Password911: Authentication Adventures in Healthcare

The talk looks at why passwords and authentication are hard to get right in hospitals, where a locked-out clinician or an unreachable device can directly affect patient care. Matt Weir frames the problem around clinical workflows, arguing that security controls cannot simply get in the way of treatment.

Through case studies, he walks through controlled substance infusion pumps, which often share one lock key across manufacturers, and pacemakers, whose pairing depends on serial-number-based PINs and whose programmers must work offline. He also covers a vulnerability where Wi-Fi credentials were stored unencrypted in flash memory. He found credentials on some purchased equipment, though not on the pump model he opened. Other examples include firmware updates with no signing, service PIN codes listed in manuals, hardcoded remote passwords, and patient apps that verify who a user is but not what that user may access.

His takeaways are that medical devices should be assessed as a whole system, that resilience matters when keys leak, and that threat modeling and standard guidance help manufacturers who lack security staff. He argues the goal is making secure options easy to adopt, while keeping break-glass access available when care depends on it.