A slide show that details the updates the FDA has made to Post Market Management of Cybersecurity in the Medical Device field

1. Cybersecurity in Medical
Devices
Post Market Management
Safis Solutions

2. The Problem
• More and more Medical Devices are
being designed to be networked
with other patient care systems
Ø Networked devices include software that may
be vulnerable to cybersecurity threats
• Safety and Effectiveness Impact
• Risk to Public Health
Ø

3. The Impact
• Compromised Device Functionality
• Loss of Data Availability or Integrity
Ø Medical
Ø Personal
• Exposure of other connected devices
or networks to security threats
Ø All of the above may lead to potential patient
illness, injury, or death

4. Scope
• Software containing Medical Devices
• Software that is a Medical Device
Note: Guidance Not Applicable to Experimental or Investigational
Devices

5. The Solution - FDA’s
Expectation
• Holistic
Ø Includes the entire Product Lifecycle of the device
– from conception to obsolescence
• Not just a point-in-time intervention
Ø Continual monitoring, including post market
Ø E.g. Monitoring vulnerabilities inadvertently
introduced during patch releases
• Device Manufacturers responsible
Ø Proactive, not reactive, posture expected from
manufacturers
Ø Active, voluntary participation in an ISAO
ISAO: Information Sharing Analysis Organizations, per Executive
Order # 13691, released 13th Feb 2015

6. FDA’s Guidance
• Cybersecurity for Networked Medical
Devices containing OTS Software
Ø Jan 14, 2005
• Content of Premarket Submissions for
Management of Cybersecurity in
Medical Devices
Ø Oct 2, 2014
• Post Market Management of
Cybersecurity in Medical Devices
(Draft)
Ø Jan 22, 2016
Purchasing
Post market
monitoring
Design

7. Key Themes
• Collaboration
• ISAO Participation
• Shared Responsibility
Ø Cognate terms for collaboration and sharing occur
24 times in the document
• Proactive approach
• Risk based approach
• Essential Clinical Performance
Ø This term occurs 58 times in the document
Ø Idea borrowed from IEC 60601-1, but ‘clinical’
added in this document
You approach your
cybersecurity program with
this…
…to preserve
this.

8. Collaboration – Key
Communities
Healthcare
Delivery
Organizations
(HDOs)
Clinical User
Community
Medical
Device
Community
IT Community
ISAO

9. Collaboration – product view
User
IT System
Integrator
Health IT
Developers
IT Vendors
Manufacturer
ISAO

10. Collaboration
• Advantages
Ø Sharing of established resources
• Standards; Guidelines; Best practices;
Frameworks
Ø Consistent threat assessment & mitigation
• Outputs
Ø Develop a Cybersecurity Risk Management
Culture
Ø Establish a Common Understanding
• Goal
Ø Device safety is preserved
Ø Device effectiveness is not compromised

11. Comprehensive Cybersecurity
Program
• NIST Framework for improving critical
infrastructure cybersecurity
Ø Identify
Ø Protect
Ø Detect
Ø Respond
Ø Recover
•
http://
www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.p

12. Identify
• Define Essential Clinical Performance
• Identify Cybersecurity Signals
•

13. Protect / Detect
• Assess and Characterize Vulnerability
• Analyze Risk (Threat Modeling)
• Analyze Threat Sources
• Incorporate Threat Detection
Capabilities
• ‘Impact Assess’ all Devices
•

14. Protect / Respond / Recover
• Assess Compensating Controls
Ø Detect / Respond
• Mitigate Risk of Essential Clinical
Performance
•

15. End Note
• The NIST Framework is mentioned here at
the very highest level
• The purpose of its mention is to simply
raise an awareness
• A separate slide deck is warranted to
delve deeper into what it is and how it
can be implemented
• Individuals are encouraged to ask
questions or provide comments on the
FDA guidance on post market
management of cybersecurity in medical
devices until April 21st of 2016