You may recall this blog post from March 2020. It highlighted the importance of factoring in clinical, organizational, financial and regulatory impact when determining which medical Internet-of-Things (IoMT) security vulnerabilities should be fixed first. Consider this post a part two. Whereas the previous post focused on the fact that IoMT devices are here to stay and finding and prioritizing vulnerabilities based on impact cannot be overlooked, this post highlights an up and coming security challenge.

Interconnected Devices Need Interconnected Risk Measurement

The healthcare system today uses various security technologies for connected devices, many of which assign a risk score to vulnerabilities. The score is meant to help hospital security teams understand and prioritize vulnerabilities that elevate risk. Those technologies, however, use different formulas to calculate the risk score. Furthermore, they are often focused on technical risk rather than the clinical impact on the hospital in terms of patient safety or disruption of a physician’s workflow.

For example, while some scanning tools provide a score based on the Common Vulnerability Scoring System (CVSS), medical device security platforms (MDSPs) monitor what devices are doing, collect data, apply machine learning, build behavioral models and calculate a risk score. Both technologies view risk through a technical lens.

The U.S. Food and Drug Administration (FDA) also has its own health care device classification formula. It focuses on a vulnerability’s associated exploit, what an attacker can do with the exploit and the potential harm that can be done. Again, these elements are viewed through a technical lens, not including the clinical impact on the hospital.

Three challenges arise with these scoring technologies. First, they do not consider clinical impact. Second, while scanner scores, MDSPs and FDA classification are all important pieces of information for determining risk, it is difficult for hospitals to know which score to use as a blueprint for vulnerability prioritization and remediation. Lastly, each MDSP and scanning tool uses different risk-calculating methodologies, which is why there is no standard model for prioritizing vulnerabilities within the field.

With a system like this, prioritization is unnecessarily fragmented.

One Recipe for Calculating Risk

Hospitals need one view of risk that merges the technical risk scores and the clinical impact that would take place if a device is compromised. In other words, throw MDSP, scanning, FDA classification and clinical impact data into a soup pot, add seasoning (enrich the data), and voila. With that recipe, healthcare providers can see which vulnerabilities pose the highest risks to patient safety, so they know where to start with remediation.

Security teams can also apply this approach beyond IoMT devices. Other connected devices within the healthcare environment, such as workstations, network infrastructure and even coffee makers — anything that connects to the hospital’s network — should also be scored and prioritized based on a singular recipe for calculating risk. Scanning tools and MDSPs will assign risk scores in any network-connected device. Those technical scores should be merged along with a clinical impact score to determine which vulnerabilities matter most. That uniform way of scoring can help drive the remediation process by understanding the clinical workflow context of each endpoint detected across a hospital network.

Learn how X-Force Red, IBM Security’s team of hackers, in partnership with The AbedGraham Group, a physician-led global security organization, are working to help hospitals overcome the problems of siloed and incomplete risk scoring that they face today. Together, they have developed a solution to merge technical risk scoring data with clinical impact data to identify the vulnerabilities that matter most.

More from Data Protection

Vulnerability resolution enhanced by integrations

2 min read - Why speed is of the essence in today's cybersecurity landscape? How are you quickly achieving vulnerability resolution?Identifying vulnerabilities should be part of the daily process within an organization. It's an important piece of maintaining an organization’s security posture. However, the complicated nature of modern technologies — and the pace of change — often make vulnerability management a challenging task.In the past, many organizations had to support manual integration work to get different security systems to ‘talk’ to each other. As…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…

Cost of a data breach 2023: Pharmaceutical industry impacts

3 min read - Data breaches are both commonplace and costly in the medical industry.  Two industry verticals that fall under the medical umbrella — healthcare and pharmaceuticals — sit at the top of the list of the highest average cost of a data breach, according to IBM’s Cost of a Data Breach Report 2023. The health industry’s place at the top spot of most costly data breaches is probably not a surprise. With its sensitive and valuable data assets, it is one of…

Cost of a data breach 2023: Financial industry impacts

3 min read - According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year. For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies…