Cybersecurity of Connected Diabetes Devices: Threats and Standards

This report delves into the critical topic of cybersecurity for insulin pumps and other connected diabetes devices. It highlights the increasing risks associated with the remote connectivity of these devices, including unauthorized access, malware, and DDoS attacks, emphasizing the potential for serious health complications. The report explores the importance of data classification, integrity, and accessibility, and discusses the CIA triad (confidentiality, integrity, and availability) as a core principle. It examines various cybersecurity measures such as encryption, hashing, and redundant systems. The report also references the Cybersecurity Standard for Connected Diabetes Devices Program, led by the Diabetes Technology Society (DTSec), which aims to establish standards and guidelines to ensure the safety and security of these devices. It underscores the need for both front-end performance mandates and post-market surveillance to maintain a high level of cybersecurity. The report concludes by emphasizing the importance of a proactive approach to protect patient data and device functionality.

Cybersecurity 1
Insulin Pumps & Hacks
Submitted By
Course
Professor
Date

Cybersecurity 2
Abstract
Diabetes devices are progressively associated remotely to each other and also to data reader
devices. Risks that are associated with data flow as well as commands can have the functions of
the diabetic devices and also keep the clients in danger of wellbeing complications. The
cybersecurity of associated diabetes devices is important to look after classification, integrity as
well as accessibility of the information and the commands given to the devices. These devices
could be hacked by the unauthorized operators and furthermore by patients themselves to remove
information that are not consequently given result programming. The unauthorized access to
associated diabetes devices has been reenacted and could occur as possible. Cybersecurity
standard outlined particularly for associated diabetes devices and enhance the security of these
items as well as enhance the certainty of clients that the items will be secure. (Klonoff, D., C.,
2015).
Introduction
The diabetic devices are utilized for observing as well as overseeing diabetes give the advantages
to save the lives of patients and viable usage alternatives to healthcare suppliers. These diabetic
devices incorporate blood and constant glucose monitor, insulin pumps, pens as well as other
insulin providing devices, and also close the loop that is artificial pancreas frameworks. While
having enhanced availability and exchanging data between these diabetes devices to other
devices like using mobile phones, and the Internet, there is an enhanced risk to the security and
privacy of the patient and to the uprightness of the healthcare supplier. (DTSec Standard
Version, 2016).

Cybersecurity 3
Insulin Pumps & Threats
The insulin pumps incorporate an imbuement pump having remote interface that helps to deliver
insulin, which is continuous glucose monitoring system having glucose measurement, and a
remote control that patients can utilize to modify their imbuement pump settings. It can be
possible to deliver insulin over a ceaseless 24 hour time span to keep blood glucose in a good
position amongst the meal as well as the night progressed. The concerned risks for insulin pumps
incorporate unauthorized access like a vindictive actor that blocks as well as alter signals which
is sent remotely to a medicinal device; malware, a malignant software program intended to do
unsafe activities; and DDoS assaults which can be propelled utilizing a system infection to
overpower a device that slows down or hinder the device function. By giving hackers some
information through distributed published device check data which includes range, radio
frequency transmission information as well as device workings that are accessible on patent
databases. (Madary, J., 2016).
Cybersecurity Course
Northern California-based Diabetes Technology Society is driving the charge, with cybersecurity
being a main topic for insulin pumps. The main cybersecurity course for insulin pumps are as
following:
1. We can avoid the danger by switching off the pump's radio frequency features. This implies
that our pump and meter can never communicate with each other, and blood glucose levels
should be entered physically on the pump.

Cybersecurity 4
2. The principle at the center of data security for the secure usage, data flow, and capacity of data
is the CIA triad. CIA remains for classification, uprightness, and accessibility. (Cluley, G.,
2016).
3. The main function of data confidentiality is to guarantee that data is accessible just to the
people who are approved to access the information.
4. When the process of encryption as well as protocols are executed accurately, at that point there
is no danger to the information being decoded without the key.
5. One approach to guarantee the integrity is with hashing. A hash value (or just hash),
additionally called a message process, is the number created from a string of content, which fills
in as a computerized signature.
6. A typical strategy for guaranteeing accessibility is to build redundant frameworks.
7. A Cybersecurity Standard for Connected Diabetes Devices Program is required. Such a
program would unite driving specialists in diabetes and cybersecurity from the scholastic,
government, and private areas. The objective is build up a standard to fit specialized
determinations, guidelines, strategies, and meanings of diabetes devices identified with
cybersecurity and to promise patients that these items are protected.
8. The most ideal approach to guarantee cybersecurity of diabetes device is to mandate a level of
execution at the front end with the end goal that inability to achieve this execution would prompt
antagonistic administrative or financial outcomes.

Cybersecurity 5
9. We can also test the item in a post market observation program at the back end to guarantee
that the device is proceeding to keep up its underlying level of execution.
10. DTSec plans to give producers as well as controllers with a productive, standardized way to
deal with viably manage the threat that is inferable from cybersecurity dangers. (Klonoff, D., C.,
2015).
References
Klonoff, D., C. (2015). SAGE Journals. Cybersecurity for Connected Diabetes Devices.
http://journals.sagepub.com/doi/abs/10.1177/1932296815583334
Diabetes Technology Society - Standard for Wireless Diabetes Device Security (DTSec). DTSec
Standard Version 1.0 – May 23, 2016. https://www.diabetestechnology.org/dtsec-
standard-final.pdf
Madary, J. (2016). Addressing Cyber Security Vulnerabilities and Threats to Implantable
Medical Devices. IEEE Journals.
http://www.wise-intern.org/journal/2016/documents/Jen_Madary_Paper.pdf
Cluley, G. (2016). Our insulin pumps could be hacked, warns Johnson & Johnson.
https://www.welivesecurity.com/2016/10/06/insulin-pumps-hacked-warns-johnson-
johnson/