Cybersecurity for medical devices

Insight in Brief

The integration of software into medical devices is constantly increasing and with it the challenges in cybersecurity. How secure are your devices? For department heads in research, development and regulatory affairs, this is not only a question of compliance, but also of patient safety. Immerse yourself with us in the world of cybersecurity in medical devices and discover solutions to the most pressing problems.

Introduction

Dive deeper into the challenges and solutions of cybersecurity in medical devices and prepare yourself for the future.

Cybersecurity in medical devices: The increasing integration of software in medical devices highlights the importance of cybersecurity.

Regulatory requirements: Understand the regulations of guidelines & international standards and how they affect security in system design.

Cybersecurity Planning & Reporting: Discover why a structured cybersecurity plan and detailed reporting is essential.

Threat Analyses: Learn more about identifying security threats and how vulnerabilities can be analyzed and remediated.

Safety vs. security: Differentiate between the control of technical errors (safety) and the prevention of external attacks (security).

In recent years, we have seen increased reports of cyber-attacks on hospitals and medical facilities. One particularly worrying incident was the attack on the NHS, the National Health Service in England, where patient and health data was encrypted, resulting in a partial disruption to patient care in five emergency departments and the cancellation of thousands of operations. Such incidents make it clear that the boundaries between physical and digital security in the medical sector are becoming increasingly blurred.

Advancing digitalization has led to the increased integration of software in medical devices. From smartphone-based imaging systems that assist in the detection of anomalies in CT scans, for example, to entire hospital information systems, technology has undoubtedly brought many benefits. However, with these advances comes increased cybersecurity concerns. How do we ensure that these devices, which often interact directly with human life, are protected from threats? In this article, we will look at this very question and identify solutions that meet both technical and regulatory requirements.

Cybersecurity in medical devices

It is impossible to imagine countless medical devices without software. As a result, the focus on cybersecurity is becoming increasingly important as it not only offers benefits but also poses risks for patients. To control these, the MDR devotes several lines to cybersecurity. It stipulates by law that a cybersecurity plan, report and cybersecurity risk analysis, known as a threat analysis, must be carried out and documented. The most important points must be completed during development, but the work does not stop there. It is also important to keep the threat analysis up to date and carry out post-market surveillance after the product has been placed on the market.

In the field of medical devices, there is a direct correlation between device functionality and patient safety. An error in an everyday digital device can be annoying, but an error in a medical device can have life-threatening consequences. The confidentiality, integrity and availability of data (according to the CIA model) are not only important for data protection, but directly for the health and well-being of the patient.

Cybersecurity aims to guarantee the confidentiality, integrity and availability of data (see CIA model). It is also about security, which has two meanings in English: safety and security:

Safety = control of technical errors
Functional safety to protect the user from the device (right image, inner circle)

Security = prevention of external attacks
Protection of the device from external attacks (right-hand image, red and white ring)

Figure1: CIA-Model (Confidentiality, Integrity & Availablilty)

Confidentiality
e.g. personal data (patient data)

Integrity
e.g. ensuring that data and systems are unaltered

Availability
e.g. ensuring data and system availability

Regulatory requirements and standards - cybersecurity planning and reporting

The landscape of cybersecurity requirements for medical devices is complex and multi-layered. The first document to be created is the cybersecurity plan. To do this, you need to know which regulatory requirements must be met. Since most of our customers are seeking approval in the EU or North America, the following applies:

MDCG & IEC 60601-4-5: These focus on the cybersecurity design of systems. They describe security levels that are device-specific and require integration into the entire product development cycle.

IEC 81001-5-1 & FDA Premarket Guidance Draft: These focus on the current state of the art and how it is integrated into product development.

AAMI TIR 57:2016: This presents the cybersecurity risk assessment in the context of the ISO14971 structure, which is relevant for the risk management of medical devices.

Exception clinical study under MDR: Here, the protection of privacy and personal data must be ensured. (MDR, Art. 62.4(h))

Best practice is to separate safety and security within cybersecurity. This allows you to focus on cybersecurity and still keep an eye on safety standards. (On the definition sheet 'Safety' & 'Security' are explained again)

Cybersecurity planning and reporting

Once the cybersecurity plan has been approved, the next step is implementation. All implementations are documented in the cybersecurity report. Reference is made to various requirements as well as elements of the threat analysis (risk analysis in the cybersecurity area). In order to maintain an overview, it is helpful to use checklists of individual standards and guidelines.

The last point we will discuss is threat analysis. This starts at the beginning of development together with the risk analysis and continues throughout the entire device lifecycle. Threat analysis deals with security-relevant threats that can be exploited through weaknesses. It considers where the system has vulnerabilities (is vulnerable) and which assets are worth protecting. This makes it possible to determine whether a threat jeopardizes safety.

If this is the case, a mitigation (measure) is required. This must be validated and verified.

Threat analysis can be somewhat confusing at first. For this reason, the thought process described above for identifying threats is shown again graphically below.

In-depth understanding of threat analysis

Threat analysis is at the heart of cybersecurity. The first step is to define the environment in which threat analysis is carried out. Since there is no uniform definition in the standards, this must be defined in a meaningful way. The following figure shows such a proposal:

Threat analysis is about identifying potential threats that could be exploited through vulnerabilities. This analysis considers where the system is vulnerable and which data or functions are worth protecting. Once the threats have been identified, measures can be taken. These are implemented and must then be verified. Cyber security must be ensured by means of penetration tests and fuzzing. After verification and validation, the threat analysis is complete for the time being. However, the development and continuous updating of the threat analysis over the entire life cycle of the device is of crucial importance.

This is illustrated once again by the following examples:

Consider again the case of the NHS in England (from the first section). A year before the devastating cyberattack on the National Health Service, the NHS was made aware of the system's vulnerability. A plan was even established but no targeted implementation of software mitigation was pursued. The threat was recognized but the measures were not implemented. This is a widespread phenomenon, as the study by the Cyber Division of the FBI (as of 2022) shows. The study in hospitals showed that 53% of medical devices have vulnerabilities. This mainly relates to inadequate security measures and the use of outdated software. Here too, the threat has been identified, but the question is whether the measures can be implemented efficiently and effectively before an attack occurs.

The complexity of cybersecurity in medical devices cannot be underestimated, but with a clear understanding of the requirements, a solid plan and sound implementation, risks can be minimized.

Summary

While the integration of software into medical devices offers immense opportunities for innovation and patient care, it also brings with it new and complex security challenges. It is not enough to consider cybersecurity measures only during the development of the device. The dynamic nature of cyber threats requires continuous monitoring and updating of security protocols, even after the device has been launched.

The key points at a glance:

The direct correlation between medical device functionality and patient safety underscores the critical need for cybersecurity.
There are various regulatory requirements and standards that need to be considered during development.
A well-thought-out cybersecurity plan, regular reporting, thorough threat analysis and rigorous testing are essential components of a robust security strategy.
Cybersecurity in medical devices is not just a technical challenge, but an ethical obligation. To ensure patient safety and confidence, organizations must remain vigilant and adapt their strategies to the ever-changing threat landscape.

Are you ready to optimize your cybersecurity strategy? Get in touch with us for a personalized consultation or. Security starts with the right conversation.

Go back