Gartner recently published an eye-popping opinion piece, one that got me thinking about the many issues facing Healthcare Delivery Organizations (HDO). Sometimes it is easy to point to the problems and not offer any helpful information on how to solve the challenge. I appreciated Gartner’s concise summation of the issue and clear action steps to help remediate the problem. If you have not read their opinion, you can find it here.
In short, Gartner alarmingly claims that bad actors will weaponize Operational Technology (OT) to seriously harm or even kill someone in the next few years. While OT exists in many different industries, with highly variable levels of complexity, the threat to Healthcare from this claim is immediately understood, as patients come to our HDO’s for care in their time of need. Healthcare is uniquely challenged with OT and the Internet of Medical Things (IoMT), as so many of these devices are directly involved in patient care. Having an IV Pump weaponized is unthinkable, so we must do everything necessary to prevent this. In addition to the devices, organizational complexity also creates an environment that makes a device security strategy hard to implement. The primary difficulties are the siloed operations responsible for isolated portions of IoMT & OT security and the myriad of devices that connect to the HDO network.
It is an emotional headline to read that someone may be seriously hurt or killed because of an attack on OT or IoMT, and it demands readers pay attention, which I certainly did! I kept coming back to a singular thought; this cannot happen on our watch. As I processed Gartner’s opinion and valuable recommendations, I found myself thinking about why Medigate exists as a company, how we partner with our customers to solve many of the challenges that Gartner outlines, and future steps we must take to prevent this from happening in Healthcare.
Medigate exists to be a verticalized platform that orchestrates and augments an HDO’s entire security program. We solely focus on the Medical IoT & OT space since our inception, and we have helped a rapidly growing number of HDO’s with this process, learning many valuable insights along the way. With this deep history of Healthcare devices and procedures, it becomes clear that most of the recommendations Gartner makes align with our strategy.
As we know, proper security involves the right people, processes, and technology, and there is no singular product that will alone make a system secure after deployment. While Medigate brings much value to Healthcare IT, Security, and Clinical Engineering, it is the challenge of bringing these groups together that separates those HDO’s that are committed to solving this challenge from those that are chaotically attempting to secure their environment. In this way, Gartner’s recommendations are valuable since they help guide an organization’s strategic framework for OT & IoMT, so I wanted to comment on four of them.
Defining Roles & Responsibilities: Every great strategy implementation starts with the groups responsible for execution understanding how they all fit together. In this way, HDO’s internal groups must find ways to work cross-functionally to prevent adverse outcomes from OT & IoMT deployments. Each group within the HDO brings a valuable level of expertise, so as long as the common goal is clearly defined, the wider cross-functional group can effectively work together.
Have an Up-to-Date Asset Inventory: Before you can secure it, you must know it is connected to the network! Asset Inventory in Healthcare is a challenge, but it is not impossible, even with a wide variety of unique devices. Providing the underlying visibility of devices and things on the network is what Medigate does and is why we are rapidly growing; we make device profiling easy and accurate.
Establish Proper Network Segmentation: Once the devices are known and visible, the hard work of Network Segmentation can begin, so each connected device and thing can utilize only allowed network resources and be prevented from all others. While not easy, this is one of the best tools against the threat Gartner describes.
Formal Patching Process: Once issues are known for devices and things, they must be patched and updated as fast as possible. With Medigate Labs, we consistently monitor the major medical device manufacturers for critical vulnerabilities and the broader threat landscape to ensure we advise our customers of any known issues they should remediate. Patching is simplified if the HDO can know what devices are affected by a problem and where they are in the facility, which Medigate empowers our customers to do.
As I said earlier, this opinion piece from Gartner got my mind moving. The overwhelming thought is that we cannot allow this outcome, namely harm to a person, to occur in our HDO’s because of our OT & IoMT strategy. Solving this issue is why Medigate exists, so let’s get to work together.
To discuss this in more detail, please reach out to us at contact@medigate.io
