Cyber ​​playbook defines threat modeling strategies for medical devices

Dive brief:

  • MITER and the Medical Device Innovation Consortium have published a playbook for threat modeling medical devices to enhance cybersecurity and security.
  • The FDA-backed guide is designed to help companies develop practices for recognizing and responding to cyberthreats for their medical devices. MITER and MDIC envision companies using the playbook as a basis for training and educating stakeholders on threat modeling.
  • FDA provided funding for the development of the playbook as part of its efforts to encourage the medical technology industry to embrace threat modeling throughout the lifecycle of medical devices. The problem is, companies often lag behind when it comes to threat modeling and pre-market testing needed to assess device security adequacy, agency officials say.

Dive overview:

The playbook comes amid FDA appeals for the medical technology industry to step up threat modeling. At least two CDRH officials, Suzanne Schwartz and Kevin Fu, have spoken publicly in recent months about the need to medical technology companies to build better threat models. The playbook and the threat modeling bootcamps that came before it are part of the FDA’s efforts to help the industry meet the challenge.

“Threat modeling has become a recognized best practice in cybersecurity, both in general and in the medical device subsector in particular. However, threat modeling is complex and involves a specialized body of knowledge and expertise. ‘expertises,’ the FDA said when announcing the release of the playbook.

Schwartz, director of CDRH’s Office of Strategic Partnerships and Technological Innovation, told MedTech Dive in August that there has been “a real kind of gap in terms of [medtechs] understand the types of questions to ask “by building robust threat models to avoid current cybersecurity vulnerabilities.

Threat modeling comes down to asking four questions: what are we working on? What can go wrong? What are we going to do about it? Did we do a good enough job? Working on these questions can reveal cybersecurity weaknesses and inform design, development, testing, and post-deployment decisions.

The playbook discusses methodologies that medical technology companies can use, alone or in combination, to answer questions at the heart of the threat modeling process. MITER, a nonprofit organization active in areas such as cyber resilience, and MDIC have chosen not to take a prescriptive approach to threat modeling in the playbook, choosing instead to describe values ​​and principles that companies can use to develop their own practices.

These values ​​and principles are conveyed in a fictional example which forms the centerpiece of the playbook. In the section, MITER and MDIC examine possible approaches to the four key threat modeling questions using the example of a peg monitor. designed to predict a patient’s risk of stroke.

The example provides a detailed look at the device and associated infrastructure, explaining that it uses Bluetooth to share data with Apple and Android apps and ultimately with a cloud service. After establishing all the features and workflows, the playbook delves into the answers to the four questions, covering topics such as creating data flow diagrams and the range of ways to identify threats.

After discussing ways to answer the four questions, MITER and MDIC provide an overview of the considerations for implementing threat modeling, then end the playbook with two more fictional examples, both of which also describe devices. stroke.

Source link

Comments are closed.