Sternum
A New Paradigm in Medical Device Security

Medical devices are increasingly connected to the internet and hospital networks to improve the ability of healthcare providers to monitor and treat patients. The flip side is that they also introduce new cybersecurity risks. Just like any other computer system, these devices are vulnerable to security threats that could impact the device itself, its user, or the network environment. Given the fact that IoT security has historically not been able to meet the ecosystem standards, hackers are taking full advantage of their vulnerabilities.

To put things in perspective, here are a few data points from the latest FBI’s Private Industry Notification on the topic of medical devices:
● 53% of internet of medical things (IoMT) devices have known critical vulnerabilities

● 33% of healthcare IoT devices have an identified critical risk

● 40% of medical devices are at the end-of-life stage, offering little to no security patches

Acknowledging the above, over the last few years, regulators have been actively updating the cybersecurity standards for medical device manufacturers (MDR, the PATCH Act, and FDA guidelines), calling for a ‘secure by design’ approach, which ensures that devices are shipped with security features built in.

This brings IoMT device manufacturers to where “traditional” IT has been for years and creates an urgency to incorporate on-device security (XDR and RASP). Unfortunately, the solutions to cater to the need are missing, largely because of how technically difficult it is to bring such advanced security models to the diversified IoT ecosystem and because of the limited resources available on the device level. This is where Sternum comes in.

Working with leading medical device manufacturers, including Medtronics, Sternum’s team created a security platform that meets the unique requirements of IoMT devices and regulatory bodies. Using patented technology, it instruments any medical device’s operating system and firmware, as well as third-party binary libraries, to ensure security and deliver fullstack protection for known and unknown (zero-day) threats.

The on-device solution works at runtime, guaranteeing the integrity of memory and code execution, stopping nearly all IoMT exploits in their tracks. It also gathers real-time insights into the performance, health, and operation of connected devices to help detect gaps and other security exposures.

It uniquely works within the constraints of IoMT devices and their environment.

“For medical devices, just like in other industries, when it comes to product security, the buck stops with the device manufacturer,” says Igal Zeifman, VP of Marketing at Sternum. “Our technology helps medical device manufacturers ship high-quality and high-resilient products, offering an easy and cost-effective way to introduce security into the product, stay on top of the latest regulatory requirements and ensure patient safety.”

To deliver on this promise, Sternum offers several key capabilities. The first is embedded integrity verification (EIV). Acting as the core of Sternum’s security offering, this unique technology leverages binary instrumentation to deploy security “checkpoints” within the device code. With these, it detects all exploitation attempts by preventing all code and memory manipulations in runtime. The deterministic (RASP-like) nature of the solution is a natural fit for IoT/IoMT devices that—unlike more complex systems—are similarly deterministic in nature.

The second capability Sternum has to offer is a powerful XDR-like threat detection engine that augments the EIV deterministic protection with awareness of device and user activity, providing proactive alerts about security gaps, unwanted behaviors, and other suspicious activities.

The third is an observability layer offering real-time monitoring and visibility of the device to provide actionable insights beyond security threats. This capability improves preand post-market quality control and allows for much faster identification of the root cause of in-field performance or quality issues.

“The ability to contribute to security and incident response is rapidly becoming a critical component of procurement decision-making,” says Zeifman. “Sternum enables manufacturers to address this need, build tangible security into their products and ensure that their device will never become a point of compromise.”

Sternum’s outstanding work with some of the world’s largest medical device manufacturers proves it’s creating a new benchmark for IoMT security. The company’s extensive knowledge of embedded systems, combined perspectives of the defender and the attacker, and a desire to raise medical security standards constantly motivate it to develop uncompromising and highly-impact technology that drives real change.