On April Fool’s day, the world was set to absorb the wrath of the Conficker worm. After April 1st came and went, many thought the scope of the virus was a hoax but in yesterday’s edition of Health Imaging and IT, an article ran that spoke of the Conficker worm beginning to make its presence known on medical imaging devices. The article started out by making it sound like an MRI scanner was infected but then clarified the statement by saying that engineers who were monitoring the internet said that, “an imaging machine used to review high-resolution images was reaching out over the internet to get instructions - presumably from the programmers who created Conficker” (HealthImaging.com , 2009). Well, this machine sounds like nothing more than the average 3D workstation that comes with many scanners these days and that brings me to the point of this discussion, how do you handle virus protection and patch management on your PACS equipment and imaging devices?
Often, actually, almost always, vendors of medical imaging equipment don’t let you touch their products with regards to putting your own software on their equipment. This puts the organization in a precarious position. After some time, the trial virus software installed on the workstation expires, leaving the device un-protected. Even when it is protected, the AV software isn’t regularly updated so the virus definitions aren’t current. I think it is time for the vendors to start allowing us to put our organizational anti-virus software on these devices.
Patch management is also a problem. Microsoft released a security patch for the Conficker worm but often, vendors don’t supply uses with these patches in a package that can be easily installed on those devices. As system administrators, we can go install them ourselves but we are then again faced with the vendor potentially not supporting us by saying we installed unapproved software on the device.
So, is it the responsibility of the vendor to develop better methods of applying anti-virus protection and patch management solutions or do we, as system administrators, take it upon ourselves to deploy these protective measures on our equipment? Weigh in on this topic in the JSPACS Forum.
References: http://www.healthimaging.com/index.php?option=com_articles&view=article&id=17323:conficker-computer-virus-snakes-its-way-into-medical-devices
