J. David Giese

This article provides an in-depth exploration of medical device cybersecurity requirements, including best practices and FAQs. It also includes examples and resources for those looking to implement or improve their own threat modeling processes.

A concise guide to the FDA’s De Novo pathway for novel, moderate-risk medical devices that lack a suitable predicate. It includes real-world examples and offers insider tips on managing higher costs, extended timelines, and proactive FDA engagement to successfully navigate this classification route.

Practical suggestions and tips for authoring SBOMs for medical devices and for using them to monitor for cybersecurity vulnerabilities.

A Pre-Sub is a mechanism for requesting formal written feedback from the FDA, and (optionally) a one-hour meeting. This article provides best-practices and FAQs about pre-subs.

A comprehensive FAQ for people who are interested in creating a new medical device software to learn the basics about the US regulations.

To provide quality service to our clients, we need to do more than produce quality work.

In this article, we share a nuanced approach to avoiding sharing sensitive information in an SBOM.

The discussion explores generative AI (GenAI) in medical devices, focusing on FDA's considerations for regulation, risks, and the lifecycle management of such technologies. Key points include the complexity of training data in foundation models, the risks of hallucinations in outputs, and the evolving role of post-market surveillance. Insights highlight challenges in balancing innovation with regulatory oversight and safety.

The conversation between Yujan Shrestha and J. David Giese focuses on making threat modeling more approachable and less intimidating. They share personal anecdotes to illustrate how threats can appear in daily life, then transition to discussing the distinctions between threats, vulnerabilities, and risks in cybersecurity. Broader definitions of harm and the STRIDE methodology are highlighted as essential tools for comprehensive risk management.

We discuss challenges in medical device cybersecurity, including balancing FDA guidelines with practical hospital and manufacturer needs. They highlight risks like network vulnerabilities and outdated dependencies, recommending best practices such as code reviews, automated testing, and prioritizing tool validation for critical security areas.