63% of Known Exploited Vulnerabilities Can be Found in Hospital Networks
A typical U.S. hospital has between 10 and 15 medical devices per bed, which means a 1,000-bed hospital could have around 15,000 medical devices. Those devices include imaging devices, clinical IoT devices, and surgery devices, and they significantly increase the attack surface. A vulnerability in any of those devices could be exploited by a threat actor to gain access to the internal network and sensitive data, especially vulnerabilities in internet-facing devices.
Research conducted by the cyber-physical systems (CPS) protection company Claroty – published in Claroty’s State of CPS Security Report: Healthcare 2023 Report – has revealed hospitals are not keeping their medical devices up to date. The researchers found that 63% of the vulnerabilities in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) Catalog can be found on healthcare networks, 23% of medical devices have at least one known exploited vulnerability, and 14% of medical devices are running an unsupported or end-of-life operating system.
The study found 22% of hospitals have connected devices that bridge guest networks and internal networks and 4% of the medical devices used in surgeries can be accessed from guest networks at hospitals. Guest networks provide visitors and patients with Wi-Fi access and they are generally the least well-secured and the most exposed place for medical devices to be connected. The researchers looked at medical devices that are remotely accessible and found many of the remotely accessible devices have a high consequence of failure, such as devices that defibrillators, robotic surgery systems, and defibrillator gateways. 66% of imaging devices, 54% of surgical devices, and 40% of patient devices were found to be remotely accessible.
The Exploit Prediction Scoring System (EPSS) is a data-driven effort for estimating the likelihood that a software vulnerability will be exploited in the wild. The researchers examined devices with high EPSS scores and 11% of patient devices – such as infusion pumps – and 10% of surgical devices had vulnerabilities with high EPSS scores. 85% of devices with unsupported operating systems had vulnerabilities with high EPSS scores.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Keeping medical devices up to date is challenging. Medical devices are in constant use, and updating software or firmware and applying patches means those devices are made temporarily unavailable. Hospitals must also contend with 360 medical device manufacturer (MDM) patch certification programs to ensure compliance requirements and verify that products provide reasonable protection against risk. While the majority (93%) of critical vulnerabilities in CISA’s KEV Catalog can be fixed with an operating system update or vendor patch, it often takes months for MDMs to certify a patch before it can be applied to an individual device. During that time, devices are vulnerable to attack. Another problem with defending medical devices is hospitals often do not have a complete and up-to-date inventory of all medical devices connected to the network, and defenders cannot adequately protect devices that they are blind to.
Claroty recommendations are for hospitals to develop cybersecurity policies and strategies that stress the need for resilient medical devices and systems that can withstand intrusions. They should limit remote access to endpoints, secure remote access through proper provisioning of credentials, ensure that multifactor authentication is enabled, restrict third-party connections from vendors and contractors, and conduct regular and continuous vulnerability scanning of assets that are exposed to the internet. Hospitals must also ensure they have complete visibility into the medical devices connected to their networks and the inventories should list whether assets are internet-facing. Defenders can then prioritize patching those assets as they are the ones that are most likely to be targeted by threat actors.
