Medical Device Cybersecurity: Are you Prepared?

The Playbook recommends that HDOs take the following steps to prepare for a cyber-attack:

1. HDOs should catalog the different sources of cybersecurity risk (e.g., number of networked devices, security controls needed to gain access, type of operating systems used, state of the operating systems, the status of known vulnerabilities, etc.).[6]

• • The inventory should include such information as the equipment/name and location, the device’s logic location (e.g., IP address, physical port or wireless access point connection(s)), device owner and manager, interaction with other devices, device status, and additional information which may be crucial in remotely or physically accessing the device.[7]
  • The risk inventory provides a framework for a cybersecurity incident response to facilitate a rapid recovery to normal operations after an incident occurs.[8]

2. That HDOs assess medical device cybersecurity risks during the device procurement process.

• • After all, an ounce of prevention is worth a pound of cure. This may include securing a commitment from the manufacturer to participate in security exercises at the HDO.[9] This could troubleshoot not only possible cybersecurity threats but also strengthen the relationship between the manufacturer and HDO for the time when an actual incident occurs.[10]

3. HDOs should arrange for real-time assistance from the manufacturer ahead of any cybersecurity incident.

• • This puts an expectation on manufacturers to remain vigilant of cybersecurity threats that might single out their devices (a practice which they should already be doing) and be ready to provide cybersecurity support, potentially at any time of day or night and certainly without prior notice.

4. HDOs should prepare for routing communications in the case of a cybersecurity incident.

• • Points of contact outside of the organization (e.g., FDA, device manufacturer) should be pre-established and disseminated to the members of the HDO’s HIMT.
  • HDOs should be aware of the address: CyberMed@fda.hhs.govas a point of contact with the FDA if no other information is available.[11]
  • So, even without a previously negotiated agreement between the HDO and the device manufacturer, manufacturers should be aware that FDA may call upon them to provide support, a call which they are advised not to send to voicemail.
  • Therefore, manufacturers should be prepared to have cybersecurity staff available to provide around-the-clock support for their devices, either in-house or through a contractor.

5. HDOs should consider developing pre-prepared templates for communications to affected system users and other internal staff (e.g., HIMT members, C-suite, managers, system owners), external business associates, internet service providers, public announcements about the incident, regulatory or compliance communications, and more.[12]

• • Manufacturers might also want to heed this recommendation: they are interested in disseminating their messaging in case of a cybersecurity incident affecting their devices. They might want to have pre-prepared communications ready for such an occurrence.

Cybersecurity incidents come without prior announcements. Even after an incident is identified, it may be challenging to determine whether an attack occurred and, if so, what happened. Identifying a cybersecurity incident is a necessary first step to detection and analysis. Manufacturers should be prepared to work with HDOs in analyzing and assessing the suspected incident they are observing. An organization might ask: was the incident the result of a system malfunction or human error instead of a targeted act? How did the incident arise? What tools were used to detect the incident? Have regional parties noticed the same or similar experiences on their networks? Have cyber information or watchdog groups noticed anything similar?[13]

Once the incident has been identified, it should be classified to understand the scope of the response. The factors that are reviewed when classifying the response include:

• Potential number of affected parties;
• Potential to spread to unaffected systems;
• Previous experience in mitigating this type of incident;
• Potential for damage or loss;
• Short and long-term business impact.[14]

The outcome of the incident classification drives the response to the incident: more severe responses require rapid activity and more significant effort than a lower-risk incident.

An essential part of the response is communication with the stakeholders. Internal communications are necessary to coordinate a response, and communications outside the HDO to the FDA, affected users, and the US Cybersecurity & Infrastructure Security Agency (CISA) may also be required.[15]

Anything in this section that device makers should pay attention to? Let’s focus on that aspect.

The Playbook recognizes that many HDOs use a “contain, clean, and deny” approach to dealing with cybersecurity incidents. These actions are meant to stop the incident, contain any damage it may have caused, and restore network function as quickly as possible.[16] “Containment begins with the HIMT activation and execution of the [Emergency Operations Plan].”[17] There are several different considerations for an HDO to factor into their response, including:

• Is there a way to test the device and confirm its safety after the threat has been contained?
• Can the device be safely used if removed from the network?
• Could the manufacturer, or another party (e.g., a capital equipment leasing company), provide loaner devices?
• Who can fix the problem, and how long will it take them? Does the organization have the internal resources to address the problem?
• Have the affected devices caused any “collateral damage” to the broader network?[18]

Eradication may be specific to the affected device and the type of network intrusion. In other words, there is no “one-size-fits-all” approach. The Playbook also instructs HDOs to anticipate longer timelines for recovery and mitigation, which the incident may require.[19] In the recovery phase, manufacturers should consider working not only with the HDOs directly impacted by the incident but also with other HDOs using their devices that were not directly impacted or targeted by the attack.

Even after all containment, eradication, and recovery activities have been completed, there is still work to be done. Amongst other things, a firm should evaluate the following:

• What happened and when?
• How well was the plan implemented? How well did it work? What could have been done better?
• What was needed sooner?
• How was information shared between groups that needed it? How could this be improved upon in the future?
• What were the early indicators of the incident? How could these be monitored in the future?[20]

The evaluation results and the items learned should be re-directed to the EOP to facilitate a future response to a cybersecurity incident and improve the HDO’s cybersecurity preparedness.

Manufacturers’ work is not finished, however. Suppose it was not possible to do so while implementing the security fix. In that case, the manufacturer should conduct a risk assessment of the change to ensure that this newly identified risk is accounted for and that any software update does not adversely affect the device; any identified risks should be documented and remedied (if possible). The manufacturer should also submit any necessary change to the FDA for further review (e.g., new 510(k), PMA 30-Day or 180-Day supplement) and document changes in the design history file for both 510(k) and PMA devices, if necessary.

In summary, the relationships an HDO may build with regional partners, and the internal plan it creates to deal with a cybersecurity incident can lay a solid foundation and prepare the organization for a rapid response when an attack occurs. An organization needs to create a plan that addresses its particular circumstances as comprehensively as possible. The Regional Incident Preparedness and Response Playbook can guide creating or updating an organization’s cybersecurity incident response plan.