USB drives should be scanned first for any malicious codes that could cause non-targeted attacks.
In their recently published guidelines for assessing risks in machine learning applications for medical devices, the Association for the Advancement of Medical Instrumentation (AAMI) and the British Standards Institution outlined strategies for addressing nontargeted cyberattacks, malware created by attackers with no specific target that can be installed randomly on any device.
These attacks often originate from either a home computing environment, or specifically from medical device updates, and are difficult to statistically model. When hit with a nontargeted attack it is almost impossible for the manufacturer to estimate the number of infected USB drives, or the number of healthcare organizations that have the resources to block downloads from these USB drives, according to the guide.
AAMI recommends adopting the Common Vulnerability Scoring System, a free and open industry standard for evaluating vulnerability severity in computer systems, and threat modeling as part of qualitative and semi-quantitative methods for determining the likelihood of nontargeted attacks.
For postmarket cybersecurity scenarios, it recommends that risk management processes question how exploitable these vulnerabilities are, and the risks and harm they pose to patients if exploited.
In a 2021 study, The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel, Stephen Grimes, a managing partner and principal consultant at Strategic Healthcare Technology Associates, and Axel Wirth, chief security strategist for MedCrypt, warn to scan memory devices, like USBs, for malicious codes that cause nontargeted attacks before connecting them to devices.
“Media should not be attached to or installed on a device without first scanning with a security application with up-to-date malware definitions to ensure the media is free from malicious code. Some organizations may choose to limit the use of external storage to sanctioned devices,” they wrote.
AAMI was unable to respond to HCB News’ questions in time for the publication of this article.
