Slashdot Mirror
FDA Calls On Medical Devicemakers To Focus On Cybersecurity
alphadogg writes "Medical device makers should take new steps to protect their products from malware and cyberattacks or face the possibility that U.S. Food and Drug Administration won't approve their devices for use, the FDA said. The FDA issued new cybersecurity recommendations for medical devices on Thursday, following reports that some devices have been compromised. Recent vulnerabilities involving Philips fetal monitors and in Oracle software used in body fluid analysis machines are among the incidents that prompted the FDA to issue the recommendations."
Isn't the normal solution to this kind of problem for those affected (or their families, since they will probably be dead) suing the manufacturer?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Like we need more guvmint BS pushing up prices. Look at the cost of an insulin pump, greater than $5K for what is basically a re-purposed pager shell with a syringe pump.
Run an internal network with no access to the internet. Limit the internet to certain devices or terminals.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
People will plug in any old system that may already be infected...
Hey I'm on a project building such a device as a sub-subcontractor for a company acquired by a megacorporation that will be selling a medical device. The security is abysmal and there was basically no thought given to the security implications of decisions like using s very of JVM, running an outdated and insecure HTTP server on the device, running on Windows and requiring the user be an admin on the system, hard coding a default password, and storing the username and password for the hospital's records database in plaintext (I managed to get that last one changed by shaming the developer involved).
This announcement means pretty much nothing and we still are unlikely to perform a cybersecurity audit on the device. That is because it is cheaper to CYA with some paperwork that says you considered things and the risk is "low" than it is to actually do anything that might threaten a ship date or cost more money. If the FDA doesn't actually start auditing device before they ship (gee I'm sure they can't afford to hire a few security geeks) nothing will happen. This is just more of the best government money can buy.
Network security is an add-on, largely viewed as an externality by corporations.
I think that it's largely because of this (and that mostly due to Microsoft) that people don't use good security features.
Suppose the socket layer had a function to generate a key pair, and a function call to set the key used for encoding and decoding. (Possibly a bit in the protocol to send a message using or not-using encryption). If it was that simple most products would use it, certainly safety-certified products would use it.
(There's Transport Layer Security, but it's not really simple to use.)
Since there is no simple universal way to use good security, everyone ends up having to implement their own version, which costs time and money.
Simple secure communications should be an OS feature.
In Soviet Russia pace makes you?
if I want to overclock my pacemaker? Will it stop me from installing Linux?
Obamacare's Medical-Device Tax Kills Patients, Not Just Jobs
The 2.3 percent Obamacare excise tax on medical devices is a tax is on sales, not profits.
If FDA really wants secure devices, that means we will have patch cycles for medical devices. This is not a very desirable perspective: What happens if you pacemaker is down after a patch? Will you need a doctor to patch?
You don't seem to understand the GBs of data that would have to be transferred.
Manually transferring the data would mean the device would have to store LOTS of data... (not possible for internal devices), or a person would have to be assigned to continuous work doing nothing but data transfer... and a corresponding tripling of the cost per device.
As well as introducing possible transcription errors - wrong data for the patient...
"Seal the holes!" screamed the FDA. "Just not this one, and that one, and that one, which the FBI, CIA, and NSA use."
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Don't forget about the pacemaker that, over WI-FI, can be instructed to kill a person.
I did a bunch of work a number of years back where we had critical (financial services not medical) computers that we absolutely were not allowed to patch. The solution I implemented was to treat any computer that can't be patched as a mini-DMZ.
The computer is firewalled from the rest of the network, put on a locked down VLAN and given only specific destinations, ports and so on as required in order to function. The concept of least privilege can and should be used for computers like this just as you would use it for a user.
You can use this concept for medical devices and it would work just as well. There is work involved and it is a pain in the ass to do. That being said this balances the risk of systems that you are highly unlikely to be able to patch with the need to secure your environment. Once completed your system is allowed to work and your network is mitigated from the risk of having that system in the first place.
I worked in the medical device field for a while. The level of paperwork and documentation required for validation activities is staggering, plus the medical field in general doesn't have as good a handle on fulfilling government requirements as well as, say, the aviation industry. The path to take a device from concept to validated, sellable product is a long one. Adding cybersecurity (while a worthy endeavor) will only exacerbate the arduous and hair-tearing experience of developing a product.
(((dB)))
Don't connect your Medical devices to the Internet and don't use Computers that are so easily compromised by connecting to the Internet
AccountKiller