11 best practices for protecting connected medical devices
Internet of Things devices are particularly susceptible to hacking, raising the potential for patient harm.
11 best practices for protecting connected medical devices
The Department of Health and Human Services, working with more than 150 healthcare and cybersecurity experts, has released a report, “Health Industry Cybersecurity Practices,” to aid stakeholders in managing threats and protecting patients. The 36-page report, available here, includes a section on attacks against connected medical devices that may affect patient safety. In distilling the guidance of the experts, HHS recommends the following 11 best practices to safeguard this sensitive equipment.
Communication
Establish and maintain communication with medical device manufacturers’ product security teams to ensure devices have the latest protection in the forms of patches and to ensure dialogue about threats.
Patching
Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.
Security controls
Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.
Inventory
Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.
Procurement
Implement pre-procurement security requirements for vendors, to ensure they’re meeting your organization’s minimum requirements for device and network security.
Security assurance
Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.
Security staff engagement
Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.
Contract language
Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.
Access controls
Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.
Security operations
Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.
Device network
Develop and implement network security applications and practices for device networks.