Managing Cyber Risks in the Medical Device Supply Chain

The global medical device supply chain is immensely complex, accounting for billions of dollars in trade each year. With that, millions of lives depend on its swift delivery and provision of crucial medical equipment—meaning also, regrettably, that companies on the chain are at increasing risk from cyber criminals.

Managing cyber risks in the chain, however, requires businesses to be more than just careful with how they handle their own data and systems. As part of a wider, global chain, they’re at the mercy of third-party vendor practices—and so are millions of innocent consumers.

Let’s explore the current threat landscape affecting medical device supply, and how companies on the chain can better protect themselves and their customers.

Understanding the Cyber Threat Landscape in Medical Device Supply Chains

The healthcare industry remains the third most-attacked worldwide, largely due to the sensitivity of the data held and the services provided.

By disrupting companies on the medical device supply chain, for example, hackers put suppliers and care providers under immense pressure to restore service as quickly as possible.

Ransomware, which locks down systems until ransom payments are made to attackers, can prevent crucial devices and support from reaching people, meaning organizations on the chain must be on high alert to prevent such extortion from taking hold.

HIMSS’ 2024 Healthcare Cybersecurity Survey explains that ransomware threats in the industry have remained steady since at least 2018—meaning that while the methodologies to handle evolving threats are improving, this type of attack is never going away.

And yet, businesses in the device supply chain must carefully consider the security postures of the vendors they work with, not just their own. Any weaknesses in vendor cybersecurity can lead to hackers intercepting communications on the supply chain, potentially finding backdoors into firms that otherwise have robust protections.

What’s more, typical cyberattacks such as phishing and social engineering take advantage of supply chain employees who lack adequate training and knowledge.

Worryingly, KLAS Research found that the majority of healthcare firms take a “when, not if” position on cybersecurity and threat response.

With generative AI making threats to the device supply chain more sophisticated, this all culminates in a stark wake-up call for businesses and vendors.

Regulatory Expectations and Compliance Requirements

Beyond threats to customer data and operational lockdowns, businesses in the medical device supply chain also have regulatory expectations and must ensure they are adequately protected in line with compliance standards.

HIPAA, the Health Insurance Portability and Accountability Act, for example, regulates healthcare businesses (including medical device users and suppliers) with regard to how they handle, protect, and store patient data.

Within medical device manufacturing itself, the U.S. Food and Drug Administration (FDA) applies specific cybersecurity guidance in line with the Consolidated Appropriations Act of 2023.

Therefore, businesses should already be aware of and following security recommendations set by regulators—and if not, should consider setting up their own security templates or frameworks, or using a pre-established framework to guide along.

Implementing a Robust Cybersecurity Framework

The ideal cybersecurity framework and incident response plan will look different for every organization on the supply chain. However, there are key steps they can take to ensure they build a reactive, proactive framework that keeps data and operations safe, and which continues to maintain compliance.

Here are a few suggested steps businesses might take to protect themselves, at least initially:

• Use a recommended security framework, such as NIST CSF. NIST CSF 2.0 is the latest version of a widely used cybersecurity template that helps businesses—such as those on the device supply chain—to ensure they follow recommended practices to protect data and operations, and to stay compliant.
• Carefully vet vendors. As mentioned above, medical device suppliers and manufacturers are frequently at the mercy of the security standards set by partners they work with. Therefore, it’s vital to hold potential new partners to account for their security measures, and to establish a framework that you can regularly revisit and reanalyze together.
• Apply zero-trust practices. An effective cybersecurity framework must never take trust for granted. Even with long-standing partners and trusted devices, firms should apply strict controls to verify connections and restrict access to data and operations unless several factors have been confirmed.
• Run regular tests and scans as part of ongoing framework reviews. Medical device firms should always run penetration tests and vulnerability scans to search for weaknesses in systems and networking that escape the naked eye. Tiny flaws such as misconfigurations can, for example, still provide backdoors to hackers.

Best Practices for Ongoing Cyber Risk Mitigation

Beyond setting up a reliable, proactive cybersecurity framework, medical device manufacturers and suppliers should take regular steps to mitigate risks and prevent threats from taking hold.

Here are a few best practices that supply chain firms should consider to tighten up their ongoing cybersecurity:

• Regularly refresh and rewrite contracts and agreements with vendors and partners to establish mutual security targets and auditing.
• Work with cybersecurity professionals and use threat intelligence tools to stay ahead of the latest threats with recommended software.
• Regularly top up employee knowledge on how the supply chain is connected, the risks that are involved, and how to secure data and personal access.
• Develop incident plans and backup procedures in the event of the worst-case scenario happening—run thorough, targeted risk analyses to grade how likely risks are to occur.
• Collaborate and share knowledge with other businesses and thought leaders on the supply chain—are there any practices you could take inspiration from, or any you could share with your partners?
• When using hardware such as RFID scanners and IoT devices, take care to regularly update firmware and reassess how systems are connected—according to the World Economic Forum, cyberattacks targeting IoT in particular are increasing.

Conclusion

The medical device supply chain and the wider healthcare industry are more at risk now than ever before from sophisticated hacking and cybersecurity threats. Although efforts to prevent these threats are, in turn, becoming more sophisticated, there is still plenty for businesses to do in terms of vigilance and preparedness.

Take our advice and don’t make cybersecurity an afterthought—plan ahead, set up analytics and work with security professionals—and, most of all, choose vendors you can safely trust across the chain.