Slashdot Mirror
Course Asks University Students To Tackle Medical Device Insecurity
chicksdaddy writes "The University of Michigan will be among the first to offer graduate students the opportunity to study the security of advanced medical devices. The course, EECS 598-008 'Medical Device Security' will teach graduate students in UMich's Electrical Engineering and Computer Science program 'the engineering concepts and skills for creating more trustworthy software-based medical devices ranging from pacemakers to radiation planning software to mobile medical apps.' The new course comes amid rapid change in the market for sophisticated medical devices like insulin pumps, respirators and monitoring stations, which increasingly run on versions of the same operating systems that power desktops and servers. In 2011, the U.S. Food and Drug Administration reported that software failures were the root cause of a quarter of all medical device recalls (PDF)."
Will give you the Frowny face :( when your patient dies, citing an error in BREATH_INITIALIZATION.
Then it really will be a blue screen of DEATH
"Here I am, brain the size of a planet, and they tell me to take you up to the bridge. Call that job satisfaction? Cause I don't. "
Not much there to study. :(
Now, a class on what security in such devices SHOULD be, and why it isn't that way now and what politically- and economically-feasible solutions already exist or could be researched would be a great class.
It's the vendors who say no OS updates and some of them need to phone home as well.
Meh... that industry is over-regulated. The excessive regulation is causing the very problems that it proposes to solve. No one can deploy fixes because each iteration has to go through draconian certifications. When a product in this field meets a deadline... that's it... so rather than releasing v1.0 which gets patched, it just goes out un-patched.
It's the classic argument against the waterfall model... hmmm... we planned really hard, but there were still problems... the solution is clearly to plan even harder next time. Doesnt work.
No one will make an innovative product, because they like the status quo. The incumbents are more than happy about the over-regulation, because the barrier to entry stops new entrants from entering the competition and reducing rents.
Take EHR... (electronic health records)... this is an easy problem... just have an electronic notebook and attach tests results as files, prescriptions as records, etc... why has it not been fixed? HIPPA and other regulatory restrictions. Oh no... we cant just save your chest X-Ray as a TIFF file with a date, time, and location... it must be part of an integrated database thing... seriously... the web (just a bunch of linked files) solved this problem decades ago.
The course is run by a Softer. It will be nothing but BS and excuses.
First, devices use different interfaces. Something that uses radio (such as a modern pacemaker that really can't be plugged in to much) has to have more thought than a device that is plugged in 24/7, such as an electrode that is attached via sticky tape and removed when done.
Second, denial of use can be just as much a threat as getting access. For example, if a device will turn itself off if it gets too many failed access attempts, someone wanting to wreak havoc could just run random guesses in a hospital and lock everyone out there.
Third, limit the functions. If the device does not need read/write access, make it read only. If the device does not need to be monitored, then have access turned off. Limiting access and separation/compartmentalization will go a long way with ensuring security as opposed to lots of coding and the QA/debugging required, especially on a life-critical item.
Is this really newsworthy? CS departments everywhere have graduate seminars that cover hot topics in the field.
OSCAR is an open-source electronic medical record system. My mom used it for years in her midwifery practice.
Unstructured electronic notebooks are no good...you want the important information to be in standardized locations/formats (for efficiency) and readily visible (to avoid mistakes). Ideally you want the web-based forms to look very much like the old paper forms to minimize disruption. OSCAR (and others, to be fair) allow this sort of thing.
Ever heard of Johns Hopkins Information Security Institute?
Prof. Kevin Fu's course website points to a nice article at MIT Technology Review on the prevalence of S/W virii in medical devices at hospitals:
<URL:http://www.technologyreview.com/news/429616/computer-viruses-are-rampant-on-medical-devices-in-hospitals/>
This proposal raises the question of whether the creator of a device can protect the associated intellectual property if they are required to include source code as part of their submission for approval. I hope that we can have that discussion instead of continuing to treat all medical devices as black boxes.
The FDA reported that 75% of recalls did not in any way involve a software failure. From which one may conclude that the platform is robust and mature. So all of you smartasses bashing Windows to make yourselves look 1337 have just made the case that it is mature and robust.
Somewhere in Russia right now, a cybercrook is salivating at the prospect of being able to break into pacemakers and hold their owners' lives for ransom. The solution? DON'T CONNECT THE DAMN THINGS TO THE INTERNET.