Success-Plan Services5 min read
**Please note that with the April 2024 release of Connext Professional 7.3 LTS, the functionalities formerly comprising Connext Secure are now available as an optional component to Connext Professional, named Security Extensions.
Today, medical device manufacturers are committed to bringing next-generation connected health technologies to market. Companies using Connext® Secure are already on the path to production, as RTI’s data-centric, zero-trust software framework was designed with this goal in mind.
Some manufacturers have already chosen Connext® Professional as their connectivity solution, but have not yet started using Connext Secure. They may be using a proprietary approach to secure communications, are wary of integration, or believe their system is operating over a secure network or inside a “trusted” perimeter, and don’t think they need to protect data on the wire.
Whatever the situation, it’s often difficult and expensive to get a second bite of the apple when bringing connected health technologies to market. To help manufacturers avoid surprises on the path to production, RTI has rounded up the top ten things to watch out for, along with an overview of the flexibility and integration benefits that Connext Secure delivers in the race to roll out innovative and secure products and solutions.
#1: The U.S. Food and Drug Administration (FDA) says your device has to be cybersecure
On March 29, 2023, the FDA announced that it will begin to “Refuse To Accept” medical devices that fail to pass cybersecurity requirements beginning October 1, 2023. At the same time, the FDA required all new device submissions to include detailed cybersecurity plans.
Essentially, the FDA says that if your device is not secure, it is not safe, and if it is not safe, it is not going to be approved for the market. Of course, this is a global concern. The status quo is not acceptable; past assumptions of effective cybersecurity controls are now considered red flags in submissions.
Connext Secure is an integral part of meeting these security requirements, and therefore also safety requirements. Connext Secure addresses the five pillars of security: confidentiality, integrity, authenticity, access control, and availability. Though manufacturers may be using some legacy mechanism for securing communications, only Connext Secure can address this issue in an efficient, all-in-one solution.
#2: Insecure architectures are very expensive
For manufacturers concerned about the expense of a secure architecture, let’s consider for a moment how much an insecure architecture could wind up costing. For starters, the average cost of a data breach is $10M and the average downtime from a ransomware attack is 20 days, according to the market data portal Statista. Additional costs include expensive investigation and remediation activities, loss of revenue, regulatory recall and fines – the list goes on. And the number of attacks are growing – in fact, the number of common IT security vulnerabilities and exposures (CVEs) topped 25k in 2022.
Medical devices in particular are highly susceptible to cyberattacks. According to a recent FBI report, 53% of connected medical devices in hospitals have known critical vulnerabilities. Meanwhile, hospitals are making purchasing decisions based on a manufacturer's cybersecurity capabilities and collaborating with security researchers. Taking these factors into account, under-investing in secure architectures can therefore be considered a very serious corporate risk, which no manufacturer could reasonably justify or afford.
#3: The longer the wait, the more expensive it is to correct weak security design
Ideally, a medtech device should leverage standards-based security from the start in order to prevent vulnerabilities and reduce the need for expensive fixes down the road. A popular way to do this is the proven Data Distribution Service (DDSTM) standard, on which Connext Secure is based.
Without DDS as the backbone, vital security controls can sometimes result in slower system performance and increased resource usage. By skipping the step of considering security early in the design, it's all too easy to underestimate system scalability and resource needs. It's therefore wise to incorporate security right after prototyping the functional aspects of the system, to help avoid costly rework and unnecessary tradeoffs between performance, functionality, and security.
#4: The adversary owns the network
The healthcare sector presents a high-value target, with a growing attack surface and increasingly sophisticated threats. Given that hospital IT networks are open and vulnerable, any perimeter-focused control approach only solves part of the looming problem. Likewise, depending solely on encryption means being just one incident away from complete data exposure.
The Zero Trust design pattern enforced by Connext Secure adheres to the principle of least privilege (PoLP), and assumes that you cannot limit network access to only trusted participants. With a Zero Trust approach, no element on the system is trusted until it is verified, regardless of whether it is a data source or a data sink that determines the destination of dataflow.
#5: Protect the “secret sauce”
External actors aside, even if everybody on a network were trusted, not everyone should have access to all device communications. Trusted network participants are not just customers and their employees, but may encompass service users, or other third-party systems and use cases. To manage this, Connext Secure provides fine-grained access control combined with identity management software. This allows manufacturers to precisely control access to dataflow, to mitigate intentional and unintentional breaches. Fine-grained access control provides a powerful mechanism for protecting proprietary designs and addressing risks from a variety of potential threats.
#6: Refine the security configuration – with no changes to the application code
Modifying security controls can add time and complexity while trying to refine the security implementation and optimize performance. For manufacturers who are already using the configurable plugins in Connext Secure however, applying state-of-the-art access control and encryption to data in motion is accomplished with ease with no code changes needed. This expedites development and test activities.
For example, once an application is built using Connext Secure, manufacturers can easily adjust security profiles during development by making a minor edit to an XML file. If the application is already built on Connext Professional, it is even possible to be up and running with Connext Secure in a few hours.
#7: Simultaneously support next-generation and legacy product lines
When designing a system to work in a Zero Trust environment, it’s important to control who can publish and who has access to what data through strict access control. But what if there is a requirement for open-access topics for backwards compatibility or legacy interoperability?
Connext Secure enables applications to be simultaneously interoperable and protected, providing both flexibility and optimized performance. This solution makes it possible to still meet legacy requirements, without sacrificing any other security postures. Connext Secure gives users complete control over what to protect and how, as well as being able to enable data access for applications and use cases that need the data.
The need for this level of control is essential to incorporate cybersecurity considerations for complex interfaces and interoperable functionality – and is specifically called out in the latest, finalized FDA premarket guidance.
#8: RTI Professional Services gives expert guidance for architecting secure device communications
RTI has a global Professional Services team that can provide detailed guidance on system architecture and the configuration of privileges to mitigate project risk. Our security assessments feature in-depth discussions on the key ways that Connext Secure can protect data in motion and ensure the quality of the final deliverable.
#9: Access to state-of-the-art tools and cryptography, without sacrificing performance
Connext Secure offers easy access to advanced cryptography with minimal performance impact. RTI productivity tools seamlessly integrate with Connext Secure, allowing real-time performance monitoring of a protected system. We also collaborate with third-party software vendors such as Cameo Systems Modeller, offering specialized plugins for simplified configuration and validation of security in DDS environments. Our support extends to custom encryption solutions via the Security Plugin SDK within the Connext ecosystem.
#10: Adopt a proven middleware based on open, international standards
Connext Secure is the first commercial solution to comply with the DDS SECURITY™ specification. Choosing Connext Secure gives manufactures the advantage of a proven connectivity technology for real-time systems, backed by 2,000+ real-world applications in safety-critical applications across industries.
Ready to start using Connext Secure? Schedule your Security Assessment today to get you on the fast path to success.
About the authors:
Mark Hary is the Market Development Director, New Markets at RTI. Mark is passionate about bringing innovative software technology to market in non-IT industries. Mark spent his first 20 years as a co-founder and managing startups (two exits) in business development and sales, then spent the next five as an early stage investor and EIR before coming to RTI. Mark has a BS in Mechanical Engineering from Santa Clara University, an MS in Aeronautics/Astronautics from Stanford University, and an MBA from Santa Clara University.
Darren Porras is the Market Development Manager for Healthcare at RTI. Darren has over 20 years of experience in the medical device industry and product development. Prior to joining RTI, Darren was a program manager at Medtronic for Surgical Robotics. Darren has also held program management and software development roles at Philips and Integra Radionics spanning medical imaging, image-guided surgery, and cybersecurity.
Darren has a Bachelor of Science in Engineering from Duke University and Master of Science in Biomedical Engineering from the University of Alabama-Birmingham.