You may recall this blog post from March 2020. It highlighted the importance of factoring in clinical, organizational, financial and regulatory impact when determining which medical Internet-of-Things (IoMT) security vulnerabilities should be fixed first. Consider this post a part two. Whereas the previous post focused on the fact that IoMT devices are here to stay and finding and prioritizing vulnerabilities based on impact cannot be overlooked, this post highlights an up and coming security challenge.

Interconnected Devices Need Interconnected Risk Measurement

The healthcare system today uses various security technologies for connected devices, many of which assign a risk score to vulnerabilities. The score is meant to help hospital security teams understand and prioritize vulnerabilities that elevate risk. Those technologies, however, use different formulas to calculate the risk score. Furthermore, they are often focused on technical risk rather than the clinical impact on the hospital in terms of patient safety or disruption of a physician’s workflow.

For example, while some scanning tools provide a score based on the Common Vulnerability Scoring System (CVSS), medical device security platforms (MDSPs) monitor what devices are doing, collect data, apply machine learning, build behavioral models and calculate a risk score. Both technologies view risk through a technical lens.

The U.S. Food and Drug Administration (FDA) also has its own health care device classification formula. It focuses on a vulnerability’s associated exploit, what an attacker can do with the exploit and the potential harm that can be done. Again, these elements are viewed through a technical lens, not including the clinical impact on the hospital.

Three challenges arise with these scoring technologies. First, they do not consider clinical impact. Second, while scanner scores, MDSPs and FDA classification are all important pieces of information for determining risk, it is difficult for hospitals to know which score to use as a blueprint for vulnerability prioritization and remediation. Lastly, each MDSP and scanning tool uses different risk-calculating methodologies, which is why there is no standard model for prioritizing vulnerabilities within the field.

With a system like this, prioritization is unnecessarily fragmented.

One Recipe for Calculating Risk

Hospitals need one view of risk that merges the technical risk scores and the clinical impact that would take place if a device is compromised. In other words, throw MDSP, scanning, FDA classification and clinical impact data into a soup pot, add seasoning (enrich the data), and voila. With that recipe, healthcare providers can see which vulnerabilities pose the highest risks to patient safety, so they know where to start with remediation.

Security teams can also apply this approach beyond IoMT devices. Other connected devices within the healthcare environment, such as workstations, network infrastructure and even coffee makers — anything that connects to the hospital’s network — should also be scored and prioritized based on a singular recipe for calculating risk. Scanning tools and MDSPs will assign risk scores in any network-connected device. Those technical scores should be merged along with a clinical impact score to determine which vulnerabilities matter most. That uniform way of scoring can help drive the remediation process by understanding the clinical workflow context of each endpoint detected across a hospital network.

Learn how X-Force Red, IBM Security’s team of hackers, in partnership with The AbedGraham Group, a physician-led global security organization, are working to help hospitals overcome the problems of siloed and incomplete risk scoring that they face today. Together, they have developed a solution to merge technical risk scoring data with clinical impact data to identify the vulnerabilities that matter most.

More from Data Protection

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today