Medical-device security isn't tracked well, research shows
"We believe the inconsistency between databases is due to lack of a meaningful and convenient reporting mechanism, but we also believe that clinicians without expertise in computer security are unlikely to recognize the difference between a virus infection and a crashed or slow computer," the study points out. "Time pressure, lack of incentives, lack of federal safe harbor policies, and lack of clear actionable guidance further reduce the probability of incident reporting by clinicians and information technology staff."
Fu said he he's been in contact with professionals at clinics and hospitals where individuals are "essentially afraid of reporting issues on paper for liability issues." He notes the U.S. may want to consider looking at the kinds of "safe harbor" laws that have helped other industries, such as aviation, in identifying safety issues.
The MAUDE database showed no events related to privacy and security, in spite of about 1,000 possible product problems, the study said. As if to test MAUDE's effectiveness, one of the study's co-authors submitted a software vulnerability report for an automated external defibrillator on July 19, 2011, and found by Jan. 19, 2012, the report had not yet been processed into MAUDE. By April of this year, MAUDE did finally contain the submitted report.
"The report processing took nine months. As the time from discovery of a conventional computer security vulnerability to the global exploitation of the flaw is often measured in hours, a nine-month processing delay may not be an effective strategy for ensuring the safety of software-related medical devices," the study says.
The study says there has not yet been any major known and sustained vicious attack on medical devices intended to harm patients in the U.S. But there have been many instances of malware infecting PCs used to operate medical equipment, sometimes even turning medical devices into botnets that are often used by remote command-and-control operators for things such as spam relays. Vendors of the equipment are getting blamed.
"Common causes of infections include use of the Internet and USB flash memory drives from vendors who are paradoxically updating software on medical devices," the study notes. "In one instance, a factory-installed device arrived already infected by malware. All detected malware pertained to conventional compute viruses rather than malware customized for medical devices. The most prevalent malware converted the medical devices into becoming nodes of 'botnet' criminal networks. Organized crime rents out botnets for others to distribute spam anonymously and for mounting targeted attacks on information infrastructure."
In contrast to the lack of consistency and clarity the researchers found in the three databases, one other database they looked at showed how serious malware infections can be in hospitals.
- 18 Hot IT Certifications for 2014
- CIOs Opting for IT Contractors Over Hiring Full-Time Staff
- 12 Best Free iOS 7 Holiday Shopping Apps
- For CMOs Big Data Can Lead to Big Profits
- Slideshow: 5 ways to lock down your mobile device
- Slideshow: 10 mistakes companies make after a data breach
- How to rob a bank: A social engineering walk through
- Which smartphone is the most secure?
For the love of Jiminy Cricket, how much cybersecurity incompetence are American citizens expected to accept and excuse while also footing the $660 million bill? Online security experts say the “new and improved” Healthcare.gov site may actually be more insecure now than before it was fixed!
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Healthcare Firm Ramps Up for Claims Processing Spikes
- Huge increases in claims processing loads and stringent SLAs for Medicaid patients prompted Molina Healthcare to enhance their IT infrastructure with VCE.
- The Telemedicine Revolution: Patients Can't Wait
- How high bandwidth, low latency ethernet communications is changing the practice of medicine. Comcast Ethernet offers the robust, scalable backbone for telemedicine for...
- Escape Plan: How Integrated IT Portfolio Management Helps Organizations Clear the Chaos
- Meaningful Use, ICD-10 compliance, EMR Implementation--do you feel lost in this ever-growing jungle?
Top Considerations for Moving to a Cloud Delivery Model for ITSM
Find out whether SaaS-based ITSM is right for you
- Software-as-a-service is more than just a cloud-based delivery model-it's a new approach to service that lets companies optimize utilization of in-house IT resources...
- A SaaS-First Approach to Application Portfolio Management
- Download this informative white paper to learn benefits of taking a SaaS-first approach to application portfolio management within ITSM. All Healthcare IT White Papers
- Pre-Engineered solutions from VCE Simplify Core Infrastructure Implementation In this video, the CTO of Purdue Pharma, a privately held pharmaceutical company explains how Purdue transformed their data center infrastructure with VCE.
- Integrated Infrastructure: Simplify Operations, Speed Deployments and Reduce Costs George Weiss, Gartner Vice President and Analyst, and Praveen Akkiraju, CEO of VCE, provide practical information regarding the various aspects of Integrated Infrastructures...
- Video: 5 Secrets To Scaling Enterprise Apps Watch this video to learn how to successfully scale enterprise apps>>
- Collaboration 2013: Where Mobility Meets Connectivity Mobility and collaboration are quickly converging and users are demanding more capabilities. It's no longer enough to enable file sharing. This Webcast dives...
- Modernizing SAP environments with minimum risk - a path to Big Data Hear from top IDC analyst, Richard Villars, about the path you can start taking now to enable your organization to get the benefits...
- All Healthcare IT Webcasts
Johns Hopkins, OhioHealth, Kaiser Permanente and other top healthcare organizations each won a place on Computerworld's Best Places to Work in IT 2013 list. Honorees say the distinction helps them both recruit and retain top talent.
Want to join this elite group? Nominate your organization for our 2014 list.