Authors:
Anita Finnegan
;
Fergal Mc Caffery
and
Gerry Coleman
Affiliation:
Dundalk Institute of Technology & Lero, Ireland
Keyword(s):
Medical Device Security, Process Assessment, ISO/IEC 15026-2, ISO/IEC 15026-4, IEC 80001-2-2, IEC 62443-3-3, ISO/IEC 15504, ISO 27799, ISO/IEC 27001, ISO/IEC 27002.
Related
Ontology
Subjects/Areas/Topics:
Biomedical Engineering
;
Design and Development Methodologies for Healthcare IT
;
Health Information Systems
Abstract:
Advancements in medical device design over the last number of years have allowed medical device manufacturers to add more complex functionality particularly through the use of software. Such advancements include the ability for devices to communicate wirelessly across networks, from device to device and over the Internet. However, with such advancements comes additional risks; these are security risks, vulnerabilities and threats. In the past twelve months, concern within the medical device community has led to the US Government calling upon the FDA to take responsibility of medical device security. In support of this, this position paper details a research proposal to address medical device security issues through the development of a Process Reference Model (PRM) and a Process Assessment Model (PAM) to assess the capability of the processes used to develop medical devices intended to be incorporated onto healthcare networks and also determine the product security capability thro
ugh the development of security assurance cases created following the lifecycle process. Further, in support of IEC 80001-2-2, the output from this PRM will be an assurance case with a security assurance level, which will be used to communicate the security capabilities of the product between Medical Device Manufacturers (MDMs) and Healthcare Delivery Organisations (HDOs). The intent is to build a better awareness of vulnerability types, threats and related risks to assist in reducing the likelihood of harm resulting from a security risk.
(More)