A Proactive Approach to Healthcare IT Security

Comment | Print | RSS

• Login to Rate

It used to be that software security was an afterthought in the healthcare industry. But HIPAA regulations have helped to bring the security topic to the forefront, and many healthcare IT managers are now placing security on an even plane with functionality.

For example, the University of Michigan recently announced that it is offering a new graduate-level course that specifically focuses on medical device security.

While this is a positive step in the right direction, it's hard to patch an already broken system. The real challenge occurs in assuring security across the full lifecycle of the software. Although software security may, indeed, be improved when an application is first deployed on a medical center infrastructure, it doesn't remain secure for long.

The real reason software security eventually fails is the outdated method for regulating medical software over the long haul. The process to recertify software after adding new security updates is tedious at best. Software companies find that it requires an inordinate amount of time and money to keep software security patches up to current standards.

What ends up happening is that software is developed, certified, and deployed, never to be updated again. There's not a great deal of profit involved in maintaining security, so it's often ignored. I've personally seen this occur on numerous occasions -- even with well-respected medical device companies. It's this combination of antiquated regulations and lack of interest by the software companies that creates an environment of lax security practices.

Additionally, it's common for healthcare device and application vendors to disallow third-party applications from being installed on these systems. This significantly limits what can be done to secure systems on an OS level, such as third-party anti-virus or software firewalls.

If you want to protect your organization from the latest vulnerabilities, the best defense is to physically or logically separate weak systems, providing an added layer of security. Fortunately, there are a couple different methods that can be used to proactively protect insecure health systems.

One way around this is to deploy small hardware-based firewalls between these systems and the rest of the network. Many enterprise-class networking companies offer low-cost firewalls that can be deployed in a bridged, or transparent mode. This means that the firewall can be deployed without any reconfiguration or re-addressing being needed. This is especially useful if a medical device regularly moves from one location to another.

An alternative to providing hardware point-based solutions for vulnerable health systems is to create separate, secure DMZ areas. By leveraging today's modern, virtualized firewall solutions, it's fairly easy to create multiple, logical DMZs. These effectively quarantine unpatched systems so they can't affect the rest of the network if they become compromised. While this may create a complex infrastructure, it often is necessary in order to quarantine specific systems that don't meet a minimum level of security.

A renewed interest in medical device security is a positive step toward safe healthcare software in the future. But securing software for deployment on day one is only part of the challenge. The real issue is continuing security measures throughout the lifecycle of the system. Because of problems within the industry, IT managers must take a proactive approach to securing software themselves.