Embracing Cybersecurity Risk Management in the Industry of Medical Devices

Abstract

The promises of Industry 4.0 in the medical device industry needs to be built on sound cybersecurity infrastructures, polices, and practices. During 2011-2017, the authors interviewed many manufacturers of medical devices in China, Germany, Israel, Japan, Taiwan, and U.S. about their attitude towards cybersecurity. Many manufacturers are not committed to cybersecurity risk management because they pursue lower cost and shorter product life cycles; do not have sufficient knowledge of operating environments of hospitals; have defensive attitude toward vulnerability disclosure; and reap quick benefits from the low-trust level among stakeholders and unequal power between manufacturers and distributors. Only a few large U.S. manufacturers of medical devices have set up robust secure platforms and interoperable optimal standards which benefit the users. As cybersecurity is a shared responsibility, many small and medium-sized enterprises need to be empowered through the support of international organizations and local government policies.