Hardware Podcasts

140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

Let's Combinate · 12 Jun 2024 · 30m

What this episode covers

Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

Most relevant to

early-stage companies

Topics

Mentioned

Companies
Blue Goat Cyber, Alpine Security
Also
Shellshock, FDA

Related episodes from other shows

Other shows on the same ground, closest first.

  • Global Medical Device Podcast · 42m

    #407: Cybersecurity in MedTech: FDA Compliance, Patient Safety & the Hidden Risks You’re Missing

    Christian Espinosa, founder of Blue Goat Cyber, explains why medical device cybersecurity must be integrated from the requirements phase to ensure patient safety, citing real-world risks like skin burns from hacked acne lasers and missed sepsis diagnoses. He details the FDA's September 2023 regulatory overhaul, which mandates Software Bill of Materials (SBOMs), static/dynamic testing, and risk assessments tied to patient harm, noting that traditional IT security vendors often fail to meet these specific medical device standards. Espinosa warns that waiting until the last minute to address security can lead to catastrophic delays, costly retrofits like disabling hardware features due to lack of secure boot support, or even abandoned projects.

    Security & privacyCertification & compliance
    8 chapters

  • Global Medical Device Podcast · 40m

    Software Bill of Materials (SBOMs) & Cybersecurity in the Medical Device Industry

    Ken Zalevsky, CEO of Vigilant Ops, explains the critical role of Software Bill of Materials (SBOMs) in medical device cybersecurity, defining them as transparent lists of software components that help hospitals and manufacturers manage risk. He discusses the FDA's evolving regulatory expectations, including the pending pre-market guidance and the 'Burgess Bill,' which mandate SBOMs for 510(k) submissions and require continuous post-market vulnerability monitoring. Zalevsky highlights the challenge of legacy devices, noting that healthcare organizations take an average of 160 days to discover breaches because they often deploy 'black box' devices without knowing their internal software composition. He advises manufacturers to scope cybersecurity efforts appropriately, integrating security into the design phase rather than treating it as a bolt-on, and to use SBOMs to provide necessary transparency to end-users.

    Security & privacyCertification & compliance
    9 chapters

  • Global Medical Device Podcast · 40m

    The Future of Cybersecurity

    Chris Gates, Director of Product Security at Velentium and author of 'Medical Device Cybersecurity for Engineers and Manufacturers', discusses the evolving landscape of software as a medical device (SaMD) security. He critiques the FDA's recent draft guidance for lacking harmonization with global standards like ISO and EU MDR, arguing that it imposes excessive burdens without clear, workable requirements. Gates emphasizes the critical need for machine-readable Software Bill of Materials (SBOMs) and Vulnerability Exposure (VEX) documents to help Health Delivery Organizations (HDOs) manage risks effectively. He advocates for integrating cybersecurity into the core development process, using tools like MedCrip and Heimdal, to streamline regulatory approval and create a competitive advantage for manufacturers.

    Security & privacyCertification & compliance
    7 chapters

  • Global Medical Device Podcast · 31m

    Navigating the MedTech Cybersecurity Ecosystem

    Jon Speer, founder of Greenlight Guru, interviews Mike Drues from Vascular Sciences about the scope and strategy of medical device cybersecurity. They clarify that the FDA’s concern is limited to device safety and efficacy, excluding identity theft and HIPAA privacy issues. Drues advises developers to question the necessity of constant internet connectivity and to use regulatory logic to apply existing standards to new threats.

    Security & privacyCertification & compliance
    6 chapters

  • Global Medical Device Podcast · 1h 12m

    Cybersecurity and the Future of MedTech

    Chris Gates of Velentium, Chris Reed of Medtronic, and Ken Hoyme of Dark Star Consulting discuss the impact of the Consolidated Appropriations Act of 2023 on medical device cybersecurity regulation. They explain how the FDA now has explicit legal authority to enforce cybersecurity hygiene, moving beyond just safety and efficacy, and detail the requirements for pre-market submissions under the April 2022 draft guidance. The panelists emphasize the critical importance of Software Bill of Materials (SBOMs), threat modeling, and security architecture analysis, while clarifying misconceptions about legacy devices and the role of VEX documents.

    Certification & complianceSecurity & privacy
    5 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Let's Combinate. The episode itself belongs to its publisher.