Medical Device Cybersecurity Assessment
Guaranteeing Secure Healthcare Technology
With 20 years in cybersecurity and 18 years in healthcare IT, ScienceSoft helps evaluate and improve the security of medical devices, SaMD, and medical device networks at any stage of their lifecycle.
Medical device cybersecurity assessment helps medical device manufacturers reveal any security gaps in their products before they go on the market, ensuring their safety in the long run, also as a part of the postmarket management strategy. For healthcare providers, it is a way to verify that the medical devices they employ don’t contain vulnerabilities that could compromise healthcare operations, patient safety, or sensitive data privacy.
Medical Devices and Software We Assess
ScienceSoft finds and helps remediate security issues in connected medical devices as well as software as a medical device (SaMD). This includes:
Class II Medical Devices
- Medical imaging devices: e.g., ultrasound, MRI, and CT scanners.
- Monitoring and diagnostic devices: e.g., wearable spirometers, hemodynamic/pressure monitoring devices, ECG patches.
- Treatment devices: e.g., anesthesia machines, insulin pumps, smart insulin pens, hemodialysis machines, smart intravenous infusion pumps.
Class III Medical Devices
- Implants: e.g., pacemakers, cardioverter-defibrillators, cochlear implants, neural prostheses.
- Emergency and intensive care devices: e.g., cardiac ablation systems, high frequency ventilators.
- Critical obstetric electronic devices: e.g., obstetric data analyzers, fetal EEG monitors.
SaMD (Class I, II, III)
- Software for monitoring and diagnostics: e.g., image recognition software for stroke type identification or cancer tumor localization.
- Software for treatment and disease management: e.g., medication dosing calculators, apps for identification of sleep apnea episodes, AI-driven solutions for disease treatment and patient care planning.
We review the existing security controls to determine which ones are lacking:
- Medical device hardware and software features that protect critical functionality and data.
- Secure software architecture.
- Secure development life cycle.
- Patching schedule.
- Infrastructure configuration (including cloud).
- Device security monitoring, response and recovery policy.
- Security tools employed, their configuration and integrations.
- Security awareness of the device users and healthcare workers who interact with the device.
To identify all security vulnerabilities that can potentially endanger medical device data or functionality, we:
- Scan the device and its infrastructure, including within a broad system (e.g., IoT) if needed.
- Manually analyze the scanning results to exclude false positives.
- Analyze and prioritize the detected vulnerabilities to offer the optimal remediation roadmap.
Acting like real-world hackers, we try to exploit the existing vulnerabilities to see if malicious actors can break into the system. We perform penetration tests according to the three main offender models:
- Black box. We approach the medical device/ system without any prior knowledge of it. We search for publicly available info about the device, its manufacturer, or end users, which we can use in attack simulation.
- Gray box. We have limited info about the device or its use environment: e.g., the device user credentials, low-privileged access to a hospital network where the device is placed.
- White box. We receive admin access and full information about the architecture and tech stack of the tested device to review its source code.
To test the security awareness of the device users (for healthcare providers) or employees (for device manufacturers), we can simulate:
- Phishing attacks – malicious emails sent to multiple users to test their security vigilance and the efficiency of email filtering.
- Spear phishing – emails targeting specific employees (e.g., admins) to trick them into giving access to the device to an unauthorized user or a user having a lower access level.
- Whaling – emails targeting C-level executives.
To evaluate and mitigate the risks that affect your medical device, we:
- Identify cybersecurity gaps in the device and the IT infrastructure it is a part of.
- Define the security threats posed by the vulnerabilities: data breaches, malware spread, modifying device operation algorithms, etc.
- Assess the likelihood of vulnerability exploitation and the severity of its potential consequences: e.g., sensitive data exposure, compliance breaches, harm to patients’ health, damage to the IT infrastructure.
- Classify the risks according to their control level.
- Offer actionable risk mitigation guidance.
ScienceSoft Is a Leader in Healthcare IT Services Market in 2022 SPARK Matrix
ScienceSoft is featured as a leading healthcare IT services provider, along with Athena Health and Oracle Cerner. This achievement is a result of 17 years of tireless pursuit of technological innovation, made possible by ScienceSoft’s passionate team of healthcare IT experts who always strive to make a difference for patients and caregivers alike.
For devices at any stage of their lifecycle
We provide:
- Security audit reports.
- Vulnerability assessment reports.
- Penetration testing reports.
- Summary of the risk assessment conclusions, including the control level of the revealed risks.
In these reports, we include:
- A summary of the detected flaws, vulnerabilities, risks, compliance gaps.
- Remediation guidelines.
For device premarket submission
To help ensure continuous safety and effectiveness of a medical device, we offer:
- A detailed description of the security controls in place to ensure that the device will maintain its integrity from the point of origin to the point where it leaves the control of the manufacturer.
- A plan for security updates and patches throughout the medical device lifecycle.
- Guidelines on the cybersecurity controls for the intended use environment (e.g., how to place and configure security tools such as antivirus software, firewalls, SIEM).
For devices on the market
If vulnerability remediation resulted in changes to the device software, they need to be reported to FDA or a Notified Body designated under MDR/IVDR. In this case, we provide:
- Detailed description of the vulnerability and the changes made to the device, including the comparison between the current and the previously approved version of it.
- The rationale for making the changes.
- References to other devices that were modified in response to the same vulnerability.
Decades-long experience
- 34 years in IT.
- 20 years in the cybersecurity domain.
- 18 years in healthcare IT.
- 12 years in IoT.
- 11 years in cloud services.
Proven expertise in healthcare security
- A solid portfolio of 100+ successful projects in the healthcare IT domain.
- 200+ implemented projects in cybersecurity.
Consistency in service quality
- Established quality management system for medical devices and SaMD confirmed by ISO 13485 certification.
- ISO 9001-certified to guarantee quality performance and timely project delivery.
- ISO 27001 certification ensuring full security of the sensitive data entrusted to us.
Recognized leadership
- A top HIPAA consulting company in 2022, according to Atlantic.net.
- Winner of Health Tech Digital Awards 2022 in the category Best Healthcare Technology Solution of the Year.
- Recognized as Top Penetration Testing Company by Clutch.
- For the second straight year, ScienceSoft USA Corporation is listed among The Americas’ Fastest-Growing Companies by the Financial Times.
Dedicated to Medical Device Excellence: Success Stories by ScienceSoft
Penetration Testing for Reconice to Improve ePHI Security
ScienceSoft conducted black box penetration testing of a speech recognition solution used at 500+ healthcare organizations to ensure complete ePHI security.
Development of a Secure Physiotherapy Platform for AKLOS Health
ScienceSoft helped deliver a platform with a mobile app and a web app that use data from wearable sensors to measure the motion range of patients’ joints and assess the physiotherapy progress. Guided by our compliance consultant, the team implemented secure architecture and data encryption and planned security updates for the solution in line with HIPAA and FDA requirements.
Pentesting of a Web Platform and Mobile Apps for a Remote Patient Monitoring Vendor
ScienceSoft conducted gray box penetration testing of a remote patient monitoring platform and corresponding mobile iOS and Android apps to help ensure PHI protection in line with HITRUST CSF and HIPAA.
Network Pentesting and a Phishing Campaign for a US Healthcare Provider
ScienceSoft evaluated internal networks and public IPs for a healthcare provider with 10+ facilities and checked the cybersecurity awareness of its staff members.
Development of a Secure Brain Tumor Localization Application
ScienceSoft created a CNN-based application to automatically analyze brain MRI scans, localize tumors, and define each tissue type. The comprehensive QA, security and compliance testing conducted by ScienceSoft helped ensure the safety of patient data and unfailing app performance as required by HIPAA and FDA.
Penetration Testing of the Hospital IT Infrastructure for a US Health System
To safeguard a hospital’s complex IT infrastructure against vulnerabilities that could disrupt healthcare procedures or lead to HIPAA compliance breaches, ScienceSoft conducted gray box penetration testing and provided exhaustive remediation guidance.
Pre-market security assessment
We help medical device and SaMD manufacturers identify and eliminate security vulnerabilities in their products before they go to the market. We assess potential risks and offer comprehensive risk mitigation guidance to ensure full security of medical devices in the long run.
Post-market security assessment
We check the security of already registered medical devices to help their manufacturers address cybersecurity vulnerabilities at the post-market stage as required by FDA and MDR/IVDR. We help healthcare providers ensure full safety and compliance of the medical devices or device networks they employ.
Medical Device Security Statistics You Can’t Ignore
All about Cybersecurity
Services
Penetration Testing
IBM QRadar Tools: Deployment & Environment
Security Testing
Vulnerability Assessment
IBM QRadar Tools: Analytics & Reporting
IBM QRadar Tools: MITRE ATT&CK
Compliance Services
Security Assessment
Security Information and Event Management
IBM QRadar Tools: Data Integration