Addressing the Inevitable: Managing Medical Device Cybersecurity Risks
JoAnne Bronikowski
Cybersecurity threats are among the fastest growing risks for devices connected to private or public networks. Because of this, regulators, including the US Food and Drug Administration (FDA) and the European Medicines Agency, now require medical device developers to include cybersecurity in risk management programmes for any device that could be connected to a network or another device, whether public or private, wired or wireless. (1, 2, 3)
Network connections potentially expose medical devices to threats from many sources – not just through a local router or server in a hospital or medical office, but from any computer, tablet, smart phone or even smart lightbulb connected to the Internet anywhere in the world. Therefore, regulators view cybersecurity as a shared responsibility.
They expect a risk management plan that incorporates input not only from patients, providers, health facilities and device manufacturers, but also from general information technology (IT) software and hardware developers, Internet service providers and commercial cybersecurity firms.
Regulators require cybersecurity risk management plans to cover the entire life of the device, from development and testing throughout its use by healthcare professionals and/or with patients. Plans should address the gamut of potential threats, including deliberate or accidental disruption of device function, interference with data transfer between devices and servers, and any exposure of private medical data, or patient location or identity.
And because hackers are an inventive lot, cybersecurity plans must be continually updated. Probable future threats should be identified and current threats monitored, and new mitigation strategies adopted. These could include hardware changes or software patches, as well as changes in user operating procedures, as required throughout a device’s life cycle.
All this sounds complicated, and it does require significant expertise. However, the FDA and other organisations, notably the US National Institute of Standards and Technology (4), offer detailed guidance for what should be included in a medical device cybersecurity risk management plan, as briefly described here.
Protections to ensure device security
“Defence in depth” is a fundamental concept for ensuring information integrity that should guide any medical device cybersecurity plan. It calls for multiple layers of defence, installed throughout an IT system, that protect against unauthorised entry.
For a connected medical device, protection begins with data encryption, and restrictions on what data could be accessed and by whom. In general, data only should be made available if there is a good reason for it. For example, patients might be able to obtain heart rate information from a pacemaker, but should not be granted access to adjust the device, whereas physicians and technicians might have access to both.
Use of public and private encryption keys, strong unique passwords, positive user identification, user access tracing and access timeouts after a set period of inactivity are additional security layers that should be incorporated into the plan’s design from the outset. These protections should be applied to all types of potential data connections including cellular modems, Wi-Fi, Bluetooth, NFC and even RFID devices, as well as any wired connection such as USB ports or telephone jacks.
In addition to the device itself, the security of any server or other device it connects to, along with any intermediary device, must be addressed. For example, if an insulin pump connects via a cell phone to a server in a physician’s office, the cell phone and Internet connections, as well as the receiving server, should be encrypted and protected against unauthorised use.
More importantly, early consideration should be paid to preventable errors caused by human factors, such as the sharing of passwords. Finally, physical security, such as keeping servers in a locked room, should be mandatory to protect devices and data.
Detection and recovery
Additionally, a cybersecurity plan should include mechanisms for detecting when unauthorised access has occurred. An example includes alarms for unauthorised entry or multiple access attempts, which could indicate an attempted takeover. A responsible party should be appointed to respond to any intrusion as required.
A recovery plan is essential, and recovery features should be built into devices and the ecosystems in which they function. These could include the ability to reboot a device that has been compromised and to recognise authentic drivers for the device. Data backups should be maintained to restore compromised devices. These have been especially useful in cases of ransomware attacks, where hospitals and other organisations have been able to recover needed data from backups after a primary system was encrypted and held for ransom.
What the FDA wants
Current FDA advice on cybersecurity is not binding, but does cover specific features of a cybersecurity plan for connected devices, including:
- Plan for software maintenance and updates, and cybersecurity risk management
- Identification of assets, threats, vulnerabilities and cybersecurity requirements
- Assessment of potential threats – updated throughout the device’s lifecycle – in terms of their impact on device function and their effect on patients
- Mitigation strategies and procedures for preventing unauthorised access and related harms, and recovering from those that occur
- Documentation of plan, vulnerability and mitigation assessments, security requirements, risk management, data integrity controls and user instructions
Partnering with organisations that understand the complexity of cybersecurity risks and how to address them, as well as what regulators now require, can help keep your device and its users safe from attacks. This cybersecurity checklist will help you to assess how well equipped you are to meet today’s cybersecurity needs. For information on how ICON cybersecurity experts can help build the safeguards into your devices and operations, contact us.
(1) Cybersecurity for Networked Medical Devices Containing Off the-Shelf (OTS) Software. FDA, Jan. 14, 2005.
(2) Content of Premarket Submissions for Management of Cybersecurity in Medical Devices. FDA, October 2, 2014.
(3) Post-market Management of Cybersecurity in Medical Devices. FDA, Dec. 28, 2016.
(4) Framework for Improving Critical Infrastructure Cybersecurity, draft version 1.1. National Institute for Standards and Technology, January 10, 2017.