Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen

Tietotekniikkaa sisältävät lääkintälaitteet pitävät meidät hengissä, jos kehomme pettää. Esimerkiksi ostoskeskuksissa olevat älykkäät defibrillaattorit antavat maallikoillekin mahdollisuuden antaa tehokasta ensiapua sydänkohtaukseen. Tietotekniikan käyttäminen lääkintälaitteissa tuo mahdollisuuksie...

Full description

Bibliographic Details
Main Author: Kallio, Heli
Other Authors: Informaatioteknologian tiedekunta, Faculty of Information Technology, Informaatioteknologia, University of Jyväskylä, Jyväskylän yliopisto
Format: Master's thesis
Language:fin
Published: 2017
Subjects:
Online Access: https://jyx.jyu.fi/handle/123456789/55153
_version_ 1826225740157288448
author Kallio, Heli
author2 Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia University of Jyväskylä Jyväskylän yliopisto
author_facet Kallio, Heli Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia University of Jyväskylä Jyväskylän yliopisto Kallio, Heli Informaatioteknologian tiedekunta Faculty of Information Technology Informaatioteknologia University of Jyväskylä Jyväskylän yliopisto
author_sort Kallio, Heli
datasource_str_mv jyx
description Tietotekniikkaa sisältävät lääkintälaitteet pitävät meidät hengissä, jos kehomme pettää. Esimerkiksi ostoskeskuksissa olevat älykkäät defibrillaattorit antavat maallikoillekin mahdollisuuden antaa tehokasta ensiapua sydänkohtaukseen. Tietotekniikan käyttäminen lääkintälaitteissa tuo mahdollisuuksien lisäksi uhkia. Tässä tutkielmassa perehdytään siihen, miten standardit ja testaaminen edistävät kyberturvallisuutta, uhkien torjumista. Ensin tehdään katsaus kirjallisuuteen ja standardeihin ja sitten kytketään tieto käytäntöön testaamalla potilasmonitoria kirjallisuuden pohjalta. Tulos oli, että tutkittava potilasmonitori oli hyvin avoin fyysisen käyttöliittymän kautta. Esimerkiksi potilastiedot olivat saatavilla ja muokattavissa kirjautumatta. Tietoliikenneyhteyksien kautta laitteeseen ei juurikaan saatu yhteyttä. Monitori läpäisi osan kirjallisuudesta valituista vaatimuksista. Muutaman vaatimuksen täyttämisestä ei voida olla varmoja, sillä kehittäjille oli annettu niiden suhteen valinnanvapautta ja kaikkia vaihtoehtoisia tapoja ei testattu. Potilasmonitori oletti fyysisesti läsnä olevan käyttäjän luotettavaksi, joten siihen pääsy tulisi estää asiattomilta henkilöiltä. Toinen vaihtoehto on olla säilyttämättä potilastietoja laitteessa. Standardit eivät ratkaise kaikkia turvallisuusongelmia, mutta ne tukevat määrittelemällä turvallisuudelle vähimmäistason. Silloin voimme luottaa tarvitsemamme lääkintälaitteen olevan riittävän turvallinen. Medical devices with information technology keep us alive if our body gives way. For example, smart defibrillators enable a nonprofessional to give effective first aid in case of a heart attack. Using information technology in medical devices bring possibilities but also threats. This study looks into the way standards and testing contribute to cybersecurity and controlling threats. First, there is a review into the literature and standards and then this knowledge is connected to practice by testing a patient monitor based on the literature. The result was that the studied patient monitor is very open when used through its physical interface. For example, patient information was accessible and could be edited without signing in. There was practically no connection to be made through its telecommunications links. The monitor passed some of the requirements picked from the literature. Whether the monitor passed was unclear with a couple of the requirements as those gave developers some freedom and not all the possibilities were tested. The patient monitor assumed a physically present user to be reliable so unauthorized people should be prevented accessing it. Another option would be to not keep patient information in the device. Standards won’t solve all security problems but they support by defining minimum level of security. This way we can rely on the medical devices we need to be secure enough.
first_indexed 2024-09-11T08:49:52Z
format Pro gradu
free_online_boolean 1
fullrecord [{"key": "dc.contributor.advisor", "value": "H\u00e4m\u00e4l\u00e4inen, Timo", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.advisor", "value": "Kovanen, Tiina", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Kallio, Heli", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2017-08-23T08:26:17Z", "language": "", "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2017-08-23T08:26:17Z", "language": "", "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2017", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1719997", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/55153", "language": "", "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Tietotekniikkaa sis\u00e4lt\u00e4v\u00e4t l\u00e4\u00e4kint\u00e4laitteet pit\u00e4v\u00e4t meid\u00e4t hengiss\u00e4, jos kehomme\r\npett\u00e4\u00e4. Esimerkiksi ostoskeskuksissa olevat \u00e4lykk\u00e4\u00e4t defibrillaattorit antavat maallikoillekin mahdollisuuden antaa tehokasta ensiapua syd\u00e4nkohtaukseen. Tietotekniikan k\u00e4ytt\u00e4minen l\u00e4\u00e4kint\u00e4laitteissa tuo mahdollisuuksien lis\u00e4ksi uhkia. T\u00e4ss\u00e4 tutkielmassa perehdyt\u00e4\u00e4n siihen, miten standardit ja testaaminen edist\u00e4v\u00e4t kyberturvallisuutta, uhkien torjumista. Ensin tehd\u00e4\u00e4n katsaus kirjallisuuteen ja standardeihin ja sitten kytket\u00e4\u00e4n tieto k\u00e4yt\u00e4nt\u00f6\u00f6n testaamalla potilasmonitoria kirjallisuuden pohjalta. Tulos oli, ett\u00e4 tutkittava potilasmonitori oli hyvin avoin fyysisen k\u00e4ytt\u00f6liittym\u00e4n kautta. Esimerkiksi\r\npotilastiedot olivat saatavilla ja muokattavissa kirjautumatta. Tietoliikenneyhteyksien kautta laitteeseen ei juurikaan saatu yhteytt\u00e4. Monitori l\u00e4p\u00e4isi osan kirjallisuudesta valituista vaatimuksista. Muutaman vaatimuksen t\u00e4ytt\u00e4misest\u00e4 ei voida olla varmoja, sill\u00e4 kehitt\u00e4jille oli annettu niiden suhteen valinnanvapautta ja kaikkia vaihtoehtoisia tapoja ei testattu.\r\nPotilasmonitori oletti fyysisesti l\u00e4sn\u00e4 olevan k\u00e4ytt\u00e4j\u00e4n luotettavaksi, joten siihen p\u00e4\u00e4sy tulisi est\u00e4\u00e4 asiattomilta henkil\u00f6ilt\u00e4. Toinen vaihtoehto on olla s\u00e4ilytt\u00e4m\u00e4tt\u00e4 potilastietoja laitteessa. Standardit eiv\u00e4t ratkaise kaikkia turvallisuusongelmia, mutta ne tukevat m\u00e4\u00e4rittelem\u00e4ll\u00e4 turvallisuudelle v\u00e4himm\u00e4istason. Silloin voimme luottaa tarvitsemamme l\u00e4\u00e4kint\u00e4laitteen\r\nolevan riitt\u00e4v\u00e4n turvallinen.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Medical devices with information technology keep us alive if our body gives way.\r\nFor example, smart defibrillators enable a nonprofessional to give effective first aid in case of a heart attack. Using information technology in medical devices bring possibilities but also threats. This study looks into the way standards and testing contribute to cybersecurity and controlling threats. First, there is a review into the literature and standards and then this\r\nknowledge is connected to practice by testing a patient monitor based on the literature.\r\nThe result was that the studied patient monitor is very open when used through its physical interface. For example, patient information was accessible and could be edited without signing in. There was practically no connection to be made through its telecommunications links. The monitor passed some of the requirements picked from the literature. Whether the monitor passed was unclear with a couple of the requirements as those gave developers some freedom\r\nand not all the possibilities were tested.\r\nThe patient monitor assumed a physically present user to be reliable so unauthorized people should be prevented accessing it. Another option would be to not keep patient information in the device. Standards won\u2019t solve all security problems but they support by defining minimum level of security. This way we can rely on the medical devices we need to be secure enough.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Heli Kallio (helmaaka) on 2017-08-23 08:26:16.694199. Form: Pro gradu -lomake (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/pro-gradu-lomake). JyX data: [jyx_publishing-allowed (fi) =True]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2017-08-23T08:26:17Z\r\nNo. of bitstreams: 2\r\nURN:NBN:fi:jyu-201708233535.pdf: 1548708 bytes, checksum: 9d5acbd1e8fea86d90d3c6ed425a7b03 (MD5)\r\nlicense.html: 4819 bytes, checksum: 308e193a8221a3211f8a17b3793ece6c (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2017-08-23T08:26:17Z (GMT). No. of bitstreams: 2\r\nURN:NBN:fi:jyu-201708233535.pdf: 1548708 bytes, checksum: 9d5acbd1e8fea86d90d3c6ed425a7b03 (MD5)\r\nlicense.html: 4819 bytes, checksum: 308e193a8221a3211f8a17b3793ece6c (MD5)\r\n Previous issue date: 2017", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (77 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "fin", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "medical devices", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "embedded computing", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "cyber security", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "cyber security standards", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "cyber security testing", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "Internet of things", "language": null, "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "L\u00e4\u00e4kint\u00e4laitteiden kyberturvallisuuden standardit ja testaaminen", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201708233535", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Informaatioteknologia", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Tietotekniikka", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Mathematical Information Technology", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2017-08-23T08:26:17Z", "language": "", "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": "fi", "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "602", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "l\u00e4\u00e4kint\u00e4laitteet", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "sulautettu tietotekniikka", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "kyberturvallisuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "potilasturvallisuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "standardit", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "testaus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "esineiden internet", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
id jyx.123456789_55153
language fin
last_indexed 2025-02-18T10:56:22Z
main_date 2017-01-01T00:00:00Z
main_date_str 2017
online_boolean 1
online_urls_str_mv {"url":"https:\/\/jyx.jyu.fi\/bitstreams\/311bc019-7868-4822-9988-6ffd056c58ec\/download","text":"URN:NBN:fi:jyu-201708233535.pdf","source":"jyx","mediaType":"application\/pdf"}
publishDate 2017
record_format qdc
source_str_mv jyx
spellingShingle Kallio, Heli Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen medical devices embedded computing cyber security cyber security standards cyber security testing Internet of things Tietotekniikka Mathematical Information Technology 602 lääkintälaitteet sulautettu tietotekniikka kyberturvallisuus potilasturvallisuus standardit testaus esineiden internet
title Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
title_full Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
title_fullStr Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
title_full_unstemmed Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
title_short Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
title_sort lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
title_txtP Lääkintälaitteiden kyberturvallisuuden standardit ja testaaminen
topic medical devices embedded computing cyber security cyber security standards cyber security testing Internet of things Tietotekniikka Mathematical Information Technology 602 lääkintälaitteet sulautettu tietotekniikka kyberturvallisuus potilasturvallisuus standardit testaus esineiden internet
topic_facet 602 Internet of things Mathematical Information Technology Tietotekniikka cyber security cyber security standards cyber security testing embedded computing esineiden internet kyberturvallisuus lääkintälaitteet medical devices potilasturvallisuus standardit sulautettu tietotekniikka testaus
url https://jyx.jyu.fi/handle/123456789/55153 http://www.urn.fi/URN:NBN:fi:jyu-201708233535
work_keys_str_mv AT kallioheli lääkintälaitteidenkyberturvallisuudenstandarditjatestaaminen