Connected medical and diagnostics devices, OTA software updates & device management

These recommendations will likely soon become mandates emanating from US Federal Law. Since December 9th, 2020, basic principles of cybersecurity for IoT devices have been signed into US Federal Law through the IoT Cybersecurity Improvement Act of 2020 . 

This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to define and mandate specific steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects. Specifically, the bill requires NIST to develop and publish standards and guidelines for the Federal Government on the appropriate use and management by agencies of IoT devices owned or controlled by an agency and connected to information systems owned or controlled by an agency, including minimum information security requirements for managing cybersecurity risks associated with such devices.

The old fashioned way to set up and perform software updates on a device in a clinical setting is to create a USB stick for them. The stick is then shipped to different sites, some with multiple devices.  This requires inserting the USB stick, perhaps staging to the device’s internal uSD card storage, and eventually - between test runs or work shifts - walking through a process and rebooting the device for it to take the commit or to rollback.  This process could take anywhere from 10 minutes to an hour, or longer.

Software signatures for USB installations are often made mandatory by the medical device makers internally so they don’t have to deal with Trojan Horses coming in via USB sticks.  Every update coming into a device should require a company-signed verification on the medium; objects exported out from a device, such as aggregated reports, counts or other non-sensitive data, should not need this.  

Device makers can take the following stringent steps to secure devices with the implementation of:

1. A secure boot
2. Network stack hardening
3. Public key encryption

Medical device makers will also look to create a better defense for their IP and patient data, and to audit for user data safety on the connected devices. Being able to maintain audit logs on the changes that have been made to devices in the field, and role-based access control are key considerations in this regard.