Cybersecurity Articles & Videos

Practical suggestions and tips for authoring SBOMs for medical devices and for using them to monitor for cybersecurity vulnerabilities.

This article provides an in-depth exploration of medical device cybersecurity requirements, including best practices and FAQs. It also includes examples and resources for those looking to implement or improve their own threat modeling processes.

The conversation between Yujan Shrestha and J. David Giese focuses on making threat modeling more approachable and less intimidating. They share personal anecdotes to illustrate how threats can appear in daily life, then transition to discussing the distinctions between threats, vulnerabilities, and risks in cybersecurity. Broader definitions of harm and the STRIDE methodology are highlighted as essential tools for comprehensive risk management.

We discuss challenges in medical device cybersecurity, including balancing FDA guidelines with practical hospital and manufacturer needs. They highlight risks like network vulnerabilities and outdated dependencies, recommending best practices such as code reviews, automated testing, and prioritizing tool validation for critical security areas.

A survey that should give you a feeling as to whether you’re cybersecurity documentation is ready for an FDA marketing submission.

How do you avoid slowing down your FDA marketing submission (510(k), De Novo, or PMA) with cybersecurity problems? This article reviews 14 common FDA cybersecurity deficiencies based on our recent submissions.

A technical exploration and discussion of DICOM Part 15 Security

How safe is DICOM in the wild? As you develop your medical imaging device or service, prepare for the standards and regulations protecting hospital networks from ransomware.

A short article that attempts to explain why badly made diagrams will confuse FDA reviewers and slow down your submissions. Includes links to the relevant guidance and a few best practices.

This is a redline between the 2022 Draft cybersecurity guidance and the final 2023 cybersecurity guidance. It should be useful to medical-device regulatory professionals who want to see, in detail, what has changed since the draft guidance.

The long-awaited FDA guidance on cybersecurity, touching both on regulatory submissions and quality system considerations.

This article contains a convenient transcript of the FDA's 2022 draft guidance on cybersecurity in medical devices. The article also provides general principles for medical device cybersecurity relevant to device manufacturers, including design for security, transparency, and submission documentation. At Innolitics, among other things, we specialize in cybersecurity-related services regarding medical device software such as whitebox penetration testing, cybersecurity risk management, remediation projects, and design controls, risk, and labeling documentation.

Security vulnerabilities in medical devices can have devestating consequences. They can lead to patient injuries and in the worst cases, death. In our first public 10x talk, learn about common cybersecurity pitfalls and how they can be mitigated using modern software testing techniques used at scale by companies like Google and Facebook.

A convenient transcription of the FDA's 2018 cybersecurity guidance for software engineers. It includes a list of suggested cybersecurity design controls to secure your device and a list of the cybersecurity documentation you need to include in your premarket submissions.

The FDA guidance discussing risks and documentation for pre-market submissions when devices must inter-operate with other devices (e.g., via DICOM or other standards).

This FDA guidance outlines recommendations for managing cybersecurity vulnerabilities in medical devices, including a risk-based framework for assessing when changes to devices require reporting to the agency. Innolitics provides turn-key engineering solutions and regulatory consulting services to help with cybersecurity requirements for SaMD.

This FDA guidance outlines how manufacturers should maintain the cybersecurity of medical devices that use off-the-shelf software. The guidance provides general principles for software maintenance actions and answers frequently asked questions. Manufacturers should use the guidance to ensure their cybersecurity maintenance activities comply with existing regulations.