We know medical devices are exposed to the Internet both directly and indirectly, so just how hard is it to take it to the next step in an attack and gain remote administrative access to these critical life saving devices? We will discuss over 30 CVE’s Mr. Erven has reported over the last few years that will demonstrate how an attacker can gain remote administrative access to medical devices and supporting systems. Over 100 remote service and support credentials for medical devices will be presented.
So is an attack against medical devices a reality or just a myth? Now that we know these devices have Internet facing exposure and are vulnerable to exploit, are they being targeted? We will present six months of medical device honeypot research showing the implications of these patient care devices increasing their connectivity, and steps that can be taken to reduce risk associated with these life saving devices.
- Understand lack of security hygiene embedded in medical devices
- Understand current attack vectors and real world attack scenarios
- Learn how to address security by looking at the lifecylce
About Scott Erven
Scott Erven is an Associate Director at Protiviti. He has over 15 years of information security and information technology experience with subject matter expertise in medical device and healthcare security. Scott has consulted with the Department of Homeland Security, Health and Human Services, Food and Drug Administration and advised national policymakers. His research on medical device security has been featured in Wired, Forbes, BBC and numerous media outlets worldwide. Mr. Erven has presented his research and expertise in the field internationally. Scott also has served as a subject matter expert and exam writer for numerous industry certifications. His current focus is on research that affects human life and public safety issues inside today’s healthcare landscape.
About Adam Brand
Adam Brand has more than 12 years’ experience in information technology and security. He is an Associate Director with Protiviti, where he has assisted companies in resolving major security incidents and maturing their information security programs. Adam has been heavily involved with the “I am The Cavalry” movement, a group of researchers focused on information security issues that can affect human life and safety. He has recently focused on medical device security and is actively engaging with healthcare organizations on this issue.