By Vincentas Baubonis, Head of Security Research at Cybernews
The recent discovery of a backdoor in the Contec CMS8000 patient monitor – revealed by CISA – should be a wake-up call for anyone in the cybersecurity or healthcare sectors. This is not a rare, isolated issue.
A report by the US Government Accountability Office (GAO) highlighted that, as of January 2022, 53% of connected medical devices and other Internet of Things devices in hospitals had known critical vulnerabilities, emphasizing the widespread nature of this problem.
These findings indicate that many of the devices we rely on in healthcare are very vulnerable. Specifically, the CMS8000 backdoor allows remote access, potentially enabling attackers to manipulate vital signs monitoring or leak sensitive patient data without detection. And as terrifying as this case is, it’s just one example of a much broader, deeply ingrained problem.
Let’s talk numbers. According to the Cybernews Business Digital Index, the healthcare industry is performing terribly when it comes to cybersecurity. A full 22% of analyzed healthcare companies scored a D in security, and nearly half – 48% – earned an F. Only 5% of the sector’s organizations reached an A. With an average security score of just 69, healthcare comes in dead last when it comes to cybersecurity. That should make everyone in this field sit up and take notice.
The reality is, medical devices like the Contec CMS8000 aren’t being designed with the security they require. With more and more devices connecting to the internet and sharing sensitive data, this is a ticking time bomb. Healthcare organizations are failing to enforce the most basic security measures. In the worst cases, manufacturers are shipping devices with poorly coded firmware that’s vulnerable to remote manipulation – leaving hospitals, doctors, and patients exposed. Devices bought by critical sectors should be evaluated technically before acquisition and potential risks associated with them must be managed and mitigated by the buyer.
Medical devices like the Contec CMS8000 often lack essential security features, making them vulnerable to cyber threats. As more devices connect to the internet and handle sensitive patient data, the risks increase significantly. Reports from regulatory agencies, including the FDA and CISA, have repeatedly highlighted security flaws in medical devices, including vulnerabilities that allow remote access and data exposure.
In some cases, manufacturers ship devices with outdated or insecure firmware, exposing healthcare providers and patients to potential cyberattacks. To mitigate these risks, healthcare organizations must enforce stricter security evaluations before procurement, ensuring that all devices meet established cybersecurity standards and that identified vulnerabilities are promptly addressed.
Medical devices need to be treated with the same rigor as any other critical infrastructure. But far too often, the focus is on getting the device to market quickly, not securing it properly. This oversight has immediate consequences: data breaches, privacy violations, and, in the worst cases, loss of life.
So, what needs to happen now? First and foremost, cybersecurity must be baked into the design and testing of every medical device. Manufacturers must adopt a security-first mindset, regularly updating their devices and using secure coding practices to eliminate these vulnerabilities before they hit the market. Healthcare providers, too, must take ownership by ensuring their networks are secure and implementing strong access controls on all connected devices.
This is not a problem that can be solved with band-aid fixes. It’s time for a fundamental shift. If the healthcare industry doesn’t start prioritizing cybersecurity across the board, incidents like the CMS8000 backdoor will continue to be just the tip of the iceberg, especially against the backdrop of rising state-backed cyberattacks.
ABOUT THE EXPERT
Vincentas Baubonis is an expert in Full-Stack Software Development and Web App Security, with a specialized focus on identifying and mitigating critical vulnerabilities in IoT, hardware hacking, and organizational penetration testing. As Head of Security Research at Cybernews, he leads a team that has uncovered significant privacy and security issues affecting high-profile organizations and platforms such as NASA, Google Play, and PayPal. Under his leadership, the Cybernews team conducts over 7,000 pieces of research annually, publishing more than 600 studies each year that provide consumers and businesses with actionable insights on data security risks.
Guest Post: Embracing Diversity in Education: Insights from Nelson Authors Coleen and Greg Birkett
Posted in Commentary with tags Nelson on February 20, 2025 by itnerdHow to include Black experience and diverse perspectives in learning
February 2025
In helping educators plan for Black History Month and their lessons all year round, Nelson, Canada’s leading and longest standing education content provider, has updated a series of content in Edwin, the company’s digital learning platform.
Earlier this month, Nelson authors and brother-and-sister team Greg Birkett (history and English teacher, guidance counsellor, author and poet) and Coleen Birkett (teacher, writer and author) shared some of their thoughts with Nelson in a video interview addressing the following questions:
A few takeaways from Greg and Coleen:
Some practical tips for inclusion for educators:
For the complete interview, visit:
In a recent conversation on The Dr. Vibe Show, Coleen and Greg responded to a question about how they felt about having a special platform to openly speak and teach about Black existence and its place in the world.
They said, “We are trying to have it woven into every fabric of our curriculum so it isn’t just a special month or a special class. Right now, we do have a Grade 12 course that speaks about the Black Canadian experience. We both co-authored a textbook with Rosemary Sadlier which is being used in some school boards here in Ontario and Nova Scotia. What we want to do is to take a cross-curricula approach, from kindergarten, when children are most ready, open and willing to learn and make it age appropriate, all the way up to Grade 12. We don’t want it to be a special platform; we want it to be a natural, organic part of the curriculum. It is Canadian history, it’s not Black Canadian history being taught in February in a particular class for kids with vested interest. It needs to be woven into every subject, across disciplines and across curriculum from K-12.”
Live Lesson: “Every Voice Counts: Equity in Education”
On February 26, 2025, Nelson will host a Live Lesson called “Every Voice Counts: Equity in Education” for teachers and students where they will talk about how bias shapes our educational experiences. The lesson will highlight the importance of inclusion and fairness in education and how they impact our daily lives. Through real-world examples and interactive discussions, they will uncover why inclusion matters, how to recognize and challenge bias, and the steps we can take to ensure every student feels valued and heard.
Register today: https://classroomsuccess.as.me/everyvoicecounts
Resources for Black History Month and All Year Round
Teachers are having to do a lot more than ever and to bear more responsibility. They need accurate, vetted and consistently high quality content so they can design lessons to accommodate individual students’ education needs. Edwin contains Canadian curriculum-aligned content that teachers can use – among other resources – to plan their lessons, not having to worry about relying on GenAI, Google search or purchasing non-Canadian materials.
Please see the three collections in Edwin for users (see screen shots here):
Black Canadian Communities
Black Canadian Culture
Black Legacy and Leadership (previously called Black Excellence)
Did you know?
About Nelson
For over a century, Nelson has worked in partnership with Canadian educators to develop quality resources that are tied to curricula and that meet provincial learning expectations. As Canada’s largest education content provider, Nelson dedicates its business efforts to the creation of quality, innovative solutions that empower learning success by supporting the needs of every student and educator. For more information, visit https://www.nelson.com/.
To learn more about Edwin, visit https://www.edwin.app/.
1 Comment »