When a hospital’s network gets hit with ransomware, the response is fairly standard: isolate the affected machines, restore from backup, patch the hole, and get systems back online. It’s disruptive and expensive, but the playbook is well understood. Take the infected system offline, fix it, bring it back.
Now imagine the “system” is an infusion pump delivering chemotherapy to a patient, or a pacemaker regulating someone’s heartbeat. You cannot simply unplug it to run a scan. You cannot reboot it mid-therapy. You cannot wait three days for a patch to be tested. This single constraint — the fact that a medical device is also a piece of life-sustaining or life-supporting equipment — is why medical device cybersecurity has grown into its own discipline, separate from the enterprise IT security practices most organizations are used to.
The Core Difference: Availability Is Non-Negotiable
In a typical corporate network, the standard security triad is confidentiality, integrity, and availability, usually weighted in that order. Data protection tends to dominate the conversation. In medical devices, the order effectively flips. A device that stays perfectly confidential but stops functioning during a procedure has failed in a way that matters far more than a data breach.
That changes how testing has to be done. A penetration tester probing a hospital’s billing system can afford to be aggressive — crash a test server, and nothing bad happens to a patient. A tester probing a ventilator’s firmware has to work around the fact that certain tests simply cannot be run against a live, in-use device without risking patient harm. Medical device security teams build entire methodologies around this constraint: testing on bench units and simulated environments that mirror production firmware exactly, rather than the live device itself.
The Attack Surface Looks Completely Different
Enterprise IT security largely deals with a known set of layers: endpoints, servers, network segments, cloud infrastructure, and increasingly, SaaS applications. A connected medical device adds layers that most corporate security teams never touch: implantable or wearable hardware, embedded firmware and real-time operating systems, short-range wireless protocols like Bluetooth Low Energy and proprietary RF telemetry, internal hardware buses such as I2C, SPI, or CAN, and companion mobile apps that pair directly with the device.
Each of those layers has its own failure modes. A 2019 CISA advisory involving Medtronic’s Conexus telemetry protocol, for example, found that the radio communications between certain implantable cardiac devices and their monitors lacked encryption and authentication, meaning a nearby attacker could potentially read or alter that communication. That is not a vulnerability class that shows up in a typical corporate network scan — it requires someone who understands RF protocols, medical telemetry, and the specific hardware involved.
The Regulatory Overlay Nobody Else Has
IT security in most industries is shaped by frameworks and best practices, but for U.S. medical devices, cybersecurity is now statutory. Section 524B of the Federal Food, Drug, and Cosmetic Act — passed in December 2022 with enforcement beginning in October 2023 — requires manufacturers of “cyber devices” to build in a secure product development process, maintain a software bill of materials, establish a way to patch vulnerabilities, and submit that evidence as part of premarket review by the FDA.
That regulatory layer changes what “good security” even means in this context. A network penetration test report that would satisfy a SOC 2 audit or a general vulnerability scan is not the same artifact an FDA reviewer is trained to evaluate. Reviewers expect testing that traces back to a documented threat model, evidence that the device’s actual attack surface — firmware, wireless interfaces, companion apps, cloud backends — was covered, and increasingly, a signed attestation identifying who did the testing and how.
Patient Safety Is the Framing, Not Data Loss
A breach of a hospital’s patient portal is a HIPAA and reputational problem. A breach of an insulin pump’s dosing logic is a patient safety problem, and regulators treat it that way. The FDA’s current framing places patient safety, device availability, and data integrity ahead of confidentiality alone — a subtle but important shift from how most people think about “cybersecurity.”
This is also why postmarket obligations don’t stop at clearance. A manufacturer has to keep monitoring for new vulnerabilities in the components its device relies on, maintain a coordinated vulnerability disclosure process, and be able to patch issues in a “reasonably and reliably timely” way for as long as the device is in the field — obligations that look nothing like a standard corporate IT patch cycle.
Documented Cybersecurity Events for Cyber-Physical Devices
None of this is theoretical. Beyond the Medtronic Conexus findings, CISA and the FDA have jointly issued advisories covering vulnerabilities in BD Alaris infusion pumps (authentication bypass and hard-coded credentials, 2021–2023), the Medtronic MyCareLink Smart monitor (improper authentication between the monitor and cloud service, 2020), and Baxter’s Sigma Spectrum infusion pump (Wi-Fi credential persistence issues, disclosed under advisory ICSMA-22-307-04 in 2022). None of these resulted from a lack of general IT security competence — they resulted from gaps specific to how connected medical devices are built and deployed.
The Skills Gap Nobody Talks About
There’s also a workforce dimension to this that rarely gets discussed outside the industry itself. A security engineer with deep experience in cloud infrastructure or web application testing has spent years building intuition for a specific kind of attacker behavior — credential stuffing, misconfigured storage buckets, injection flaws in web forms. That intuition doesn’t transfer automatically to firmware reverse engineering, RF protocol analysis, or hardware debug interface exploitation. These are adjacent disciplines, not the same discipline applied to a different target.
This is part of why medical device security teams tend to be built around a different hiring profile than typical corporate security teams: engineers with backgrounds in embedded systems, hardware hacking, and offensive security certifications oriented toward red-team and exploitation work, rather than compliance-oriented GRC backgrounds. It’s also why so many manufacturers end up partnering with outside specialists rather than trying to build this capability from scratch internally — the talent pool for people who can competently extract and reverse-engineer medical device firmware is genuinely small, and the learning curve for a generalist security hire is measured in years, not months.
Why This Matters for Manufacturers Right Now
For a MedTech team building a connected device, the practical takeaway is that a generic IT security vendor — however competent at web application testing or network audits — is unlikely to have covered the specific ground an FDA reviewer expects: firmware analysis, wireless protocol testing, hardware interface review, and reviewer-formatted documentation tying it all together. Specialist firms exist precisely because this gap is real.
https://bluegoatcyber.com/ is one example of a firm built exclusively around medical device cybersecurity rather than general IT security, reflecting how distinct this niche has become.
As more devices connect to hospital networks, patient smartphones, and cloud platforms, the line between “medical device” and “IT system” keeps blurring — but the standards applied to each remain very different, and understanding why is the first step toward building (or buying) security that actually holds up under regulatory review.
Disclaimer: This article is for informational purposes only. Medical device cybersecurity requirements and practices may vary by device, manufacturer, and regulations. Always verify current guidance with qualified cybersecurity and regulatory professionals.
The post Why Medical Device Cybersecurity Isn’t Just IT Security With Extra Paperwork appeared first on PHIMDACAP.COM.