The healthcare industry is the most complicated environment to secure – as it takes a village – from the medical devices community, to healthcare providers, healthcare workers and government bureaucrats. This is the industry at highest risk because of the sheer volume of unmanaged or hard-to-manage devices and the consequences (life-or-death nature of the trade). The emerging nature of IoT devices and cybersecurity compliance requirements in the healthcare sector requires both equipment vendors and service providers to implement security policies that address the risks posed by cyber-attacks and insider threats. Mission critical production systems and medical devices require protection from unauthorized software updates or configuration changes, and secure authentication of field and remote operators. Legacy enterprise IT managed systems rely on password policies, multi-factor authentication and role based physical and network access. Such controls are inadequate against zero-day cyber-attacks on headless IoT devices that subvert threat intelligence-based intrusion and/or anomaly detection systems designed to prevent data breaches. Therefore, IoT solutions in the healthcare sector require a tamper-resistant system that provides built-in protection controls, trustworthy change management and continuous integrity verification – for high scalability and availability.
The strategy will require at least:
Devices: Aging Legacy Medical Devices
Company: Medical Device Manufacturers
There are 6+ million medical devices in the market and 6,500+ manufacturers in the U.S. alone.
— MPO Magazine
Aging medical devices such as imaging equipment, pumps, surgical equipment, implantable medical devices, hospital and home patient monitors, and medical Internet of Things (IoT) edge devices are vulnerable due to a lack of strong cryptographic controls, including: multi-factor authentication, secure boot, secure update, and secure, encrypted communications.
Medical equipment manufacturers and healthcare providers must ensure compliance with HIPAA, HITECH Breach, and cybersecurity standards such as NIST 800-53, Revision 4, IEC 62443-3-3, and FIPS 140-2. Keeping up with these standards as well as emerging standards from the Industrial Internet Consortium (IIC) and Industrie 4.0 can be challenging. New regulations such as GDPR in Europe raise the stakes for non-compliance to more than €20 million per incident. Older protocols such as Modbus, DNP3 and BacNet can be difficult to secure.
A Cybersecurity System Tailored for Clinics, Hospitals, and Manufacturers
Used by more than 200 OEMs to protect more than 100 million devices
Mocana’s end-to-end cybersecurity system is a FIPS 140-2 validated embedded cybersecurity software solution that ensures device trustworthiness and secure communications by giving industrial automation manufacturers, OEMs and critical infrastructure operators an easy way to harden electronic control units and controllers with multi-factor authentication and trust chaining, as well as secure boot to validate the firmware, OS and applications.