Hacking humans: A case study and analysis of vulnerabilities in the advancing medical device landscape

This paper analyses the findings and trends of discovered vulnerabilities in medical devices enabled with ‘smart’ technology. With today’s medical devices often being connected to the Internet or to an external monitoring source, the risks to people’s health increase. This paper suggests a path to mitigating known vulnerabilities to enable better informed healthcare decisions. The paper will first set the landscape discussing medical devices which enable connectivity and incorporate software, which causes increased cyber vulnerability. Secondly, it details how medical device recalls increased, due to software issues and vulnerabilities, which recalls were based on weaknesses discovered by government security entities and academic institutions. Third, the paper highlights the devices most at risk, which include implantable cardioverter defibrillators (ICDs)/pacemakers, infusion pumps, and magnetic resonance imaging (MRI) machines. Fourth, the cyber security vulnerabilities trends will be discussed with the corresponding health safety concerns. Finally, the government response in terms of risk mitigation guidance will be identified, to include a vulnerability scoring system which assesses impact and risk of exposure. The paper concludes with supporting a broader adoption of the health risk mitigation scoring system to achieve a diminished health risk of utilising connected medical devices.