Improving Vulnerability Management for Security-by-Design of Medical Devices.

Area of Science:

• Biomedical Engineering
• Cybersecurity in Healthcare
• Medical Device Technology

Background:

• Increasing adoption of connected medical devices (wearables, implants, sensors) for real-time patient monitoring and personalized care.
• Growing cyberattack surface in healthcare due to ICT integration in medical devices, leading to new vulnerabilities.
• High value of medical data makes the healthcare industry a prime target for cyber threats.

Purpose of the Study:

• To address the challenge of fragmented vulnerability information for medical device development.
• To demonstrate the utility of the Malware Information Sharing Platform (MISP) for managing medical device security data.
• To promote a security-by-design approach in the development of medical devices.

Main Methods:

• Leveraging key features of the Malware Information Sharing Platform (MISP).
• Developing tailored structures, objects, and taxonomies specific to medical devices within MISP.
• Systematically collecting and structuring vulnerability-related information for medical devices.

Main Results:

• Demonstrated MISP's capability to systematically collect and organize vulnerability data for medical devices.
• Proposed standardized data representation through tailored MISP structures, objects, and taxonomies.
• Facilitated enhanced security-by-design development processes for medical devices.

Conclusions:

• MISP can be effectively utilized to centralize and structure critical security information for medical devices.
• Standardized data representation is crucial for implementing effective security-by-design in medical device development.
• The proposed approach supports stakeholders in mitigating cybersecurity risks associated with connected healthcare technologies.