When it comes to cybersecurity and liability in medical device development, manufacturers need to treat 99% mitigation as a 100% chance of an incident. It takes only one cybersecurity incident to undo years of work building a reputation, or worse, cause harm to a patient.
There are nearly as many cybersecurity concerns around infiltration (bad actors gaining access to a system) as there are with exfiltration (bad actors exporting data from a system). It’s unfortunate that this is the world we live in, and even sadder to realize that it’s likely always been that way: thieves and spies are not a modern invention.
Building medical equipment and Software as a Medical Device (SaMD) is no exception. The FDA reminds us all frequently of our collective responsibilities to guard against attacks that compromise medical device safety and risk patient harm. The most impactful measures a manufacturer can take to guard hardware devices and software from malicious actors are to assess their attack surfaces, be proactive in monitoring and guarding, and be responsible in evolving cybersecurity mitigations. This applies not only to in-house engineering and product development teams, but to every hardware and software development partner and consultant that contributes to a product.