CNN Video: The FDA is urging manufacturers to tighten security measures on pacemakers and other medical devices.
A guidance document has been developed by the FDA to assist medical industry manufacturers by identifying issues related to cybersecurity that manufacturers should consider in preparing premarket submissions for medical devices. The need for effective cybersecurity to assure medical device functionality has become more important with the increasing use of wireless, Internet- and network-connected devices, and the frequent electronic exchange of medical device-related health information.
The FDA warns that failure to maintain cybersecurity can result in compromised device functionality, loss of data availability or integrity, or exposure of other connected devices or networks to security threats. These, in turn, have the potential to result in patient illness, injury, or death.
Manufacturers are advised to consider cybersecurity during the design phase of the medical device, as this can result in more robust and efficient mitigation of cybersecurity risks. Manufacturers should define and document the following components of their cybersecurity risk analysis and management plan as part of the risk analysis required by 21 CFR 820.30(g)2 (Medical Device Quality System Regulation and Design Controls):
Identification of assets, threats, and vulnerabilities;
Impact assessment of the threats and vulnerabilities on device functionality;
Assessment of the likelihood of a threat and of a vulnerability being exploited;
Determination of risk levels and suitable mitigation strategies;
Residual risk assessment and risk acceptance criteria.
Cybersecurity Protocols/Security Capabilities
Limit Access to Trusted Users Only
Limit access to devices through the authentication3 of users (e.g., user ID and password, smartcard, biometric);
Use automatic timed user session log-offs appropriate for the use environment;
Employ a layered authorization4 model by differentiating privileges based on the user role (e.g., caregiver, administrator);
Use multi-factor authentication to permit privileged device access (e.g., to administrators, service technicians, maintenance personnel);
Strengthen password protection by avoiding “hardcoded” passwords (i.e., passwords which are the same for each device, difficult to change, and vulnerable to public disclosure) and limit public access to passwords used for privileged device access;
Where appropriate, provide physical locks on devices and their communication ports to minimize tampering;
Require user authentication or other appropriate controls before permitting software or firmware updates, including those affecting the operating system, applications, and anti-malware.
Ensure Trusted Content
Restrict software or firmware updates to authenticated code. One authentication method manufacturers may consider is code signature verification;
Use systematic procedures for authorized users to download version-identifiable software and firmware from the manufacturer;
Ensure secure data transfer to and from the device, and when appropriate, use accepted methods for encryption5.
Use Fail Safe and Recovery Features
Implement fail-safe device features that protect the device’s critical functionality, even when the device’s security has been compromised;
Implement features that allow for security compromises to be recognized, logged, and acted upon;
Provide methods for retention and recovery of device configuration by an authenticated system administrator.
The FDA also recommended guidelines on Cybersecurity Documentation.
Cybersecurity Documentation
The type of documentation that we recommend you submit in your premarket submission is summarized in this section. These recommendations are predicated on your effective implementation and management of the quality system in accordance with the Quality System Regulation, including Design Controls.6
In the premarket submission, manufacturers should provide the following information related to the cybersecurity of their medical device:
Hazard analysis, mitigations, and design considerations pertaining to intentional and unintentional cybersecurity risks associated with your device, including:
A specific list of all cybersecurity risks that were considered in the design of your device;
A specific list and justification for all cybersecurity controls that were established for your device.
A traceability matrix that links your actual cybersecurity controls to the cybersecurity risks that were considered;
To assure continued safe and effective device use, the systematic plan for providing validated updates and patches to operating systems or medical device software, as needed, to provide up-to-date protection and to address the product life-cycle;
Appropriate documentation to demonstrate that the device will be provided to purchasers and users free of malware; and
Device instructions for use and product specifications related to recommended anti-virus software and/or firewall use appropriate for the environment of use, even when it is anticipated that users may use their own virus protection software.
See also …
FDA.gov Medical Devices Content of Premarket Submissions for Management of Cybersecurity in Medical Devices – Draft Guidance for Industry and Food and Drug Administration Staff