Post Topic: Medical Device Security

Health-ISAC whitepaper highlights cybersecurity responsibilities in medical device lifecycle, focuses on resilience

Written by Julia Annaloro on February 7, 2025. Posted in Health-ISAC, In The News, White Papers.

Health-ISAC published a whitepaper addressing the tasks needed to maintain the cyber resilience of medical devices and how the responsibilities may shift from party to party throughout the total product. As medical devices move through the lifecycle phases, the responsibility for tasks may transfer between the manufacturers and the customer. The Health-ISAC whitepaper identifies that communication between the two parties is essential as the device moves through the lifecycle so that tasks are coordinated, and security gaps within the product are reduced.

Titled ‘Exploring the Cybersecurity Roles of Manufacturers and Healthcare Organizations During the Medical Device Lifecycle,’ the white paper identified that medical devices go through four lifecycle phases, with varying levels of responsibilities placed on the medical device manufacturer and the healthcare delivery organization. Healthcare delivery organizations (HDOs) should perform more regular risk assessments going into end of life (EOL) and end of support (EOS) to determine if they can accept the risk of continued use. It also points out that the responsibility for maintaining a medical device’s cybersecurity posture evolves throughout the lifecycle of a device.

Read the full article in Industrial Cyber. Click Here

Exploring the Cybersecurity Roles of Manufacturers and Healthcare Organizations During the Medical Device Lifecycle

Written by Julia Annaloro on February 4, 2025. Posted in Health-ISAC, Medical Device Security, White Papers.

TLP: WHITE This report may be shared without restriction.
Health-ISAC Members be sure to download the full version of the report from the Health-ISAC Threat Intelligence Portal (HTIP)

Key Judgements

Medical devices go through four lifecycle phases, with varying levels of responsibilities placed on the medical device manufacturer and the healthcare delivery organization.
Healthcare Delivery Organizations should perform more regular risk assessments going into End of Life and End of Support to determine if they can accept the risk of continued use.
The manufacturer implements Security Control Categories in the development phase to ensure that the device is Secure by Design, Secure by Default, and Secure by Demand.
Documentation and Transparency are critical in maintaining cybersecurity. This includes providing detailed security documentation, a Software Bill of Materials (SBOM), and clear communication about vulnerabilities and updates.

Download this white paper.

Exploring The Cybersecurity Roles Of Manufacturers And Healthcare Organizations During The Medical Device Lifecycle
Size : 3.2 MB Format : PDF

Introduction

As medical devices become more interconnected and have internet and wireless communications capabilities, understanding the lifecycle stages and the tasks needed to maintain their security posture will help organizations secure devices against cybersecurity threats. The device lifecycle is the various stages a device will go through, from research and development, on the market, and eventually, end of life and end of support. As medical devices move through the lifecycle phases, the responsibility for tasks may transfer between the manufacturers and the customer. Communication between the two parties is essential as the device moves through the lifecycle so that tasks are coordinated, and security gaps within the product are reduced.

This document explores the tasks needed to maintain the cyber resilience of medical devices and how the responsibilities may shift from party to party throughout the total product. The responsibility for maintaining a medical device’s cybersecurity posture evolves throughout the lifecycle of a device. The process begins with the device manufacturer during the design and development phase and may increasingly shift to the Healthcare Delivery Organization (HDO) once in clinical use. The International Medical Device Regulators Forum (IMDRF) Principles and Practices for the Cybersecurity of Legacy Medical Devices outlines four lifecycle phases. The Food and Drug Administration (FDA) provides requirements for the cybersecurity of medical devices in the pre-and post-market guidance. Manufacturers can address a device’s cybersecurity during design and development using the premarket requirements. Post-market requirements are needed due to cybersecurity risks continuing to evolve after the medical device reaches the market.

AI, Ransomware, and Medical Devices: Safeguarding Healthcare

Written by Julia Annaloro on January 23, 2025. Posted in In The News.

McCrary Institute Cyber Focus Podcast

Host Frank Cilluffo interviews Errol Weiss, Chief Security Officer at the Health Information Sharing and Analysis Center (Health ISAC).

They discuss the evolving cybersecurity challenges in the healthcare sector, including ransomware, supply chain vulnerabilities, and the critical need for better security measures to protect medical devices and patient data. Weiss shares insights from his extensive experience in both healthcare and financial services cybersecurity, highlighting lessons learned, the role of information sharing, and the importance of proactive measures to mitigate risks.

Listen to the podcast on YouTube Click Here

Topics include:

Health and Ransomware
Outages in hospitals
Health cyber budgets
Security and Compliance
Lessons from FS
Future technology
Medical Devices
Cross-sector info sharing
Practical steps toward security

Leveraging ISO 81001-5-1 Amid Medical Device Procurement

Written by Julia Annaloro on November 20, 2024. Posted in Health-ISAC, In The News, Medical Device Security.

Blog by Health-ISAC VP of Medical Device Security, Phil Englert

The ISO 81001-5-1:2021 standard Health software, and health IT systems safety, effectiveness, and security provides guidelines for the cybersecurity of health software and health IT systems, including medical devices. Part 5-1 focuses on security activities in the product life cycle. This standard is critical for ensuring that medical devices are secure by design, protect patient data and maintain the integrity of health care operations.

The Secure Product Development Framework (SPDF) provides manufacturers with a set of processes that, when effectively implemented, can help manufacturers demonstrate a reasonable assurance of safety and effectiveness during the regulatory submission process. Manufacturers should integrate security into each phase of the development process, from design to deployment.

Read the full blog in TechNation here:

Click Here

Enhancing Cybersecurity in Rural Hospitals

Written by Julia Annaloro on November 19, 2024. Posted in Health-ISAC, In The News.

Blog by Health-ISAC VP of Medical Device Security, Phil Englert

Rural hospitals face unique challenges, including financial constraints and staffing shortages.

Between 2010 and 2021, 136 rural hospitals closed, with a Crisis in Rural Healthcare report stating 600 more of the remaining 1,796 are at risk of closing.

HealthIT Security.com reports that “Cyberattacks are pivoting to target smaller health care companies and specialty clinics without the resources to protect themselves, instead of larger health systems that – despite being treasure troves of personal and medical data – generally have more sophisticated security.” Most smaller hospitals are connected to larger systems becoming the “path of least resistance” into those larger health care networks increasing risk on a national level.

Read the full blog in TechNation here.

Click Here

Cyber Incident Response: Playbook for Medical Product Makers

Written by Julia Annaloro on November 15, 2024. Posted in Health-ISAC, In The News.

New HSCC Publication Aims to Help Device, Drug Makers Improve Cyber Response

Read the full article in Healthcare Infosecurity here:

Click Here

Article excerpt:

Medical product manufacturers often face the same cyber incident response challenges as their peers in other industries, such as constraints in skills and technologies, said Phil Englert, vice president of medical device security at the Health Information Sharing and Analysis Center (Health-ISAC), and a contributor to the HSCC playbook.

But manufacturing processes to ensure medical products perform as intended are essential to protecting public health and may require reporting to other government agencies such as the Department of Health and Human Services or the Cybersecurity Infrastructure and Security Agency, he told Information Security Media Group.

For instance, “under section 506J of the Federal Food, Drug, and Cosmetics Act, during or in advance of a public health emergency, manufacturers of certain medical devices must notify the FDA of an interruption or permanent discontinuance in manufacturing,” he said.

“In addition to framing the incident severity assessment in terms of business impact, national security, or civil liberties, the guidance also impacts public health or safety in the incident response planning,” he said.

“Additionally, the guidelines infuse regulatory considerations into the cyber incident response team process, including reporting suspected or confirmed incidents to Health-ISAC and other information-sharing and analysis organizations.”