Medical Device Penetration Testing
Overview
Penetration testing, or ethical hacking, involves simulating cyber-attacks to identify and address vulnerabilities in systems before malicious actors can exploit them. This practice is crucial for safeguarding sensitive information, ensuring regulatory compliance, and improving overall security posture. For medical devices, penetration testing is especially important to protect patient data, maintain device integrity, and prevent disruptions in healthcare services, thereby enhancing patient safety and system reliability.
New Resource: Medical Device Penetration Testing Best Practices
MDIC’s new Medical Device Penetration Testing resource provides manufacturers with a consistent, industry-developed approach to planning, conducting, evaluating, and documenting penetration testing across the medical device product lifecycle.
From Testing to Action
The Medical Device Penetration Testing Best Practices resource outlines a practical, five-step penetration testing process:
- Scoping Penetration Tests: Define attack surfaces, system boundaries, and relevant threat scenarios to ensure meaningful testing.
- Resourcing and Supplier Selection: Identify qualified penetration testing partners with the appropriate expertise, independence, and regulatory experience.
- Execution Best Practices: Prepare environments, manage testing activities, and ensure effective communication throughout the engagement.
- Findings and Risk Disposition: Translate vulnerabilities into actionable risk decisions, including mitigation, acceptance, or remediation.
- Reporting and Communication: Align findings with internal stakeholders, customers, and regulatory submissions.
PenTesting Members
Chris Reed (Lead)
Medtronic
Dirk de Wit
Philips
Jason Herbst
Medtronic
Peter Kapelanski
Medtronic
Inhel Rekik
Bracco
Curtis Blythe
Abbott
Matt Hazelett
MedSec
David Hingos
Johnson and Johnson
Tyrone Heggins
BD
Sanket Kamath
Boston Scientific
Michelle Jump
MedSec
Jessica Wilkerson
FDA
Cybersecurity Resources
MDIC Medical Device Cybersecurity Maturity: Industry Benchmarking Report 2023
Coordinated Vulnerability Disclosure (CVD) for Medical Device Cybersecurity Report
Playbook for Threat Modeling Medical Devices
Validating Medical Device Cybersecurity Through Penetration Testing
Join Us!
To learn more, you can get in touch with the MDIC Cybersecurity team at cybersecurity@mdic.org