Understanding Threats to Medical Devices

Updated October 26, 2024

One of the hardest parts of the security process is the initial discovery phase of understanding what could go wrong. Cyber threats are constantly changing, with old attacks slowly becoming less common while new attacks rapidly pop up. Modern attack techniques target new technologies to try and cause maximum impact. These attacks can slip the minds of many manufacturers and developers producing medical devices. Device manufacturers need to stay up to date on the latest threats and be able to prepare for whatever risks may present themselves.

Key Takeaways

• Attackers target high-value assets, including patient data and critical device functions.
• Medical device complexity increases potential attack surfaces and defense challenges.
• Threat modeling helps predict attack vectors and prioritize protective measures.
• Assess both attack probability and potential impact to guide mitigation efforts.
• Creative, 'outside-the-box' thinking improves threat identification.
• Regular review of threat models ensures continued effectiveness.

Table of Contents

• Key Takeaways
• What Will Attackers Target?
• How Can Defenders Predict Attacks?

Why this matters

The stakes are incredibly high in medical device cybersecurity, as compromised devices can lead to patient harm, data breaches, and significant financial and reputational damage for manufacturers. The FDA, in its Cybersecurity in Medical Devices Final Guidance dated February 3, 2026, emphasizes the critical need for manufacturers to proactively address cybersecurity risks throughout the total product lifecycle. This guidance highlights the importance of anticipating potential threats and implementing effective mitigations. Failure to adequately address cybersecurity can result in regulatory non-compliance, product recalls, and even class action lawsuits. Adherence to standards like IEC 81001-5-1 and ISO 14971 provides a framework for secure development and risk management. AAMI TIR97 further supports the security risk management process. Understanding relevant threats is not merely a formality but a fundamental component of ensuring patient safety and maintaining trust in medical technology. Proactive threat identification enables manufacturers to design and maintain secure devices, minimizing vulnerabilities that adversaries could exploit.

What Will Attackers Target?

One of the most important considerations for understanding attacks against medical devices is that attackers will usually want to go straight for high-value targets. Internal databases storing patient data, or a critical functionality will be far more valuable than something mundane, such as functionality logs. This is not to say that areas with reduced perceived value should be left unprotected, but getting into the mind of a bad guy can help prioritize areas to defend.

Depending on the unique device, functionality can be possibly life-saving to the patient. The other side to this is that failure can be catastrophic. Medical devices often hold and transmit very sensitive data that patients will want to keep private. Attackers can target this data to try and find ways to siphon it out and build up a collection of private information. It can also happen that attackers target critical devices in an attempt to shut down their functionality either for ransom purposes or terror attacks.

Medical devices can be very complex and have sprawling functionality. This can be a great thing since modern technology allows for revolutionary changes in medicine. Unfortunately, this also means that many unique risks may be introduced into the system. Too much complexity can make devices difficult and costly to defend. In many cases, there is no way to get around this, but unnecessary complexity is still something that manufacturers should be aware of.

How Can Defenders Predict Attacks?

It seems like an impossible task to guess what an attacker will do to a device, but this is luckily not the case. While perfect security is a hollow dream in almost every case, there are many steps that defenders can take to prevent attacks before they happen. A lot of the information needed to perform these exercises comes from careful analysis of software components and the information derived from mapping out what areas will be of high value for hackers.

With this information in mind, it can be possible to make educated guesses about what an attacker will do and preemptively protect against these attacks. This process of mapping out potential attacks is threat modeling. There are many different threat modeling frameworks, each with its specifics, but the general idea is to find relevant threats to a process or component, test it, and draw conclusions.

A very important part of threat modeling is understanding the probability of an attack as well as the potential impact. This can help prioritize fixes and let manufacturers find a proper solution without dedicating too much time to low-risk threats, or worse, ignoring critical vulnerabilities. There will always be a balance between how likely an attack is compared to the risk, with higher risk/likelihood being far more important to fix. In some cases, attacks with very low impact and probability of occurrence will be considered an acceptable risk, especially when the fixes may be complex.

Moving backward from threats can allow security teams to understand the ways that an attacker would try to exploit a system and begin patching up those areas. For example, the threat may be an attacker exfiltrating information in a sensitive database. The next consideration would be how an attacker could do that. This could be a complex exploit targeting the device, intercepted traffic in the system, or even something as simple as an attacker just guessing a password purely by luck.

Security teams should do their best to come up with creative attacks and techniques. Attackers are using new strategies and techniques every day, so defenders must do the same. Some attacks may sound far-fetched, or even silly, but can be surprisingly effective. A great example is gummy bear attacks, where hackers can bypass fingerprint scanners using gelatin and super glue.

A critical final step in threat modeling is reviewing the work and ensuring that everything was done properly and that major threats are not unaccounted for. It is easier said than done to map out complex systems, as the list of relevant threats can get daunting quickly. The cybersecurity experts at Blue Goat Cyber can help with this process and streamline the entire FDA clearance cycle. Our team is well-versed in modern attacks and techniques and can help you defend against costly cyber attacks. Contact us to schedule a discovery session.

How Blue Goat approaches this

See also: When to Hire a Device Security Consultant vs. Build In-House, Cybersecurity Is Now a QMS Requirement, and Why Medical Device Cybersecurity Is Nothing Like Enterprise.

Our approach to understanding medical device threats begins with a detailed threat modeling process. We analyze device architecture, identify critical assets, and brainstorm potential attack scenarios, even those considered unconventional, using methodologies like STRIDE and DREAD. Our team, comprised of certified professionals with CISSP and OSCP designations, including ex-military red team personnel, brings a unique adversarial perspective to uncover hidden risks.

We don't just identify threats; we contextualize them within your device's specific operational environment and regulatory landscape. Our goal is to provide actionable insights that enable targeted and efficient mitigation strategies. We partner with manufacturers to build a resilient security posture from pre-market design to post-market maintenance. Learn more about our specialized support for new device approvals at FDA Premarket Cybersecurity Services. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

FAQ

What data do attackers target in medical devices?

Attackers primarily target high-value data such as internal databases storing sensitive patient information. They also aim for critical device functionalities whose disruption can have serious patient impacts.

Why is medical device complexity a cybersecurity risk?

Complex medical devices introduce numerous unique risks and potential vulnerabilities. This complexity can make it difficult and costly for manufacturers to defend the devices against various cyber threats.

How can manufacturers predict cyber attacks on devices?

Manufacturers can predict attacks through threat modeling, which involves analyzing device components, identifying high-value targets, and making educated guesses about attacker methods. This process helps in preemptive protection.

What is the role of probability and impact in threat modeling?

Understanding the probability and potential impact of an attack helps prioritize fixes. High-risk, high-likelihood threats receive immediate attention, while low-impact, low-probability threats might be accepted risks.

Does the FDA provide guidance on medical device cybersecurity threats?

Yes, the FDA's February 3, 2026 final guidance on Cybersecurity in Medical Devices provides recommendations for managing cybersecurity risks throughout the device lifecycle, including threat analysis.

What are "gummy bear attacks" in cybersecurity?

"Gummy bear attacks" refer to a technique where attackers use gelatin and super glue to create molds that can bypass certain fingerprint scanners. This exemplifies creative, unconventional attack methods.

Related: The Rising Tide of Cyber Threats in Medical Devices: Understanding the Risks

Select all squares with bicycles If there are none, click skip

Skip

Select all squares with motorcycles If there are none, click skip

About the author

Christian Espinosa, CISSP, Founder, Blue Goat Cyber. Christian leads a team focused exclusively on medical device cybersecurity for FDA premarket submissions and postmarket compliance. Read more about Christian.