Medtronic rushes to replace insulin pumps after flaws found
US medical equipment giant Medtronic has announced the immediate recall of all MiniMed 508 and Paradigm series insulin pumps after researchers uncovered serious security flaws which can’t be patched.
The news emerged last week when the company started sending recall letters to all US users of the device, a warning echoed by a public alert issued by the US Food and Drug Administration (FDA).
According to the FDA, Medtronic has identified around 4,000 US patients using affected models although an unknown number of others (including patients in other countries) will have received them through third parties.
This is still a relatively small number, which is perhaps explained by the fact that both pumps are older models dating back to 2012 that were withdrawn from sale in October 2018.
The job of a pump is to deliver insulin to a patient throughout the day via a catheter implanted under the skin, which removes the need for regular injections to maintain stable blood glucose levels.
However, to do this, the pumps need to connect to a separate continuous glucose monitor (CGM) sensor which for a decade or so has been implemented wirelessly using Bluetooth.
The final element of the system is the CareLink USB, which plugs into a computer and gives patients a way to send the pump dosing commands wirelessly while sharing data with health providers.
Neither Medtronic nor the FDA has revealed much about the flaws – nor who discovered them – but the alert states that the weaknesses lie in the way the wireless part of the system was implemented.
That’s significant because, in March 2019, Medtronic issued a separate alert after Dutch researchers uncovered security vulnerabilities in the Conexus wireless protocol used by a wide range of the company’s implantable heart monitoring products.
While Conexus doesn’t appear to be involved in this latest alert, these incidents draw attention to the way wireless security, or the lack of it, was implemented in this generation of systems. The FDA said this could mean: Someone other than a patient, caregiver or healthcare provider could potentially connect wirelessly to a nearby MiniMed insulin pump and change the pump’s settings.
Bluntly, a hacker could tamper with the system to over or under deliver insulin to the patient with dangerous health consequences.
The good news is that Medtronic and the FDA are not aware of any attacks exploiting the flaws, which would also require an attacker to target a patient from their immediate vicinity.
This means the chances of anyone patient being attacked are slim. Unfortunately, that’s little comfort because the pumps can’t be patched, hence the need for them to be replaced “with better cybersecurity controls,” said the FDA.
Medtronic has a history when it comes to insulin pump flaws, falling prey in 2011 to security researcher Barnaby Jack’s discovery of a separate wireless vulnerability in now-defunct models. That researchers are still discovering similar flaws in more recent equipment is pretty disappointing.
The wider issue is the difficulties companies have in finding and patching or replacing vulnerable equipment. This points to the lack of a system to track equipment once it has reached patients, a dangerous and unsatisfactory state of affairs for medical equipment.
Industry: Cyber Security
- IAM Product/ Project Manager
- Upto €80,000 plus benefits
IAM product/project manager is need for this expanding service provider to help develop their IAM (CIAM) strategy roadmap. This role will have two main functions, to work between the front end digital team and the backend IAM development team to ensure that the current deployment of the solution runs smoothly and is fit for purpose, the Second function is to look at the business’ future digital offerings and to understand how the IAM/CIAM solution will develop with the new digital strategy, you will be looking at the future technology and the ensuring the IAM solution is fit for purpose. The business is an agile environment and you will require agile experience. This is a great opportunity to help shape a key product within the future digital strategy of this expanding service provider. We are looking for someone with both IAM and strong product management experience Project management experience would be beneficial. If you are interested speak to Robert Anderton on 0044 (0) 7957 493501 and he will be able to discuss the role in more details IAM product/project manager is needed for this expanding service provider to help develop their IAM (CIAM) strategy roadmap. This role will have two main functions, to work between the front end digital team and the backend IAM development team to ensure that the current deployment of the solution runs smoothly and is fit for purpose, the second function is to look at the business’ future digital offerings and to understand how the IAM/CIAM solution will develop with the new digital strategy, you will be looking at the future technology and the ensuring the IAM solution is fit for purpose. The business is an agile environment and you will require agile experience. This is a great opportunity to help shape a key product within the future digital strategy of this expanding service provider. We are looking for someone with both IAM and strong product management experience Project management experience would be beneficial. If you are interested then speak to Robert Anderton on 0044 (0) 7957 493501 and he will be able to discuss the role in more details
- Cyber Incident Manager, Proactive planning and management. SC
Cyber Incident Manager, Proactive planning and management. Cyber incident Manager needed to join a large and complex business to help them prepare for a cyber related incidents. SC clearance will be required. Current or the ability to achieve. This role does not require specific current hands on technical Incident response experience, but this background would give a distinct advantage. The role has two key functions: to help the business prepare for an event and to steer them through when / if that happens. The Cyber Incident response managers role will include, but not be limited to; working with internal stakeholders to develop a security incident management plan along with its and supporting policies. Developing plans and implementing strategies on how incidents are detected, reported, assessed and responded to. Engaging with leadership teams both internal and external, proactively mapping out this large business to identify and engage the various other stakeholders and their teams. Build out and document incident scenarios and their processes, ensure incident management procedures are updated, playbooks and key training etc. You should have experience working with both internal teams and external suppliers. The role will also focus on liaising with the various teams to ensure the security incident response plan is delivered effectively. CCIM, GCIH, CIPR (NCSC-Certified Cyber Incident Planning & Response) Looking to interview immediately.
- SOC Manager. SC Clearance. Immediate opportunity.
Permanent SOC Manager. SC cleared / clearable, London / Birmingham. SOC Manager needed to replace a SOC contractor I placed into a client who is due to complete their assignment at the end of March. The ability to achieve SC clearance is essential. Looking for someone that is a blend of strategic stakeholder engagement with strong technical skills. The role will sit in a relatively new SOC environment. The position is to setup, implementation and management of resources to help with the initial and on-going stages of a new SOC. Experience engaging with and managing client stakeholder relationships as well as 3rd party relationships is critical. The role will involve; setting up, implementing and fine tuning the various initial stages of a SOC environment. Experience establishing and building out technical process / operational capability, managing of technical teams (analysts, engineers and architects, creation of policy / playbooks, fine turning is key. SPLUNK is the tooling of choice… Interviewing immediately. Set up a call with me today on https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-manager-role Direct contact details Chris.Holt@dclsearch.com or 07884666351
- Security engineer. Financial Services. UK. Permanent
CH7863 Security engineer. End User . Financial Services Security Engineer needed to monitor and manage a security suite of tools within an End User environment. The Security Engiener will be responsible monitoring, configuring, fine tuning, incident management and generally improving the security tool capability. Specific experience with CyberArk, Tripwire Log Center and Tripwire Enterprise is highly desirable). Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. To book a call please use my Calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-