Research, Not Marketing

No single entity is going to “fix” medical device cybersecurity on their own. We are dedicated to helping advance our industry’s understanding of the challenges and opportunities we face through research. The documents below are free to download, and we’re not going to do that thing where we ask for your email address in order to download them. We love feedback - so tell us if you love it, hate it or want to enhance it together. Enjoy!

Latest Whitepapers

Impact of monitoring on medical device vulnerabilities

The root causes associated with medical device cybersecurity disclosures to date, reveals 81.8% of the related root causes would be impacted by the implementation of monitoring practices.

Tool and Processes for Medical Device Cybersecurity

The Food and Drug Administration (FDA) issued an updated draft of the Premarket Cybersecurity Guidance in April 2022 which, when combined with existing finalized Postmarket Management of Cybersecurity in Medical Devices Guidance, specifies process and technical requirements to ensure medical devices are “secure by design” and that their security posture can be maintained over the lifetime of the device. In this paper we propose a hypothetical medical device vendor’s mature cybersecurity program that complies with FDA guidance, and we will analyze the processes and tools that aid in their success.

What the medical device industry can learn from past cybersecurity vulnerability disclosures

In the 2022 update of our annual ICS-CERT cybersecurity disclosure analysis, we found that the rate of medical device advisories has increased by 490% since the release of the FDA Postmarket Cybersecurity Guidance in 2016, but appears to have plateaued. Read about the latest medical device vulnerability data trends and predictions for the future.

Benefiting from Software Transparency: From SBOM to Vulnerability Management

Software bills of material (SBOM) capture software used in products. SBOMs are prerequisites to proactive product security, as well as vulnerability and risk management programs. However, extracting the full potential value of SBOMs at scale will take sustained effort, requiring tooling to overcome inherent complexities.

Understanding the constraints of healthcare cybersecurity

The sobering reality is that all the promise held in technology advancing healthcare is foundationally reliant on security. Unfortunately, not only does the healthcare supply chain inherit what makes information security hard, healthcare additionally inherits economic constraints that allow security debt to pass to consumers. Watch the webinar where Seth explores the six constraints: https://youtu.be/1pYlbqkM9Ew

A patient safety approach for assessing medical device vulnerabilities

With medical devices being increasingly network-connected, we leveraged our collective expertise in medical device security and clinical risk management, to provide a holistic analysis of vulnerabilities in the medical device space through the assessment of clinical case studies using quantitative analytics, and a discussion of incident prevention recommendations.

A medical device cybersecurity toolbox

There is no silver bullet. Complying with FDA cybersecurity regulations requires a variety of processes and technologies. A hypothetical device vendor’s approach to securing their product is analyzed, and leading tools are identified.

A tool in medical device cybersecurity - MedCrypt

In this paper we highlight the specific cybersecurity requirements that can be satisfied using various features of MedCrypt.

Understanding international medical device cybersecurity guidance

Medical device cybersecurity requirements from global regulators will continue to evolve as the industry and ecosystem matures. The industry must be cautious against over reliance on “security frameworks” and must rapidly iterate to keep up with emerging technology best practices.

Medical Device Threat Modeling

International regulators as well as customers are expecting Medical Device Manufacturers to deliver proactively secured devices. A deep dive into the unique considerations when threat modeling for medical devices.

The missing link between cybersecurity vulnerabilities and patches

An analysis of ICS-CERT cybersecurity disclosures reveals no correlation between a vulnerability’s CVSS score and the likelihood a patch will be made available by the manufacturer.

We live and breathe healthcare cybersecurity

A medical device may look like just another IoT device, but regulatory constraints and their unique use case require a healthcare-first approach to cybersecurity. MedCrypt's solutions are built specifically for medical devices, which means clinical functionality, patient safety, and care delivery are always the highest priority.