Vulnerabilities can put your patients and devices at risk. Our spring 2022 product release includes tools for prioritizing risk mitigation and remediation efforts to quickly address the most significant threats.
Health care is targeted for cyberattacks more than any other industry, with over 100 to 200% more attacks than the next closest industry. Ransomware attacks alone rose 123% in 2021, costing hospitals over $21B dollars. In 2021, researchers cited unpatched vulnerabilities as the primary reason for ransomware attacks after discovering 65 new vulnerabilities connected to ransomware, a 29% increase from 2020*. This is increasingly problematic for health systems, as the growing number of connected medical and IoT devices make it difficult for healthcare delivery organizations to manage and secure everything in a clinical network.
There is rarely a debate on the importance of cybersecurity in health care, however, a growing debate centers around what is an acceptable level of risk? Should a health system’s risk tolerance remain the same for each site or each department? The reality is that each health system’s toleration for risk is unique and adopting a one-size-fits-all technology approach may leave many health systems wondering if they are making tangible improvements to their risk posture.
TRIMEDX is uniquely focused on putting health systems at the center of lowering risk posture by leveraging industry-leading tools and data with over 50 years of combined clinical engineering and cybersecurity expertise while allowing for flexibility to improve processes and risk. Real-time monitoring can only go so far in detecting a threat or vulnerability. First, Medical Device Security Platforms (MDSPs) monitor connected devices, which, on average, represent only 30% of inventory. So, for MDSPs to detect anomalous behavior, the device must be connected to the network. But even when connected, it only alerts for irregular activity on the device. But what about devices that are connectable and not yet connected, or threats that may not be detectable? That is why, at the core of the TRIMEDX CYBER solutions, we coupled Medigate’s real-time monitoring with our proven vulnerability and threat identification methodologies that survey over 40 external sites and is now all viewable in our vulnerability tracker in Clinical Asset Informatics.
We are pleased to announce our latest innovation, focused on giving health systems more visibility into our industry-leading, vulnerability identification processes and tools that allow health systems to work collaboratively with TRIMEDX CYBER experts to proactively manage risk.
Our new Dynamic Risk Score
Cyber risk scores are not unique to TRIMEDX, however, —the TRIMEDX Dynamic Risk Score—is the only score that changes with new and existing vulnerabilities, OEM responses, completed remediations, and real-time device attributes. Other risk scores alert health systems to a risk without OEM follow-up to validate the risk, while the TRIMEDX Dynamic risk Score—visible through TRIMEDX’s Clinical Asset Informatics—gives the confidence to accept risk or prioritize devices for remediation. In fact, as work is done on medical devices by the health system or a TRIMEDX’s CYBER specialist, the risk score will dynamically adapt and change. This gives health systems the ability to watch their risk posture adjust in real-time as changes are implemented as well as monitor month-over-month improvements in medical devices.
The Dynamic Risk Score incorporates information on the:
Cyber vulnerability risk
- Vulnerability criticality
- OEM remediation status
- Mission critical devices
Device risk
- Operating system
- FDA alerts and recalls
- Capable of storing ePHI information
Patient safety
- Risk to patient safety and consequence of failure
- Proprietary TRIMEDX Alternative Equipment Maintenance Risk Score
Cyber threats and projects
60% of all impacted medical devices do not have an OEM-validated response or patch. If a primary reason for ransomware attacks is vulnerabilities from unpatched devices, this is a problem that cannot be ignored. That is why TRIMEDX created “Cyber Threats & Projects” within our Clinical Asset Informatics platform to allow health systems to work directly with TRIMEDX CYBER Specialists. This gives health systems the ability to view priority “Threats” sent from a TRIMEDX CYBER Specialist and to make the decisions to approve, reject, or accept the risk for specific medical devices with a specific vulnerability. Health systems will be in control on what TRIEMDX compensating control is used to remediate these non-validated OEM vulnerabilities. Health systems can actively triage priority “Threats,” and with a click of a button, the “threat” can be turned into a “project” that is automatically sent to RSQ, TRIMEDX’s proprietary computerized maintenance management system (CMMS), then tracked in Informatics, and stored in the equipment history.
TRIMEDX puts health systems in control of their risk posture. With more data integration, health systems have visibility into the threats and vulnerabilities that exist within their medical devices, and they’re able to more accurately access and determine what they are comfortable tolerating versus what they want to focus on securing. By partnering with a trusted leader with over 50 years of experience in clinical engineering and cybersecurity, health systems will have the confidence that—once parameters have been set or devices have been identified for remediation—risk posture will improve, enabling health systems to better secure the health and safety of their hospital and their patients.
* Ivanti in partnership with Cyware and Cyber Security Works
To learn more or to inquire directly about our cybersecurity and asset informatics solutions, please fill out our Contact Form.