Attack Modeling and Mitigation Strategies for Risk-Based Analysis of Networked Medical Devices

Date

2020-01

Authors

Hodges, Bronwyn J.
McDonald, J. Todd
Glisson, William Bradley
Jacobs, Michael
Van Devender, Maureen
Pardue, J. Harold

Journal Title

Journal ISSN

Volume Title

Publisher

Proceedings of the 53rd Hawaii International Conference on System Sciences

Abstract

The escalating integration of network-enabled medical devices raises concerns for both practitioners and academics in terms of introducing new vulnerabilities and attack vectors. This prompts the idea that combining medical device data, security vulnerability enumerations, and attack-modeling data into a single database could enable security analysts to proactively identify potential security weaknesses in medical devices and formulate appropriate mitigation and remediation plans. This study introduces a novel extension to a relational database risk assessment framework by using the open-source tool OVAL to capture device states and compare them to security advisories that warn of threats and vulnerabilities, and where threats and vulnerabilities exist provide mitigation recommendations. The contribution of this research is a proof of concept evaluation that demonstrates the integration of OVAL and CAPEC attack patterns for analysis using a database-driven risk assessment framework.

Description

Paper co-authored by William Glisson that was published by Proceedings of the 53rd Hawaii International Conference on System Sciences in 2020.

Keywords

Machine Learning and Cyber Threat Intelligence and Analytics, cyber threat, medical devices, risk analysis, threat intelligence, vulnerabilities

Citation

Hodges, B., Mcdonald, J., Glisson, W., Jacobs, M., Van Devender, M., & Pardue, H. (2020). Attack Modeling and Mitigation Strategies for Risk-Based Analysis of Networked Medical Devices. Proceedings of the 53rd Hawaii International Conference on System Sciences. Hawaii International Conference on System Sciences. https://doi.org/10.24251/hicss.2020.796