11 best practices for protecting connected medical devices
The Department of Health and Human Services, working with more than 150 healthcare and cybersecurity experts, has released a report, “Health Industry Cybersecurity Practices,” to aid stakeholders in managing threats and protecting patients. The 36-page report, available here, includes a section on attacks against connected medical devices that may affect patient safety. In distilling the guidance of the experts, HHS recommends the following 11 best practices to safeguard this sensitive equipment.
Establish and maintain communication with medical device manufacturers’ product security teams to ensure devices have the latest protection in the forms of patches and to ensure dialogue about threats.
Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.
Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.
Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.
Implement pre-procurement security requirements for vendors, to ensure they’re meeting your organization’s minimum requirements for device and network security.
Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.
Security staff engagement
Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.
Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.
Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.
Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.
Develop and implement network security applications and practices for device networks.