Cyberinsights : Cybersecurity as a Team Sport
Axel Wirth, Christopher Falkner · Biomedical Instrumentation & Technology · 2020
We often hear that cybersecurity, and especially medical device security with its unique challenges and complexities, requires a team effort that frequently is described as the need for "stakeholder cooperation."Although, being a bit cynical for a moment, this sometimes feels like "kicking the can down the road," as it may appear that this has resulted in a lot of talking among stakeholders and very little action.However, some notable exceptions give us cause for hope, such as the healthcare cybersecurity efforts (including specific medical device security) by the Healthcare and Public Health Sector Coordinating Council's Joint Cybersecurity Working Group and Health Care Industry Cybersecurity Task Force.An additional and new example was presented at the most recent Health Information Sharing and Analysis Center (H-ISAC) 2019 Fall Summit in San Diego, CA, where a group of representatives from four U.S. hospitals presented their efforts to produce a unified medical device security contracting language.We know of earlier and commendable efforts in this area, most notably reflected in the Mayo Clinic's Medical and Research Device Risk Assessment Vendor Packet Instructions 1 and the Risk Management Framework for DoD Medical Devices. 2 However, not every institution has the resources and capabilities to develop such a framework and contracting language on its own, and vendors should not have to build up staffing to respond to yet another security questionnaire.This is why an effort put forward by the Cleveland Clinic, Froedtert Health, Kaiser Permanente, and Mayo Clinic during a presentation titled "Grassroot Collaboration: Update on Unified Medical Device Contract Expectations" at the recent H-ISAC Fall Summit is so important.I had the opportunity to speak with one of the presenters, Christopher Falkner, product owner of medical device cybersecurity governance and standards at Kaiser Permanente, to get more insight.