In medical devices, risk management is expected to be an ongoing activity, which is considered, controlled and documented across all phases in the life of a product, from the initial conception to development and testing, market authorization, post-market use, and through to end-of-life and retirement.
When cybersecurity risk is not effectively managed throughout the life of the device, it can lead to issues including a medical device failing to deliver its therapeutic benefit, a breach in the confidentiality, integrity, and availability of medical device data, or malicious unauthorized access to the medical device and the network it operates on.
Medical Device Cybersecurity - 25 Probing Questions
Questions that will be asked during product registration, regulatory inspection or customer audit:
- Has cybersecurity been considered in the design of your medical device? Have principles of inherently safe design (e.g. security by design; quality by design) been used to reduce cybersecurity risks to patient safety?
- Does the intended use of your device expose it to risks associated with cybersecurity (e.g. will your device connect to networks, will it transmit data)?
- How will any cyber risks be managed?
- Is there a risk that a cybersecurity vulnerability may lead to your medical device compromising the health and safety of the user (patient or operator)?
- Is that risk acceptable?
- Is there a risk that your device could compromise the safety and health of other people (e.g. could your device compromise a biomedical network with other connected medical devices?)
- Is it reasonable to expect intended users would have the appropriate technical knowledge, experience, education, or training to use your device in a way that minimizes cybersecurity risk?
- Is the device adequately secured to limit the risk of falsification, impersonation, or suppression of data generated?
- Do you know the generally acknowledged state of the art for cybersecurity for this type of product or the products it connects to and does your product meet this?
- Have you conducted a risk assessment to identify cybersecurity-related risks associated with the use and foreseeable misuse of your device and have you eliminated or minimized these risks?
- Does this risk assessment consider risks associated with the implementation of selected security controls (e.g. application of security patches to devices post-market)?
- Does the risk assessment consider the risk of potential intrusion based on the projected level of cybersecurity threat during the expected life of the device and identify possible mitigations/strategy during design?
- Does your device have the capability to detect, notify, and log cybersecurity issues and raise an alarm if at risk?
- Is the cybersecurity of the device able to be regularly maintained? Will your device require patches/updates to its software to maintain acceptable and safe performance? How will updates be delivered, verified, and are accessories required?
- If your medical device is intended to be used in combination with other devices, equipment, or accessories, has consideration been given to how the intended performance of the medical device might be impacted by cybersecurity vulnerabilities in other devices or other networks? How can risks posed by other devices be mitigated?
- Are there environmental conditions that need to be considered to minimize the risks associated with the use of the medical device? What are the essential environmental security controls, e.g., isolation, firewalling, intrusion detection systems, etc.?
- Could a cyber exploit affect the measurement accuracy, precision, and stability of the medical device? Is the integrity of the data vulnerable to cyber-attacks? If measurements become inaccurate, could this result in harm to a patient?
- Are appropriate cybersecurity controls in place to ensure the applicable confidentiality, integrity, and availability of information collected by the device? How will a user become aware of any issues with regards to this information?
- Can the performance, reliability, and repeatability of the device be impacted by cyber vulnerabilities?
- Are there alarm systems to indicate a power failure or warn the user of possible patient harm? Can the integrity of these alarms be altered by adversaries? Is there an appropriate system alarm in place for known vulnerabilities?
- Are there unique cybersecurity conditions that need to be considered for active implantable medical devices, especially with regards to programming interfaces?
- Does the information provided with the device explain how to use the device safely with regards to minimizing potential cybersecurity implications? Is the format and structure (free text, structure, or machine-interpretable) of the information provided appropriate to the expected audience?
- What cybersecurity measures, specific to the device, are recommended/required for networks that this device connects to?
- Does the information provided with your device explain to users how to maintain cybersecurity for the device, how to know if cybersecurity has been compromised and the steps to take during and after a cyber incident? Is there a risk associated with applying security updates?
- Is providing cybersecurity information and instructions for maintenance and use adequate to explain how to use the device safely, or does the user require education as well?
Learn More
We can assist in establishing enterprise-wide processes to manage medical device cybersecurity, creating design features that enable postmarket management of security risk, and implementing processes to manage device security patching.
Fundamentals
CIA Triad
The CIA triad represents the three pillars of cybersecurity: confidentiality, integrity, and availability, as follows.
Confidentiality – preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
Integrity – guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity
Availability – ensuring timely and reliable access to and use of information
NIST
NIST published version 1.1 of the Cybersecurity Framework in April 2018 to provide guidance on protecting and developing resiliency for critical infrastructure and other sectors. The framework core contains five functions, listed below
- Identify – develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities
- Protect – develop and implement appropriate safeguards to ensure delivery of critical services
- Detect – develop and implement appropriate activities to identify the occurrence of a cybersecurity event
- Respond – develop and implement appropriate activities to take action regarding a detected cybersecurity incident
- Recover – develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident
Establishing a Medical Device Cybersecurity Program
Step 1: Prioritize and Scope. The organization identifies its business/mission objectives and high-level organizational priorities. With this information, the organization makes strategic decisions regarding medical device cybersecurity implementations and determines the scope of systems and devices that support the selected business line or process.
Step 2: Position. Once the scope of the medical device cybersecurity program has been determined for the business line or product, the organization identifies related systems and assets, regulatory requirements, and overall risk approach. The organization then consults sources to identify threats and vulnerabilities applicable to those systems and assets.
Step 3: Create a Current Profile. The organization develops a Current Medical Device Cybersecurity Profile.
Step 4: Conduct a Risk Assessment. This assessment could be guided by the organization’s overall product risk management process or previous risk assessment activities. The organization analyzes the operational environment in order to discern the likelihood of a cybersecurity event and the impact that the event could have on medical device. It is important that organizations identify emerging risks and use cyber threat information from internal and external sources to gain a better understanding of the likelihood and impact of cybersecurity events.
Step 5: Create a Target Profile. The organization creates a Medical Device Cybersecurity Target Profile that focuses on the assessment describing the organization’s desired cybersecurity outcomes. It is important to understand that a Target Profile should be created for each medical device or family of medical devices.
Step 6: Determine, Analyze, and Prioritize Gaps. The organization compares the Current Profile and the Target Profile to determine gaps. Next, it creates a prioritized action plan to address gaps – reflecting mission drivers, costs and benefits, and risks – to achieve the outcomes in the Target Profile. The organization then determines resources, including funding and workforce, necessary to address the gaps. Using Profiles in this manner encourages the organization to make informed decisions about medical device cybersecurity activities, supports risk management, and enables the organization to perform cost-effective, targeted improvements.
Step 7: Implement Action Plan. The organization determines which actions to take to address the gaps, if any, identified in the previous step and then adjusts its current cybersecurity practices in order to achieve the Target Profile.