By Marianne Kolbasuk McGee (HealthInfoSec) • March 22, 2022
The integration of third-party components and software is an increasingly critical area of security risk that needs more attention from medical device manufacturers, says global head of medical device security at safety certification and consulting firm UL, Anura Fernando.
“We’ve gotten to a point as an industry where a lot of manufacturers understand that they need to have basic things, like authentication, authorization, encryption of data and protection of personally identifiable information and protected health information,” he says in an interview with Information Security Media Group.
“But where we are seeing a lack of awareness across the industry is the notion of integration. Whether you’re integrating a component into a device or integrating multiple software-as-a-service solutions, we see that that integration is often where some level of breakdown can occur.”
Exposed Vulnerabilities
Often, there are business constructs in place, such as service-level agreements, “that drive some of the behaviors of those interfaces,” Fernando says.
“But often when you get into contracts and contract language, there are still a lot of areas that need to be better addressed.
“Whether we’re talking about buying a component and integrating it into your product, or whether we’re talking about subscribing to a software as a service, the differences and security posture of the vendor-purchaser relationship can really start to open up some of those cracks and expose vulnerabilities that threat actors can go right after,” he says.https://www.databreachtoday.com
