Hardware Podcasts

Cybersecurity and the Future of MedTech

Global Medical Device Podcast · 2 Jun 2023 · 1h 12m · Episode 321

What this episode covers

Chris Gates of Velentium, Chris Reed of Medtronic, and Ken Hoyme of Dark Star Consulting discuss the impact of the Consolidated Appropriations Act of 2023 on medical device cybersecurity regulation. They explain how the FDA now has explicit legal authority to enforce cybersecurity hygiene, moving beyond just safety and efficacy, and detail the requirements for pre-market submissions under the April 2022 draft guidance. The panelists emphasize the critical importance of Software Bill of Materials (SBOMs), threat modeling, and security architecture analysis, while clarifying misconceptions about legacy devices and the role of VEX documents.

Most relevant to

large enterprises

Topics

Mentioned

Companies
Velentium, Medtronic, Dark Star Consulting, Boston Scientific, Greenlight Guru
Tools
eSTAR, CycloneDX, SPDX
Also
Log4j

Related episodes from other shows

Other shows on the same ground, closest first.

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Let's Combinate · 1h 03m

    021 - "Options" with Karandeep Singh Badwal

    Karandeep Singh Badwal, a QA/RA consultant and host of The MedTech Podcast, explains how defining 'intended use' determines whether a product is a regulated medical device or unregulated software, a critical distinction for startups. He details the specific regulatory challenges of Software as a Medical Device (SaMD), including cybersecurity, GDPR compliance, and the impact of the EU MDR on software classification. Badwal also discusses the strategic advantages for UK software companies post-Brexit, where they can still self-certify as Class 1 devices while EU counterparts face stricter notified body audits.

    Validation & product-market fitQuality & yield
    9 chapters

  • Let's Combinate · 35m

    079 - How FDA Reviews Combination Products, Policy, EPR's, and Harmonization with Rumi Young

    Rumi Young, Director of Regulatory Policy at Becton Dickinson (BD), explains how the FDA reviews combination products, drawing on her previous tenure as Acting Assistant Director in CDRH’s Division of Drug Delivery. She details the inter-center consult process for products like auto-injectors and smart connected devices, highlighting the manual nature of current submissions and the critical need for clear device identification in NDAs and BLAs. Young discusses the role of industry in shaping policy, advocating for updated Essential Performance Requirements (EPRs) and international harmonization through IMDRF to address the gap between evolving technologies and outdated guidances.

    Connected products & IoTCertification & compliance
    8 chapters

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Global Medical Device Podcast. The episode itself belongs to its publisher.