Cybersecurity for Medical Device Manufacturers: Ensuring Safety and Functionality

Wu, Fubin; Eagles, Sherman

doi:10.2345/0899-8205-50.1.23

Cited by 14 publications

(18 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Medical devices, which were traditionally stand-alone systems, are becoming network-integrated within hospital IT systems and are no longer immune to traditional cyber attacks [8]. As of recent, medical device manufacturers are implementing and expanding networked medical devices, while failing to maintain a pace to circumvent the possible cybersecurity threats posed by network integration [9,27]. Many IT experts are concerned that recent trends will convince cybercriminals to target medical devices such as pacemakers or Intensive Care Unit (ICU) respirators [33].…”

Section: Synthesis Of Resultsmentioning

confidence: 99%

See 1 more Smart Citation

Cybersecurity in healthcare: A systematic review of modern threats and trends

Kruse¹,

Frederick²,

Jacobson³

et al. 2017

THC

291

157

View full text Add to dashboard Cite

Abstract. BACKGROUND:The adoption of healthcare technology is arduous, and it requires planning and implementation time. Healthcare organizations are vulnerable to modern trends and threats because it has not kept up with threats. OBJECTIVE: The objective of this systematic review is to identify cybersecurity trends, including ransomware, and identify possible solutions by querying academic literature. METHODS: The reviewers conducted three separate searches through the CINAHL and PubMed (MEDLINE) and the Nursing and Allied Health Source via ProQuest databases. Using key words with Boolean operators, database filters, and hand screening, we identified 31 articles that met the objective of the review. RESULTS: The analysis of 31 articles showed the healthcare industry lags behind in security. Like other industries, healthcare should clearly define cybersecurity duties, establish clear procedures for upgrading software and handling a data breach, use VLANs and deauthentication and cloud-based computing, and to train their users not to open suspicious code. CONCLUSIONS: The healthcare industry is a prime target for medical information theft as it lags behind other leading industries in securing vital data. It is imperative that time and funding is invested in maintaining and ensuring the protection of healthcare technology and the confidentially of patient information from unauthorized access.

show abstract

Section: Synthesis Of Resultsmentioning

confidence: 99%

“…Wu et al [9] Introduces the topic of new wireless applications of medical devices left vulnerable to cyber attacks and how safety risk management in manufacturing is being redefined to address growing cybersecurity threats.…”

Section: Synthesis Of Resultsmentioning

confidence: 99%

Cybersecurity in healthcare: A systematic review of modern threats and trends

Kruse¹,

Frederick²,

Jacobson³

et al. 2017

THC

291

157

View full text Add to dashboard Cite

show abstract

“…These costs account for about four percent of the loss, reputation damage associated with about eight percent of the loss, and damage to infrastructure, which accounts for about 10 percent of the losses. Other costs include theft of information assets (23 percent), system downtime (25 percent), and end user and IT productivity loss; with the latter accounting for 30 percent of the costs incurred [2][3][4]6]. The figure below provides a summary of these healthcare costs associated with endpoint attacks.…”

Section: Introductionmentioning

confidence: 99%

End-Point Information Security in the Healthcare Industry: A Critical Review

Uzzaman¹

2018

IJET

View full text Add to dashboard Cite

The ability of the healthcare industry to keep abreast with the evolving trends in endpoint information security depends on combinations of measures. In the current literature, some of these measures include the development of analytics capable of spotting intruders on time, embracing quick reactions to potential or detected intrusions, and the decision to employ robust system defenses. In this paper, the main aim was to review the current literature regarding the subject of endpoint information security, with critical insights gained from the case of the healthcare industry. Findings suggest that the healthcare industry forms one of the most attractive arenas for security attackers. Some of the healthcare organizations that have been victims of recent security attacks include the Californian Hollywood Presbyterian Medical Center that experienced a data breach in February 2016 and MedStar Health Inc. (in the same month). In the following month, San Diego’s Alvaro Hospital Medical Center was also targeted for cyber attack. Hence, some algorithms have been proposed to counter these attacks; including the use of SOA-based EHRs, the implementation of the RBAC model, the use of k-anonymity, k-unlinkability, and the SQL searching mechanisms that target the patients’ encrypted data. Also, some strategies have been proposed as best practices in endpoint information security. These strategies include the management of identity lifecycles, the establishment of risk-aware cultures, the management of third-party security compliance, and securing healthcare firms’ devices in terms of design. Overall, it is evident that the complexity of endpoint information security in the healthcare industry (due to the evolution of applications such as virtualization and cloud computing) implies that the ability to survive from future security attacks will depend on the firms’ ability to keep abreast with industry demands.

show abstract

“…As described in the MDPC (2014) framework, the process of choosing controls is not trivial, especially when there are multiple control options. Wu and Eagles (2016) highlight that cybersecurity controls need to be balanced against usability, which is also articulated in the FDA's guidance (FDA, 2016). An example of the tradeoff is the use of a password to access information on a medical device, which could result in a delay of treatment.…”

Section: Tailored Impactmentioning

confidence: 99%

“…An assurance case is a communication method that organizes information in a systematic and structured way to articulate evidence and critical thinking, and it is traditionally applied to safety assessments (FDA, 2014). Wu and Eagles (2016) provide a template of a cybersecurity assurance case and propose that this assurance case can be used to articulate cybersecurity assessment to outside stakeholders, specifically to regulators, which has also been recommended by the FDA for infusion pump manufacturers.…”

Section: Tailored Impactmentioning

confidence: 99%