Medical device cybersecurity platform
Systems and methods for the management of cybersecurity risks for medical devices are disclosed. A system may streamline and automate the process of generating a cybersecurity bill of materials and evaluate it against the National Vulnerability Database or a similar source. Furthermore, the system may provide a secure platform for data to be transferred between medical device manufacturers and healthcare delivery organizations allowing for the notification of security vulnerabilities and the transferal of security updates.
1. A system for the management of cybersecurity risks for medical devices, the system comprising:
a processor; and
a non-transitory, processor-readable storage medium, wherein the non-transitory, processor-readable storage medium comprises one or more programming instructions that, when executed, cause the processor to:
receive data associated with a medical device;
evaluate, based on the data, an identity of the medical device;
generate, based on the identification, a cybersecurity bill of materials associated with the medical device, wherein the cybersecurity bill of materials comprises a software bill of materials detailing a software component of the medical device, wherein the software bill of materials comprises a build status comprising a build environment of the software component and a current status comprising applied updates to the software component;
standardize the cybersecurity bill of materials based on a common platform enumeration database;
evaluate, using a vulnerability database, the cybersecurity bill of materials to identify one or more potential vulnerabilities;
provide notification of the one or more potential vulnerabilities to at least one user;
determine, using a manufacturer's database, whether the medical device is up-to-date; and
responsive to determining that the device is not up-to-date, receive a patch from the manufacturer's database to update the medical device.
2. The system of claim 1 , wherein the received data associated with the medical device comprises at least one of a device manufacturer, a device name, a device model, a device version, an IP address, a device domain, a device administrator, or a device password.
3. The system of claim 1 , wherein the one or more programming instructions that, when executed, cause the processor to receive data associated with the medical device further comprise one or more programming instructions that, when executed, cause the processor to interrogate the medical device directly for data.
4. The system of claim 1 , wherein the data associated with the medical device is received directly from the medical device.
5. The system of claim 1 , wherein the data associated with the medical device is received directly from the build environment of the software.
6. The system of claim 1 , wherein the at least one user comprises at least one of a medical device manufacturer user, a healthcare delivery organization user, or a platform maintenance user.
7. The system of claim 1 , wherein the one or more programming instructions that, when executed, cause the processor to evaluate, using a vulnerability database, the cybersecurity bill of materials to identify one or more potential vulnerabilities are performed recursively and in real-time.
8. The system of claim 1 , wherein the one or more programming instructions that, when executed, cause the processor to provide notification of the one or more potential vulnerabilities further comprise one or more programming instructions that, when executed, cause the processor to flag the one or more potential vulnerabilities on a graphical user interface.
9. The system of claim 1 , wherein the one or more programming instructions that, when executed, cause the processor to provide notification of the one or more potential vulnerabilities further comprise one or more programming instructions that, when executed, cause the processor to message at least one user using an automated email, text, call, messaging application, or service ticket system.
10. The system claim 1 , wherein the one or more programming instructions that, when executed, cause the processor to evaluate the identity of the medical device further comprise one or more programming instructions that, when executed, cause the processor to map the identity of the device to a standard naming convention of a known device.
11. The system of claim 1 , further comprising one or more programming instructions that, when executed, cause the processor to automatically deploy the received patch.
12. The system of claim 1 , further comprising one or more programming instructions that, when executed, cause the processor to:
transmit a notification associated with the received patch to at least one user;
receive deployment instructions to deploy the received patch from the at least one user; and
deploy the received patch in response to receiving the deployment instructions.
13. The system of claim 11 , wherein the one or more programming instructions that, when executed, cause the processor to deploy the received patch further comprise one or more programming instructions that, when executed, cause the processor to deploy the received patch at a pre-determined time.
14. A method for the management of cybersecurity risks for medical devices, the method comprising:
receiving data associated with a medical device;
evaluating, based on the data, an identity of the medical device;
generating, based on the identification, a cybersecurity bill of materials associated with the medical device, wherein the cybersecurity bill of materials comprises a software bill of materials detailing a software component of the medical device, wherein the software bill of materials comprises a build status comprising a build environment of the software component and a current status comprising applied updates to the software component;
standardizing the cybersecurity bill of materials based on a common platform enumeration database;
evaluating, using a vulnerability database, the cybersecurity bill of materials to identify one or more potential vulnerabilities;
providing notification of the one or more potential vulnerabilities to at least one user;
determine, using a manufacturer's database, whether the medical device is up-to-date; and
responsive to determining that the device is not up-to-date, receiving a patch from the manufacturer's database to update the medical device.
15. The method of claim 14 , wherein receiving data associated with the medical device further comprises interrogating the medical device directly for data.
16. The method of claim 14 , wherein providing notification of the one or more potential vulnerabilities further comprises flagging the one or more potential vulnerabilities on a graphical user interface.
17. The method of claim 14 , wherein providing notification of the one or more potential vulnerabilities further comprises messaging at least one user using an automated email, text, call, messaging application, or service ticket system.
18. The method of claim 14 , wherein evaluating the identity of the medical device further comprises mapping the identity of the device to a standard naming convention of a known device.
19. The method of claim 14 , further comprising automatically deploying the received patch.
20. The method of claim 14 , further comprising:
transmitting a notification associated with the received patch to at least one user;
receiving deployment instructions to deploy the received patch from the at least one user; and
deploying the received patch in response to receiving the deployment instructions.