A Cyber-Security Risk Assessment Methodology for Medical Imaging Devices: the Radiologists' Perspective.

Area of Science:

• Cybersecurity in Medical Imaging
• Risk Assessment Methodologies
• Healthcare Technology Management

Background:

• Medical imaging devices (MIDs) face significant cybersecurity threats.
• Existing risk assessment methods for MIDs are often inefficient and lack comprehensive detail.
• A need exists for a specialized, efficient, and detailed methodology for MID cybersecurity risk assessment.

Purpose of the Study:

• To introduce and validate the Threat identification, ontology-based Likelihood, severity Decomposition, and Risk assessment (TLDR) methodology.
• To demonstrate the TLDR methodology's efficiency, consistency, and customization capabilities.
• To compare the TLDR methodology against existing risk assessment approaches for MIDs.

Main Methods:

• The TLDR methodology was developed, decomposing attack impacts into six severity aspects.
• Twenty-three identified MID attacks were assessed by four Radiology Medical Experts (RMEs) using the TLDR methodology.
• External consistency was tested using paired T-tests against existing methods; internal consistency was evaluated using Spearman rank correlations among RMEs.

Main Results:

• The TLDR methodology demonstrated external consistency with existing risk assessment methods, with insignificant differences in severity and overall risk assessments.
• Internal consistency was significant (P < 0.05) for RME severity rankings using TLDR, outperforming existing methods for smaller expert groups.
• The TLDR methodology proved more efficient, transparent, and adaptable to local preferences than standard techniques.

Conclusions:

• The TLDR methodology provides a feasible, consistent, and efficient approach to cybersecurity risk assessment for medical imaging devices.
• TLDR enhances risk assessment by detailing severity components and supporting organizational customization and prioritization.
• The proposed methodology offers superior internal consistency and transparency compared to traditional risk assessment techniques in healthcare settings.