1. Medical Device Cybersecurity Legislative Activities - Overview
Axel Wirth, CPHIMS, CISSP, HCISPP
Distinguished Architect US Healthcare Industry Symantec Corp.
01-Nov-2017

2. Medical Devices Security – Legislative Activities
June 2017 HHS Cybersecurity Task Force Report July 2017 Medical Device Cybersecurity Act of 2017 Aug IoT Cybersecurity Improvement Act of 2017 Oct IoMT Resilience Partnership Act Oct Cyber Shield Act of 2017 Mar/Sep 2017 UL / UL WIP MDISS Recommended Practice
High level summary only. For business, legal and regulatory decision making please refer to the most recent version of the actual text. 2

3. Medical Devices Security – HHS Efforts
HHS Cybersecurity Task Force Report (June 2017)
Imperative 2 (of 6): Increase the security and resilience of medical devices and health IT.
Recommendations:
2.1: Secure legacy systems
2.2: Improve manufacturing and development transparency
2.3: Increase adoption and rigor of the secure development lifecycle (SDL)
2.4: Require strong authentication to improve identity and access management
2.5: Employ strategic and architectural approaches to reduce the attack surface for medical devices … and interfaces
2.6: Establish a Medical Computer Emergency Readiness Team (MedCERT) to coordinate medical device-specific responses to cybersecurity incidents and vulnerability disclosures. 3
Text Questions to

4. Medical Devices Security – Action in Congress
Medical Device Cybersecurity Act of 2017
Introduced July 2017 (Blumenthal, D-CT)
Definitions:
Cyber device: device with network connectivity (incl. near field, Bluetooth, WiFi), connects to external storage or media, or has other cyber capability.
Key aspects:
Cybersecurity Report Card: MDS2, traceability matrix, compensating controls, testing, risk assessment, remote access capabilities.
Disclosures: Clearance (e.g. 510(k)) and permitted access
Protecting remote access: notification, audit log, multi-factor authentication, encryption, whitelisting
Cybersecurity Fixes and Updates (free); End-of-Life
Expansion of ICS-CERT responsibility: investigation, response coordination 4
Text Questions to

5. Medical Devices Security – Action in Congress
IoT Cybersecurity Improvement Act of 2017
Introduced Aug (Warner D-VA, Gardner R-CO, Wyden D-OR, Daines R-MT)
Minimal cybersecurity operational standards for Internet-connected devices purchased by Federal agencies
Verification:
Contains no known vulnerabilities
Ensure trusted updates
Secure connection and access
Vulnerability notification requirements
Provide timely updates and repair
Continuation of service
Certification against 3rd party security standards
Coordinated disclosure 5
Text Questions to

6. Medical Devices Security – Action in Congress
IoMT Resilience Partnership Act
Introduced Oct (Brooks R-IN, Trott R-MI)
Under FDA & NIST Leadership: establish public-private partnership to lay out a cybersecurity framework
Increase the security and resilience of networked medical devices
Unauthorized access, modification, misuse, or denial of use may result in patient harm
Identification standards, guidelines, frameworks, and best practices
Specification of high-priority gaps and action plans by which such gaps can be addressed. 6
Text Questions to

7. Medical Devices Security – Action in Congress
Cyber Shield Act of 2017
Introduced Oct (Markey D-MA, Lieu D-CA)
Cyber Shield Advisory Committee:
Cyber Shield label
Cybersecurity and data security benchmarks
Cyber Shield Program:
Voluntary program to identify and certify products
Grading against security benchmarks
Device use case risk based
Promote compliant cybersecurity technologies
Enhance public awareness
Certification by a accredited third-party laboratory
Cyber Shield Digital Product Portal 7
Text Questions to

8. Medical Devices Security – Certification and Assurance
UL (general) and UL (medical devices)
Evaluation and testing of network-connectable products for vulnerabilities, software weaknesses and malware.
Risk management process
Evaluation and testing methodology
Security risk controls
Normative references
Key security aspects:
Design and security documentation
Risk controls
Remote communication
Sensitive data
Product management and risk management process
Vulnerability and malware testing
Malformed input testing
Penetration testing
Software weakness analysis and source code analysis 8
Text Questions to

9. Medical Devices Security – Best Practice Guidance
MDISS Recommended Practice (Draft)
Based on ISA/IEC “Cybersecurity for the Industrial Environment”
Role-based: manufacturer, integrator, provider, support
Requirements by role and main category:
Staffing
Assurance
Architecture
Wireless
Safety Systems
Configuration Management
Remote Access
Event Management
Account Management
Malware Protection
Patch Management
Backup & Restore 9
Text Questions to

10. Thank You!