Read on Twitter
Today the final report of the @BSI_Bund project #ManiMed was published in which we at #ERNW as contractor examined medical devices for security vulnerabilities.
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/DigitaleGesellschaft/ManiMed_Abschlussbericht_EN.pdf?__blob=publicationFile&v=3
https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/DigitaleGesellschaft/ManiMed_Abschlussbericht_EN.pdf?__blob=publicationFile&v=3
Vulnerabilities in IT systems can exist at any given time. Security vulnerabilities in networked medical devices are usually of great concern as their exploitation could have an impact on patient safety or on their environment, e.g. hospital network.
This project’s objective is to assess the current state of the IT security posture for network-connected medical devices that have recently been approved for the German market and IT security-related processes.
Since the German market of connected medical devices has grown over the last years, a market analysis was performed to identify relevant medical devices for the assessment.
These four constraints/requirements have to be met for devices subjected to IT security assessments apart from the fact that the selected device categories are dependent on high security postures due to their impact on #patientsafety.
The selected devices were evaluated in an IT security assessment. The identified vulnerabilities were responsibly disclosed. The project partners worked closely together with the manufacturers to ensure a timely fix for the more than 150 vulnerabilities.
Some of the respective vulnerabilities and @ICSCERT advisories are already public. Others will follow in the near future.
Examplarily, our #ERNW White Paper 69 – "Safety Impact of Vulnerabilities in Insulin Pumps" shed light on the vulnerabilities identified for the Dana Diabecare RS insulin pump. https://insinuator.net/2020/09/white-paper-69/ via @Insinuator
Further, we already published a blog post concerning HL7v2 Injections in Patient Monitors. https://insinuator.net/2020/04/hl7v2-injections-in-patient-monitors/ via @Insinuator
ICS Medical Advisory (ICSMA-20-254-01): Philips Patient Monitoring Devices. September 10, 2020. Online: https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01
ICS Medical Advisory (ICSMA-20-296-02): B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus. October 22, 2020. Online: https://us-cert.cisa.gov/ics/advisories/icsma-20-296-02
ICS Medical Advisory (ICSMA-20-296-01): B. Braun OnlineSuite. October 22, 2020. Online: https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01