FDA calls on manufacturers, hospitals to better protect medical devices

Share this article:
FDA calls on manufacturers, hospitals to better protect medical devices
FDA calls on manufacturers, hospitals to better protect medical devices

The U.S. Food and Drug Administration on Thursday warned medical professionals to implement practices that will safeguard computer-embedded health care devices from attack.

"Many medical devices contain configurable embedded computer systems that can be vulnerable to cyber security breaches," the advisory said. "In addition, as medical devices are increasingly interconnected, via the internet, hospital networks, other medical [devices] and smartphones, there is an increased risk of cyber security breaches, which could affect how a medical device operates."

The FDA recommended that device manufacturers "take appropriate steps to limit the opportunities for unauthorized access" to these endpoints. This includes evaluating their security practices and policies, and deploying designs, strategies and methods to both prevent against attack and respond in the event of a breach.

Meanwhile, health care entities must ensure their networks are built to repel unauthorized access and attacks by monitoring for anomalous behavior, patching regularly and conferring with device makers.

The FDA also noted that manufacturers are required under Medical Device Reporting requirements to alert the agency of any security issues associated with their products. Health care staff can voluntarily report security "events" related to a medical device through the MedWatch program

The agency said it was not aware of any real-life attacks that have targeted these devices, nor any patient injuries or deaths associated with a compromise.

The government warning should come as no surprise to the security research community, whom for several years has showcased how these devices are susceptible to malicious attack.

For example, at the 2011 Black Hat conference in Las Vegas, researcher and Type 1 diabetic Jay Radcliffe demonstrated how he is able to send commands to wirelessly disable (within about 150 feet) the insulin pump he has been wearing since he was 22.

And as early as 2008, studies have shown how pacemakers could be manipulated by remote attackers.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Adobe exploit used to spread Dyre credential stealer

Adobe exploit used to spread Dyre credential stealer

Users running vulnerable Adobe software could be in danger of having credentials for Bitcoin websites stolen.

Staples is investigating a potential issue involving credit card data

Staples is investigating a potential issue involving credit ...

The company said it is investigating a potential issue involving credit card data and that customers are not responsible for fraudulent activity on cards if an issue is discovered.

Skills set a priority over legacy prejudices, experts say

Skills set a priority over legacy prejudices, experts ...

Cybersecurity expert Winn Schwartau and Robert Clark, a cyber law attorney at the Army Cyber Institute, discussed issues around hiring in the information security industry.