Medical device development and cybersecurity are crucially linked. Internet of Things (IoT)-enabled devices for diagnostics and patient care are on the rise, as are cyber attacks seeking to leverage their security vulnerabilities. To ensure medical devices don’t create risk for their users, medical device cybersecurity risk management needs to be carefully considered at every stage of their lifecycle.
This is because medical devices contain, or provide access to, incredibly valuable personal information hackers are looking to exploit. The value of a medical record on the black market is anywhere from $100 to $1000.
In response to the growing attacks leveraging medical devices, regulatory bodies require manufacturers to implement cybersecurity risk management processes at every stage of a device’s lifecycle.
In this article, we’ll look at the importance of cybersecurity risk management for medical devices and how risk is managed at every stage of a device’s lifecycle.
The Importance of Cybersecurity Risk Management in Medical Devices
Cyber risk management is the process used by organizations and governments to identify, categorize, assess, and manage cyber risks. For medical devices, this process involves identifying potential security vulnerabilities that could impact the safety and effectiveness of the devices, as well as the people and organizations that use them.
These risks are real—82% of healthcare organizations have experienced a cyberattack due to medical device (IoT) vulnerabilities. The impact of cyber incidents involving medical devices are costly to hospitals, health organizations, and pose serious, life-threatening risks to patients.
Security vulnerabilities in medical devices are understandably complex, as risk can be introduced at each stage of a devices life cycle leading to serious, harmful events. IBM’s 2023 Cost of a Data Breach report indicates that healthcare is the top target for online criminals and tends to last 231 days before discovery.
As a result, there are strict risk assessment and management processes OEMs, users, and stakeholders must adhere to ensure a device is as low risk as possible at every stage of its life.
Regulatory bodies and standards that address cybersecurity risk assessment in medical devices include:
- U.S. Food and Drug Administration (FDA)
- ISO 14971
- IEC 62304
- ANSI
Note: This is not a comprehensive list of regulations. Devices must meet security risk requirements depending on the region it will be used in, its medical class, the functions they are designed to perform, and other factors.
Simplify Compliance with Global RegulationsTap into exceptional regulatory and clinical consulting services. |
Cybersecurity Risk Management Throughout a Device’s Lifecycle
To effectively manage medical device cybersecurity risks, comprehensive security measures and risk assessments must be integrated at every stage of a medical device’s lifecycle. Not only does this safeguard its users against risk, it increases its ability to meet FDA approval—the average FDA approval rating for medical devices is just 45%.
Measures must be taken during design and development, production, deployment, post-market, and when decommissioning a medical device.
Design and Development Phase
During this stage, a risk assessment is tailored to ensure devices are built using secure software and firmware, threat vector identification, and to instill the appropriate traceability measures.
Two components central to attaining these goals are the Secure Product Development Framework (SPDF) and Software Bill of Materials (SBOM)
Secure Product Development Framework (SPDF)
Incorporating a Secure Product Development Framework (SPDF) in device development helps OEMs ensure that security is a fundamental part of the design and development process.
SPDF is crucial to achieve FDA requirements that a device is “secure by design” and includes threat modeling, security architecture, and cybersecurity-specific testing.
Software Bill of Materials (SBOM)
Traceability and a clear outline of all open source and third party components used in a device’s codebase is crucial to the long-term security of a medical device. This helps in managing and mitigating vulnerabilities that could be introduced through these components, regardless of its age, and is also a requirement of the FDA.
Production Phase
Risk assessments in the production phase of a medical device address cybersecurity risks within the supply chain, manufacturing processes, and in the implementation of security measures within the device itself. These are to ensure medical devices are resilient against cybersecurity threats, such as this event reported by LivaNova in late 2023.
The FDA’s document, Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions, last updated in September 2023, provides guidance on how to approach cybersecurity risks medical device cybersecurity risk assessments during the production phase of a cyber device.
It addresses security within:
- Manufacturing processes of a medical device
- Supply chain risks and traceability
- Secure coding practices
- Regular security audits during manufacturing
| Other articles on medical device development: |
Deployment Phase
Once deployed, a medical device becomes exposed to security vulnerabilities and threats resulting from network integrations, IAM misconfigurations, physical damage and theft, interoperability problems, and more.
Managing cybersecurity risks during deployment involves ensuring that proper network and data system configurations are established, connected communication pathways are secure, as well as establishing regular security assessments and testing schedules to evaluate and monitor security risks to be used during post-market surveillance.
Key medical device cybersecurity risk management practices during the deployment stage include:
- Network security: Ensure secure integration with hospital networks through firewalls, encryption, and intrusion detection systems.
- Proper configuration: Create secure information and access management processes, disable unnecessary services.
- Interoperability testing: Ensure security measures aren’t reduced or compromised when a device is integrated with other systems including other devices, communication systems, and databases.
- Physical security: Install devices in secure environments with tamper-evident seals and access controls.
- Continuous monitoring: Implement systems to continuously monitor and respond to security incidents.
- Regular updates: Perform regular updates of software and security patches.
Post-Market Surveillance
After deployment, ongoing monitoring and management of cybersecurity risks are crucial to ensure the continued safety and effectiveness of medical devices. Cybersecurity threats evolve, and new vulnerabilities can emerge over time, necessitating a robust post-market surveillance strategy.
Post-market medical device cybersecurity risk assessments are established based on the following:
- FDA Guidance on Postmarket Management of Cybersecurity in Medical Devices
- ISO 14971:2019 Medical Devices – Application of Risk Management
| Cybersecurity Risk Assessment for Medical Devices: Post Market Tasks | |
| Continuous Monitoring | Continuous monitoring is required post deployment to identify new vulnerabilities and security threats before they can be exploited by hackers. |
| Regular Updates and Patch Management | Outdated software can become a target for cyber attacks. Medical device OEMs must establish a process for timely software and firmware updates to address newly discovered vulnerabilities. |
| Incident Response and Recovery | An incident response plan must be created for all cyber medical devices. In the event of a cyber incident, this plan outlines steps for identifying, containing, and mitigating security incidents.
This should include procedures for communicating with affected users and recovering from cyber attacks to restore device functionality and security. |
| User Training and Awareness | Develop training and educational resources to healthcare professionals and end-users on best practices for device security, including recognizing phishing attempts, securing access credentials, and understanding the importance of regular updates. |
| Vulnerability Reporting and Management | Establish a system for users and researchers to report vulnerabilities. This should include a process for assessing and responding to reported issues in a timely manner, ensuring that vulnerabilities are patched and communicated effectively. |
Decommissioning Phase
At the end of a medical device’s life, any sensitive, protected, and health data must be securely erased before disposal or refurbishment. This is to prevent data from being accessed by unauthorized users or exploited by cybercriminals.
Media sanitization of medical devices should be done in accordance with NIST SP 800-88 Rev. 1 guidelines.
Manage Medical Device Cybersecurity Risks from the Ground Up
Since the integration of the internet and software into medical devices, development of these innovative and essential tools has changed drastically. Addressing safety concerns is no longer just about ensuring devices are safe for patient use, researchers must now create devices that are safe for physical and digital use.
Navigating these new foundations is complex; and not incorporating risk assessment processes at an early stage can lead to project failure.
At Vantage MedTech we can provide a way forward. We are an ISO 13485-certified company and our product development services incorporate cybersecurity consulting that can help ensure your Class I, II, or III device is as safe as possible—and meets every security regulatory requirement—from inception to decommissioning.
Visit us today to learn more.
