Medical Device Cybersecurity Legislative Activities - Overview Axel Wirth, CPHIMS, CISSP, HCISPP Distinguished Architect US Healthcare Industry Symantec Corp. 01-Nov-2017

Medical Devices Security – Legislative Activities June 2017 HHS Cybersecurity Task Force Report July 2017 Medical Device Cybersecurity Act of 2017 Aug. 2017 IoT Cybersecurity Improvement Act of 2017 Oct. 2017 IoMT Resilience Partnership Act Oct. 2017 Cyber Shield Act of 2017 Mar/Sep 2017 UL 2900-1 / UL 2900-2-1 WIP MDISS Recommended Practice High level summary only. For business, legal and regulatory decision making please refer to the most recent version of the actual text. 2

Medical Devices Security – HHS Efforts HHS Cybersecurity Task Force Report (June 2017) Imperative 2 (of 6): Increase the security and resilience of medical devices and health IT. Recommendations: 2.1: Secure legacy systems 2.2: Improve manufacturing and development transparency 2.3: Increase adoption and rigor of the secure development lifecycle (SDL) 2.4: Require strong authentication to improve identity and access management 2.5: Employ strategic and architectural approaches to reduce the attack surface for medical devices … and interfaces 2.6: Establish a Medical Computer Emergency Readiness Team (MedCERT) to coordinate medical device-specific responses to cybersecurity incidents and vulnerability disclosures. 3 Text Questions to 929-237-5318

Medical Devices Security – Action in Congress Medical Device Cybersecurity Act of 2017 Introduced July 2017 (Blumenthal, D-CT) Definitions: Cyber device: device with network connectivity (incl. near field, Bluetooth, WiFi), connects to external storage or media, or has other cyber capability. Key aspects: Cybersecurity Report Card: MDS2, traceability matrix, compensating controls, testing, risk assessment, remote access capabilities. Disclosures: Clearance (e.g. 510(k)) and permitted access Protecting remote access: notification, audit log, multi-factor authentication, encryption, whitelisting Cybersecurity Fixes and Updates (free); End-of-Life Expansion of ICS-CERT responsibility: investigation, response coordination 4 Text Questions to 929-237-5318

Medical Devices Security – Action in Congress IoT Cybersecurity Improvement Act of 2017 Introduced Aug. 2017 (Warner D-VA, Gardner R-CO, Wyden D-OR, Daines R-MT) Minimal cybersecurity operational standards for Internet-connected devices purchased by Federal agencies Verification: Contains no known vulnerabilities Ensure trusted updates Secure connection and access Vulnerability notification requirements Provide timely updates and repair Continuation of service Certification against 3rd party security standards Coordinated disclosure 5 Text Questions to 929-237-5318

Medical Devices Security – Action in Congress IoMT Resilience Partnership Act Introduced Oct. 2017 (Brooks R-IN, Trott R-MI) Under FDA & NIST Leadership: establish public-private partnership to lay out a cybersecurity framework Increase the security and resilience of networked medical devices Unauthorized access, modification, misuse, or denial of use may result in patient harm Identification standards, guidelines, frameworks, and best practices Specification of high-priority gaps and action plans by which such gaps can be addressed. 6 Text Questions to 929-237-5318

Medical Devices Security – Action in Congress Cyber Shield Act of 2017 Introduced Oct. 2017 (Markey D-MA, Lieu D-CA) Cyber Shield Advisory Committee: Cyber Shield label Cybersecurity and data security benchmarks Cyber Shield Program: Voluntary program to identify and certify products Grading against security benchmarks Device use case risk based Promote compliant cybersecurity technologies Enhance public awareness Certification by a accredited third-party laboratory Cyber Shield Digital Product Portal 7 Text Questions to 929-237-5318

Medical Devices Security – Certification and Assurance UL 2900-1 (general) and UL 2900-2-1 (medical devices) Evaluation and testing of network-connectable products for vulnerabilities, software weaknesses and malware. Risk management process Evaluation and testing methodology Security risk controls Normative references Key security aspects: Design and security documentation Risk controls Remote communication Sensitive data Product management and risk management process Vulnerability and malware testing Malformed input testing Penetration testing Software weakness analysis and source code analysis 8 Text Questions to 929-237-5318

Medical Devices Security – Best Practice Guidance MDISS Recommended Practice (Draft) Based on ISA/IEC 62443 “Cybersecurity for the Industrial Environment” Role-based: manufacturer, integrator, provider, support Requirements by role and main category: Staffing Assurance Architecture Wireless Safety Systems Configuration Management Remote Access Event Management Account Management Malware Protection Patch Management Backup & Restore 9 Text Questions to 929-237-5318

Thank You! axel_wirth@symantec.com 617-999-4035