A Biomed’s Journey: From the Workbench to Connected Device Security

In the late 1990s, I was just starting out in my career in tech. As an electronics engineer, I was busy designing and building circuits, installing and maintaining systems, and gaining as much experience as I could to broaden my horizons. I enjoyed the work, but things changed in late 2001, and opportunities in tech contracted dramatically. Looking for stability and a chance to apply my skills in a growth market, I moved to healthcare and became a biomedical technician with little to no understanding of the field and the rewarding experience it offered.

I thrived as a biomed. My background in electrical engineering blended well with the need to integrate and manage the influx of innovative medical technologies that hospitals were using to improve their ability to deliver positive patient outcomes. I soon earned my CBET certification, and over the coming years, progressed to a BMET 2 and then BMET 3.

ACA Changed Healthcare Cybersecurity Dynamics

Around that time, the Affordable Care Act (ACA) was passed, and with it came a push to accelerate the adoption of electronic medical records (EMR). That meant the devices I was working with were now becoming connected to the hospital network to improve workflows and reduce errors. I saw the risks that came along with that trend, so I began investigating what protections were in place to ensure patient safety and privacy. Manufacturers were frantically adapting products to meet the needs of rapidly changing care delivery strategies. These adaptations, although functional, did not take cybersecurity into account. Recognizing the danger that network-connected medical devices posed to IT networks in healthcare environments, I began working closely with security teams to help them understand these unfamiliar technologies and how they affected security and IT operations, but also impacted patient care.

Back then, IT management was laser-focused on protecting data and systems; patient safety was not a part of their mandate. But unlike installing or servicing a server, you can’t just take something like an infusion pump or patient monitor offline if there’s an update needed. Nothing works in a bubble in IT once it is connected to the network. There are downstream effects, security implications, and new regulatory regimes to satisfy. That meant we had to rethink our approach to the design and management of the emerging healthcare IT estate. Biomeds were now working alongside traditional IT management to address the influences of things like connected medical device inventory, patching strategies, vulnerability management, and cyber risk assessments.

The Start of Whole Hospital Cybersecurity

Looking back, it was the start of what at Ordr we call the “whole hospital” approach to protecting healthcare IT environments, and that is what attracted me to Ordr. I knew firsthand how difficult it was for Healthcare Technology Management (HTM) and IT management to discover, identify, manage, and secure their Internet of Medical Things (IoMT) devices. Traditional methods for conducting IoMT asset management (often including manual labor) are slow, inaccurate, and error prone. The result is an incomplete, moment-in-time snapshot of what devices are operating on the network and an inaccurate assessment of where the risks are.

But with the Ordr whole hospital approach to healthcare IT security, CISOs have the tools needed to discover and profile IoMT, Internet of Things (IoT), and operational technology (OT) in real-time, and with the clarity that comes from access to the Ordr Data Lake with its rich library of profiles on millions of devices. The Ordr technology suite enables Biomedical Engineers/HTMs, CISOs, and IT operations managers to embrace the SEE, KNOW, SECURE philosophy of connected device security with the confidence that comes from knowing you have accurate information and precise insights for decision making—and automations to act quickly when threats arise.

Five Keys to Improving Healthcare Cybersecurity

Ordr delivers value for healthcare organizations in five important ways:

1. Automating asset inventory to identify what’s connected to the hospital network. Ordr discovers and monitors every connected device in real time, understands how devices connect and communicate on the network, and provides insights to locate devices across the environment. This allows hospitals to allocate resources doing manual inventory to higher value tasks, and enables HTM and security teams to easily locate devices for maintenance or incident response.
2. Know risks and vulnerabilities such as devices with outdated operating systems and vulnerabilities, complete with device risk scores. This information enables teams to know their attack surface, prioritize patching and reduce risk. It also addresses a key security gap as some devices like medical and IoT devices are typically not scanned by traditional vulnerability management solutions because of impact to operations.
3. Improving collaboration between teams HTM, security, and IT teams by providing a complete picture of every device, with deep context (serial number, manufacturer, model, operating system, and more), understanding of how devices interact, device owners and device utilization. Operating from a single source of truth about assets improves hospital efficiencies.
4. Detecting threats such as devices with exploits, communicating to malicious domains, or behaving abnormally. Ordr can automate workflows to assign tickets to the appropriate device owner, or create segmentation policies to limit compromised devices to “baseline” behavior.
5. Demonstrate ROI not only in the context of device management and security, but by maximizing medical device utilization efficiency. By understanding how devices are being used, and when, hospitals can identify areas of over or under usage, manage maintenance schedules and optimize capital spend.

I recently recorded a webinar with more information about connected device security for healthcare organizations. If you have questions about how Ordr can help your organization compile, track, and manage its complete asset inventory in real-time, improve its security posture through the whole hospital approach, and effect better utilization of its existing medical devices, reach out and let us know.

Benjamin Stock

Benjamin Stock is the Director of Healthcare Product Management at Ordr. Previously, Ben worked as the Director of Clinical Equipment Systems and Project Support at SSM Health St. Louis, MO. With more than 15 years of experience in healthcare technology management, his wealth of knowledge in the Clinical Engineering space allows him to be a wonderful advocate for Ordr healthcare customers. Ben is also a Certified Biomedical Equipment Technician (CBET).