Cyber-security testing for medical devices set to arrive in UK

A US-led initiative that tests medical device security is expected to expand to the UK by the end of this year.
 
The World Health Information Security Testing Lab (WHISTL) initiative has been launched in America by the Medical Device Innovation, Safety and Security Consortium (MDISS), focusing on critical care environments like hospital intensive care units, A&E departments and operating theatres that feature multiple devices which need secure vetting.
 
WHISTL facilities will comprise a network of medical device security testing labs, which are to be owned and operated independently by technology companies, universities, device manufacturers and healthcare delivery businesses – all of which are MDISS member organisations.
 
Its focus is on identifying and migrating vulnerabilities present in medical devices, sharing best practice and solutions, and providing device security education and awareness – with any new information uncovered reported to manufacturers and the NHISAC-MDISS Medical Device Vulnerability Program for Evaluation and Response.
 
It is the first lab network specifically designed to meet the requirements of medical device researchers, hospital clinical engineering leaders and healthcare IT professionals; its goal is to help organisations work together more effectively to address cyber security issues arising in multi-vendor device networks in public health.
 
The medical device cyber risk assessment platform (MDRAP) was built by MDISS under a $1.8m contract from the Department of Homeland Security (Science and Technology Directorate, Cyber Security Division), and aims to help health systems, technology firms and device manufacturers share risk assessments.
 
MDRAP facilitates timely, responsible sharing of risk assessments and threat indicators, features moderated crowdsourcing and helps automate critical device inventory, audit, oversight and vulnerability tracking tasks for hospitals.
 
It is hoped by the end of 2017 MDISS WHISTL facilities will be operating in New York, California, Tennessee, Indiana, the UK, Singapore, Israel and Finland.