Falling Water Vulnerability disclosure for Medical Devices
summary
Argues that medical-device disclosure must hinge on concrete actions not platitudes: manufacturers use a waterfall approach with long lifespans and 100% functional testing so fixes risk breaking implants; timelines like 30 days are often unrealistic; a reported workflow shows confirmation, asset-tracking, risk tradeoffs, and patient impact analysis. Demonstrates forensic proof-of-issue via an Apple HealthKit data dump and Python scripting, leads replacement is the real-world remediation that ultimately restores safety.
AI-written summary · about
chapters (8)
- 0:00Start
- 4:15No such thing as a non-vulnerable device
- 7:17The Waterfall approach
- 9:32How does it work?
- 9:50Waterfall Translated
- 21:05Assessing the Severity
- 21:44Do we fix all vulnerabilities?
- 22:57Losing Quality of Life
related talks
45mTraceability In Cyber Security:Lessons Learned From The Medical Sector
52mAnatomy of a Vulnerability Response - A View from the Inside
48mSecuring The Internet Of Things
13mNavigating the complex and rapidly evolving world of product and application security regulations
30mScoring Security Vulnerabilities in Medical Devices: Rubric for CVSS
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
24mIf They Can Touch It, They Own It: The Stories We Tell...
19mSecurity in the Medical Internet of Things