NH-ISAC also to hold medical device vulnerability info sharing workshop, hosted by St. Jude Medical.

Sara Peters, Senior Editor

September 21, 2016

1 Min Read

The National Health Information Sharing and Analysis Center (NH-ISAC) and the Medical Device Innovation, Safety and Security Consortium (MDISS) Tuesday released a statement encouraging medical device researchers to comply with ISO/IEC standards and US Food & Drug Administration (FDA) recommendations on vulnerability disclosure.

The announcement comes in the wake of security research firm MedSec's controversial decision to partner with Muddy Waters to short-sell stock on medical device manufacturer St. Jude Medical. MedSec, via Muddy Waters, revealed only vague information about severe vulnerabilities in the company's implantable cardiac devices, rather than reporting the complete details of those vulnerabilities to the manufacturer or to the FDA or ICS-CERT (which are the official handlers of medical device safety and cybersecurity complaints/investigations).

Dr. Dale Nordenberg, Executive Director of MDISS, stated in the release, that “when identifying security vulnerabilities that may pose a risk to patients, it is critical that medical device researchers provide detailed engineering methods to support a timely collaborative peer review process by manufacturers, ICS-CERT, and the FDA of any potential medical device vulnerability.”

The FDA laid out its draft guidance for "Postmarket Management of Cybersecurity in Medical Devices" in January. NH-ISAC and MDISS will hold an educational workshop about these new FDA guidelines later this month in Minnesota; the workshop will be hosted by St. Jude Medical.  

About the Author(s)

Sara Peters

Senior Editor

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad of other topics. She authored the 2009 CSI Computer Crime and Security Survey and founded the CSI Working Group on Web Security Research Law -- a collaborative project that investigated the dichotomy between laws regulating software vulnerability disclosure and those regulating Web vulnerability disclosure.


Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights