![](bg6.png)
6 FDA (FAULTY DEVICE
ARRIVED) MEDICAL DEVICES
The greatest threat facing healthcare facilities are net-
works of interconnected medical devices that are in-
herently vulnerable. These devices are crucial in
patient care and could mean the difference between
life and death. Such devices are diagnostic devices
such as a MRI machine, infusion pumps, life support
equipment, and medical monitors such as a electroen-
cephalogram (EEG), laboratory analyzers, or insulin
pumps.
In 2011 Barnaby Michael Douglas Jack showed
the first exploit of a medical device at McAfee FO-
CUS 11 when he was able to have an insulin pump
deliver the maximum dose of 25 units until all 300
units had dispensed into a test dummy. A dosage of
10 units is enough to send an average diabetic patient
to the hospital. An insulin unit containing 300 units
should provide a patient three to four days worth of
insulin supplies (Viega and Thompson, 2012).
At the RSA Security Conference the following
year, Barnaby Jack was able to once more wire-
lessly hack an insulin pump from 90 meters away us-
ing high-gain antenna. Later in 2012, Barnaby Jack
was able to demonstrate the ability to hack a pace-
maker (Viega and Thompson, 2012). He was due
to present his hacking of pacemakers at Black Hat
2013, but was unfortunately found unresponsive in
his apartment and pronounced dead (Leyden, 2014).
While we lost one of the pioneers in medical device
exploitation, Barnaby Jack highlighted just how vul-
nerable these devices are. Unfortunately, since Barn-
aby Jack highlighted the weaknesses in medical de-
vices, security regarding them has not improved.
The United States has put the U.S. Food and
Drug Administration (FDA) in charge of regulating
the sale of medical device products in the United
States. With the adoption rate of technology after
HITECH became established, medical devices have
gone from stand-alone devices to networked devices.
On December 27th 2016 the FDA released its “Fi-
nal Guidance: Postmarket Management of Cyberse-
curity in Medical Devices.” Across the top of every
page it states “Contains Nonbinding Recommenda-
tions” (FDA, 2016). The organization that should be
assisting in securing medical devices can only make
recommendations that they feel are nonbinding.
The FDA states in these nonbinding agreements
that patches and update plans need to be submitted
to the FDA for review. In the field of cybersecu-
rity, patches and updates are one of the best defenses
we have, especially when critical vulnerabilities such
as EternalBlue or BlueKeep become commonplace.
With monthly patches coming out for Microsoft Win-
dows, it is an impossible task to re-certify every med-
ical device monthly. The gap in patch release to de-
ployment is immense. If there is a patch for a medical
device, the vendor must perform engineering analysis
before it can be submitted to the FDA for verification
and validation. After release, testing must be done
to ensure that target environments will not produce a
negative impact on patient safety or workflows. Once
completed, the deployment of the roll-out across all
the vendor’s customers and products must begin. This
complete process can take months to patch one critical
vulnerability, which is unacceptable when lives are on
the line (Williams and Woodward, 2015).
7 CONCLUSION AND FUTURE
WORK
As per our research, and experiences the authors
have found that as healthcare becomes more intercon-
nected and reliant on technology, cybersecurity needs
to become a priority in future legislation. The current
legislation and regulations that the United States has
enacted on healthcare have inherently weakened the
sector in cybersecurity. Healthcare has been forced to
implement technology at a rapid pace to avoid finan-
cial penalties. Regulations on medical devices cause
a direct hindrance to the process of securing medical
devices, putting lives at risk.
The authors would like to see modifications to
current legislation that adequately encompasses the
needs of cybersecurity in healthcare. HIPAA, which
intended to protect patient privacy and data, has not
seen an update to the Security Rule since 2003. While
HIPAA does not dictate security software or technol-
ogy, rather patient privacy, the authors would like to
see the Security Rule reviewed and amended annu-
ally, to encompass the latest innovations in technol-
ogy, while ensuring lessons from major cybersecu-
rity events are taken into consideration. When the
Security Rule was authored, it stated that computer
drives containing E-PHI should be destroyed using
a “reasonable” method. With the advent of Solid
State Drives what is considered “reasonable”? Fu-
ture legislation such as HITECH that forces technol-
ogy upon organizations should look at cybersecurity-
related ramifications before enactment. We can-
not legislate technology for the sake of advancement
without these critical considerations.
As additional future works the authors would like
to expand out from just legislation in the United
States and begin moving globally. With recent im-
plementation of the General Data Protection Regu-
ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy
696