23% of connected healthcare devices vulnerable to attack

By Dylan Bushell-Embling
Wednesday, 13 March, 2024

23% of connected healthcare devices vulnerable to attack

Nearly one in four (23%) medical devices used in healthcare settings and connected to healthcare organisation networks are vulnerable to attack by hackers, according to a new report from IoT security company Claroty.

The report found that despite the healthcare sector being the most targeted industry in Australia for cyber attacks, hospitals have not taken the required steps to address known vulnerabilities.

An analysis of the networks of healthcare organisations such as hospitals and clinics discovered 63% of all known exploited vulnerabilities tracked by the US Cybersecurity and Infrastructure Security Agency on those networks, the report states. It found that 23% of medical devices, including imaging devices, clinical IoT devices and surgery devices, have at least one such vulnerability.

In addition, 22% of hospitals have connected devices that bridge guest networks such as those for patients and visitors with internal networks, creating a dangerous attack vector. Perhaps most concerningly, 4% of surgical devices communicate on guest networks.

The report also found that 14% of connected medical devices are running on unsupported or end-of-life operating systems. Of these, 32% are imaging devices and 7% are surgical devices.

Finally, the research found that a high proportion of medical devices with a high consequence of failure, including defibrillators, robotic surgery systems and defibrillator gateways, are remotely accessible. This also includes 66% of imaging devices, 54% of surgical devices and 40% of patient devices.

Claroty VP of Research Amir Preminger said the findings show that the connectivity revolution in healthcare settings has been a double-edged scalpel.

“Connectivity has spurred big changes in hospital networks, creating dramatic improvements in patient care with doctors able to remotely diagnose, prescribe and treat with a never-before-seen efficiency,” he said. “However, the increase in connectivity requires proper network architecture and an understanding of the exposure to attackers that it introduces. Healthcare organisations and their security partners must develop policies and strategies that stress the need for resilient medical devices and systems that can withstand intrusions. This includes secure remote access, prioritising risk management and implementing segmentation.”

The report, State of CPS Security Report: Healthcare 2023, can be found here.

Image credit: iStock.com/Caiaimage/Martin Barraud

Related News

World-first 'Cybercrime Index' ranks countries by threat level

The first ever World Cybercrime Index identifies the globe's key cybercrime hotspots by...

Careless employees cause 80% of Australian data losses: report

While organisations are investing in DLP solutions, a report by Proofpoint shows that those...

Intercede launches MyID MFA 5.0

Intercede has introduced a range of enhancements to its MyID MFA multi-factor authentication...

  • All content Copyright © 2024 Westwick-Farrow Pty Ltd