Slashdot Mirror
Global Network of Labs Will Test Security of Medical Devices (securityledger.com)
chicksdaddy shares a report from The Security Ledger: Amid increasing concerns about cyber threats to healthcare environments, a global network of labs will test the security of medical devices, according to an announcement on Monday by a consortium of healthcare industry firms, universities and technology firms, The Security Ledger reports. The "World Health Information Security Testing Labs (or "WHISTL") will adopt a model akin to the Underwriters Laboratory, which started out testing electrical devices, and focus on issues related to cyber security and privacy, helping medical device makers "address the public health challenges" created by connected health devices and complex, connected healthcare environments, according to a statement by The Medical Device Innovation, Safety and Security Consortium. "MDISS WHISTL facilities will dramatically improve access to medical device security know-how while protecting patient privacy and the intellectual property of our various stakeholders," said Dr. Nordenberg, MD, Executive Director of MDISS.
The labs will be one of the only independent, open and non-profit network of labs specifically designed for the needs of medical field, including medical device designers, hospital IT, and clinical engineering professionals. Experts will assess the security of medical devices using standards and specifications designed by testing organizations like Underwriters Labs. Evaluations will include application security testing like "fuzzing," static code analysis and penetration testing of devices. Any vulnerabilities found will be reported directly to manufacturers in accordance with best practices, and publicly disclosed to the international medical device vulnerability database (MDVIPER) which is maintained by MDISS and the National Health Information Sharing and Analysis Center (NH-ISAC). The group says it plans for 10 new device testing labs by the end of the year including in the U.S. in states like New York to Indiana, Tennessee and California and outside North America in the UK, Israel, Finland, and Singapore. The WHISTL facilities will work with Underwriters Labs as well as AAMI, the Association for the Advancement of Medical Instrumentation. Specifically, MDISS labs will base its work on the UL Cybersecurity Assurance Program specifications (UL CAP) and follow testing standards developed by both groups including the UL 2900 and AAMI 80001 standards.
The labs will be one of the only independent, open and non-profit network of labs specifically designed for the needs of medical field, including medical device designers, hospital IT, and clinical engineering professionals. Experts will assess the security of medical devices using standards and specifications designed by testing organizations like Underwriters Labs. Evaluations will include application security testing like "fuzzing," static code analysis and penetration testing of devices. Any vulnerabilities found will be reported directly to manufacturers in accordance with best practices, and publicly disclosed to the international medical device vulnerability database (MDVIPER) which is maintained by MDISS and the National Health Information Sharing and Analysis Center (NH-ISAC). The group says it plans for 10 new device testing labs by the end of the year including in the U.S. in states like New York to Indiana, Tennessee and California and outside North America in the UK, Israel, Finland, and Singapore. The WHISTL facilities will work with Underwriters Labs as well as AAMI, the Association for the Advancement of Medical Instrumentation. Specifically, MDISS labs will base its work on the UL Cybersecurity Assurance Program specifications (UL CAP) and follow testing standards developed by both groups including the UL 2900 and AAMI 80001 standards.
www.mdiss.org doesn't even implement https. And you can't tell them about it because http://www.mdiss.org/Home/Contact has no submit button.
-rsaxvc
and we both won
www.mdiss.org doesn't even implement https. And you can't tell them about it because http://www.mdiss.org/Home/Cont... has no submit button.
... it is "designed" into devices. It appears the medical device industry still does not get security. How many people have to die before they do get security?
This is the usual beauhd summary. A wall of text with little thought behind it. So sad. And this person is a /. editor. How far has /. sunk to this to be the norm?
Now I can go back as a high priced consultant to fix all of those devices I helped design as a struggling young engineer. Get your checkbook ready, I don't work cheap anymore.
They are applying for H-1B visas too.
... all soon receive cease-and-deist orders.
Are they testing them by implantation... in high profile people that are widely disliked?
Given the low level of trust I hold for pharma firms, how much trust could I put into "a consortium of healthcare industry firms, universities and technology firms"? Especially when uni gets deeper and deeper into industry's pockets?
Exactly.
I expect device makers to try and litigate them into submission before they can go public with vulnerabilities.
We need a global mandate that *all* medical equipment has 100% open-source firmware. Only then can we have any real hope of security with these critical, life-saving devices.
It seems like any time you read anything about medical devices, it's about security being abysmal: not even an afterthought. Hard-coded default admin passwords are commonplace. It's been my experience, working in the medical field, that most of the hardware is obsolete shit even when it's brand new. I often wonder if this has to do with the arduous process each device must go through to get FDA approval for medical use. For instance, my hospital uses the PYXIS medstation, a commonly-used locked medication cabinet with fingerprint access. The company rep just came through a couple days ago with latest-gen tops that contain a new touchscreen, keyboard, barcode reader, etc. The touchscreen is poor resolution and less touch-sensitive than the one it replaced. The only "improvement" to the keyboard is they removed tactile ability completely by making it flat for easy cleaning. The components inside (hard drive, etc) are connected with fucking IDE ribbon cables.