Towards cyber-biosecurity by design: an experimental approach to Internet-of-Medical-Things design and development

Abstract

The introduction of the internet and the proliferation of internet-connected devices (IoT) enabled knowledge sharing, connectivity and global communications. At the same time, these technologies generated a crime harvest as security was overlooked. The Internet-of-Medical-Things (IoMT) generates biological information and is transforming healthcare through the introduction of internet-connected medical-grade devices that are integrated with wider-scale health networks to improve patients’ health. Many innovative ideas arise from academia; however, there is a lack of support in medical device regulation. The implementation of the current regulatory framework is limited to security risk assessment and guidance. Unfortunately, premarket risk-management requirements of current regulation do not include crime risks and a more predictive approach could help fill this gap. Crime science, or the perspective of crime as an event that can be influenced directly by its immediate environment, may encourage the biotechnology industry to design-in security and crime out. In this article, I provide a point of view of an early career researcher and medical device developer navigating the medical device regulatory pathway for the first time. I narrow the focus of this article to an assessment that is specific to current UK provisions and acknowledge the limited scope. In response to the ongoing changes in the current regulatory framework of the UK, I propose a new secure by design mechanism that can be employed by early career developers earlier in the development process of a product. Such a model can be used to systematically consider security design in devices and to understand and address potential crime risks ahead of their widespread use.