Medical devices are complex cyber-physical systems incorporating emergent hardware and software components. However, this complexity leads to a wide attack surface posing security risks and vulnerabilities.
Mitigation and management of such risks during premarket design and postmarket deployment are required. Dynamically mitigating threat potential in the presence of unknown vulnerabilities requires an adaptive risk-based scheme to assess the system’s state, a secure system architecture that can isolate hardware and software components, and design methods that can adaptively adjust the system’s topology based on risk changes. The essential complementary aspects during deployment are detecting, characterizing, and quantifying security threats.
In the article “Probabilistic Threat Detection for Risk Management in Cyber-physical Medical Systems,” which appears in the January/February 2018 issue of IEEE Software, the authors present a dynamic risk management and mitigation approach based on probabilistic threat estimation. A smart-connected-pacemaker case study illustrates the approach.
About Lori Cameron
Lori Cameron is a Senior Writer for the IEEE Computer Society and currently writes regular features for Computer magazine, Computing Edge, and the Computing Now and Magazine Roundup websites. Contact her at l.cameron@computer.org. Follow her on LinkedIn.
