Unfortunately, the fact that these security objectives are governed by different regulators does add to the challenge. Inversely, if we want to understand the impact potential of a security vulnerability or incident, we need to look at the consequences to patient safety, effectiveness, information privacy, care delivery, and business. Once these objectives have defined the underlying requirements, we then can define the level and type of security we need. Security by itself has no purpose security’s purpose is defined by other objectives (e.g., patient safety, effectiveness, information privacy, care delivery, business needs). We need to make devices more secure, of course, but we need to do so within what is practically and economically possible while maintaining functionality.Īs we are on the path to a more secure ecosystem of medical devices, we need to keep these real-world dependencies in mind. Unfortunately, many of the discussions on this topic seem to overlook this and focus on the perceived sole importance of solving for security. Yet, at what cost would this occur? Each of these devices provides an important clinical function, and without them, we would lose the ability to diagnose and treat the diseases addressed by this type of device. A simple example: It would be easy to mandate removal of insecure devices from our hospitals or rejection of market approval of devices based on a mandated security standard. Security is important and needs to be prioritized, but not at the cost of breaking something else. In addition to the problem itself being complex and challenging from a technology, infrastructure, and economic perspective, the effort to solve the problem must balance many external factors-one of which is the need to avoid disruption of the care delivery capability of the public health system.

I believe medical device cybersecurity is a perfect example of this type of intertangled structure.

Seen another way: Solving the problem itself should not make something else worse.

Solving complex problems is, unfortunately, a slow process, as it not only requires untangling of the individual pieces that are forming that complexity but also management of external dependencies.

International Standards Conference 2022.

Oh what a tangled web we weave