Data Enrichment and Sharing

Leveraging deep packet inspection, optional active scanning and, AI engine, MDefend auto identifies and classifies all medical devices and assets deployed with a network to form an accurate, live inventory.

This granular visibility includes the device's type, vendor, model, as well as version and hardware IDs (MAC, SN).

The system provides further visibility into the traffic flows of the devices and its interactions with its own ecosystem. Device-specific risk assessments are conducted based on known vulnerabilities detected threats, and the assembled insights are used to stitch together a composite view, assessing the risk of the business as a whole. 

This data is then pushed by MDefend into Cisco ISE, boosting its classification capabilities and providing a single porthole from which all network devices can be monitored and managed. Both systems — MDefend and Cisco ISE — continuously communicate with each other, creating a sort of data feedback loop that refines and enriches their shared functionality.

Smart Isolation

MDefend doesn't only provide real-time visibility into devices, their workflows, and concomitant risk levels, but leverages that insight to the tune of effective attack prevention. In effect, Cisco ISE executes and enforces rules according to the security policies generated by MDefend. The result is that attacks are torpedoed before they can ever take hold. 

In two words, this advantage can be described as “smart Isolation”. Smart isolation intelligently segments a fleet of medical devices into groups, and provides an access policy for each of those groups. Smart isolation is predicated on access policies tailored to each group so as to permit legitimate and operationally justified network access to the devices in that group, while blocking all other attempts to connect to, communicate with, or otherwise remotely interface with those devices. 

Comprehensive Visibility

The Cisco ISE-MDefend integration provides a single point of view (Cisco ISE) from which to manage all devices, replete with clinical device classifications, courtesy of CyberMDX’s AI engine.

What's more, bringing these two platforms together delivers a purpose-specific solution designed specifically for clinical engineers, as well as healthcare security and IT teams; providing in-depth visibility into medical device behaviors, risk profiles, and threat landscapes.

Accelerated Segmentation Processes

For non-TrustSec infrastructure, MDefend groups devices to VLANs and ACL assignments per algorithmic insights refined by years of industry expertise. In this way, a medical network can be duly segmented and layers of protection can be imposed beyond the perimeter.

For TrustSec based infrastructures, MDefend sorts assets into Security Groups, working through Cisco ISE to create and maintain the Security Group Tags, map assets to Security Groups and compile Security Group-Access Control Lists.

A group of SIEMENS MRIs, for example, will consist of MRI machines by Siemens. The SGACL between this group and other groups will allow DICOM communication corresponding to various SGs of Workflow and PACS servers, and CDPs, and incoming management traffic (such as ssh, ftp, telnet) corresponding to privileged SGs. No other communication will be allowed between members of this group nor to other groups (such as Ultrasound machines or infusion pumps).

In this manner, the security apparatus is designed and refined to shield specific (usually high risk) devices using discretionary Access Control Lists. In parallel, MDefend continuously monitors the hygiene of the network, making sure that segmentation and governance doesn't degrade over time.

Attack Response at a Click

Of course, preventative controls are of little use if your system has already been infiltrated or compromised — or if the preventative solution is rolled out piecemeal or deployed incompletely. For that, you're going to require rapid detection and response capabilities. Here too, CyberMDX and Cisco have you covered.

Empowered by MDefend insights and Cisco controls, you can be in real time when an active threat is detected and be guided through the process of quarantine the affected device(s) in response to an attack (via Change of Authorization).