April 28, 2015 By Shane Schick 2 min read

Security threats against desktops and smartphones are so overwhelming that few would want to contemplate the possibility of medical device malware, which means a product that could track it based on power consumption could be just what the doctor ordered.

According to a recent story on The Register, a startup called Virta Labs is quietly signing up health care organizations to pilot WattsUpDoc, a platform that uses machine learning to detect medical device malware via the power footprints of websites or other feedback over AC. In demonstrations at the recent RSA Conference, the firm demonstrated how this technology could work, though the two most recent U.S. hospitals among the trial group were not mentioned by name.

Though they might not be considered a high-risk endpoint today from the perspective of a chief information security officer, devices such as heart-rate monitors can collect and transmit considerable amounts of sensitive information and are sometimes connected to back-end hospital systems and medical records. In fact, InformationWeek suggested it might be relatively easy for medical device malware to find its target since default passwords are often set to things such as “admin” or can’t be changed at all.

One of the things that complicate this particular attack vector is the role of regulators such as the Food and Drug Administration (FDA), according to Government Health IT. Though the FDA has issued guidance around cybersecurity, there have historically been restrictions on how such hardware can be changed, even if it’s to provide a patch against medical device malware. Some suggest more standards are needed in this area.

The notion of using AC power to monitor and mitigate threats isn’t limited to medical device malware, of course. An in-depth feature on CSO Online explored how tools similar to WattsUpDoc are being deployed to fend off cybercriminals from industrial control systems or supervisory control and data acquisition (SCADA) systems. The latter could be a particularly interesting test case, given that recent research said SCADA systems are among the areas where cybersecurity activity is on the rise.

Of course, nothing beats prevention, and medical device malware is no exception. As Healthcare IT News pointed out, manufacturers need to build security into the design of products instead of dealing with the fallout when a cybercriminal strikes. Otherwise, technologies such as WattsUpDoc may be making a lot of house calls.

Image Source: iStock

More from

Skills shortage directly tied to financial loss in data breaches

2 min read - The cybersecurity skills gap continues to widen, with serious consequences for organizations worldwide. According to IBM's 2024 Cost Of A Data Breach Report, more than half of breached organizations now face severe security staffing shortages, a whopping 26.2% increase from the previous year.And that's expensive. This skills deficit adds an average of $1.76 million in additional breach costs.The shortage spans both technical cybersecurity skills and adjacent competencies. Cloud security, threat intelligence analysis and incident response capabilities are in high demand. Equally…

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today