[{"innerBlocks":[],"name":"core\/freeform","postId":127396,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

11 best practices for protecting connected medical devices<\/h2>
The Department of Health and Human Services, working with more than 150 healthcare and cybersecurity experts, has released a report, \u201cHealth Industry Cybersecurity Practices,\u201d to aid stakeholders in managing threats and protecting patients. The 36-page report, available here<\/a>, includes a section on attacks against connected medical devices that may affect patient safety. In distilling the guidance of the experts, HHS recommends the following 11 best practices to safeguard this sensitive equipment.<\/p>

Communication<\/h2>
Establish and maintain communication with medical device manufacturers\u2019 product security teams to ensure devices have the latest protection in the forms of patches and to ensure dialogue about threats.<\/p>

Patching<\/h2>
Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.<\/p>

Security controls<\/h2>
Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.<\/p>

Inventory<\/h2>
Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.<\/p>

Procurement<\/h2>
Implement pre-procurement security requirements for vendors, to ensure they\u2019re meeting your organization\u2019s minimum requirements for device and network security.<\/p>

Security assurance<\/h2>
Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.<\/p>

Security staff engagement<\/h2>
Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.<\/p>

Contract language<\/h2>
Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.<\/p>

Access controls<\/h2>
Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.<\/p>

Security operations<\/h2>
Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.<\/p>

Device network<\/h2>
Develop and implement network security applications and practices for device networks.<\/p>

","saveContent":"
11 best practices for protecting connected medical devices<\/h2>
The Department of Health and Human Services, working with more than 150 healthcare and cybersecurity experts, has released a report, \u201cHealth Industry Cybersecurity Practices,\u201d to aid stakeholders in managing threats and protecting patients. The 36-page report, available here<\/a>, includes a section on attacks against connected medical devices that may affect patient safety. In distilling the guidance of the experts, HHS recommends the following 11 best practices to safeguard this sensitive equipment.<\/p>

Communication<\/h2>
Establish and maintain communication with medical device manufacturers\u2019 product security teams to ensure devices have the latest protection in the forms of patches and to ensure dialogue about threats.<\/p>

Patching<\/h2>
Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.<\/p>

Security controls<\/h2>
Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.<\/p>

Inventory<\/h2>
Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.<\/p>

Procurement<\/h2>
Implement pre-procurement security requirements for vendors, to ensure they\u2019re meeting your organization\u2019s minimum requirements for device and network security.<\/p>

Security assurance<\/h2>
Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.<\/p>

Security staff engagement<\/h2>
Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.<\/p>

Contract language<\/h2>
Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.<\/p>

Access controls<\/h2>
Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.<\/p>

Security operations<\/h2>
Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.<\/p>

Device network<\/h2>
Develop and implement network security applications and practices for device networks.<\/p>

","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Patching<\/h2>Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.<\/p>

Security controls<\/h2>Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.<\/p>

Inventory<\/h2>Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.<\/p>

Procurement<\/h2>Implement pre-procurement security requirements for vendors, to ensure they\u2019re meeting your organization\u2019s minimum requirements for device and network security.<\/p>

Security assurance<\/h2>Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.<\/p>

Security staff engagement<\/h2>Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.<\/p>

Contract language<\/h2>Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.<\/p>

Access controls<\/h2>Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.<\/p>

Security operations<\/h2>Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.<\/p>

Device network<\/h2>Develop and implement network security applications and practices for device networks.<\/p>","saveContent":"

11 best practices for protecting connected medical devices<\/h2>

Patching<\/h2>Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.<\/p>

Security controls<\/h2>Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.<\/p>

Inventory<\/h2>Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.<\/p>

Procurement<\/h2>Implement pre-procurement security requirements for vendors, to ensure they\u2019re meeting your organization\u2019s minimum requirements for device and network security.<\/p>

Security assurance<\/h2>Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.<\/p>

Security staff engagement<\/h2>Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.<\/p>

Contract language<\/h2>Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.<\/p>

Access controls<\/h2>Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.<\/p>

Security operations<\/h2>Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.<\/p>

Device network<\/h2>Develop and implement network security applications and practices for device networks.<\/p>","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Patching<\/h2>
Install security and updated system patches on devices after the coded patches have been validated, distributed by the medical device manufacturer and properly tested.<\/p>

Security controls<\/h2>
Assess current security controls on networked medical devices to ensure they are working effectively and are not easily hackable.<\/p>

Inventory<\/h2>
Assess inventory traits, such as IT components, that may include the Media Access Control address, Internet Protocol address, network segments, operating systems, applications and other elements relevant to managing information security risks.<\/p>

Procurement<\/h2>
Implement pre-procurement security requirements for vendors, to ensure they\u2019re meeting your organization\u2019s minimum requirements for device and network security.<\/p>

Security assurance<\/h2>
Implement information security assurance practices, such as security risk assessments of new devices and validation of vendor practices on networks or facilities.<\/p>

Security staff engagement<\/h2>
Engage information security as a stakeholder in all clinical procurements that could involve linkages to clinical networks.<\/p>

Contract language<\/h2>
Use a template for contract language with medical devices manufacturers and others to ensure it provides sufficient requirements to protect the organization.<\/p>

Access controls<\/h2>
Implement access controls for clinical and vendor support staff, including remote access, monitoring of vendor access and minimum necessary or least privilege.<\/p>

Security operations<\/h2>
Implement security operations practices for devices, including hardening, patching, monitoring and threat detection capabilities.<\/p>

Device network<\/h2>
Develop and implement network security applications and practices for device networks.<\/p>

","saveContent":"

11 best practices for protecting connected medical devices

More for you