Organizational measures describe protective measures that are implemented through instructions, procedures and practices. They serve to prevent potential attack opportunities and describe processes for dealing with known vulnerabilities.

In order to fulfill the basic requirements of the currently valid directives for medical devices, a risk analysis must be prepared as part of the conformity assessment procedure. The risks identified there, which include cybersecurity, are analyzed, minimized and documented.
Risk analysis is a continuous process in which new potential attack vectors are identified during the course of development and how they are dealt with. The aim is to minimize the probability of safety risks occurring and to reduce their impact on patients and medical devices.

Cybersecurity plays an important role in the life cycle of a medical device. Essential questions about the software development process are asked right at the start of the planning and development of such a product. This involves deciding on specifications for secure implementation, the selection of trustworthy development tools and the implementation of control mechanisms, which can take the form of test sections (security gates) and system tests.

The life cycle also regulates the handling of security-related issues in relation to product maintenance and known vulnerabilities after the product release. Relevant here are processes for detecting new potential attack vectors, regular checks for known vulnerabilities and all external subcomponents used, and questions about the product’s update policy.

In addition to dealing with known vulnerabilities, it is also necessary to define how to communicate about them. This includes the establishment of communication channels, e.g. for reporting identified vulnerabilities, open communication of these vulnerabilities to users and the creation of contact options for cybersecurity-related questions.

Technical measures include all software and hardware-based, implementable protective measures to safeguard the medical device against attacks by third parties. They deal with specific potential attack vectors and secure the medical device against them.

The biggest attack vector for network-enabled medical devices is an attack on the communication channels and the associated data exchange and processing. An attacker has the possibility to read or manipulate this data. To secure the communication, an analysis is necessary first. The planning and technical implementation of data transmission is based on this. Data should be secured on the basis of the protection objectives, taking into account current protective measures and cryptographic procedures.

In addition to protecting data transmission, the medical device and host system must also be secured. System-based vulnerabilities allow attackers to obtain information about the communication and security features used, which can be used to attack this network connection.

Despite the use of current security standards and their conscientious implementation, potential attacks on unknown vulnerabilities cannot be ruled out. It is therefore advisable to implement a system for detecting potential attacks. It analyzes the use of the medical device and its communication channels. It also uses this data to detect irregularities that could indicate an attack. In addition to detection, this also serves to understand the course of an attack and its attack vector so that specific countermeasures can be initiated on this basis.

Medical devices should ensure their basic functionality even without an active network connection or in the event of a potential attack. The primary protection goal and therefore central to cybersecurity issues is to safeguard the health of patients.

The most important questions at a glance:

All new territory for you? We would be happy to analyze your products, establish cybersecurity risk management in your company or train colleagues in the development department.