I was talking to a healthcare organization recently that was in utter disappointment over their new CAT scan machine. When deployed, the machine was already infected with malware, and the bug spread to other systems in the organization. Pre-installed malware is never something you expect to deal with in a new machine, but it can and does happen – probably more than you think.
As more and more evidence points to the fact that every major U.S. organization has been the target of organized cyber crime, it begs the question: Who is involved in the manufacturing process, delivery and installation of these machines? With so many parties involved – from the sub-components, to the building of specialized devices, software providers, integrators, and resellers – any one of them could have, even inadvertently, introduced the gift of malware. We all try our best, but without a single point of contact, how do you really know that what you are about to plug into your network is healthy?
The obvious recommendation is to verify, scan for viruses, and validate the firmware, bios and software of any new system prior to giving it full rights to the environment. This step should always be done as a precaution to ensure that both intentional and unintentional deliveries of infected components are thwarted. If you ever encounter malware, push hard on all parties involved in the manufacturing, delivery and installation of these systems, letting them know what your expectations are. At minimum, they are responsible for clean components, as well as their vendors’ actions.
In the end, it’s not just about protecting your environment. It’s about pushing for lasting change in how all parties involved perceive their roll in protection and security. For our part, McAfee is working with all industries and manufacturers on how advanced security technologies like Integrity Control and Deep Defender can provide trusted execution, helping to solve the issue of device and component security.
By Kim Singletary
