BAKE: a novel framework for iterative security design for identifying criminally-exploitable vulnerabilities in...

Area of Science:

• Biotechnology and Cybersecurity
• Medical Device Security
• Cyber-Physical Systems

Background:

• In-body monitoring devices, including ingestible technologies, are advancing personalized health.
• Security and crime implications of these bio-electronic devices are often overlooked during development.
• Proactive identification of vulnerabilities is crucial for safeguarding emerging medical technologies.

Purpose of the Study:

• To develop and deploy a hybrid framework (BAKE) combining hackathon and Delphi processes.
• To capture expert insights on risks associated with in-body monitoring devices.
• To demonstrate the utility of BAKE in identifying criminally-exploitable vulnerabilities early in the design lifecycle.

Main Methods:

• Utilized a hybrid hackathon-Delphi framework, named BAKE, for expert engagement and scenario building.
• Convened four expert groups to identify crime forms, secure design principles, and governance mechanisms.
• Included non-traditional experts and early-career researchers to broaden threat identification.

Main Results:

• Identified four distinct crime forms, including corporate exploitation and data breaches.
• Recognized five secure-by-design principles (e.g., end-to-end encryption) and four governance mechanisms (e.g., independent bodies).
• Highlighted the value of diverse expertise in uncovering complex cyber-physical device threats.

Conclusions:

• The BAKE framework effectively integrates expert knowledge to address security risks in emerging biotechnology.
• Embedding Delphi processes within hackathons promotes secure-by-design thinking early in the product development lifecycle.
• This approach is vital for mitigating criminal exploitation of medical products and services.