CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump

Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by fabulist on Monday May 04, 2015 @08:06PM (#9490087)

Security necessarily comes in layers. Some will fail; hopefully not all of them. Adding protections at the hardware part of the stack is a fantastic idea, but insufficient for something lives are literally, directly depending on.

Medical devices do need to be accessed. Diagnostics need to be performed to make sure they're functioning. Sometimes batteries even need to be changed. Insulin pumps and the like need to be given more medicine, and the dosage may need to be adjusted. Et cetera.

[ Parent | on HN ]

Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by TheLoneWolfling on Monday May 04, 2015 @08:32PM (#9490209)

Diagnostics are a good example of something that can be separated from the actual safety-critical stuff. Have a dumb output from the safety-critical processor that the radio interface can read.

If you're changing batteries or medicine, you're going to be accessing the device physically anyways, and so can change settings / dosages then.

Et cetera.

[ Parent | on HN ]

Re:CVE-2015-3459 – Hospira Lifecare PCA Infusion Pump by DasIch on Tuesday May 05, 2015 @04:49AM (#9491486)

A battery change of a pacemaker or an ICD is required every 6 years or so, if not later. You may need to change settings far earlier than that.

[ Parent | on HN ]