Healthcare IT,
Biomedical, Security
Guide to Improving Visibility andSecurity Risk Mitigation for Medical Devices

Table of ContentsIntroduction

3

How vulnerable are medical

3devices to cyberattack?
How big is the problem?

4

What threat vectors affect medical devices?

5

Phase I:

6

Understanding the connected-device environment
Phase II:

8

Risk Assessment
Phase III:10

Protecting connected medical devices

This document is provided strictly as a guide. No guarantees can be provided orexpected. This document contains the confidential information and/or proprietaryproperty of Ivanti, Inc. and its affiliates (referred to collectively as “Ivanti”) and may not be
disclosed or copied without prior written consent of Ivanti.
Ivanti retains the right to make changes to this document or related product specifications
and descriptions, at any time, without notice. Ivanti makes no warranty for the use of thisdocument and assumes no responsibility for any errors that can appear in the document,
nor does it make a commitment to update the information contained herein. For the mostcurrent product information, please visit www.ivanti.com.

Healthcare IT, Biomedical, Security | WHITEPAPER

2Introduction
Connected medical devices represent a hugechallenge for healthcare IT, biomedical and securityorganizations. They are inherently vulnerable tocyberthreats, and successful cyberattacks can haveterrible consequences. Yet traditional cybersecurity
measures cannot be applied to these devices and may
even risk interfering with critical clinical operations.
In this guide we go through a three-step process
to help increase visibility into medical devices
and improve security risk mitigation. Establishing
cybersecurity layers for medical devices is a multistage, ongoing process, which can be successfulwhen it starts from a strong foundation and takes amethodical, systematic approach.

Learn how to discover, assess, and mitigate
cybersecurity risks associated with connected medical
devices. The three phases we present in this guideare not a one-time process, but rather should betreated as a cycle. IT and security teams at healthcare
centers should perform these phases continuously— surveying the environment, assessing risks andaddressing security issues they discover day to day.

Why are medical devices vulnerable?
■ Software code has not undergone security review.
■ Authentication is weak or nonexistent.
■ Data-transfer channels are often insecure andunencrypted.
■ Limited visibility over which devices areactively used.
■ Inability to monitor device activity andHow vulnerable are medicaldevices to cyberattack?
An increasing number of medical devices areconnected to networks or to other devices, creatinga major security vulnerability for hospitals andsecurity incidents.
■ Decommissioned devices are not securelydisposed of.
■ Software updates are unavailable, orrarely deployed.

healthcare providers. Many of these devices are notsecure and are not actively managed, opening thedoor to a wide range of cybersecurity threats.

Understanding the environment

Risk assessment

Protecting devices

Discover which IT and medical devices exist,
classify them accurately, understand theirclinical context, and identify their networking
needs.

Identify device vulnerabilities and networkrelated risks, assigning each device a risk
index, and providing recommendations forremediation.

Address security at the device level, isolating
devices within the LAN and preventing
unwanted communication over LAN/WAN, andpreparing a strategy for detecting security
incidents when they occur.

Healthcare IT, Biomedical, Security | WHITEPAPER

3

How big is the problem?

81%
81% of healthcare organizations reported
being compromised by a cyber-attack in
the past two years.

Sources: KPMG, Wired

10-15
Hospitals maintain 10 – 15 connected
medical devices per bed, with over 3.7
million devices in active use.

32%
32% of healthcare organizations say
medical devices are their top
security concern.

Healthcare IT, Biomedical, Security | WHITEPAPER4

What threat vectors affectmedical devices?

How can you evaluate cybersecurity risk
and the impact of an attack?
The FDA guidelines for medical devices provide useful classification of device risk levels.

MalwareMedical devices typically have no endpoint
protection and are especially vulnerable tomalware.

Inside threats
Due to weak authentication, malicious insiders
can easily gain unauthorized access andtamper with devices.

Web application attacks
Some medical devices are manageable via a
web interface, creating a range of cyber risks
such as code injection, cross-site scripting(XSS), and path traversal.

Device misuse
Connected medical devices are often basedon Windows PCs. Hospital staff can use themachines to browse the internet or install
software, creating additional risk.

Tier 1: Higher cybersecurity risk

Tier 2: Standard cybersecurity risk

The device is:

The device is:Capable of connecting to another medical

Capable of connecting to another device oror non-medical product, to a network, or tonetwork, but cannot directly harm patientsthe internetOROR

Capable of directly harming patients but

A cybersecurity incident affecting thecannot connect to a network

device could directly harm one or morepatients

To get a more granular evaluation of risk, use a framework like the CVSS risk calculation.
Take the following factors into account when assessing cybersecurity risk:■ Software vulnerabilities■ Privacy■ Patient safety■ Networking■ Authentication■ Service disruption

Healthcare IT, Biomedical, Security | WHITEPAPER5

Phase I:

Security teams see medical devices asblack boxes, or cannot see them at all

Understanding theconnected-device environment

Security for medical devices is becoming a sharedThe first step to solving a problem is

responsibility of clinical engineering teams and IT

can disrupt medical device operation, so you must
use passive discovery.
■ Invisible to network discovery tools. Traditional

departments. While information about these devices

tools will not discover the vast majority ofexists in healthcare organizations, it can’t be readily

connected medical devices, or may indicate

accessed by security teams.

falsely that the device is a Windows workstation.

recognizing its existence and understanding

The following important questions are left

its scope. The problem of connectedunanswered:

medical devices is not well understood■ Devices are sensitive. Active network scanningby IT, biomedical and security teams at

1. How many devices are connected?

hospitals and healthcare organizations due

2. What types of devices are they?

to extremely limited visibility.

3. Which other devices or networks do they
communicate with?
4. Is network behavior normal and expected oranomalous?

Why is it difficult to create an inventory ofconnected medical devices?

Most connected medical devices do not advertise
their information, and detecting them over thenetwork requires careful analysis of traffic at theapplication layer.
■ Large number and variety of devices. There may

be tens of thousands of devices of different types,vendors and versions.
■ Ongoing flux. Devices are constantly added,

replaced or removed from the network, often
without involving IT, so discovery and inventory
must be an ongoing process.

You cannot simply run a network scan and identify
medical devices like you would on a regular IT
network. That’s because:

Healthcare IT, Biomedical, Security | WHITEPAPER

6Step 1. Discovery■ What other devices does it communicate with?

Aim to build a database of medical devices with data

■ Does this device have unnecessary access toabout each device. Focus on high-quality data that

other devices, networks, or the internet?

can help you determine risks and vulnerabilities. Inparticular:■ Device type
■ Department and room
■ Vendor■ Is this device’s network communication isolated ina VLAN?
■ What types of protocols are used?
■ Where does the device send or receive Public

Health Information (PHI) data, and which typeof PHI?

■ Model■ Does it communicate externally over the internet?

■ IP address■ Does the device need to communicate with the■ Operating system■ Application software version■ Latest security patch

Step 2. Network mapping and clinical context
Understanding a device’s network behavior lets you

device vendor on an ongoing basis?
■ Are internet communications normal for this typeof device?
■ Is this device’s internet communication isolated ina VPN tunnel?

understand how exposed it is to external and internal

Clarify the clinical use of each device and, bythreats. Try to obtain the following information forextension, its exposure to risks. This data can beeach of your connected devices:

extremely difficult to obtain without the aid ofautomated tools.

Healthcare IT, Biomedical, Security | WHITEPAPER

7

Phase II:

Step 1. Identify device vulnerabilities andremediation opportunities

Risk Assessment

Collect data about vulnerabilities for each of yourdevice models, operating systems, and applicationversions.

Backup
Does the device have backup or redundancy, andwhat is the impact of service disruption?

Step 2. Identify network-level risks
Medical device vulnerabilities are only one aspect ofOnce you have a better understanding

Impact of software vulnerabilities

the risk. Analyze network connectivity and identify

of your connected medical devices andUse the CVSS risk calculation to identify the impact

vectors by which attackers can connect to yourhave built an inventory of the devices,of known software vulnerabilities in your connected

devices.

their context, and network behavior, youdevices.

can use this inventory to assess the risks
affecting each device and their impact on
the organization.

Internet connection

Misconfigurations

Check if the device connects to other systems overCheck for general vulnerabilities such as hard-coded

the internet, for example to a third-party company oror default passwords, unpatched operating systems,

the manufacturer for maintenance or updates.

or software.

Connections to less-secure devices

Device authentication

Check if the device can connect to a less-secure

Identify if the device has authentication and if so,

device or endpoint, such as a physician’s workstation,

how strong it is and whether secure passwords have

and whether it exposes management or data services

been set. Just as important, discover the owner oflike FTP or SSH.

the device and your level of access for remediating
security issues.
Point of contact
Who manages the device—clinical engineering, IT, themanufacturer, or a third-party contractor?

Encryption
Check if the device transmits or receives unencrypted
dataflows.
Non-secure protocols
Check if the device uses protocols that offer

Ease of accessweak authentication, no authentication, or have

Does the security team have access to this device tovulnerabilities.

implement security controls or respond to incidents?

Healthcare IT, Biomedical, Security | WHITEPAPER

8Step 3. Identify risk severity

Patient safetyPrivacy

Service disruption

successful cyberattack on each of your devices?

LOW: FDA Class I Medical Device;

LOW: Device does not store PHI.

LOW: Device failure cannot

Unlike attacks on healthcare IT systems, the impact of

low-to-moderate risk to thean attack on connected devices is not limited to data

patient or user.

Ask yourself: what would be the impact of a

disrupt patient care.

security and privacy. A successful cyberattack could
disrupt clinical care and cause direct harm to patients.
We recommend identifying risk severity according toMEDIUM: FDA Class II Medical

MEDIUM: Device stores a small

MEDIUM: Device failure canDevice; moderate-to-high risk

amount of PHI for a limited time

disrupt patient care but notperiod around a test or treatment.

critical medical treatment.

HIGH: FDA Class III Device;

HIGH: Device stores large

HIGH: Device failure can disrupt

high risk, devices that sustain

amounts of PHI across multiple

critical medical treatment such asor support life, are implanted

tests or treatments.y.

surgery, respiratory equipment

the three impact metrics in the CVSS risk calculation:■ Confidentiality. Corresponds to the risk exposureof Protected Health Information (PHI) stored in, ortransmitted by the device.
■ Integrity. Corresponds to the risk to patient safety

for devices directly used in patient care.
■ Availability. Corresponds to the risk of service

or present high risk of illness oror delivery of life-sustaining

injury.

medication.

disruption.

Healthcare IT, Biomedical, Security | WHITEPAPER

9Phase III:

Protecting connected
medical devices

We advise protecting connected medical devices in

Step 2. Network isolation

four steps:

A key strategy to securing connected medical devices is toisolate them, as much as possible, from non-critical clinicalcommunication to limit the attack surface. This has twocomponents:

Step 1. Device hardening
As with any computing device, you must make sureconnected medical devices have the latest security

The advantage of our structured process
for discovery and risk assessment is thatyou can rank devices according to the risks
they represent. Each device should have arisk impact score (for patient safety, privacy
and service disruption).
Your organization can define an acceptablelevel of risk. The security team can focus onprotecting devices with risk scores beyond

patches and software upgrades. Configuration mustbe hardened to enable secure authentication. Close
unused ports, limit unnecessary functions, and ingeneral, reduce the attack surface.
Most medical devices run on a Windows operating
system. However, applying a patch is not as simple aswith a workstation or Windows server.
Challenges with hardening medical devices:■ Windows security patches must be verified andthe acceptable level, and can apply theapproved by the device manufacturer.

appropriate security measures to devices■ Clinical engineering must verify patches orwith different risk scores.

updates that do not impact the functionality of themedical device.

■ Defining network segmentation to ensure

connected medical devices can only communicate
with devices or systems that are part of theirclinical process .
■ Blocking external communication to ensure

connected medical devices never connect to theinternet, unless this is needed to communicatewith the device vendor or other known entities.
Considerations when isolating medical devices■ Isolate clinical data flows from non-clinical dataflows.
■ Clinical communication is essential, but any othercommunication should be blocked.
Guidelines:

Guidelines:■ You will not succeed in deploying all security

patches or hardening all devices.
■ Focus on devices that have a high risk score.
■ Prioritize security patches or configuration

changes that address the known vulnerabilities
you identified in your risk assessment.

■ Set strict access policies and network

segmentation to restrict non-essential
communication to/from devices.
■ Set segmentation policy to address risks andvulnerabilities discovered in your impact analysis.
■ Block the device from connecting to the internet

unless absolutely needed for the device tofunction, and only to known entities.

Healthcare IT, Biomedical, Security | WHITEPAPER

10

Step 3. Incident detection and response
It is impossible to protect most connected medical
devices from all potential threats because there will
always be critical legacy devices that cannot bereplaced and cannot be fully patched or isolated.
This means you can limit the attack surface but
not eliminate it. In addition, isolation can be a longprocess, and in the interim, some devices will remainvulnerable. This is why it is critical to monitor devices
and detect and alert immediately when unusual
activity takes place.
Considerations when monitoring forsecurity incidents:■ Use passive monitoring such as a network TAP or

mirror port to avoid interrupting device operations.
■ Leverage information you collected about theclinical context of each device to understand whatrepresents normal clinical communication.

Guidelines:■ Continuously monitor all devices, with special

emphasis on those with a high risk score.
■ Establish a strategy for comparing ongoing

communication to normal clinical communication.
■ Alert security on any major deviation from normalbehavior.
■ Integrate with third parties that can help perform

Guidelines:■ Create a scorecard for medical devices with atimeline of risk scores, ensuring risk is reduced
over time■ Identify activities and strategies that improved

KPIs and reduced overall risk indexes.
■ Set KPIs based on risk of important devices andmonitor improvement; tie KPIs to business goals

speedy remediation via remote action, such as on-

like patient safety and service availability to get

demand network segmentation.

buy-in from leadership.

Step 4. Metrics and analytics
Medical device cybersecurity is a long process, whichmust be maintained and improved over time to adapt to acontinuously changing threat landscape.

■ Collect data about risk indexes and historicalbehavior of devices, and use it for better
procurement decisions

Tracing your progress can help you understand if you are
moving in the right direction and make corrections if yourwork is not improving the security situation. Below are a few
guidelines for tracking the progress of your medical device
security project.

■ Compare current behavior to vendor

specifications, past behavior, and to the behaviorof a peer group of devices in your environment
and in other organizations.

Healthcare IT, Biomedical, Security | WHITEPAPER

11

Improve asset visibility and security
risk mitigation for medical devices
with Ivanti Neurons for Healthcare
Ivanti® Neurons for Healthcare improves asset visibility andsecurity risk mitigation for medical devices. The solution
discovers and intelligently profiles medical devices andInternet of Medical Things (IoMT), assessing security
risks, reporting threats and reconciling device information
across multiple data sources. Know more about the various
healthcare-specific devices across your facilities, including
device classification and usage information, with the details
to reduce security risk or attend to anomalies. Collect andreconcile vendor data, creating a single source of truth for all
your medical devices.
For more information, visit
ivanti.com/products/ivanti-neurons-healthcareCopyright © 2021, Ivanti. All rights reserved. IVI-2505 03/21 DH

ivanti.com/neurons
1 800 982 2130
sales@ivanti.com