Strategies for Health Organizations in Enhancing Security of Existing Software Systems
In the rapidly evolving digital landscape, the healthcare sector is facing a surge in cybersecurity threats, with malware attacks on internet-connected devices spiking 123% in the first half of 2022, according to research from SonicWall. This alarming trend highlights the importance of addressing the risks associated with managing legacy operating systems in healthcare.
Legacy systems, often found on life-critical devices such as those used to monitor patients in the intensive care unit, pose significant risks due to their high vulnerability to cyberattacks. A 2021 report from Kaspersky Lab found that 73% of health systems used medical equipment running legacy operating systems. These systems, which often lack modern security features such as strong encryption, two-factor authentication, and timely software patches, tend to be deeply integrated into daily workflows but receive little to no security updates or vendor support, making them easy targets for ransomware, malware, and unauthorized access.
The risks are not limited to these systems alone. Legacy operational technology (OT) systems, which focus on stability and continuous operation rather than security, expose critical devices and patient information to risks. Additionally, legacy systems suffer from poor interoperability with new software, difficulties in meeting regulatory compliance (e.g., HIPAA), and increased operational inefficiencies.
Legacy medical devices running outdated operating systems and firmware also present regulatory and cybersecurity challenges, exposing healthcare providers and patients to risks due to outdated protections and heightened scrutiny by authorities like FDA, NIST, and ISO.
To address these challenges, a balanced approach focusing on discovery, risk assessment, mitigation strategies, modernization planning, security enhancements, workforce challenges, compliance, and documentation is recommended.
- Discovery and Inventory: Identify which legacy systems and devices are still in use, their network connections, and clinical criticality, often requiring collaboration with healthcare providers who may not have full inventories.
- Risk Assessment: Systematically evaluate each legacy system’s technical state, update capabilities, encryption and access controls, Software Bill of Materials (SBOM) availability, and alignment with regulatory guidance to prioritize risk mitigation.
- Mitigation Strategies:
- Remediation: Apply secure updates and patches where feasible.
- Compensating Controls: Use network segmentation, continuous monitoring, and access restrictions to isolate and protect legacy systems that cannot be updated.
- Containment or Documentation: Document risks and operational constraints for lower-priority systems when remediation is impractical, ensuring clear communication among stakeholders.
- Modernization Planning: Evaluate options such as replacement, rebuilding, refactoring, or rehosting legacy systems based on organizational capacity, balancing costs, disruption, and security improvements. Developing a modernization roadmap with stakeholder engagement and change management is crucial.
- Security Enhancements: Integrate modern security features where possible, such as HIPAA-compliant encryption standards (e.g., 256-bit AES), two-factor authentication, and real-time monitoring to improve protection against cyber threats.
- Addressing Workforce Challenges: Mitigate the skills gap by documenting legacy system knowledge, training new staff, and engaging vendors familiar with legacy technologies to ensure ongoing support.
- Compliance and Documentation: Maintain updated Standard Operating Procedures (SOPs), regulatory documentation, and transparent communication to reduce liability while extending system usability safely.
This balanced approach reduces cyber risk without unnecessarily discarding functional legacy systems, supporting patient safety and regulatory compliance in healthcare environments. As the transition from PCs to tablets and increased adoption of automation technology for incident detection and response will minimize the security impact of legacy systems in five years, it is crucial for healthcare organizations to invest time in the basics of security and adopt a proactive, risk-informed approach to managing their legacy systems.
- Healthcare organizations should focus on implementing a balanced approach to address the cybersecurity risks associated with legacy systems, as identified medical equipment and operational technology still running on outdated operating systems can expose critical data and patient information to ransomware, malware, and unauthorized access, in accordance with regulatory guidelines such as HIPAA and FDA standards.
- In the realm of health and wellness, the integration of modern security features like strong encryption, two-factor authentication, and real-time monitoring into legacy systems can improve overall security and help actively protect against medical-conditions stemming from cybersecurity threats, in line with best practices for health-and-wellness, technology, and cybersecurity management.
