Chapter 7: Why Healthcare IT Security Can’t Protect Against IoMT Vulnerabilities

Vulnerability management can help hospitals monitor all their devices, assess risks, prevent threats, and meet compliance requirements. The result is improved cyber resilience, operational continuity and, most importantly, patient safety.

Yet, putting into practice a vulnerability management program ranks among the biggest security challenges for the sector, per the 2021 HIMSS Healthcare Cybersecurity Survey.

In this article, part of our Internet of Medical Things (IoMT) security series, we look at the limitations of traditional IT vulnerability management programs and offer a blueprint for effective assessment of vulnerabilities in the healthcare industry.

Explosive Growth in IoT Healthcare Devices Opens the Door to More Vulnerabilities

The healthcare device ecosystem is more connected than ever. Medical device manufacturers are taking advantage of the Internet of Things (IoT) in healthcare to reduce costs and improve convenience.

For example, Internet of Things devices are taking on a medical context in hospitals. You can leverage a peripheral component plugged into a tablet to use it as a mobile ultrasound. Vendors are also using Raspberry Pi to power medical technology. These initiatives lower costs but create healthcare security blind spots if you don’t understand the context in which these assets are used.

IDC forecasts that the number of connected IoT devices will reach 55.7 billion by 2025. The growth of connected assets in healthcare expands the attack surface. More connected devices and systems mean increased IoT vulnerabilities in healthcare. In fact, 63% of the respondents of Armis Censuswide survey have dealt with one or more security incidents related to unmanaged IoT healthcare devices.

What is a Vulnerability?

Vulnerabilities are weaknesses in hardware, software, and procedures that could be exploited by threat actors, posing cybersecurity and clinical risk factors to organizations.

For example, a vulnerability in the software of an infusion pump could lead to unauthorized access to these devices. A possible risk could be the overdelivery of medication, which can have a negative impact on patient care.

Why You Need to Map Vulnerabilities to Secure IT, OT, IoMT, and IoT in Healthcare

In 2021, the National Institute of Standards and Technology (NIST) recorded more than 20,000 vulnerabilities. When not remediated, device and software vulnerabilities can expose hospital networks to exploits and cyberattacks.

No wonder vulnerability management is a market in expansion, expected to grow to 21.38 billion by 2028, up from 11.26 billion last year, per Brandessence Market Research. The increased number of cyberattacks on the healthcare industry — leading to massive financial losses and disruption to health services and patient care — has been a driver of rapid adoption of vulnerability management solutions.

Looking for ways to better manage medical device vulnerabilities? Download our white paper.

Limitations of Traditional Cyber Vulnerability Management Programs

Findings from the SANS Vulnerability Management Survey 2022 indicate that 77% of the surveyed organizations have a formal vulnerability management program, but only 43.8% of these initiatives include IoT/ICS.

Traditional healthcare IT security has limitations when it comes to OT, IoT, and IoMT vulnerabilities.

Here are three pillars of traditional IT methods that can’t be applied to healthcare cybersecurity:

1. Agent-based Technology

A traditional approach to vulnerability management is all about endpoint detection. This model works well for IT devices such as computers and servers because they can accommodate security agents. However, more than 50% of connected medical devices are unmanaged assets and, for this reason, are unable to support security agents.

Healthcare security requires the deployment of an agentless security solution like Armis, which doesn’t install security agents and is able to identify and monitor all assets (IoMT, IoT, OT, IT) to provide comprehensive visibility.

2. Use of Vulnerability Scanners

Vulnerability scanners are a hallmark of traditional IT security. However, scans are intrusive tools that probe your network, which can be disruptive in the case of sensitive OT, IoMT, and IoT in healthcare.

Scans are notorious for crashing devices, and you don’t want a medical asset malfunctioning when it’s touching patients. Hospitals need a passive solution like Armis, which monitors the environment quietly.

3. Inability to Patch Legacy Assets

Unsupported legacy technology is commonplace in hospitals. Old devices can’t be easily patched or replaced. Slow patching is also a concern. It’s staggering that a vulnerability for which a patch was available, but not applied, was behind 53% of the breaches reported in a Ponemon Institute survey.

4. Emphasis on Vulnerability Scores and Databases

Traditional vulnerability management programs rely on databases such as the Common Vulnerabilities and Exposures (CVE) by MITRE and the National Vulnerability Database (NVD). Systems often classify the threat level of a vulnerability based on the Common Vulnerability Scoring System (CVSS).

This approach doesn’t take into account the clinical context of vulnerable assets. Let’s say you have a connected medical device that is running XP and has a vulnerability with an exploit. You need to understand if the vulnerable device is touching patients because it suggests a context of increased risks.

Steps to Improved Healthcare Vulnerability Management

The evolution of medical devices requires healthcare delivery organizations (HDOs) to change how they approach asset vulnerability management. Hospitals need to shift to a holistic risk-based approach. Here’s how:

1. Leverage Comprehensive Asset Inventory and Visibility

Visibility should be the foundation of a vulnerability management program. In fact, creating a system inventory — key to visibility — is a critical step of the NIST 800-40 standards.

You can’t secure healthcare devices you can’t see or know about. However, asset visibility is a challenge in healthcare, with only 36% of respondents of a Ponemon study saying their HDOs know where all medical devices are.

2. Bring Biomedical, Clinical Engineering, and Security Teams Together

Effective healthcare vulnerability management requires collaboration between biomedical, clinical engineering, and IT security teams. Overcoming these silos is critical to better understand clinical workflows and the impact that vulnerabilities might have on patient care.

3. Prioritize Remediation Based on Clinical Risk Factors

Remediation efforts should be prioritized based not only on the severity of the vulnerability — following the CVSS ratings, for example — but also on the potential impact on the quality of care. And Armis can help with that.

Watch our webinar to learn more about our innovative approach to IT, OT, IoMT, and IoT vulnerabilities in healthcare.

Manage Healthcare IoT Vulnerabilities with Armis

Need help to overcome the challenges of IoT in healthcare? Get in touch with our team. Test drive our platform and see for yourself how we strengthen your hospital’s IT, OT, IoMT, and IoT security defenses.

Frequently Asked Questions

Read all IoMT Playbook Chapters:

1. Chapter 1 – How to innovate in healthcare with IoMT devices without exposing the expanding cyber attack surface
2. Chapter 2 – The Hurdles of Internet of Medical Things Security
3. Chapter 3 – A history of medical device hacking
4. Chapter 4 – How to mitigate ransomware in healthcare
5. Chapter 5 – How to minimize the clinical risks of unsecured healthcare devices
6. Chapter 6 – How to improve patient data security
7. Chapter 7 – Why healthcare IT security can’t protect against IoMT vulnerabilities 👈 you are here
8. Chapter 8 – How to spot the top indicators of compromise in healthcare
9. Chapter 9 – The fundamentals of medical device cybersecurity
10. Chapter 10: Which role can you play in strengthening cybersecurity in healthcare moving forward?