Cibersegurança em dispositivos médicos: Estudo da ABNT IEC/TR60601-4-5 de junho de 2022

Abstract

The internet has connected people and provided access to various contents, from texts to videos, and can be used as a work tool and with easy access through smartphones. However, it also brought dangers to its users, making them exposed to cyber attacks, threats, scams and other digital crimes. Medical devices have also become connected and, likewise, are also exposed to existing attacks on the internet, so it is necessary to seek information on cybersecurity requirements and recommendations for medical devices. Thus, the present academic work seeks to understand the information security recommendations for medical devices present in the ABNT IEC/TR60601-4-5 standard of June 2022. This academic work sought to explore the practices defined only in the ABNT IEC/TR 60601-4-5 June 2022 standard, as it is a Brazilian standard and specifically deals with cybersecurity in medical devices, unlike other standards whose contexts are very different from those existing on these devices. The standard studied aims to provide the necessary requirements to achieve adequate levels of cybersecurity in medical devices, showing that a more simplified model of Confidentiality, Integrity and Availability cannot be used in the context of medical devices, due to all the existing complexity. Several important concepts are also defined by this standard, such as countermeasures and firecalls, to ensure that the devices perform their essential function even under security events. Finally, it is clear that medical devices have a very high specificity, where more generic cybersecurity standards may not meet these requirements correctly, showing how essential the standards specifically for medical devices are.