Listen now
Key takeaways
- Cybersecurity must be integrated into medical device development from the earliest stages, adhering to a "secure by design" philosophy rather than being an afterthought.
- The "harvest now, decrypt later" threat from quantum computing necessitates immediate consideration of post-quantum cryptography to protect sensitive health data from future decryption.
- Medical device manufacturers should proactively plan for post-quantum cryptographic methods and assess their feasibility for implementation on both new and legacy devices.
- Global regulatory landscapes for medical devices, particularly in the US (the FDA), EU (MDR), and China (NMPA), differ significantly in their cybersecurity requirements.
- China’s NMPA regulations often require unique approaches, such as specific domestic encryption algorithms and cloud providers, leading to potential product variations for that market.
- The integration of AI and Machine Learning into medical devices introduces additional complexities for ensuring both cybersecurity and regulatory compliance across different markets.
- Early engagement with regulatory and cybersecurity experts is crucial for developing a clear compliance strategy, mitigating risks, and achieving cost-effective market entry.
- A comprehensive Total Product Life Cycle approach, including robust supply chain management and third-party risk assessment, is essential for effective cybersecurity in medical devices.
How can you prepare your device for future quantum computing risks?
In this episode of The Med Device Cyber Podcast, Christian and Trevor talk with May Lee of CS Life Sciences about the fast-changing world of medical device cybersecurity. They discuss the growing regulatory demands from the FDA, EU, and China, and why cybersecurity can no longer be an afterthought in device design. The conversation also dives into quantum computing, supply chain risks, and how manufacturers can balance compliance with innovation.
May Lee is a medical device consultant at CS Life Sciences who specializes in AI, machine learning, and cybersecurity. With experience ranging from startups to global corporations, she brings a practical perspective on navigating regulations and helping innovators bring safer devices to market.
(03:21) Why cybersecurity is moving from afterthought to design control.
(05:49) Key takeaways from the FDA’s finalized cybersecurity guidance.
(08:04) Comparing U.S. FDA and EU MDR cybersecurity requirements.
(10:44) How quantum computing raises new risks for health data.
(16:26) The balance between compliance, over compliance, and innovation.
(18:23) Differences in regulatory approaches across the U.S., EU, and China.
(28:05) Why third-party supply chain and software components matter for device security.
(32:48) When medical device companies should engage cybersecurity consultants.
Notable quotes
“It's moving out of thinking about compliance maybe at a later stage or like post-launch security compliance. But now it's really weaving the security requirements into design control itself, thinking about those security aspects right from the very start.”
“The whole 'harvest now, decrypt later' problem is due to the fact that we're currently not using, in most applications, future-proofed encryption methodologies.”
“The FDA guidance is very mature from what we can see for a lot of different countries' regulations. EU MDR and EU cybersecurity regulations try to lean on certain other standards.”
“If you can present your case and say, 'This data is not sensitive. It doesn't need to be encrypted,' they're going to be understanding of that.”
Frequently asked questions
Bring this work to your device
Need help with sbom management?
Blue Goat Cyber delivers sbom & supply chain services for medical device manufacturers - from threat modeling to FDA-ready reports.
SBOM & Supply Chain ServicesMore on SBOM Management
Keep listening
-
Episode 53
Untangling Software Composition Analysis for MedTech Teams
With MedTech leader
-
Episode 33
Vulnerability, Penetration & Other Cybersecurity Testing Types Explained
With MedTech leader
-
Episode 70
Why MedTech Needs Specialists with Zoltan Kevei and Saby Toth of Bishop & Co
With Zoltan Kevei
-
Episode 69
Science Before Hype in MedTech Investing with Varun Turlapati of Chaanakya Capital
With Varun Turlapati