Through partnerships, Main Line Health implemented a real-time risk management platform for adding new medical devices to the network. If a device presents a threat, Weismann’s team can isolate it from communicating with other devices and sandbox it. Such devices can still communicate with the internet but not with the internal network.
Going forward, Weismann plans to ensure that devices touching any open port are authenticated so the organization can prevent a potential compromise from a local attack.
“We were very focused on remote attacks with the strategy we’ve taken, and now we’re pivoting to look more locally as well,” Weismann says.
Michigan Medicine Maintains Device Visibility Amid Mergers
The University of Michigan Health (Michigan Medicine) experienced a number of mergers in recent years, which presented a pressing challenge to gain visibility to tens of thousands of devices in an ever-growing ecosystem. In 2018, it joined with Metro Health (now University of Michigan Health-West) and in 2024, Sparrow Health was brought into the fold.
Michigan Medicine uses tools to assign a vulnerability score for devices such as MRI machines and smart TVs. Threat intelligence allows the school to better determine the criticality of vulnerabilities, says Greg Sieg, CISO for the University of Michigan Regional Health Network, which includes the community hospitals UM Health-Sparrow in Lansing and UM Health-West in Grand Rapids.
The ServiceNow platform helps manage device inventory, and segmented networks keep medical technology separate from consumer-grade devices. Cisco’s Identity Services Engine (ISE) automates some of Michigan Medicine’s network segmentation and determines if a device should be allowed on the network. It can move a device such as an infusion pump to the correct virtual network in the organization to secure it, Sieg says.
RELATED: Clinical care resilience ensures healthcare business continuity when IT fails.
“It does all that automation on the back end, and it doesn’t matter where I plug it into a switch,” Sieg adds. “As long as the switch has ISE enabled, it’s going to do that.”
If a patient unplugs an infusion pump and plugs in an Xbox console instead, for example, the port will shut down, Sieg explains.
Legacy devices are also segmented, he adds: “As we find devices, we get them moved over to where they need to be.”
Industry threat intelligence enables the health system to pinpoint which devices to prioritize for patching, Sieg says, along with information from federal agencies. Managing edge devices is an ongoing process, so the health system continues to evaluate partners for its next steps.
Luminis Health Guards Against Edge Device Vulnerabilities
Maryland-based Luminis Health has more than 100,000 devices on its network, says Virtual CISO Jason Taule. That’s a lot of vulnerable endpoints to manage.
“Hospitals are a fairly permissive environment due to the nature of our mission, allowing patients and their families in, but as soon as I find out a device doesn’t belong, we’ve got to get it out of there,” Taule says.
Another key challenge is avoiding a prolonged outage, Taule says. “We are laser-focused on downtime, prolonged outages, because that inhibits our ability to serve our patients.”
Managing legacy edge devices can present its own set of issues, especially when acquiring new services. When Luminis Health was buying a blood chemical analyzer from a medical device company, it discovered that the solution was running on a long-unsupported Windows CE operating system, Taule says.
“The U.S. Food and Drug Administration process is flawed, because you don’t have to go through a new certification if you don’t change your product, giving companies no incentive to update an old, unpatched, vulnerable thing,” Taule says. “I couldn’t defensively put that on my network.”
Click the banner below to sign up for HealthTech’s weekly newsletter.
