Design with security in mind

To be successful in healthcare, the industry requires proof of value – and designing medtech devices requires cybersecurity from step one.

image of security

AdobeStock_395355885
© MedCrypt | https://www.medcrypt.com

Driven by the need to reduce costs, improve efficiency, and enable secure data sharing among care providers and patients, the healthcare industry has been on a steady path of increasing connectivity between systems. Today, medical devices are connected to hospital networks and hospital networks are connected to the Internet. Traditionally, devices were protected because they were operating on stand-alone, separated networks. Now, patients and clinicians demand interoperable devices and sharing of data, which necessitates connectivity. This exposes hospital networks, including medical devices, to cyber threats.

A study conducted by Cynerio and the Ponemon Institute, surveying experts in leadership positions at 517 healthcare systems, demonstrated that 43% of respondents suffered at least one data breach in the prior 24 months with IoT/IoMT devices being involved in 88% of the cases. Three out of four infusion pumps delivering medications and fluids to patients have cybersecurity flaws, putting them at increased risk of being compromised by hackers, according to a new study by Palo Alto Networks’ Unit 42 threat research service.

Guidelines, regulations
Healthcare regulators have recognized this problem and are acting within the bounds of authorities, trying to curb the risks without hampering innovation and speed to market. For years, the U.S. Food and Drug Administration (FDA) and other global regulators have been establishing clear guidelines for the industry. FDA published pre- and post-market cybersecurity guidelines, but these guidelines and the FDA’s current regulatory authority were insufficient to demonstrably reduce cybersecurity risks.

To address the need for expanded regulatory action, Congress granted the FDA new legal authority, by passing the Omnibus Bill and giving the FDA explicit authority to require cybersecurity to be built into medical devices as a condition for market approval.

In addition to the FDA’s regulatory authority, lawmakers are seeking to increase regulatory requirements more broadly – from the White House to Congress. However, the challenge for medical device manufacturers (MDMs) is figuring out how to meet the new requirements, while the regulatory environment is still evolving and is expected to continue to change for a while.

It's a question of how
One thing is certain: the FDA plans to enforce its new authorities. In March 2023, the FDA codified its plans to use its new enforcement discretion by publishing its Refuse to Accept guidance. In one of the most concise guidance documents to date, the FDA made it clear: MDMs must demonstrate they’ve taken reasonable steps to show they’ve designed secure products and they have a reasonable plan to maintain these products’ security throughout their lifespan.

This may seem deceptively simple – just build secure devices – but how? Should manufacturers build with strict cybersecurity rules? That’d be easy if cybersecurity didn’t inherently cause tension with device usability and availability. For example, surgical robots should only be used and updated by authorized personnel. While passwords and identity management are common ways to ensure authentication, it's important to note that the authorization of a service technician can be designed as a separate function, independent of how clinicians access a device. This approach can help ensure both security and efficient delivery of medical care, as clinicians can access the device quickly and easily while service technicians can still be authenticated as needed.. Manufacturers need to figure out how to meet FDA requirements without harming product usability or availability – deceptively difficult.

Fortunately, the FDA and IMDRF have provided roadmaps for proactively designing cybersecurity into devices: secure product development life cycle, good encryption, threat modeling, and security testing. In short, apply a secure product development framework (e.g., the Joint Security Plan). While this approach may require many MDMs to make major changes to their organizational framework, the processes and procedures are relatively well-known outside of healthcare. The most difficult problem is the lack of cybersecurity expertise available for each device; manufacturers need solutions that apply cybersecurity best practices to medical device designs and builds without requiring a cyber expert on every build.

Once the device is proactively built with security by design, its security must be maintained through time. MDMs must produce software updates at reasonable intervals to address newly discovered vulnerabilities. There are two potential strategies for a post-market cybersecurity management plan. The first is updating the software frequently whenever vulnerabilities are present; with low vulnerability tolerance. The second is updating software less frequently, knowing vulnerabilities will inevitably exist in the system, but tolerating the vulnerabilities unless they have a high impact on patient safety. Major software producers such as Microsoft and Apple use the first strategy. Most MDMs selling hospital-based equipment use the second strategy. The second approach is non-optimal for security but has historically been optimal for devices operated by hospitals behind biomedical network firewalls. Now that the FDA has explicitly discouraged depending on network security as a primary defense, the optimal approach may have changed.

Ensuring medical device security requires a comprehensive approach that includes both over-the-air (OTA) updates from manufacturers and sound decision-making about vulnerabilities. OTA updates require investment in encryption and PKI as well as a sustaining engineering team to produce regular updates, while vulnerability analysis requires manufacturers to determine critical uncontrolled risks and produce software updates accordingly. This is the approach of Microsoft, Apple, and Tesla.

Currently, manufacturers can analyze vulnerabilities one at a time. Some are working on triaging vulnerabilities at scale, but the work is new. There are efforts to provide data standards (e.g., SBOM, VEX, SSVC) for the exchange of information about vulnerabilities as the volume of known vulnerabilities is ever-increasing. While efforts are being made to provide data standards for the exchange of vulnerability information, automating post-market vulnerability risk assessment remains an unsolved challenge.    

Medical devices have a critical role to save lives, treat diseases, diagnose, and improve the quality of life. The emergence of Internet connectivity in medical devices has brought new opportunities for innovation but also introduces risks. Recognizing this, global regulators have taken appropriate action by requiring manufacturers to explicitly address cybersecurity as an integral part of the overall value proposition of a device.

The healthcare industry is accustomed to change, constantly innovating, and knows how to handle risk. Ultimately, patients and citizens usually benefit from this healthy regulatory-industry tension. The industry is already reorganizing, re-optimizing, and placing bets on the next wave of clinical innovations, ideally with security in mind from the start.

MedCrypt

Get curated news on YOUR industry.

Enter your email to receive our newsletters.
Loading...