NCCoE Seeks Vendors to Help Secure Wireless Medical Devices

Medical devices such as the infusion pumps that deliver medication intravenously were once standalone instruments that interacted only with the patient. Today, they have operating systems and communications hardware that allow them to connect to other devices and networks. While this technology has created more powerful tools and the potential for improved patient care, it also creates new safety and security risks.
 
The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) is developing example cybersecurity solutions that demonstrate how to protect wireless infusion pumps from unintended errors or unauthorized access, including malicious acts.
 
A recently released white paper reviews the challenges and potential solution requirements to better secure the pumps on an enterprise network. It updates a December 2014 draft developed with input from health care organizations and providers. The new draft incorporates feedback collected during a public comment period.
 
A recently published Federal Register notice invites technology vendors interested in working on a standards-based example solution, or reference design, to work with the center. Those who participate will provide commercially available products and services as modules in the end-to-end example solution.
 
NIST does not endorse particular products, but uses them as exemplars of capabilities that conform to standards and best practices. To adopt this approach to better secure wireless infusion pumps, health care organizations can use similar products with the same capabilities. The goal is to help organizations and providers implement improved security controls by identifying the people and systems that interact with infusion pumps, defining the interactions between those people and systems, performing a risk assessment, and identifying mitigating security technologies.
 
The NCCoE is a partnership of NIST, the State of Maryland and Maryland’s Montgomery County. It accelerates the adoption of practical, standards-based cybersecurity solutions for businesses and public organizations by demonstrating how commercially available technologies can be integrated to potentially solve cybersecurity challenges.
 
By working with industry stakeholders and technology vendors, the NCCoE develops a reference design or example solution to meet pressing cybersecurity challenges and then publishes that information in a freely available NIST Cybersecurity Practice Guide. The guide includes a materials list and instructions for implementing the reference design. The NCCoE will seek the public’s feedback on the reference designs and improve them accordingly.
 
Companies interested in participating in the reference design project must submit a letter of interest in which they outline their proposed contribution. Full details of this process are published in the Federal Register notice (docket number 151217999-5999-01). Those selected to participate will enter into a cooperative research and development agreement with NIST.