Building Resilient Medical Devices: A Look at the Essential Technologies and Infrastructure

Hey there, welcome back! Today, we're going to be talking about security considerations as part of the design phase of a device and what can be done to prevent vulnerabilities from popping up further right in the development process. We'll also look at some of the big considerations as far as the areas that should be covered by security in the eyes of regulatory bodies such as the FDA. Sounds pretty serious stuff. Oh, yeah, yeah. When we're looking at medical devices and the impact of breaching them, it can get pretty serious. Alright, and where do these controls come from? Are these standard best practices or where do they come from? These controls are partially going to be standard best practices industry-wide, and they're also going to come from the FDA's requirements since that's what we have the most experience dealing with. What we see the most of and what the FDA sees as the most important areas to address cybersecurity. Okay, awesome. So I think one of those requirements is authentication, is that correct? Yeah, and how we're getting to the controls around these requirements. So I want to talk a little bit about a requirement in a device. Period. So there can be a good place to start, we should back up a little bit and talk about that. Yeah, yeah, all right, go ahead. Sorry, there are going to be the functional requirements in a device. So if I have my cell phone right here, a functional requirement is put a password in place to log into the phone. Now, the non-functional requirement there might be how is that password protected? Is it just stored in plain text somewhere in the phone where if someone gets in they can just read it? Is it hashed in some way? Is it stored up in the cloud? Is there an authentication manager? The non-functional requirements are sort of where it can get a little bit murky and where security really needs to be looked at. So for each of these items, they are typically going to be the non-functional requirements that we're looking at more. And for each of the functional requirements, we need this kind of like cybersecurity as a whole isn't cybersecurity as a whole like a non-functional requirement typically? Pretty much. A lot of people see cybersecurity as a necessary very evil. It's that one thing you have to do once a year to make sure that you're able to keep selling your product, which is often a hard way to think about it since that means you're often not addressing security at the very beginning and often making it a little bit harder on yourself later down the line. So that's what does that mean,