Hardware Podcasts

Software Bill of Materials (SBOMs) & Cybersecurity in the Medical Device Industry

Global Medical Device Podcast · 1 Jun 2022 · 40m · Episode 265

What this episode covers

Ken Zalevsky, CEO of Vigilant Ops, explains the critical role of Software Bill of Materials (SBOMs) in medical device cybersecurity, defining them as transparent lists of software components that help hospitals and manufacturers manage risk. He discusses the FDA's evolving regulatory expectations, including the pending pre-market guidance and the 'Burgess Bill,' which mandate SBOMs for 510(k) submissions and require continuous post-market vulnerability monitoring. Zalevsky highlights the challenge of legacy devices, noting that healthcare organizations take an average of 160 days to discover breaches because they often deploy 'black box' devices without knowing their internal software composition. He advises manufacturers to scope cybersecurity efforts appropriately, integrating security into the design phase rather than treating it as a bolt-on, and to use SBOMs to provide necessary transparency to end-users.

Most relevant to

large enterprises

Topics

Mentioned

Companies
Vigilant Ops, FDA, NTIA, CISA, NIST, Greenlight Guru, Carnegie Mellon, Harvard Business School
Also
AAMI TIR57, Burgess Bill, WannaCry, 510(k)

Related episodes from other shows

Other shows on the same ground, closest first.

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

  • IoT For All Podcast · 18m

    Biggest Firmware Vulnerabilities & How to Fix Them | NetRise's Thomas Pace | Internet of Things Podcast

    Thomas Pace, co-founder and CEO of NetRise, explains how automated firmware analysis provides visibility into extended IoT (XIOT) devices, including industrial control systems and medical devices. He details the process of extracting firmware from embedded Linux and RTOS environments to identify vulnerabilities, weak credentials, and exposed keys. Pace emphasizes the critical importance of generating a Software Bill of Materials (SBOM) to enable vulnerability correlation and risk prioritization for both device manufacturers and enterprise customers.

    Embedded firmwareSecurity & privacy
    8 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • The Pragmatic Embedded Podcast · 33m

    How to Speed Up Safety Critical Processes

    Jeff Gable and Luca Njani discuss strategies to accelerate safety-critical development in medical devices, automotive, and aerospace without compromising quality. They argue that reducing scope for initial releases and automating documentation using modern tools like Jama and Matrix significantly shortens cycle times. The hosts emphasize that modern regulatory guidance, such as the FDA's Computer System Assurance, supports streamlined validation processes, allowing teams to iterate faster and uncover defects earlier.

    Medical & health devicesDesign for manufacturing & NPI
    7 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Global Medical Device Podcast. The episode itself belongs to its publisher.