I'm Mary Ann Colby, Executive Editor at Information Security Media Group. Today I'm speaking with Daniel Bessentos, who is Head of Security Research at Security Firm Forescout about some of the top medical device cybersecurity challenges facing the healthcare sector this year. So Daniel, as we begin 2023, what are you especially watching in terms of cybersecurity of medical devices and other connected devices in healthcare? What are you most concerned about?
Looking at, let's say the threat landscape and looking at the research that we have done and also other vulnerabilities that we see published, you know, if not daily, then at least weekly on Cesar's website and on other resources. I believe that there are two main issues with vulnerabilities affecting medical devices these days. It's mainly issues with insecurity by design in the sense of things like hard-coded credentials, insecure protocols, oftentimes insecure configurations by default, and on the other side, supply chain vulnerabilities, right? So basically trying to understand what all software components go into a medical device and trying to understand how devices are affected by these big supply chain vulnerabilities.
So, you know, you can think of things like Log4J, which was a big issue in the IT security community, but it also might have an effect on medical devices, right? So medical devices might run the vulnerable library. And more specifically in our research, for instance, we saw software components like TCP ID stacks that are embedded in almost any type of device that is connected into a network and medical devices are no exception. And basically trying to understand when a component is vulnerable, whether a device is running that component, how that is configured and so on, it's a challenge for a device manufacturer.
So, just to summarize, I would highlight these two big aspects in terms of vulnerabilities in medical devices. So, the issues that are there kind of by design or by developing life cycle problems and the issues that are there out of supply chain or third party risk that is included in devices. So, Daniel, you did mention that TCP IP research that your team recently did, and indeed, you recently released new analysis of this research Endeavour called Project Memoria, which again, examined the security of TCP IP stacks used by connected device manufacturers, including medical device makers. Very briefly, please describe the most significant finding that you had from this project and what that means pertaining to medical devices.
The main findings are that TCP IP stacks, they are this basic component that allows connectivity in any kind of device, including medical devices. And they are kind of vulnerable across the board because, as with many other components that go into this kind of very specialized device or specialized hardware, they were often developed, you know, 20, 30 years ago when security was an afterthought at best, right? In many cases, not at all. So, you still see a lot of programming errors that lead to memory issues and lead to basically vulnerabilities that attackers can leverage and can use in their attacks to either take a device of line or take full control of a device.
And interestingly, this research that we did was not specifically focused on healthcare, right? It was focused on the TCP IP stacks and how they are used across the board in IoT devices, operational technology, healthcare, and so on and so on. But healthcare, we did have several healthcare devices impacted, such as patient monitors, some infusion pumps and things like that. And basically, one finding that we had out of the research that was not just the, not just the vulnerabilities themselves was the fact that vendors are typically very slow to respond to this supply chain issues, right?
So, when an issue is affecting a component that's not developed by them, either because they're unaware or not sure how it is used on their devices or because they cannot immediately release a patch because they depend on another third party vendor or think or some situation like that, right? So, typically vendors are very slow, but we realized that the healthcare vendors, they at least are willing most of the times to say something about vulnerabilities, right? Whether they are affected or not, publicly stating something. And part of it, of course, is because they may be required to do so.
They're more regulated than in other industries. But also, we believe part is because some of the device manufacturers in healthcare are more mature than, you know, general IoT or, in some cases, operational technology manufacturers. So, going a bit concretely into numbers, right? We saw that out of the 95 vendors that were affected and that released a public response, right?
17 of those were medical manufacturers. And then whether that is saying that they are affected or not affected, at least they said something about these vulnerabilities when contacted. So, they were really among the best in responding to the disclosures. And in many cases, they were investigating the issues, even if we had not originally identified them as potentially vulnerable, right?
We just released the vulnerabilities out there, talked to the HISAC, for instance, in other organizations. And the manufacturers hear about that and they investigate themselves. So, I do believe that there is a good level of maturity or increasing level of maturity with medical device manufacturers when compared with other types of connected device manufacturers. In the last weeks of 2022, President Biden signed into law a new spending legislation that contained provisions that basically expands the FDA's authority over medical device cybersecurity.
And that includes being able to require that medical device makers submit detailed cybersecurity plans to the FDA as part of their new product submissions. And some of those items that the manufacturers have to include relate to vulnerability disclosures, how their products can be updated and patched, various security controls that are contained in the products, and so on and so forth. What do you think of this latest development? Do you think it will have much of an impact on how medical device makers look at cybersecurity in their products, not only the mature vendors, but some of the immature ones as well?
So, legislation and regulation is always a bit controversial, right? Because so many factors are always opposed to exciting issues with cyber innovation or whatever that is, right? I tend to take a look at the fact that from my point of view, it tends to increase the security of the device and at least the liability of vendors and trying to improve the security of their own devices, right? So, I look at it as a positive development, as with every piece of legislation and regulation, we have to wait and see what the concrete effects of this latest one will be, what the concrete requirements, concrete response from the manufacturers and so on will be to understand its effects longer term.
But I do believe that it's positive that we move to a state where the device manufacturers and more specifically healthcare device manufacturers have more responsibility and more liability with the products that they put out there in terms of cybersecurity, right? I'm not just talking about safety and other issues that the FDA also looks at, but in terms of cybersecurity as well. And some of the issues that you mentioned, like patching basic security controls and so on, it's important that we look at the devices that will be produced from now on, new device models, as you mentioned. But we always have to keep in mind that devices that are specialized, like connected medical devices, they have a very long lifespan, right?
In some cases, for some types of devices, it can be up to 20 to 30 years. So we really have to keep in mind that this is new and hopefully more secure devices will be connected in oftentimes the same networks as devices that are less secure, which increases the overall risk of the network, right? So there are still many cases of things as I mentioned in the first question, right? And secure by design issues are basically, you know, protocols that offer no authentication, no encryption or hard-coded credentials to happen on time and mental devices.
So we need to keep in mind that things may improve for the newer models and that's great and we really need to be unproven there as well. But we need to keep in mind the older devices that will still be on HDO's networks for potentially a long time in the future. And Daniel, finally, is there one bit of advice that you would offer to healthcare delivery organizations and then also medical device makers in terms of one important step they should take to improve the cybersecurity of the medical devices either used in their environments or the manufacturers themselves putting these products out into the market? I think the most basic step, the one step that has to be done well and that enables all other types of security controls to be done effectively and efficiently later on is asset inventory.
It's basically knowing what is connected on your network and not just, you know, what what medical devices are on the network, but also what personal devices like mobile phones may be on same network segments as those medical devices or which doctors, workstations or nurses, workstations are communicating with infusion pumps or patient monitors or anything like that. So asset inventory includes knowing all the devices that are on the network, their characteristics, their software and firmware versions, their potential vulnerabilities and also how they are communicating. I think that really from a complete and accurate or as complete and as accurate as possible asset inventory, it's then possible to create later on security controls that will make sense, right? Whether that is segmentation, whether that is hardening endpoints with antivirus or whether that is, you know, tightening firewall rules or anything like that, right?
We really need to know, first of all, what is on your network, how it behaves so that then you can take control of it. And actually, it's it's often the case that, you know, you see attacks happen when the security teams are not aware of how they are behaving on the network or that they are even present on the network, right? Or rogue devices, there are devices that are compromised and only after a very long time, the compromise is attacked. So you don't know the real compliance state of a device and so on.
So really, complete and accurate asset inventory is basically the I think the way to go in 2023 to be able to achieve better security for HDOs. Thank you so much, Daniel. I've been speaking to Daniel dos Santos. I'm Mary Ann Kolbasak-McGhee of Information Security Media Group.
Thanks for joining us.