Medical Device Security Is Largely Nonexistent

A new report by Synopsys and the Ponemon Institute finds that medical device security is plagued by a lack of standards, testing, and accountability.

Healthcare organizations tend to focus their cyber security efforts on HIPAA compliance, protecting patient data, and defending against ransomware attacks like WannaCry, with scant, if any, attention paid to medical device security. A Ponemon Institute study released last week by Synopsys, Medical Device Security: An Industry Under Attack and Unprepared to Defend, paints an ominous picture regarding the cyber security of IoT devices such as smart insulin pumps, diagnostic and monitoring equipment, and even the mobile apps used to control connected devices:

• 67% of medical device manufacturers expect that their devices will be hacked within the next 12 months, but only 17% are taking “significant steps” to prevent it.
• 56% of healthcare delivery organizations (HDOs) expect a hack within the next 12 months, but only 15% are doing anything about it.
• Fewer than half (41%) of device manufacturers have an incident response plan in place in the event of a hack.
• Among HDOs, the numbers are even worse; only 22% have an incident response plan.
• Only 9% of device manufacturers and 5% of HDOs test their medical devices at least yearly. Over half of HDOs, and 43% of manufacturers, either do not test their devices at all or are “unsure if testing occurs.”

No Testing, No Standards, No Accountability: What Could Possibly Go Wrong?

One would think that, given the fact that a faulty connected medical device could result in a dead or maimed patient, these devices would be subject to strict regulations and exacting security standards.

This is not the case at all. Medical device security is no more robust than general IoT security. The respondents to the Synopsys/Ponemon study cited a complete lack of security standards, testing, and accountability for medical device security, along with intense pressure to push products to the market as soon as possible. These are the same problems that plague the overall connected devices industry. Smart watches, smart doorbells, smart toys, and even smart cars are designed for ease of use and cutting-edge features, not cyber security.

Smart medical devices are no different. The FDA does have a set of voluntary guidelines addressing medical device security, but according to the study, only 51% of manufacturers and 44% of HDOs followed them.

Medical Device Security Cannot Be Reactive

Perhaps the most horrifying finding from this already frightening report is that most device manufacturers and HDOs stated that only a “serious hacking incident” would prompt their organizations to increase their medical device security budgets. Yes, you read that correctly: The majority of players in the medical device industry are relying on reactive cyber security, waiting until a breach has actually happened – which, in this case, could mean that someone dies or is maimed – to address device vulnerabilities.

Last fall, medical device maker St. Jude Inc. announced that it was forming a medical advisory board focused specifically on medical device security. This is a positive step, but it happened only after allegations that its smart cardiac implants were vulnerable to hacking, which prompted an investigation by the FDA.

The current reactive approach to medical device security is completely unacceptable. Knowing this, the FDA has cited the cyber security of medical devices as one of its top regulatory science priorities in 2017. However, the wheels of government turn very slowly; manufacturers, HDOs, and patients cannot afford to wait for the government to step in and save the day. The healthcare industry needs to start taking the same proactive approach to cyber security that it does to disease prevention. This isn’t just about money or reputation; human lives depend on it.