Topics:
Cybersecurity and patient care are often part of the same discussion. And with good reason as healthcare devices critical to diagnoses and treatments cannot afford disruption or manipulation of information because of a cyberattack.
Phil Englert, VP, Medical Device Security, Health-ISAC, often finds himself and the information and analysis center as a conduit for discussions between medical device manufacturers and healthcare providers to ensure that risks to patient care are minimized on the cybersecurity front.
On this episode of the Nexus Podcast, Englert discusses the cybersecurity risks introduced by legacy technology in healthcare and how it impacts patient care and safety. He also brought context and insight into the U.S. Food and Drug Administration's (FDA) updated guidance on cybersecurity requirements for medical devices aimed at manufacturers and premarket product submissions. The guidance proposes stricter secure development processes, software component tracking, and more.
Englert said that the disparity between component (operating systems, software and firmware libraries) lifecycles meant to last a half-decade, and medical devices expected to be in service for up to two decades presents governance and remediation challenges. Thrown into question often are code safety, authentication, and whether devices can be updated to address vulnerabilities, Englert said.
"That's one of the key areas that I work with both healthcare providers and medical device manufacturers to work through and negotiate [those areas] to understand what the risks are, what the impacts are, were those risks to be actuated on the devices?" he said. "How they could be managed, whether that's through patching and updating, improved monitoring, isolation, or having a response plan different than a response plan that you might have for traditional IT, where it's restored from backup and reconfigure. Medical devices have to be brought back up much quicker so that we can continue on with the patient care mission that we have."
The FDA's updated guidance carries on its stated goal of equating cybersecurity with device quality and patient care. It proposes stricter secure development processes be instituted, including software component tracking, managing vulnerabilities, and maintaining secure development practices.
"One of the brilliant things that I thought the FDA did was when it said cybersecurity is a quality issue. If your device could be made to do something that it's not intended to do, we've got a problem," Englert said. "I love that approach because it gives them a very broad base with which to operate from."
Legacy technology remains a significant risk within healthcare. Any security-related updates to medical devices and other critical patient care systems must obtain FDA approval before implementation. While the number of attacks directly affecting medical devices is limited, healthcare delivery organizations nonetheless face significant windows of exposure to newly discovered vulnerabilities.
"Legacy is a challenge. Again, the disparity in component lifecycles versus product life cycles means that almost every device will become legacy at some point," Englert said. "The real key to managing the risks around that is to understand what the threats are and then what the impacts are, so that we're spending our resources to reduce the negative impacts that these devices can have on patient care, patient safety, and data protection."
Michael Mimoso is Director of Influencer Marketing at Claroty and Editorial Director of Nexus.
