Watching Part 2 of the Minnesota HIMSS webinar series Medical Device Security Overview for Healthcare Delivery Organizations with speakers Matt Dimino and Carrie Whysall from CynergisTek, I found the following to be useful information that you can apply to your organization’s security program development.

IoT & IoMT Device Security

Device Risk

The biggest medical device security risk organizations face is the possibility of a widespread attack or multiple security threats happening at once. This can cause widespread unavailability of devices needed to treat patients. The integrity of devices is also important to consider, without proper device management and supervision, malware can remain undetected.

Gaps

Medical devices should be assessed at point of purchase. Before putting a device on a network it should be checked for basic passwords and other vulnerabilities. Organizations should also know all devices that are on the clinical network, and track what those devices are doing. Clinical Engineering (CE) and Information Technology (IT) teams should work together to leverage their training and awareness of device security risks.

Challenges

Typically there are safety specialists who focus on technical controls and separate specialists who work on risk management, but these tasks should be joined into one security plan so that medical devices are controlled and monitored for risks.

Difficulties Developing a Medical Device Security Program

Developing a medical device security program can be difficult for a multitude of reasons:

• Business: Lack of adequate funding, staffing and training issues, as well organizational structure impede the creation of a joint CE and IT security program.
• Policy and Procedure: Organizations’ IT policies and procedures rarely include medical device security, and have disjointed governance and sponsorship policies.
• Technical: Typical IT network tools do not work for medical device security purposes, and without passively scanning them as part of the IT network, medical devices often get overlooked. Use of legacy devices also causes technical issues, as devices are not updated for long periods of time.
• Vendors: Medical device vendors utilize different remote access controls that may or may not be able to show who/what causes devices to crash.
• Physical Security: Physical guest access to devices and the potential for organization IDs to be used to gain access to devices puts them at risk.

Addressing the Stakeholders

Involve all parties in the creation of a medical device security plan. Make clinical staff aware of the integrity of medical devices such as ultrasounds and anesthesia machines. Also include CISOs, IT teams, Healthcare Technology Management (HTM) teams and vendors. Discuss with all those involved the objectives of creating a medical device security plan and set up a timeline, as creating and rolling out a security plan can take many months.

How Ordr Can Help

Creating a device security program is challenging on its own, and would be even more difficult without a product to help passively scan for devices and identify risks.

The Ordr System Control Engine (SCE) gives organizations the power to enable visibility and security of their network-connected devices, with a simple and powerful solution to identify, classify, profile the behavior and risk and automate action for every network-connected device in the enterprise. Want to experience Ordr on your network? Request a free sensor.

Listening to the third and final webinar of the Minnesota HIMSS webinar series, Medical Device Security Overview for Healthcare Delivery Organizations with speakers Matt Dimino and Carrie Whysall from CynergisTek, I found the following useful tips when developing a medical device security program.

Medical Device Security

Medical devices are difficult to secure on a technical level. They are expensive and their operating systems typically stay the same while in service. These devices are not easily remotely managed, may not be able to be encrypted, and have default user passwords.

IoMT Security Components

To develop a thorough security program you should plan it in three stages:

Stage 1: Risk Assessment

• Assess the total program risk you have
• Multi-dimensional risk contextualization: consider device master data record, patch/mitigation prioritization, device inter-relationships, & risk monitoring
• Ask yourself what practices are the preceding security program missing

Stage 2: Program Development

• Lifecycle management approach: managing procurement, installation, maintenance, incident response & retirement procedures
• Improve asset management and create network visibility
• Standardize security policies and procedures

Stage 3: Program Management

• Assist with medical device procurement and decommissioning
• Provide IoMT device training and awareness
• Manage continuing vulnerability reporting and remediation programs

Device Risk

When trying to secure your medical devices you should be looking at all of the risk areas. Security vulnerabilities pose a threat to patient safety, medical device availability, and could result in financial loss or unauthorized access to information.

How to Analyze Risk

Risk analysis should follow these steps:

• System characterization: Gather data on hardware & software
• Threat identification: Look at the full spectrum of possible threats
• Vulnerability analysis: Ask how do vulnerabilities impact devices and protocols
• Controls analysis: Look at controls already in place and what is needed
• Likelihood determination: Ask what are the chances of a device being compromised
• Impact analysis: Ask how a compromised asset would affect the organization
• Risk determination: Ask what risk level a device should be placed in
• Controls recommendation: Determine what controls assets need to mitigate vulnerabilities
• Results documentation: Share information and communicate with stakeholders

Risk Criteria & Categorization

When determining device risk level it is important to consider the likelihood of threat occurrence as well as the potential impact of threat occurrence on patients, business, and data.

Risk categorization aids in risk prioritization and remediation. You can categorize risks through device threat modeling: collecting device data, establishing a hypothesis, threat hunting, threat detection, and threat response.

Governance

It takes a team to create and manage a medical device security program. Setting a purpose and objective for this committee is key. The Responsible Accountable Consulted Informed (RACI) Matrix can help organize stakeholders and ensure everyone is aware of their role and responsibilities.

How Ordr Can Help

Developing a medical device security program can be a difficult and lengthy process. Ordr can help.

The Ordr System Control Engine (SCE) gives organizations the power to enable visibility and security of their network-connected devices, with a simple and powerful solution to identify, classify, profile the behavior and risk and automate action for every network-connected device in the enterprise. Want to experience Ordr on your network? Request a free sensor.

Ordr Now Addresses the Entire Asset Management and Security Journey, from Visibility and Risk-Based Vulnerability Management, to Advanced Threat Detection and Segmentation

Santa Clara, CA – March 19, 2024 – Ordr, the leader in AI-powered asset intelligence, today announced the launch of its new OrdrAI CAASM+ (Cyber Asset Attack Surface Management) product, built on top of the market-leading OrdrAI Asset Intelligence Platform.

For years, Ordr has been solving asset visibility and security challenges in the world’s most demanding environments, including healthcare, financial services, and manufacturing. Building on its proven Asset Intelligence Platform with unique features such as the Ordr Discovery Engine for unified asset discovery, AI/ML classification and analytics, and automated policy creation and workflows, OrdrAI CAASM+ provides a frictionless option for organizations to manage their entire asset attack surface — including devices, users, installed software, cloud, and SaaS.

Industry analyst firm Gartner defines CAASM as “…focused on enabling IT and security teams to overcome asset visibility and exposure challenges… primarily through API integrations with existing tools.” CAASM is a key component of “continuous threat exposure management,” one of Gartner’s “Top Strategic Technology Trends” for 2024. With comprehensive and accurate visibility into all assets, devices, and users, security teams can confidently reduce the time required to understand, report, react, and remediate security exposure and incidents, while dramatically simplifying collaboration and communication among teams and with business leaders.

Not all CAASM solutions are created equal. OrdrAI CAASM+ goes beyond API-only solutions, utilizing API data collection and proprietary discovery methods with AI/ML classification to give accurate, complete asset visibility, business context, and insights. Key features include:

• Complete asset visibility: Utilizing API integrations and Ordr’s Discovery Engine, CAASM+ offers real-time visibility into all devices, cloud assets, applications, and SaaS apps.

• Accurate asset visibility: Say goodbye to duplicated and inaccurate inventories. CAASM+ provides a de-duplicated, correlated, and accurate single source of asset truth, eliminating noise and blind spots such as the 40% of IoT, OT and IoMT devices that are undetected today.

• Risk-based vulnerability prioritization: CAASM+ delivers a prioritized list of top vulnerabilities with risk scores, using Ordr’s powerful mapping and correlation engine to align security impact with business context.

• Enables natural language queries: Ordr simplifies how teams understand their security posture, and how they obtain information to protect their environment, with generative AI powered natural language queries.

• Surface security gaps and exposure: CAASM+ automatically surfaces issues on a continuous basis, such as devices running outdated operating systems, or missing EDR or MDM agents.

• Automate remediation: Remediation workflows are automated using ITSM, SIEM, and SOC integrations, empowering teams with asset and business data to accelerate incident response.

“We’ve spent years building an enterprise-scale asset intelligence platform, with an asset knowledge base and the unique functionality needed to secure mission-critical devices,” said Pandian Gnanaprakasam, co-founder and Chief Product Officer, Ordr. “We now offer all enterprises an easy-to-deploy CAASM+ product to secure their expanded attack surface — devices, users, installed, SaaS, and cloud workloads. Compared to other CAASM solutions, Ordr delivers 2x asset visibility, 3x asset context, and 4x scale. More importantly, teams also have an easy expansion path to OrdrAI Protect for advanced security use cases.”

For more information, see how Ordr can help your organization establish enterprise visibility and improve its security posture.