Simplify Safe and Secure Medical Device Design

Safety and security are two simple words that create complex requirements for mission-critical embedded systems, such as medical devices. Implementation takes great effort, in part because most device manufacturers are system integrators and do not build everything themselves.

To identify the security risks that exist for a medical device, suppose a malicious hacker gains control of an infusion pump. The hacker may interfere with the normal operation of the device, such as administering the wrong dose of the medication, or not administering any medication when the user prompts it. The various places in the system where the attacker could get in to take malicious actions are called attack surfaces. These attack surfaces are like safety hazards. When analyzing a system for security, the goal is to identify the vulnerable places.