The document discusses AAMI TIR 57, which provides guidance on bi-dimensional risk analysis for medical devices that considers both security and safety risks. It notes that threats and vulnerabilities are often discovered after a device is released, so security risks must be continually evaluated. The document advocates using a customized "LEGO-like" operating system with advanced process management, firewall whitelisting, and minimized components to reduce cybersecurity risks and eliminate the need for operating system upgrades. This customized approach aims to create a more stable, secure system focused only on approved medical device processes.

1. 1
AAMI TIR 57 Bi-dimensional Risk Analysis
Security and safety design
Antonio Bartolozzi
antonio.bartolozzi@bartolozzi.it 25/11/2019

2. 2antonio.bartolozzi@bartolozzi.it
Electronic programmable systems – Essential principles of
safety and performance
state of the art
use harmonized
Standards,
and state of the art,
to demonstrate that products, services
or processes comply with Essential principles
of safety and performance.
EN 60601-1
EN 62304
EN 14971
EN 82304
EN 62366
ISO 80001-1
ISO 80001-2-1
ISO 80001-2-2
ISO 80001-2-4
AAMI TIR57/Ed. 1,
Principles for medical
device security—Risk
management
GAMP5, CANADA 2019
cybersecurity guidance,
Australian TGA medical
device cybersecurity
guidance, NIST, AAMI, UL
29000 , ISO 2700X ...
risk management
AAMI TIR57/Ed. 1
17.2. For devices that incorporate software or for software
that are devices in themselves, the
software shall be developed and manufactured in
accordance with the state of the art
including information security,verification and validation.
taking into account the principles of development life cycle,

3. 3antonio.bartolozzi@bartolozzi.it
AAMI TIR 57
Bi-dimensional
Risk Analysis

4. 4antonio.bartolozzi@bartolozzi.it
AAMI TIR 57
Because threatschange over timeand new vulnerabilities in operating systems
middleware and components are discovered
on regular basis security risks are frequently identified
after a device is released to the market
Example : operating system vulnerability

5. 5antonio.bartolozzi@bartolozzi.it
Operating System
Operating system vulnerability
Spo2
96
%
NIBP 250/105
mmHg
HR 120
bpm
High blood Pressure John Doe
Vulnerability
Attack
USE AAMI TIR57

6. 6antonio.bartolozzi@bartolozzi.it
AAMI TIR57 Security  Safety
Risk : OS Vulnerability
Security Risk
Control
constantly update operating system
Safety Risk : Medical device in uncontrolled environment
Not acceptable safety risk
Safety risk analysis
Security risk analysis

7. 7antonio.bartolozzi@bartolozzi.it
AAMI TIR57 Risk Analysis – Safety  Security
OS Vulnerability
Safety Risk Control
Release updated OS only after complete test
Security Risk : Medical Device exposed to an attack for a long time
Not acceptable Security risk
Security Risk analysis

8. 8antonio.bartolozzi@bartolozzi.it
There is NO Acceptable Risk control"
There is NO Acceptable Risk control
Change Design

9. 9antonio.bartolozzi@bartolozzi.it
Change design
New Opering
system barriers
Use LEGO-like
Operating system
• Strong firewall whitelist based
• Advanced Operating System Process
Manager
Minimize
Operating
system

10. 10antonio.bartolozzi@bartolozzi.it
Example - Windows Embedded
Customized
Operating system
Low memory usage  10 MB!
Not standard port and service !
(old)
Less ComponentsLess Memory
more stability
less cyber-attacks

11. 11
firewall whitelisting
OS
ATTACK OS Driver
OS Filter
Guardian
Kill
NAK
White list
Software Antivirus
API Access
There is no need of os upgrade
Manufacturer knows al right
processes and right
operations of the system