[论文解读] A New Methodology for Information Security Risk Assessment for Medical Devices and Its Evaluation

Tom Mahler, Yuval Elovici+1 more|arXiv (Cornell University)|Feb 17, 2020

Healthcare Technology and Patient Monitoring参考文献 34被引用 9

一句话总结

本文提出TLDR方法，一种针对医疗设备信息安全管理风险评估的新型方法，该方法将网络攻击映射至CAPEC本体，通过专家小组估算可能性，并通过整合基于CAPEC的可能性与专家评估的严重性，计算综合风险评分。该方法通过强相关性（Spearman等级相关系数 > 0.8）和非显著的t检验结果，证明了其在CAPEC方法与直接专家可能性估算之间的一致性，验证了其在传统方法上的可靠性与高效性。

ABSTRACT

As technology advances towards more connected and digital environments, medical devices are becoming increasingly connected to hospital networks and to the Internet, which exposes them, and thus the patients using them, to new cybersecurity threats. Currently, there is a lack of a methodology dedicated to information security risk assessment for medical devices. In this study, we present the Threat identification, ontology-based Likelihood, severity Decomposition, and Risk integration (TLDR) methodology for information security risk assessment for medical devices. The TLDR methodology uses the following steps: (1) identifying the potentially vulnerable components of medical devices, in this case, four different medical imaging devices (MIDs); (2) identifying the potential attacks, in this case, 23 potential attacks on MIDs; (3) mapping the discovered attacks into a known attack ontology - in this case, the Common Attack Pattern Enumeration and Classifications (CAPECs); (4) estimating the likelihood of the mapped CAPECs in the medical domain with the assistance of a panel of senior healthcare Information Security Experts (ISEs); (5) computing the CAPEC-based likelihood estimates of each attack; (6) decomposing each attack into several severity aspects and assigning them weights; (7) assessing the magnitude of the impact of each of the severity aspects for each attack with the assistance of a panel of senior Medical Experts (MEs); (8) computing the composite severity assessments for each attack; and finally, (9) integrating the likelihood and severity of each attack into its risk, and thus prioritizing it. The details of steps six to eight are beyond the scope of the current study; in the current study, we had replaced them by a single step that included asking the panel of MEs [in this case, radiologists], to assess the overall severity for each attack and use it as its severity...

研究动机与目标

• 解决日益互联的医疗环境中医疗设备缺乏专用信息安全风险评估方法的问题。
• 开发一种系统化、可重复且可扩展的方法，用于评估医疗设备特有的网络风险。
• 通过将基于CAPEC的可能性估算与直接专家评估进行比较，验证该方法的准确性。
• 使医疗专业人员能够基于经验证的、数据驱动的风险评分，对安全工作进行优先排序。
• 通过标准化的攻击模式映射，促进在多样化医疗设备生态系统中的风险评估。

提出的方法

• 识别医疗设备中易受攻击的组件，重点关注四类医学成像设备（mid）。
• 列出23种可能针对这些设备的网络攻击。
• 将每种攻击映射至CAPEC（通用攻击模式枚举与分类）本体，实现标准化分类。
• 利用资深医疗信息安全专家（ISEs）小组，基于CAPEC模板估算攻击可能性。
• 通过整合基于CAPEC的可能性估算与资深医疗专家（MEs）的严重性评估，计算综合风险评分。
• 基于整合的可能性-严重性评分对风险进行优先排序，实现可操作的风险管理。

实验结果

研究问题

• RQ1 基于CAPEC的方法能否产生与直接专家评估相当有效的医疗设备网络攻击可能性估算？
• RQ2 基于CAPEC的可能性估算与医疗ISEs提供的直接可能性估算之间的相关性如何？
• RQ3 基于CAPEC的可能性估算与直接专家可能性估算之间是否存在统计学上的显著差异？
• RQ4 TLDR方法能否提高医疗设备安全风险评估的效率与一致性？
• RQ5 将攻击映射至CAPEC在多大程度上提升了医疗设备风险评估的可扩展性与标准化水平？

主要发现

• TLDR方法在基于CAPEC的可能性估算与直接专家评估之间实现了较高的Spearman等级相关性（rho > 0.8），表明具有高度一致性。
• 基于CAPEC与直接专家可能性估算之间的配对t检验未能拒绝原假设（p > 0.05），证实两者之间无显著统计差异。
• 基于CAPEC的方法产生的可能性估算与直接专家评估具有同等有效性，但所需工作量和时间显著减少。
• 该方法使医疗ISEs能够在保持风险评分绝对有效性的同时，就攻击可能性达成共识。
• 将攻击映射至CAPEC使得在多个医疗设备及生态系统中实现了高效、标准化且可扩展的风险评估。
• 结合专家小组对严重性的评估与基于CAPEC的可能性估算，生成了可靠且适用于优先排序的综合风险评分。