Cybersecurity Challenges in Medical Devices and Operational Technology
Is cybersecurity a major issue for companies in the healthcare and operational technology (OT) sectors?
A recent study by Armis has highlighted the most vulnerable assets and the preferred targets of cyber attacks. In this article, we will explore the study's findings and the lessons it offers on the security of connected equipment.
Medical devices: a major vulnerability.
According to data gathered by Armis, Internet of Medical Things (IoMT) devices are the most exposed to unpatched vulnerabilities and attacks. Between August 2022 and July 2023, more than half of optical disc burners (62%) and infusion pumps (26%) had unpatched vulnerabilities, making them potentially open to attack.
This IoMT equipment, used in medical environments, is essential for patient treatment. Unpatched vulnerabilities can compromise patient safety, data confidentiality or the availability of healthcare services. This underlines the crucial importance of strengthening the security of connected medical devices.
The preferred targets of attacks.
Besides medical devices, Armis's study revealed that operational technology (OT) assets were among the most frequent targets of cyber attacks. Attackers are mainly after potential access to assets rather than their specific type.
The ten most frequently targeted asset types include engineering workstations (OT), imaging workstations (IoMT), media players (IoT), personal computers (IT), virtual machines (IT), building management systems (BMS) powered by uninterruptible power supplies (UPS), servers (IT), media burners (IoMT), tablets (IoPT) and mobile phones (IoPT).
Accessibility from outside, a complex attack surface and the presence of known vulnerabilities make these assets attractive targets for malicious actors. For example, engineering workstations are often connected to every controller in a factory, imaging workstations store sensitive patient data in hospitals, and UPS units serve as critical access points for essential infrastructure.
Common risk factors.
In addition to unpatched vulnerabilities, Armis identified common risk factors among cyber assets. Some assets, such as servers and programmable logic controllers (PLCs), run operating systems that are end-of-life or no longer supported. These systems no longer receive active security updates, leaving them vulnerable to attack.
Furthermore, the continued use of the unencrypted and vulnerable SMBv1 protocol is a concern. WannaCry and NotPetya are two examples of attacks that exploited vulnerabilities in this protocol. Nearly three quarters of organisations still have at least one asset vulnerable to EternalBlue, an SMBv1 vulnerability.
Finally, some technical equipment, such as pneumatic tube systems, uses insecure software update mechanisms, which exposes it to security risks.
Cybersecurity remains a major challenge for organisations operating in the healthcare and operational technology sectors. Protecting medical devices and securing OT assets are essential priorities for preventing attacks and ensuring operational continuity.
Organisations must remain vigilant, put effective security measures in place and keep up to date on known vulnerabilities in order to face growing cyber threats.
Powered by E-MED-CYBER