Biomedical devices and systems security

Abstract

Abstract-Medical devices have been changing in revolutionary ways in recent years. One is in their form-factor. Increasing miniaturization of medical devices has made them wearable, light-weight, and ubiquitous; they are available for continuous care and not restricted to clinical settings. Further, devices are increasingly becoming connected to external entities through both wired and wireless channels. These two developments have tremendous potential to make healthcare accessible to everyone and reduce costs. However, they also provide increased opportunity for technology savvy criminals to exploit them for fun and profit. Consequently, it is essential to consider medical device security issues.In this paper, we focused on the challenges involved in securing networked medical devices. We provide an overview of a generic networked medical device system model, a comprehensive attack and adversary model, and describe some of the challenges present in building security solutions to manage the attacks. Finally, we provide an overview of two areas of research that we believe will be crucial for making medical device system security solutions more viable in the long run: forensic data logging, and building security assurance cases.

Attack-Graph Threat Modeling Assessment of Ambulatory Medical Devices

“…The second type of adversaries, passive, eavesdrop for the purposes of acquiring private data stored in a device. They also note four classes of targets that adversaries attack within medical device systems: patient physical security, patient data security (privacy), medical device physical security, and data security of the health-care institution that deploys the device [26]. Burleson et al [20] note that threat modeling is vital to assessing the security vulnerabilities to medical devices, and the risk posed by the vulnerabilities varies along with the nature of the data or the ramification of actuation.…”

“…Arney et al [26] state that adversaries who attack medical devices can be classified into two categories, active and passive. Active adversaries have the ability to spy on communications among devices, network controllers and supervisors.…”

A Study into Detecting Anomalous Behaviours within HealthCare Infrastructures

“…These devices have the potential to be tampered with, reprogrammed by unauthorized users or subject to device-specific hazards [5]. Devices can be targeted though their firmware upgrades or through connections to the network interface when connected through remote attacks, in addition to local attacks.…”

“…Security is crucial for the long term viability of all types of networked medical devices [5]. These devices have the potential to be tampered with, reprogrammed by unauthorized users or subject to device-specific hazards [5].…”

Generalized Attack Model for Networked Control Systems, Evaluation of Control Methods

“…And in the area of biomedical devices the issue of security of these devices has been increasingly critical because the development trend of these devices will connect them to other entities through both wired and wireless channels. It is therefore important to consider medical device security issues [12].…”