Is it Secure… Enough?
There is often discussion between the balance of “secure enough” while avoiding being “too secure”. Thinking of security as a balance may mislead many companies into thinking that security is achieved by meeting a threshold, but that exceeding that threshold is problematic for business objectives. However, the real challenge for medical device manufacturers is not about tuning the amount of security but integrating the right security in the right way so it protects users while fulfilling business needs.
Businesses often face pressure to prioritize speed-to-market. This can cause security to be rushed or poorly implemented (or worse, deferred to future efforts), and increase the likelihood for a security breach. A breach could be costly: regulatory penalties, recalls, harm to a reputation, and/or patient safety risks. These costs can easily exceed the perceived savings of cutting corners to get to market quickly.
At Tensentric strong cybersecurity starts at Phase Zero. Whether your product is a new or existing design, our Phase Zero approach captures the user, technical, and business needs that must be satisfied before a security architecture can be created. These inputs are then used to carefully craft a security design, model threats, and generate security requirements before writing code. Integrating this approach into our standard software design controls helps ensure that Tensentric is designing a panoramic security foundation for our clients.
Designing to Secure the CIA Triad
The core objective of cybersecurity is ensuring the Confidentiality, Integrity, and Availability (CIA) of a system.
- Confidentiality – Protecting sensitive data from unauthorized access.
- Integrity – Assurance that data being passed between system peripherals is unaltered.
- Availability – A system’s resilience to attacks, ensuring quick and secure recovery.
Though there are many variations to these core tenants (CIA, CIAA, CIAAN), the goal remains the same: a guideline to protect data in a system.
There isn’t one specific way to achieve this objective, instead cybersecurity is more of a toolbox, with many tools at the disposal of a developer. The combination and correct implementation of these tools is what provides a robust security architecture.
Tensentric’s approach to securing the CIA triad begins with a Zero Trust framework. Zero Trust means that all connections in the system are assumed to be exploitable, and all requests need to be verified. Trust in a system shouldn’t ever be assumed. The CIA Triad describes what needs to be protected, and a Zero Trust framework underpins how it should be secured.
What goes into a Zero Doubt design?
Security breaches are a starting to become a common headline across all types of industries. To help our clients secure their devices, we approach cybersecurity as a critical component to device design prior to Phase I of the typical product lifecycle.
- Security Needs – Understanding user, patient, and business needs for security.
- Security Concept Exploration – Identifying existing security architectures that can be adapted to meet the security needs.
- Threat Modeling – A thorough process meant to identify threats that post a risk to the system and its assets.
- Security Requirements – The specific, testable requirements derived from the security needs, concept explorations, and threat modeling steps.
Choosing the right tools, or the right design partner
The choice of security tools can determine if a system will be resilient or vulnerable to attacks. Creating your own libraries for cryptography or relying on outdated protocols could also leave your system vulnerable. These common pitfalls can be avoided by using proven, standards-based technologies.
Using well-validated, modern protocols maintains Tensentric’s position as trusted partner in cybersecurity that delivers strong protection and regulatory confidence. We use technologies like Elliptic Curve Cryptography (ECC) for efficient key generation, exchange, and digital signatures, and TLS 1.3 for secure communications. By staying on top of the latest standards and aligning with FDA guidance, we ensure our clients are benefitting from security that is state-of-the-art, safe, testable and maintainable.
Conclusion
The 2023 FDA Cybersecurity Guidance adds onto the growing list of regulatory requirements that must be navigated during the total product lifecycle for medical devices. Thankfully, the medical device manufacturing industry has many companies that can help traverse this regulatory terrain. Even still, choosing the right design partner can be overwhelming especially when trying to parse through companies that can implement cybersecurity.
[1] https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
