Securing insecure devices

I'll bet a lot of people read this post already http://boingboing.net/2015/05/07/drug-pump-is-most-insecure.html

It talks about one particular medical device that has practically no security. No passwords, open telnet by default and a root shell. Yikes! For those not really into IT security, that's really bad....

It also talks about some other devices that are almost as bad. But in the medical space these devices are needed. I mean if someone doesn't get the right dose of drugs they will die and if this is the only machine available (I'm not saying it is), then until it is really fixed patients and doctors unfortunately need to roll the dice and hope for the best. Sort of like we all do with identity theft every day, but that's a different story.

So what can CIOs and CISOs do to protect them? Well the short answer is get after the vendors, but in the real world that takes time and honestly a lot of time IT just doesn't carry that much weight to over rule the medical professionals. As much as that's the right thing to do, it's not the effective thing to do.

Instead secure the network and don't allow unauthorized machines to connect to these devices. Tools like Network Access Control (NAC) and Network policy have been around for years (decades in some cases) and allow IT administrators and security experts to restrict  how and who can connect to these insecure devices.

For example, if people outside of IT shouldn't be allowed to telnet to the drug pump, the network can simply block all access to it. You can even go a step further and log if someone tries to telnet to it and alert security to investigate who did it and why.

If you are worried about someone unplugging the pump from the network and plugging it into a switch to tamper with it, you can even monitor the device and alert when it goes offline. That's probably not a bad thing to do actually in case the device fails.

I think we need to stop throwing our hands up and saying "The device isn't secure, it's not fair" and instead look at when we can do today with existing technology. We can make things better so don't give up.

The problems with BYOD

I recently posted a blog post on the Enterasys blog  talking about the 8 types of BYOD.  Essentially BYOD is made up of 3 attributes that related to LAN connection, Management and Data. It can range from essentially the same technical problems we have today with corporate managed devices on our networks and connecting to our data, to someone's "personal" iphone.

Each of these situations brings up a different problem and solution set required. In summary though it works out like this.

1. If it is on your network, you can control it with firewalls, network policy and SIEM tools.
2. If it is managed by you, then you can use MDM to protect yourself.
3. If it is accessing your data then authentication, like Okta, with automatic provision and de-provision can help.

The corollary to these are.
1. If it's not on your network, traditional network tools won't help. In other words a hardware appliance on my network has zero control over my 3g connected Android device.
2. If you can't manage the device, you can't control the device.
3. If it's not your data the best you can do is have a policy and react accordingly.

There is no protection from someone using their iphone, on their 4g data plan connecting to their facebook. The best you can do is watch and react appropriately.