Connected Medical Device Safety

Transcription

1 Connected Medical Device Safety Bob Zemke CISSP, CPHIMS Director Healthcare Solutions Extreme Networks

2 Connected Medical Devices to Medical IoT The Internet of Things (IoT) is a collection of devices or Things that connect to the Enterprise Network or Cloud for machine-tomachine or machine-to-people communication. Medical IoT is the new term to describe the connected medical devices wired, Wi-Fi, or BLE. That have been used in healthcare facilities for years 2

3 3 Why Connect Devices? Situational awareness is the engine behind various hospital of the future, digital hospital and smart patient room initiatives. It is at the heart of the real-time healthcare system. - Barry Runyon, Vice President of Healthcare Research at Gartner

4 Connected Devices Keep Multiplying Devices Applications Medical Devices Handheld/BYOD Workstations Building Systems 4

5 Simple Walls Have Never Provided Enough Protection 5

6 The First Medical IoT Vulnerability 6

7 New Regulatory Guidelines Symbiq Infusion System by Hospira: Ensure that unused ports are closed, including Port 20/FTP and Port 23/TELNET. Monitor and log all network traffic attempting to reach the affected product via Port 20/FTP, Port 23/TELNET and Port Contact Hospira s technical support to change the default password used to access Port 8443 or close it. 7

8 The Next Risk to Medical IoT 8

9 IEC Application of risk management for IT-networks incorporating medical devices IEC Standard & Guidance provides a framework for applying proven risk management principles to networked medical technology deployment & use. Focus is achieving a balance between Safety (unexpected risk), effectiveness (intended result), as well as device and data security (confidentiality, availability, and integrity). Lowering the probability of potential hazards turning into harm and gauging the amount of risk. 9

10 Risk Assessment Per Device Unintended Consequence for Security; Effectiveness and Data and System Security Improbable Remote Increasing Probability Occasional Probable Frequen t Increasing Severity Catastrophic High Medium Low Negligible Low Risk is acceptable. Risk has little effect on goals, no additional control measures required. Moderate Risk acceptability needs further consideration. Risk has some effect to goals but can be accepted when balanced with benefit. RO must pre-define policies in Risk Management Plan for risks in this level. Policies can include special team reviews (IT, clinical) or review boards, rationales, top management signoff, showing risk has been reduced as low as practicable, etc... High Risk to goals is unacceptable, risk must be reduced before Medical IT network can be used, either by reducing likelihood or by reducing severity. This matrix can be found in the Medical IT-Network Risk Management Plan document. 10

11 Phased implementation Education Risks Clinical and IT on best practices Communication How will ICT & Clinical Engineering work together How will events be found How will the response be communicated Process Tools Inventory what is in the hospital today Audit what is needed to address Establish who is responsible for monitoring & who is responsibility for corrective actions Find on network Monitor behavior Micro-segment Disable unnecessary access 11

12 Thank you!