Author: By Steve Curren, ASPR Critical Infrastructure Protection Program Manager
This spring two independent cyber security researchers identified a potential vulnerability among a sample of medical devices, spanning from general use to life-sustaining. If exploited, the vulnerability could result in unauthorized access to the device, changes in functionality that could cause harm to patients or, with networked devices, could compromise a hospital’s computer networks. The researchers alerted the U.S. Food and Drug Administration and to the Department of Homeland Security to the potential vulnerability.
Because of a new Presidential Policy Directive on critical infrastructure security, called PPD-21, and a new executive order on improving critical infrastructure cyber security, federal agencies were better prepared to take on this issue in a coordinated way.
In fact not long before this vulnerability was discovered, DHS, FDA, ASPR, the HHS Office of Security & Strategic Information, and the HHS Office of the Chief Information Officer completed an exercise on sharing cybersecurity information. The exercise established relationships and information sharing processes across the agencies which they drew on to respond to this real-time challenge.
FDA and DHS immediately began a coordinated effort to assure that the vulnerability was assessed properly and addressed by the medical device manufacturers. FDA and DHS notified the companies whose devices were identified by the researchers , cross-referencing each other’s communications. ASPR alerted its partners in the Healthcare and Public Health Sector, including hospitals and state and local public health departments. DHS provided technical expertise to the manufacturers to address specific IT vulnerabilities. The effort demonstrated to manufacturers that the agencies really are working together to strengthen cybersecurity and critical infrastructure in the healthcare space.
FDA also released draft guidance for medical device manufacturers that clarifies the cybersecurity risks that manufacturers should consider in the design of their medical devices and identifies what type of information should be included in premarket submissions to FDA.
They also sent an important safety communication on cybersecurity to medical device manufacturers, hospitals, medical device user facilities, health care IT and procurement staff, and biomedical engineers. The safety communication recommended that medical device manufacturers and health care facilities take steps to assure that appropriate safeguards are in place to reduce the risk of failure due to cyber attack.
This real-world example is what PPD21 and the executive order are all about: a more coordinated approach to infrastructure protection before, during and after a cyber crisis. A coordinated approach means situational awareness and information exchange among local, state, and federal agencies and the private sector.
PPD21 lays out the roles and responsibilities of federal agencies to drive a more coordinated federal approach. Better federal coordination means streamlined processes for sharing information with local and state agencies and the private sector.
Executive Order 13636, called “Improving Critical Infrastructure Cyber Security,” focuses on enhancing cyber security for everyone. The order helps the federal government to share information on cyber threats and vulnerabilities – like the medical device vulnerability – with the industries and agencies that would be affected. This information helps them fix the problems and protect their own systems. This information is often more comprehensive than the information previously available to the private sector and local and state agencies.
Also under the order, federal agencies are creating a new cybersecurity framework with non-regulatory standards to guide practices for private industry. The same practices could be applied by state and local agencies to protect health department systems.
Want to know more? Interested in participating in the writing the framework? Watch your association’s website or newsletter for upcoming workshops the cybersecurity framework taking place around the country or contact ASPR at CIP@hhs.gov.
What are your cybersecurity concerns when it comes to health care and public health?
