.png)
As IoT devices including both wearables and attachables grow in popularity, so too does the threat they post for cybersecurity.
Currently there is a plethora of standards, regulations and guidance on cybersecurity from standards bodies and regulators in multiple jurisdictions globally. While having many of the same principles, these documents also often have specific requirements, making it difficult to discern the bottom line that needs to be adhered to satisfy everyone.
Ideally, there would be a global effort to product harmonised cybersecurity standards for medical devices that are recognized by regulators around the world. As yet there is none, but individual market sectors are starting to move this way. From November onwards the US Federal Drug Administration will be forcing all new medical device submissions to be fully compliant with its cybersecurity requirements.
While this is just one industry segment that Genesys serves, it prompted us to conduct an exhaustive analysis of all the relevant standards and guidance, cross checking them against our current best practices. Below are some of our key findings. Again, some of the standards are medical specific but are perfectly valid for any high reliability industry.
As a base approach, we have determined the key standards that need to be adhered to are:
UL 2900 Software Cybersecurity for Network-Connectable Products including Part 1 on General Requirements
ANSI/ISA 62443-4-1 Security for industrial automation and control systems Part 4-1: Product security development life-cycle requirements
IEC 80001-1 Application of risk management for IT-networks incorporating medical devices – Part 1: Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software
AAMI TIR 57 Principles for medical device security - risk management
NIST SP 800-218 Secure Software Development Framework
Dissecting the detail of these and other standards yields a comprehensive checklist of cybersecurity considerations. Areas of analytical assessment include:
Safety impacts
Privacy considerations
Known vulnerabilities
Malware
Malformed inputs
Penetration testing
Software weaknesses
Source code
Binary and bytecode
Lifecycle considerations
Security considerations include:
Access control, user authentication and user authorisation
Remote communication
Software quality and coding standards
Cryptography
Sensitive data
Physical security
Human factors
Backup and disaster recovery
Emergency access
Logging and audit trails
Product management and software updates
On the back of this analysis, Genesys has revised the Cyber Security Compliance Manual in its QMS, and has upgraded its template documents for use in any particular product’s Design and Development File.
Complying with the key standards, and addressing the above dot points in accordance with a robust quality, risk and software management processes, will ensure that any device will be as cyber-secure as practically possible.
Our general approach is to ensure that any device we develop has a coherent cybersecurity architecture addressing a clearly defined attack surface. We identify potential vulnerabilities, relevant classes of threat actors and the type of attacks likely to come from each class. We then analyse the likely threat intensity of each attack vector and, using risk management techniques, assess the likelihood/impact of a determined attack.
It’s easy to feel overwhelmed by the challenge of cybersecurity. The sheer volume and density of technical detail in the above standards can be overwhelming for newcomers to the product development industry. For help in addressing this challenge contact Genesys for more detailed advice on how your product can be in compliance with any relevant standards and be cybersecure.