11 best practices for protecting connected medical devices

Internet of Things devices are particularly susceptible to hacking, raising the potential for patient harm.


11 best practices for protecting connected medical devices

The Department of Health and Human Services, working with more than 150 healthcare and cybersecurity experts, has released a report, “Health Industry Cybersecurity Practices,” to aid stakeholders in managing threats and protecting patients. The 36-page report, available here, includes a section on attacks against connected medical devices that may affect patient safety. In distilling the guidance of the experts, HHS recommends the following 11 best practices to safeguard this sensitive equipment.



Communication

Establish and maintain communication with medical device manufacturers’ product security teams to ensure devices have the latest protection in the forms of patches and to ensure dialogue about threats.



Patching

Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.



Security controls

Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.



Inventory

Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.



Procurement

Implement pre-procurement security requirements for vendors, to ensure they’re meeting your organization’s minimum requirements for device and network security.



Security assurance

Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.



Security staff engagement

Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.



Contract language

Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.



Access controls

Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.



Security operations

Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.



Device network

Develop and implement network security applications and practices for device networks.



More for you

Loading data for hdm_tax_topic #better-outcomes...