GxP Lifeline
Cybersecurity in Medical Device Development
For medical device manufacturers, technology can be a double-edged sword. The technologies that elevate the quality of life for patients can be used by cybersecurity bad actors to potentially harm patients or undermine the organization using the device as well as the device itself.
The vast interconnectivity of medical devices is widening the attack surface of the public health sector. Intrusions and breaches are possible because of weaknesses in a medical device’s cybersecurity design. Medical device vulnerabilities that are not identified and remediated before the device goes to market can serve as access points for entry into a health care facility’s network, which leads to compromising data confidentiality and integrity as well as potential patient safety.
That said, security now needs a seat at the design table, accompanied by its own list of requirements. Many cybersecurity weaknesses are a result of poor design choices and lack of clear requirements. Having a security expert who is familiar with medical device development review the device’s requirements and architecture can uncover security vulnerabilities, which can be mitigated during development long before the product goes into manufacturing.
The strongest cybersecurity risk control is to use secure by design principles to eliminate the vulnerabilities. The next strongest risk control category is a protective system where the security threat can be detected, responded to, and recovered, so the risk does not materialize. The weakest cybersecurity risk controls are labelling and instructions. All three of these categories of risk controls can be used to manage cybersecurity risks in medical devices.
Effective security by design depends on the ability to understand and stay on top of cybersecurity issues to maintain the safety and security of devices, data, and users. One of the biggest challenges with medical device development is infrastructure diversity. Devices are designed, manufactured, configured, and deployed using various programming languages, operating systems, databases, networks, and hardware platforms. This means vulnerabilities can be anywhere.
One common issue that can lead to vulnerabilities is when devices still use legacy operating systems that are no longer supported by the companies that developed them. Health care organizations can mitigate these vulnerabilities by restricting access and monitoring for threats on the network where the device is connected.
It is not possible to have a completely secure device. But with a well-planned design along with full visibility of product development and the supply chain, companies can strengthen their device’s security posture. Also, cybersecurity must be monitored and maintained throughout the device’s life cycle. As new vulnerabilities are discovered, the device will require cybersecurity patches and updates. Just because something is not exploitable today does not mean it will not be exploitable in the future.
The following resources identify specific areas to focus cybersecurity efforts throughout the product’s life cycle.
International Medical Device Regulators Forum (IMDRF)
The IMDRF published the guidance “Principles and Practices for Medical Device Cybersecurity.” The document provides recommendations to help all stakeholders minimize cybersecurity risks across the product’s total life cycle. According to the guidance, medical device cybersecurity is a shared responsibility among all stakeholders, including the manufacturer, health care providers, users, and regulators. All stakeholders must understand their responsibilities and work closely with one another to continuously monitor, assess, mitigate, communicate, and respond to potential cybersecurity risks and threats throughout the life cycle of the medical device.1
Technical Information Report 57 (TIR57) and TIR97
TIR57 is a cybersecurity standard for medical devices. The guidance, titled “Principles for Medical Device Security—Risk Management,” was published by the Association for the Advancement of Medical Instrumentation (AAMI). It provides recommendations on integrating cybersecurity risk management into the overall development of the device. TIR57 is closely modeled after ISO 14971 for safety risk management, which specifies the terminology, principles, and processes for risk management of medical devices.
TIR57 also works in conjunction with TIR97, which provides guidance for addressing postmarket security risk management within the risk management framework defined by ANSI/AAMI/ISO 14971. Both TIR57 and 14971 touch on the postmarket phase at a high level. TIR97 expands on the foundation established in TIR57 and focuses on establishing security risk management for the postmarket phase of the product’s life cycle.
Recognizing the need for protection of medical devices in an increasingly digitized world, the U.S. Food and Drug Administration (FDA) added TIR57 to its list of recognized consensus standards. Device manufacturers who implement it can expect to have all the information expected by the FDA in place for premarket submissions.2
NIST Framework for Improving Critical Infrastructure Cybersecurity
The National Institute of Standards and Technology (NIST) is an agency within the Department of Commerce that promotes innovation for enhancing science, business, technology, and economic security. The organization produced a document called the “Framework for Improving Critical Infrastructure Cybersecurity,” which assists companies in improving the security of their infrastructure.
The framework is useful for any organization no matter what type or level of cybersecurity it currently employs. The framework is not intended to replace a company’s current cybersecurity strategy. Instead, it advises organizations on identifying their current cybersecurity posture, determining a target state for cybersecurity efforts, and developing a plan for progressing toward the target state.3
Open Web Application Security Project (OWASP)
OWASP is a nonprofit organization that works to improve the security of software. The OWASP Top 10 is a standard awareness document for developers that provides information about the most current critical security risks to web applications. As part of their approach to security, companies can incorporate the OWASP findings and recommendations into their security practices. The OWASP list is routinely updated to stay up to date with the ongoing advances in technology.4
FDA Cybersecurity Recommendations
According to the FDA’s guidance on premarket submissions for cybersecurity, a trustworthy medical device:
- Contains hardware, software, and/or programmable logic that is reasonably secure from cybersecurity intrusion and misuse.
- Provides a reasonable level of availability, reliability, and correct operation.
- Is reasonably suited to performing its intended functions.
- Adheres to generally accepted security procedures.
The agency’s Quality System Regulation (QSR) suggests that software device manufacturers employ a risk-based approach to the design and development of medical devices, which includes setting up appropriate cybersecurity protections. Using this approach, the FDA encourages device manufacturers to:
- Identify assets, threats, and vulnerabilities.
- Assess the impact of threats and vulnerabilities on the device’s functionality, end users, and patients.
- Assess the likelihood of a threat as well as the likelihood of a vulnerability being exploited.
- Determine risk levels and suitable mitigation strategies.
- Evaluate residual risk and risk acceptance criteria.
Implementing these design controls improves the likelihood that the FDA will find your device meets its applicable statutory standard for premarket review.5
To effectively combat the ongoing cybersecurity threats, companies should have a clear definition of responsibilities for all relevant stakeholders regarding infrastructure, policy development, and communication. To achieve this, regulatory agencies along with cybersecurity experts strongly advocate effective and unified collaboration across the enterprise. Using a platform-based quality management system (QMS), companies easily manage design control, risk, changes, suppliers, etc. from a single platform. This way, all stakeholders can have an appreciable impact on the transformation of the product throughout its design, development, and postmarket life cycle.
References:
- “Principles and Practices for Medical Device Cybersecurity,” International Medical Device Regulators Forum (IMDRF) Medical Device Cybersecurity Working Group, Mar. 18, 2020.
- “Standards for Medical Device Cybersecurity in 2018,” Sean Yuan, Anura Fernando, David C. Klonoff, Journal of Diabetes Science and Technology, Mar. 24, 2018.
- “Framework for Improving Critical Infrastructure Cybersecurity,” National Institute of Standards and Technology (NIST), April 16, 2018.
- “OWASP Top Ten,” Open Web Application Security Project (OWASP), Current version 2017.
- “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices,” Draft Guidance, U.S. Food and Drug Administration (FDA), Oct. 18, 2018.
Seyed Khorashahi is Executive VP of Medical Devices and Chief Technical Officer (CTO) for Regulatory Compliance Associates Inc. (RCA). He has more than 25 years of experience leading R&D teams in all aspects of developing safety-critical medical devices. Khorashahi held leadership positions at Covidien (Medtronic), Baxter, and Beckman Coulter Inc., and has an extensive background in medical device product development, quality systems, regulatory affairs, and mergers and acquisitions. Other core competencies include engineering and business strategy.
Khorashahi has significant domain expertise in U.S. Food and Drug Administration (FDA) and EU standards, as well as in software systems and hardware development for medical devices.
