Cyber Defense eMagazine December Edition for 2021

Getting specific about what HDOs need in device visibility and insights
CMMS data deficits must be resolved quickly, accurately, and continuously. Creating a single source of
device data truth goes a long way to supporting ongoing risk abatement and workflow efficiencies that
help keep operations secure. To achieve this, HDOs need to feed their CMMS dynamic information and
validate it against existing CMMS data fields. This level of dynamic information should include specific
details on the device model, make, OS version, network status, security posture, utilization, and location.
Therefore, data solutions need to apply advanced deep packet inspection (DPI) techniques combined
with vast medical expertise, so they can identify and capture relevant device details and consider the
clinical context in which these devices are operating. Clinical context, after all, is crucial because medical
devices are not like other IT devices.
For example, most clinical devices are closed systems, and AV or security agents cannot be downloaded
to protect them. They run proprietary or legacy software that can’t be patched unless approved and
authorized by the manufacturer. This means vulnerabilities may persist, and devices may be open to
exploit for the duration of the patch/fix process. They also often leverage proprietary or clinical protocols
to communicate, so to identify activity that could pose a threat, these protocols need to be fluently
understood.
Since most clinical devices serve a specific function and act a certain way, they’re much more predictable
than general computer systems controlled by people. However, this is only useful if the workflows and
manufacturer-defined behaviors of the specific device are known. HDOs are unique because they require
solutions with a level of knowledge that don’t produce a lot of false alarms on activity that is perfectly
normal (and necessary) for a medical device’s operation.
Probably the most important (and somewhat obvious) thing to be mindful of is that clinical devices are
used in procedures and treatment plans, so protective measures cannot be disruptive. If access to a
ventilator is blocked or an IV pump is prevented from communicating with a patient monitor simply
because it was moved, powered up, or made a new connection, an unnecessary point of failure is
introduced that can impact patient care and outcomes. All these things need to be considered and
accommodated in device management and security decisions.
Cyber Defense eMagazine – December 2021 Edition 102
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.