Addressing Cybersecurity Risks in Medical Devices: Challenges and Solutions
Explore the alarming vulnerabilities in medical devices, from pacemakers to infusion pumps, and the potential risks they pose to patients. Learn why these devices are targets for cyber attacks and how the industry is addressing cybersecurity concerns through FDA guidance, risk management programs, and information sharing initiatives.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Cybersecurity of Medical Devices Christopher Kersbergen, JD October 14, 2016
What is the problem? 2008 Pacemaker hack 2011 Insulin Pump hack 2013 Discovery of a wide range of vulnerabilities: surgical and anesthesia devices, ventilators, infusion pumps, defibrillators, patient monitors, laboratory equipment 2015 - Hospira Symbiq Infusion System vulnerabilities 2016 Vulnerabilities reported in St Jude Medical manufactured pacemakers 2016 Johnson & Johnson alerts users of cybersecurity vulnerability in insulin pumps.
Why are medical devices being attacked? Enormous profit from stealing patient health information No ability to scan for viruses and malware Unsecured connections Hardcoded passwords Outdated operating systems
How is cybersecurity of medical devices being addressed? Food and Drug Administration Guidance Shared Responsibility Risk Management Programs Routine Updates and Patches Essential Clinical Performance Controlled and Uncontrolled Risks Information Sharing and Analysis Organizations (ISAO)
Essential Clinical Performance Manufacturer defined Uncontrolled Risk = Serious Injury or Death Controlled Risk = No Possibility of Injury or Death due to Vulnerability
Information Sharing and Analysis Organizations (ISAO) Marketplace for Information with all Stakeholders Shared Vulnerabilities by All Stakeholders Incentives for Joining
Where is there room for Improvement? Patient Privacy Issues Not Addressed Physical Safety Information Safety ISAOs poorly defined Inherent Risks with ISAOs Opportunists Have Access to Vulnerability Information
Conclusion Requirements, not Just Recommendations
