Powerfulprotection
for medical
equipment running
Windows® OSPowerful protection for medical equipment running Windows® OS
In July, 2019, Springhill Medical
Center in Alabama was hit by aransomware attack that disabledmany of the hospital’s computer
systems. This resulted in lost
access to patients’ historical data
as well as a severe lack ofdiagnostic information, as mostof the monitoring equipment wasmade offline. The latter was thereason for a wrong decision,
resulting in a traumatic birth of ababy girl who sufferedhypo-oxygenation brain damage
and later died because of it. The
mother filed a lawsuit against thehospital – which, in turn,presented the information about
the then-ongoing ransomware
attack. The trial is currently set
for November 2022; if the court
accepts the hospital’s data as theproof of innocence, it will be thefirst officially confirmed deathcaused by ransomware.
Source: Wall Street Journal

Hospitals around the world have hundreds of thousands of Internet-enabled devices
connected to their networks, covering almost every aspect of patient care from medical
records to pacemaker implants. Medical equipment must be fault-tolerant, stable andavailable 24/7, yet these devices face risks associated with being part of the corporate
network, as well as those unique to the embedded systems which they’re based on.
Embedded healthcare systems are targets of sabotage that directly impacts connected
equipment – and can even manipulate patient data.
Medical devices generally have a lifecycle of around 20 years, and it’s estimated that over
60%1 of medical devices have reached end of life, making it more likely that they’re runningon outdated, unsupported operating systems. Cybercriminals use vulnerabilities in theseoutdated systems to gain access to the healthcare network.
Add to this the fact that the number of connected medical devices globally is set torocket from around 10 billion today to over 50 billion in the next decade2 and it’s not hard
to see why the healthcare industry faces more ransomware attacks than nearly any othersector. And these types of attack are growing rapidly, as is the number of networked
devices. More devices mean more attack vectors, and old devices can’t be properly
secured with outmoded protection.
The Covid-19 pandemic has exacerbated the situation. Healthcare practitioners andoperators have had to accelerate their digital transformation almost overnight. Suddenly,
there are waiting lists for online medical consultations across the board, and more digital
devices, medical equipment and connected monitors than ever before are being used
to collect and share data to be stored and analyzed. When these devices and systems
aren’t protected, it’s great news for cybercriminals – and bad news for healthcare.
Cybercriminals’ claims that they would not damage healthcare institutions have provenempty, and they have caused plenty of disruption to medical facilities. The consequencesof a ransomware attack on health monitoring systems or diagnostic equipment can’t only
be measured in unanticipated costs, but in human lives. The protection for these systems
must be as powerful as their often below-average specs allow.
A purely anti-malware-based or purely system hardening3 -based approach is not enoughto deal with threats to embedded systems. Only multi-layered protection specificallydesigned to address these unique challenges can deliver reliable, effective protection
Of course, not all medical equipment has the same computing power. Some devices,
especially newer ones, are close to regular workstations, and some configurations canrestrict the scope of the protective layers. Ideally, the security solution must be able toadapt to devices with any power levels within any medical facility.

https://www.sensato.co/post/endless-terrifyingpossibilities-call-for-a-good-medical-device-cop
https://linchpinseo.com/trends-medical-deviceindustry/
3 
Including Application control, device control and othertechnologies capable of utilizing the Default Denyscenario1 2 

1

Efficient design even for
low-end hardware
Kaspersky Embedded Systems
Security has been built
specifically to work smoothly
even on low-end hardware. The
efficient design delivers powerful
security with no risk of systems
overload. Requirements startfrom only 256MB RAM for
Windows XP, with around 50MB
space required on the system
hard drive when operating in‘Default Deny only’ mode.

Protection against the latest threats
Kaspersky Embedded Systems Security is all-in-one security designed specificallyfor embedded systems. It delivers multiple layers of essential security technologies,
including application and device control, anti-malware, exploit prevention and network
protection to protect embedded systems from attacks.
The solution supports an opt-in approach for its protection layers, offering the highest
level of protection for the broadest possible range of Windows-based embeddedsystems.

Optimized for Windows XP
Most embedded systems still run on the obsolete Windows® XP OS. Kaspersky
Embedded Systems Security has been optimized to run with full functionally on
Windows XP as well as on Windows 7, Windows 8 Windows 10 and even Windows 11families. Kaspersky Embedded Systems Security is committed to providing 100%
support for Windows XP for the foreseeable future, giving organizations plenty of time
to upgrade when they’re ready.

Features and benefits
Easy management
Kaspersky Embedded Systems
Security can be managed fromthe command line, the local GUI or
the centralized policy-based
management of Kaspersky
Security Center.
Security policies, signature
updates, anti-malware scans andresults collection are easily
managed through the single
centralized management console.
In addition, clients in a local
network can be managed throughany local console – particularlyuseful when working in theisolated, segmented networks
typical of embedded systems.

Kaspersky Embedded Systems Security has been specifically designed fororganizations operating embedded systems and the threat environment they operate
in. It protects the attack surfaces unique to these architectures, reflecting their uniquefunctionality and OS, channel and hardware. When it comes to medical equipment,these capabilities can literally be the difference between life and death.
Management and reporting

Systems integrity monitoring
and compliance*

Optimized system requirements• RAM 256MB or more• OS: Windows XP and later• Network bandwidth: 56kbps+• File integrity monitoring• Registry access monitoring NEW• Log Inspection• PCI/DSS compliance* Requires a Kaspersky Embedded Systems SecurityCompliance Edition License

Anti-malware protection• Opt-in• Real-time/on-demand• Exploit prevention• Ransomware protection

Systems control• Application launch control• Software distribution control• Device control

Network protection• Network Threat Protection• Firewall management

Flexible licensing
Kaspersky Embedded Systems
Security is available in twocommercial licenses:• CLI/GUI/centralized management• Cloud-hosted SaaS console option NEW• SIEM integration

System hardening• Kaspersky Embedded Systems
Security standard

Using ‘allow list’ principles, system hardening prevents the use of unsolicited
applications and external devices. This helps to prevent malware attacks and stops
unwanted utilities and storage from connecting to your systems. It also ensures thatapps on the allow list can be easily and safely updated, in default deny mode.

• Kaspersky Embedded Systems
Security Compliance Edition, an
extended license that includes
File Integrity Monitor and Log
Inspection.

Opt-in anti-malware and exploit prevention/
memory protection
Proven cloud-assisted protection from the industry’s leading antivirus engine, capableof detecting even the most aggressive attacks. Anti-malware protection offers bothreal-time and on-demand scanning, instant, reputation-based protection from theKaspersky Security Network cloud, and exploit prevention. This is essential for allsystems but especially those running an unsupported OS. You can enable or disable
this component depending on your device type and deployment scenario.

2Network threat protection
Embedded systems are highly vulnerable to network attacks. Kaspersky Embedded
Systems Security offers centralized management of the OS embedded firewall as well
as network threat pretention to counter a broad range of attack scenarios, including
DoS and network-related vulnerability exploitation. Network threat protection isparticularly important for medical embedded devices because cyberattacks thatstart by infecting a regular endpoint can move laterally, using network vulnerabilities tocompromise highly specialized medical machines.

Application and device controls
Application and device controls are the foundation of effective protection forembedded systems, where everything (apps drivers, libraries, USB drives) not explicitly
permitted is blocked, making direct infection highly unlikely.

Optimized system requirements
Embedded systems can vary significantly in terms of resources, age and usage
scenarios. Kaspersky Embedded Systems Security offers flexible configuration andselection options, so that security can be tailored to any system, regardless of its ageand use. This optimize performances and delivers rock-solid stability.

Windows Firewall management
Windows Firewall can be configured directly from Kaspersky Security Center, giving
you the convenience of local firewall management through a single unified console. Thisis essential when embedded systems are not in domain and Windows firewall settings
can’t be configured centrally.

SIEM integration
Kaspersky Embedded Systems Security can convert events in application logs
into formats supported by the syslog server, so these can be transmitted to, andsuccessfully recognized by, all SIEM systems. Events can be exported directly fromKaspersky Embedded System Security to SIEM or centrally via Kaspersky SecurityCenter.

File Integrity and Registry Access Monitoring4
Most embedded systems are single-purpose devices, so interference with theircomponents may indicate an intrusion. Tracking changes in critical system areas andmonitoring abnormalities in system logs is crucial for system integrity – especially whencompliance is at stake. File integrity monitoring and Registry Access monitoring in
Kaspersky Embedded Systems Security tracks actions performed on specified registrykeys, files and folders, and can be configured either to alert or block the undesiredchanges.

Log Inspection5
Kaspersky Embedded Systems Security monitors possible protection violations basedon Windows Event Logs. The application notifies the administrator when it detects
behavior that may indicate an attempted cyberattack.

Available in Kaspersky Embedded Systems Security
Compliance Edition
Available in Kaspersky Embedded Systems Security
Compliance Edition

4 5 3On-prem or cloud-based management
Fast deployment and remote operation options have become essential, so Kaspersky
Embedded Systems Security can be administered from an on-premise management
infrastructure or from the cloud via Kaspersky Security Center. This enables a faststart, without the need to set up a management server, and brings easy availabilityof management instruments from anywhere. The solution is managed from the same
management console as other Kaspersky products, delivering better visibility andcontrol and consistent, more effective security policies.

Life-saving stability and security
The smooth, uninterrupted functioning of embedded medical devices is critical for thedelivery of effective healthcare, allowing medical staff to do much more, and ultimately
save more lives. Even if the functioning of a particular device isn’t threatened, a leak ofconfidential medical information can be disastrous for medical services and patientsalike. Kaspersky Embedded Systems Security delivers reliable security and rock-solid
stability so that the medical fraternity can focus on the most critical task of all: keeping
people well and alive.

To find out more about how Kaspersky Embedded Systems Security cansecure your healthcare facilities and systems, contact us now

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
Kaspersky technologies in details: kaspersky.com/technowiki
Cybersecurity for SMB: kaspersky.com/business
Cybersecurity for Enterprise: kaspersky.com/enterprisewww.kaspersky.com
2021 AO Kaspersky.
Registered trademarks and service marks are the property of theirrespective owners.

4