I work primarily in the field of healthcare information security. Although this article does go a little bit into the realm of hyperbole--as HN commenter 'excu

I work primarily in the field of healthcare information security. Although this article does go a little bit into the realm of hyperbole--as HN commenter 'excuse-me' pointed out, not every single aspect of medical equipment is even remotely capable of interfering with patients--there is a serious security risk with networked devices that most people do not understand. The article pointed out the McAfee research on insulin pumps. Yes, these devices were hacked and could potentially kill a patient. This was a complex application attack, that while serious and certainly something that should be addressed, has a very high level of sophistication. For example, if one was trying to kill a patient, they would need physical (or very-close networked access) to the device. At that point, is it easier to write exploit code or simply kill someone? These are morbid thoughts, but it's also a requirement to think of the actual use case. Please keep in mind that I'm not trying to understate the seriousness of these findings, or others like them: we absolutely need to step up security in the healthcare field. It's a mess, and frankly makes me feel uncomfortable every time I'm in a hospital. But let's talk about things that are even simpler than the insulin pump attack. When I send engineers on-site to hospitals, we need to specifically exclude BioMed network devices, as well as anything that's connected to a patient (even through a couple of hops) for even simple network scans (nmap, etc). Why? Because even just running a contemporary port scan has a tendency to overflow device state tables/networking stacks and crash the device. Let me reiterate: just scanning the device, without any security checks or attacks, can take a device offline. You might think that devices such as these are protected from attackers by other security controls; that if someone has networked access to an internal network, that it's game over anyway. Well, yes and no. Part of the problem in healthcare information security is that hospitals and healthcare providers have thought almost exclusively about the physical security of their facilities for far too long. Sure, there are security guards in place, but how does that help when the Emergency Room "guest wifi" is bridged to the internal network? What about when there are live Ethernet ports in visiting rooms or, again, the ER? These are real problems that we're trying to find and resolve, but it's more of an industry-wide change of vision than a couple of holes we need to plug. Even the security of the internal network itself is generally a disaster (missing patches, unorganized security departments, etc). It's our job to resolve these issues, and although I'm just a little biased, it's not super hard to do on a hospital-by-hospital basis. It gets a lot tougher when we're talking about a pan-industrial change. Which is where, in the U.S., the government steps in. HIPAA compliance forces these checks to be done on a regular basis--although the tendency for hospitals to save money by getting a "checkbox compliance" scan from an automated vendor instead of having a real team of security engineers conduct analysis is still very strong. HIPAA is focused mainly around protecting electronic protected health information (PHI), but the HITECH Act and "meaningful use" allows healthcare organizations to actually receive money from the government for staying in compliance while using ePHI (instead of paper records) for a large percentage of their health records. We've got a long way to go, but the healthcare industry is steadily improving. That said, don't be too quick to discard remarks about the security of hospitals and your medical data: right now, a complete medical record is worth more on the black market than a credit card number. Keep that in mind next time you see Windows NT machines while getting your annual check-up.