Forgot your password?
typodupeerror
Government Medicine Security United States Technology Your Rights Online

DHS Steps In As Regulator for Medical Device Security 123

Posted by timothy
from the handicapper-general dept.
mask.of.sanity writes "The Department of Homeland Security has taken charge of pushing medical device manufacturers to fix vulnerable medical software and devices after researchers popped yet another piece of hospital hardware. It comes after the agency pushed Philips to move to fix critical vulnerabilities found in its popular medical management platform that is used in a host of services including assisting surgeries and generating patient reports. To date, no agency has taken point on forcing the medical manufacturers to improve the information security profile of their products, with the FDA even dubbing such a risk unrealistic (PDF)."
This discussion has been archived. No new comments can be posted.

DHS Steps In As Regulator for Medical Device Security

Comments Filter:
  • by gstoddart (321705) on Thursday January 17, 2013 @10:29AM (#42616109) Homepage

    It seems the DHS keeps expanding its mandate into ever broader areas.

    And, quite frankly, that's a little creepy -- it's becoming this vast umbrella which has control over everything.

    • Re: (Score:2, Interesting)

      by logjon (1411219)
      Seen this yet? [dhs.gov]
      • Re: (Score:3, Informative)

        by Bam_Thwok (2625953)
        What exactly do you think this means? Did you actually read any of the reports? The DHS joined almost all other federal agencies in making it policy not to fuck over the health or environment of low-income populations as part of their operations. E.g. if the coast guard wants to test the effects of a new chemical dispersant for oil spills, this policy directs them to do it somewhere other than a lower-income fishing village in Louisiana. Or if the nuclear regulatory commission wants to build a site to dis
      • by Anonymous Coward
        Has slashdot become so partisan that a guy posting a link gets modded to 0 or worse now? He's absolutely on topic with this as whether you agree or disagree with the POLICY, DHS should have zero roll in it.
    • by Anonymous Coward on Thursday January 17, 2013 @10:38AM (#42616175)

      It was assigned to the wrong DHS... this should fall under the Department of Health and Human Services (HHS [hhs.gov]). Someone needs to tell a director that Homeland Security is stealing a project that should be theirs (i.e. taking their power).

      • by timeOday (582209) on Thursday January 17, 2013 @11:47AM (#42616883)
        What does HHS or FDA know about computer security? Nothing. It is a technical niche. Trying to independently stand up a computer security audit group within every niche of government just because they all use computers is crazy.

        As for DHS covering too many things.... DHS isn't really anything in itself. It's just an umbrella created after 911 to try and make connections between what where (and still are for the most part) essentially independent organizations that suffer from too much redundancy and tribalism. (Which is not to say the DHS is necessarily doing a good job of solving these problems).

        • As it's inevitable that more and more health-care products will contain electronics of sorts, shouldn't HHS or FDA acquire some expertise in this field? If it were a "one off" situation, yeah, I'd agree with you.
          • by icebike (68054)

            You are sort of feeding the trolls here, because the GPs original premise that FDA or HHS knows nothing about computer security is simply bogus flamebait.

            I agree that those two agencies should improve their expertise rather than allowing a bunch of external security freaks stepping in between the Doctors and their tools. The expertise should be in-house, and tailored to the other systems used in hospitals. Handing this task to an outside umbrella agency is like having every mom calling the sheriff to enforc

        • I thought the NSA was responsible for computer security, not the DHS.
          • Information Assurance. You aren't wrong, but it's a slightly better term.

            Computer security is something you do as a subset of working towards information assurance.

          • by timeOday (582209)
            This is where technical considerations and political considerations collide. The NSA has high-end capabilities, but is a spy agency that has always been explicitly prohibited from targeting the US. Just as we created the FBI to police ourselves vs. the CIA to police the world. Here is an article [wired.com] on the subject. Personally I do not think we should turn the NSA loose on ourselves. But admittedly in the case of computer security it can be extremely difficult to even determine whether a threat is foreign o
            • Let me rephrase... I thought that the NSA, in addition to whatever domestic or foreign intelligence gathering functions it may or may not have, was the government's go-to agency for providing guidelines, tools, and equipment for securing computers and data communications facilities. ie, if you want to secure a facility, follow NSA guideline X.
        • by rickb928 (945187)

          Remember the Therac-25 [wikipedia.org]? No, probably not.

          This happened in the late 80s, a radiation thereapy device had some unfortunate software problems and causes 6 accidents, some fatal. the FDA investigated then.

            NO reason they can't investigate now. Software is software. Grow some expertise.

          • by timeOday (582209)
            I disagree that "software is software." Everything changes in adversarial situations, where you are combatting adaptive, intelligent adversaries. The regulatory regime that is good for safeguarding against flaws in medical devices such as Therac-25 is not appropriate for the day-to-day operations of staying on top of computer security threats.
            • by sycodon (149926)

              Al Qaeda is going to kill us all...one by one, with an X-ray machine...by appointment.

        • by drinkypoo (153816)

          What does HHS or FDA know about computer security? Nothing. It is a technical niche.

          What does the DHS know about computer security? Even less.

          You don't have to know these things, you hire them in. Now, the issue of whether our government will do that based on merit or more likely not is a good point to raise, but it's a separate problem from not having the experience in-house already.

          • by nbauman (624611)

            What does HHS or FDA know about computer security? Nothing. It is a technical niche.

            What does the DHS know about computer security? Even less.

            You don't have to know these things, you hire them in. Now, the issue of whether our government will do that based on merit or more likely not is a good point to raise, but it's a separate problem from not having the experience in-house already.

            How can you hire, and manage, security experts if you don't know something about security yourself? What's a "security expert"? I know a guy who was a prosecutor for a while, then went looking for jobs as a corporate security consultant. Do you just hire an ex-cop? An ex-FBI agent? An ex-hacker? Do you take it on faith that they know what they're doing?

            Years ago, government agencies developed in-house computer expertise, and they did a pretty good job. The VA hospitals developed VISTA, which is a better med

        • Anyone doing that today should understand security. If they can't, then they can get help from NIST and/or NSA, or outsource it and make the device maker pay a specialist for an audit.

        • by nbauman (624611)

          One of the big jobs of the FDA is to screen through millions of accident reports to find the few that are actually relevant to safety.

          I've reviewed FDA accident reports. Out of 200 reports on medical lasers, I might find 100 about the hinge on a door to the cabinet being broken, or "malfunctions" of that nature. There might be one report about a serious incident, in which a patient was injured because a cotton swab caught fire or something.

          One of the big jobs of the FDA is to screen through those accident r

          • by TubeSteak (669689)

            DHS does a notoriously bad job of screening through millions of potential threats and figuring out which are the real threats. They're like a smoke alarm that continually gives false alarms until people ignore it.

            What does your comment have to do with the conversation at hand?
            This isn't a false alarm, there is no need to "balance the risks and costs against the benefits."
            The DHS is being handed weaponized computer exploits and ideally they're going to turn around and say "You. Manufacturer. Fix it."

            CERT (Computer Emergency Readiness Team) is under DHS, and I don't thing anyone could reasonably argue that reports of computer exploits should go to the FDA or the Dept of Health and Human Services, just because they're

            • by nbauman (624611)

              DHS does a notoriously bad job of screening through millions of potential threats and figuring out which are the real threats. They're like a smoke alarm that continually gives false alarms until people ignore it.

              What does your comment have to do with the conversation at hand?
              This isn't a false alarm, there is no need to "balance the risks and costs against the benefits."
              The DHS is being handed weaponized computer exploits and ideally they're going to turn around and say "You. Manufacturer. Fix it."

              The DHS is being handed theoretical attacks which have never been used in the real world. The problem is to figure out whether these are realistic problems, and what the priority is for dealing with them.

              It may be possible that somebody could hack into an insulin pump. Nobody has ever done so. It's hard to imagine why somebody would want to. Nobody could make any money doing it. Nobody could accomplish a political goal by doing so. It's not like a bank where somebody could transfer money. So it is a false a

    • by rainmayun (842754)
      if I had mod points, I'd mod this up to 10. and I'm saying this as a former contract employee who did work for a DHS agency.
    • Maybe we should rename them.... Umbrella Dept? I know, I know, cheap shot.

    • by Sarten-X (1102295) on Thursday January 17, 2013 @11:08AM (#42616423) Homepage

      Personally, I think this is a good thing. Now to just neuter them, and we'll be set.

      My current job (IT admin in the financial sector) involves a fair bit of security work. A natural understanding of security is stunningly absent, even in places where security should be one of the highest concerns. Someone building an accounting program won't think about encrypting their data, because they're trained in accounting, not security. Someone programming a radiation therapy machine [wikipedia.org] won't think about hardware interlocks, because they're trained in programming software, not hardware safety.

      Network-connected medical devices are becoming prevalent, and I expect they will only get more useful and necessary in time. They present opportunities for doctors, and hospital managers are trained in hospital management, not security.

      I like seeing someone bringing a security-conscious mindset to the public. The DHS certainly wouldn't be my first choice, but they're better than not having anybody. Now if only we could get Bruce Schneier as Secretary...

      • by sycodon (149926)

        Someone building an accounting program won't think about encrypting their data, because they're trained in accounting, not security.

        Actually, they would probably reject it out of hand because it's terrible slow and a maintenance nightmare.

    • by bbelt16ag (744938)
      OH! thats who its trying to be! Umbrella Corp... er wait wasn't they the bad...
    • by ArhcAngel (247594)
      Although crass our FP AC wasn't so far off base. Also, does Godwin's law apply when the comparison is justifiable? While we're at it, does Bettridge's law of headlines only apply to headlines?
    • Pretty scary that a government department that nobody ever heard of pre-9/11 now has such power.
      • by blueg3 (192743)

        ...a government department that nobody ever heard of pre-9/11...

        You're joking, right?

    • by blueg3 (192743)

      DHS has actually been one of the major government organizations for computer security for quite a while. US-CERT, for example, is a part of DHS.

    • by westlake (615356)

      It seems the DHS keeps expanding its mandate into ever broader areas.
      And, quite frankly, that's a little creepy -- it's becoming this vast umbrella which has control over everything.

      Well, yeah.

      That is sort of the point of the thing.

      The reason we have a consolidated Department of Defense (created ca. 1947-1949) is because of the absurd and damaging inter-service rivalries that became very visible in World War II.

      The United States Department of Homeland Security (DHS) is a cabinet department of the United States federal government, created in response to the September 11 attacks, and with the primary responsibilities of protecting the United States of America and U.S. territories...from.. terrorist attacks, man-made accidents, and natural disasters.
      DHS is the equivalent to the Interior ministries of other countries. An interior ministry (sometimes ministry of home affairs) is a government ministry typically responsible for policing, national security, and immigration matters.

      United States Department of Homeland Security [wikipedia.org], Interior ministry [wikipedia.org]

    • by Shivetya (243324)

      they were down here for the NFL playoffs with other agencies to bust people for fraudulent NFL gear, I kid you not.

      • they were down here for the NFL playoffs with other agencies to bust people for fraudulent NFL gear, I kid you not.

        That isn't quite as insane as it sounds. My guess is that most of the unlicensed merchandise is imported, and customs falls under DHS. Of course, you're free to feel that they shouldn't be spending the resources on unlicensed merchandise, but if anyone is going to enforce it, it would be DHS.

      • Well, they directly fund terrorism with the profits from fraudulent trademarked/copyrighted products.

        Fact!

    • by Seumas (6865)

      Like every government agency, once they're formed, their goal is to become as big and expensive as possible to justify their existence.

    • by sycodon (149926)

      I had an x-ray just the other day and some creepy dude in a Blue uniform tried to feel me up.

  • Nuance (Score:5, Funny)

    by Toe, The (545098) on Thursday January 17, 2013 @10:30AM (#42616121)

    Technology in hospitals? Good.

    Internet-connected technology in hospitals? Why?

    Sure, people in hospitals need information, but surely something which is assisting in the physical process of a surgery (etc.) doesn't need to be in the cloud, does it?

    The cloud can be cool, but be reasonable. Why not put the operations of the CIA into Salesforce.com while we're at it?

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      But as we have seen, even isolated SCADA devices are getting infected. Isolation is not enough. The devices need to be fixed, and new ones created with security in mind.

      • by sinij (911942)
        Isolated SCADA? When? If you refer to Iranian nuclear program, they weren't properly isolated. They just weren't connect to the internet so USB was used as a vector.
        • by guruevi (827432)

          You can convince someone to write the binary code of a program in notepad if it means they get to see Anna Kournikova's titties.

    • Naked in the cloud is a bad idea, VPN'ed on the common internet infrastructure has real tangible benefits in infrastructure costs.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        Naked in the cloud is a bad idea,

        And there are pictures of me to prove it.

    • Re:Nuance (Score:5, Interesting)

      by Tha_Big_Guy23 (603419) on Thursday January 17, 2013 @11:10AM (#42616439)

      Sure, people in hospitals need information, but surely something which is assisting in the physical process of a surgery (etc.) doesn't need to be in the cloud, does it?

      As someone who works for a company that writes medical systems software, I can tell you that at the very least the systems need network connectivity so that the different systems can consolidate data in one place for examination. The problem is that any network connected device is potentially vulnerable to random Joe plugging a laptop into the network and hacking away.

      To illustrate why that's bad, I've run into situations in which a client site (read: Hospital) outright prohibited using SSL/TLS on their servers. They deemed their internal network secure and refused to budge on allowing secure communications between the clients and the servers. Authentication information should always be encrypted and some administrators just don't get that.

      As a whole, I think the medical technology industry needs someone to force tighter security requirements on software developers and medical sites as a whole. This is a good thing in my opinion. If that appropriate someone is the DHS may require a different discussion, but some government body needs to start pushing information security in the medical industry.

      • by Dcnjoe60 (682885)

        Sure, people in hospitals need information, but surely something which is assisting in the physical process of a surgery (etc.) doesn't need to be in the cloud, does it?

        As someone who works for a company that writes medical systems software, I can tell you that at the very least the systems need network connectivity so that the different systems can consolidate data in one place for examination. The problem is that any network connected device is potentially vulnerable to random Joe plugging a laptop into the network and hacking away.

        That's interesting. My uncle had a pacemaker in the 70s and I'm pretty sure it didn't have any network capabilities.

        To illustrate why that's bad, I've run into situations in which a client site (read: Hospital) outright prohibited using SSL/TLS on their servers. They deemed their internal network secure and refused to budge on allowing secure communications between the clients and the servers. Authentication information should always be encrypted and some administrators just don't get that.

        As a whole, I think the medical technology industry needs someone to force tighter security requirements on software developers and medical sites as a whole. This is a good thing in my opinion. If that appropriate someone is the DHS may require a different discussion, but some government body needs to start pushing information security in the medical industry.

      • To illustrate why that's bad, I've run into situations in which a client site (read: Hospital) outright prohibited using SSL/TLS on their servers. They deemed their internal network secure and refused to budge on allowing secure communications between the clients and the servers. Authentication information should always be encrypted and some administrators just don't get that.

        I hope you walked away from that client, or ignored their prohibition.

    • Similarly to Tha_Big_Guy23, elsewhere in this thread, I worked (past tense) for a health care company - Siemens - on a blood analysis unit that had Internet connectivity for support reasons. These units run 24/7 and any downtime is huge. In many cases, the volume of diagnostic information would take too long to send over a dial-up connection, if it was even available. Software updates were supposed to be "push capable." Also, the software provided VNC - desktop sharing - so one operator could keep track
    • Not that I support having my hospital equipment on the Interwebs, but there are instances, such as remote robotic-assistance surgery, where it's either that or lay your own cable. Any respectable hospital will use a VPN, yada, etc, but it still requires an internet connection.

      This issue will only become thornier unless clear-cut best management practices are established with respect to what gets on the Internet and what doesn't. Robo-surgery? Well, ok but it needs to be securing using A, B and C. My IV drip

  • After all, DHS must have _some_ use. This might turn out to be it.

  • manufacturers need to let os updates and AV software to be install on there systems if they want / need to be on the hospital network. also why do they need to phone home as well?

    • by mcmonkey (96054) on Thursday January 17, 2013 @11:02AM (#42616379) Homepage

      manufacturers need to let os updates and AV software to be install on there systems if they want / need to be on the hospital network.

      Because running untested software is a bad idea. Heath care systems and medical device software should get the benefits of updates and patches, but only after those updates have been tested for those specific systems and software. Whatever the vendor does prior to release is insufficient.

      When entire hospital processes come to a halt because the latest AV update mistakenly identifies a core OS file as a trojan, you'll come back and say, why are manufactures letting updates to be installed on their systems?

      As with many things, the best path is in the middle. Critical systems should be updated as preventative maintenance, but administrators cannot rely on vendor testing alone.

      • by Dcnjoe60 (682885)

        manufacturers need to let os updates and AV software to be install on there systems if they want / need to be on the hospital network.

        Because running untested software is a bad idea. Heath care systems and medical device software should get the benefits of updates and patches, but only after those updates have been tested for those specific systems and software. Whatever the vendor does prior to release is insufficient.

        When entire hospital processes come to a halt because the latest AV update mistakenly identifies a core OS file as a trojan, you'll come back and say, why are manufactures letting updates to be installed on their systems?

        As with many things, the best path is in the middle. Critical systems should be updated as preventative maintenance, but administrators cannot rely on vendor testing alone.

        Why update the software? Pacemakers and insulin pumps were available long before you could wirelessly update them. If it is such a threat, then don't enable wireless updates. Plain and simple. My God, how did we exist before computers did everything for us!?

        • by mcmonkey (96054)

          Why update the software? Pacemakers and insulin pumps were available long before you could wirelessly update them. If it is such a threat, then don't enable wireless updates. Plain and simple. My God, how did we exist before computers did everything for us!?

          This discussion isn't about having computers do anything for us. It's about how we use computers as tools to do things. How did we have conversations before computers? Well, we did, and yet here you are using a network of computers to have a conversation.

          As for the ability to update the software in a medical device, it's about trade-offs and compromises. ObCarAnalogy: computers in cars have made maintenance more complicated, so why not take the computers out of cars? Sure, if you also want to remove th

          • by Dcnjoe60 (682885)

            You misunderstand my post. I am not saying that we shouldn't have these devices, but if the risk from the software, or somebody hacking the software is so great that homeland security has to take it over, then maybe the very benefits and tradeoffs you mention should be looked at again.

            As for the car analogy, computers CAN make cars more fuel efficient, but in reality, they have a smaller impact on fuel efficiency than people think and are really used to keep pollution down and to keep from making the tough

            • by nbauman (624611)

              before turning all of this over to Homeland Security, I'd like to know how many pacemakers and insulin pumps have been hacked versus how many are out there? Is this a true threat or just bad movie plot from the ScyFy Channel that has taken hold in DHS?

              That's one of the questions that the FDA answers a lot better than the DHS. The FDA has procedures to decide whether something is really a problem, so they can prioritize their efforts on the real threats. You could search the FDA's public device adverse events reporting database to see if any hacked pacemakers or insulin pumps have been reported.

            • by mcmonkey (96054)

              You misunderstand my post. I am not saying that we shouldn't have these devices, but if the risk from the software, or somebody hacking the software is so great that homeland security has to take it over, then maybe the very benefits and tradeoffs you mention should be looked at again.

              We agree there.

        • My God, how did we exist before computers did everything for us!?

          Stone knives and bear skins, my friend, stone knives and bear skins.

        • Medical software runs a wide gamut, and pace makers are at the very bottom end of the scale. Check this out:

          http://www.medical.siemens.com/webapp/wcs/stores/servlet/ProductDisplay~q_catalogId~e_-101~a_catTree~e_100001,1023065,1015817~a_langId~e_-101~a_productId~e_172960~a_storeId~e_10001.htm [siemens.com]

          This thing has:
          • three operating systems: two running Solaris, one running Win 2000
          • two different databases: Oracle on Solaris; not sure what it runs on Win 2000
          • dozens of mechanical controllers, sensors, pumps and
          • by Dcnjoe60 (682885)

            Medical software runs a wide gamut, and pace makers are at the very bottom end of the scale. Check this out:

            http://www.medical.siemens.com/webapp/wcs/stores/servlet/ProductDisplay~q_catalogId~e_-101~a_catTree~e_100001,1023065,1015817~a_langId~e_-101~a_productId~e_172960~a_storeId~e_10001.htm [siemens.com]

            This thing has:

            • three operating systems: two running Solaris, one running Win 2000
            • two different databases: Oracle on Solaris; not sure what it runs on Win 2000
            • dozens of mechanical controllers, sensors, pumps and actuators
            • etc

            You can bet that on a product of this complexity, there will be updates.

            There is no doubt that medical devices use all sort of operating systems and have all sorts of capabilities, but what they are talking about in the article is communications between patient devices like pacemakers, insulin pumps, etc. That is different than the equipment you show, or an MRI, CT scan, etc. Those, are true computer driven systems. The ones DHS are taking over are the kind that are embedded or worn on your body.

      • by drinkypoo (153816)

        As with many things, the best path is in the middle. Critical systems should be updated as preventative maintenance, but administrators cannot rely on vendor testing alone.

        Critical systems should also not be connected to the internet.

        • by cellocgw (617879)

          As with many things, the best path is in the middle. Critical systems should be updated as preventative maintenance, but administrators cannot rely on vendor testing alone.

          Critical systems should also not be connected to the internet.

          Or, to be more precise, should not be connected to the internet with unlimited IP address access in either direction. You can obtain (or at least you can if you're dealing with an important-enough Fed agency) nice little boxes that not only encrypt the crap out of your traffic but are set up only to send to specified addresses and only to receive from specified addresses. Aside from deliberate sabotage, this is a safe way to connect to a manufacturer's update-providing hub.

    • by sinij (911942)
      AV and OS vulnerabilities is not top security concern. Something like letting unauthenticated user copy entire patient database that for some reason was stored on the device is much bigger threat.

      Protecting all terminals is not a very effective strategy for preventing large data breaches. While undeniably required step, it isn't firth thing you do, and it isn't most important thing you do.

      For example: Not storing session data locally would be the first step in securing this mess. Preventing access to
  • Or they could take the money assigned to DHS for medical device security and instead design a universal open-source electronic medical records system where security is maintained constant peer review and no one company has a monopoly on EMR's system.

    I know, I know. You can stop laughing now.

    • First of all, no one does have a monopoly on EHR systems. There are a couple of large players and a host of smaller ones. I would maintain that you Do. Not. Want. a monoculture here - or anywhere. Security is not 'maintained' by constant 'peer review' (that word doesn't mean what you think it means). Security is a process and open source software is only a small (and not necessary) aspect of that.

      There is an open source, Enterprise grade EHR system - VistA from the VA (Veterans Affairs) Department. It

    • by sinij (911942)
      OS is a no-go here mostly due to liability concerns and approval process. Medical Devices cost so much not because they are complicated technology (some of them are) but because when they explode, maim someone and give your uncle cancer there is a manufacturer and insurance to go after. You can design OS that is 100 times better than industry standard and it still won't be used because of the above.
  • When an entire agency is tasked with finding bogeymen under beds they have to get creative to justify their funding.
  • by Anonymous Coward

    Does this mean that DHS has access to source code and 0-day vulnerabilities for network attached medical equipment?
    Could this knowledge be user offensively, in a situation where say Kim Jong Un is in hospital for a heart operation, and
    DHS remotely pulls the plug on the life support machine?

    Can this power be later extended to medical devices implanted in people, like defibrillators, insulin pumps etc.

    Sorry to sound like Richard Stallman here for a second, but I would be very apprehensive having a device impl

  • Thanks go to Homeland for giving them this brilliant idea
    • by cellocgw (617879)

      Thanks go to Homeland for giving them this brilliant idea

      Thanks go to omems for not posting the "Spoiler Alert" tag here, you insensitive clod!

      • by omems (1869410)
        Hey I just said it was an idea. You kind of gave away that it was a spoiler, you...
  • I'll bet this is just the DHS' attempt at getting a record with medical equipment, so they can rubber stamp the x-ray machines the TSA uses, to keep the FDA out of the loop.

  • by mcmonkey (96054) on Thursday January 17, 2013 @11:07AM (#42616407) Homepage

    Is this from the Australian equivalent of the Onion?

    We've dropped exploits before on medical systems like Honeywell and Artridum...

    Dropped? Is this serious security research or the latest mix tape?

  • Yeah, there is nothing wrong with that. DHS, the government agency that believes it is alright to do anything in the name of protecting the population, now has control over the pacemakers and insulin pumps of anybody they suspect might threaten the nation or their own power structure. Nothing will go wrong with that.

  • by headhot (137860)

    Cause they regulate their x-ray scanners so well?

  • Source? I couldn't find anything about it on DHS website.

    All DHS hate aside, this is much needed change. We have FIPS and it made our crypto much stronger. We have other standards and procurement requirements (CC, PCI, etc) that made inroads on making sure vendors at least consider security. It is about time the same applied to medical devices.

    Why DHS, NIAP or NIST would be more appropriate agency to handle this.
  • by Translation Error (1176675) on Thursday January 17, 2013 @12:13PM (#42617199)

    To date, no agency has taken point on forcing the medical manufacturers to improve the information security profile of their products, with the FDA even dubbing such a risk unrealistic (PDF).

    Looks like this is right up the DHS's alley.

  • Is there a link to a story somewhere? The links in the story don't talk about DHS at all.

  • by cdrguru (88047)

    The first issue that should be addressed is does anyone believe that 100% total bulletproof security is even possible today? Come on, do you think it is possible to have large, interlocking systems of computers communicating over a network with 100% security?

    I think anyone reasonable will say "Heck no you can't!" There might be a few dreamers that think it is possible, but the amount of effort that would be required is beyond any reasonable standard. So sure, it might be possible to force all medical dev

    • by Prune (557140)
      > And sure, maybe a few good mistakes to ensure nobody wants to even get near to someone that might do something like that.

      So you're volunteering? When your innocence is post-humously established, your great sacrifice for the public good will be forever in the public memory! Or...at least for a week or two.
  • The slow, Hooverite acquisition of power. Once they have enough dirt on current legislators and CEOs gleaned from their vile activities, they will be unstoppable.
  • This was probably the real reason DICK Cheney switched back to a human heart.

    That and the whole cool Kali-ma um, 'medical procedure'.
  • They watched that episode of Homeland where the Vice President was killed remotely through his pace maker.

  • No need to worry they will just reclassify any security problems as "design issues" [slashdot.org] thus cutting the number of security bugs by up to 90%.

Scientists will study your brain to learn more about your distant cousin, Man.

Working...