Palo Alto Networks, a global provider of IT security solutions, examined 200,000 networked infusion pumps. This revealed that their outdated equipment makes them highly vulnerable to attacks from the network.
Table of Contents: What awaits you in this article
Infusion pumps: critical infrastructure
The American security experts focused their evaluation on infusion pumps in particular because they are among the most widespread networked devices in the healthcare segment. Accounting for 44 percent of all medical equipment, they now form a critical infrastructure. The larger the therapeutic facility in question, the more extensive its inventory of infusion pumps tends to be. Some hospitals, for example, have thousands of them.
Attack target: outdated technology
It is all the more worrying when this essential basis of medical care is in use for long periods without being updated. Machines that automatically deliver infusion solutions to human bodies can easily have a lifespan of ten years or more. And true to the motto, what isn’t broken doesn’t need to be repaired, the systems are rarely updated at these intervals. This is a practice that can have serious consequences.
Two thirds of the devices are unsecured
In the analysis mentioned above, it was found that 75 percent of the pumping equipment examined had glaring safety deficiencies. Between 40 and 70 gaps were identified, making it easier for attackers to gain access to cause a variety of problems.
Huge potential for abuse
According to the experts, this vulnerability offers a potential for abuse that can hardly be underestimated. Not only could important and sensitive data of patients and institutions be easily siphoned off through these gaps. Manipulation of the devices is also quite conceivable. The administration of drugs could be interrupted, overdosed or underdosed by external intervention. But shutdowns of entire facilities by networked technology are thus also conceivable.
Human factor as a problem area
As mentioned earlier, many medical facilities tend not to keep their vital medical equipment constantly up to the latest and best possible technical standard that would be possible. Beyond that, however, there is another problem that makes it too easy for criminals to infiltrate or even take over entire systems. We are talking here about the use of credentials.
Inadequate access controls
Medical staff, who are not infrequently under massive time pressure and constantly affected by overload, tend to use insecure access. Instead of changing their credentials at regular intervals, they use passwords that are not only easy to crack. The Palo Alto analysts found that in many cases employees simply used the combinations created by the manufacturers of the devices. This is problematic insofar as these standard logins can be found out by simple searches in the network.
