Originally published on JS PACS, May 5, 2009.
On April Fool’s Day, the world was set to absorb the wrath of the Conficker worm. After April 1 came and went, many thought the scope of the virus was a hoax, but in yesterday’s edition of Health Imaging & IT, an article reported that Conficker was beginning to make its presence known on medical imaging devices. The article started out making it sound like an MRI scanner was infected, then clarified by saying that engineers monitoring the internet had seen “an imaging machine used to review high-resolution images” reaching out over the internet for instructions, presumably from the programmers who created Conficker. That machine sounds like nothing more than the average 3D workstation that comes with many scanners these days, and that brings me to the point of this discussion: how do you handle virus protection and patch management on your PACS equipment and imaging devices?
Often, actually almost always, vendors of medical imaging equipment don’t let you touch their products when it comes to putting your own software on them. This puts the organization in a precarious position. After some time, the trial anti-virus software installed on the workstation expires, leaving the device unprotected. Even when it is protected, the AV software isn’t regularly updated, so the virus definitions aren’t current. I think it is time for vendors to start allowing us to put our organizational anti-virus software on these devices.
Patch management is also a problem. Microsoft released a security patch for the Conficker worm, but vendors often don’t supply users with such patches in a package that can be easily installed on their devices. As system administrators, we can go install them ourselves, but then we are faced with the vendor potentially withdrawing support because we installed unapproved software on the device.
So, is it the responsibility of the vendor to develop better methods of applying anti-virus protection and patch management, or do we, as system administrators, take it upon ourselves to deploy these protective measures on our equipment?
Reference: “Conficker computer virus snakes its way into medical devices,” HealthImaging.com, May 2009.