Corman, who teaches secure development lifecycle and product security for Carnegie Mellon university’s grad school, is the founder of Iamthecavalry.org, a collection of thousands of volunteer experts from around the world with a common mission to improve cybersecurity in medical devices, transportation and infrastructure systems, and the connected home. Josh was active in developing the PATCH Act, as well as the FDA’s latest pre-market cyber security guidance for device manufacturers that was published in September (2023).
Now backed by law, the FDA’s guidance is no longer elective, and dictates how the agency evaluates medical devices going to market, says Corman, who also co-founded CyberMedSummit.org, where he’s demonstrated dozens of ways medical devices could be hacked to charm patients.
In this show, he talks about the nine-year journey to get medical device manufacturers to follow best practices and shift left in their DevOps practices, starting with secure by design and throughout the product lifecycle. And, since medicfaceal device software utilizes up to 90 percent open-source components, SBOMs (software bill of materials) play a huge part in managing the risks associated with third-party code.
While manufacturers initially pushed back on the cyber safety requirements, Corman notes that those who got onboard with this guidance immediately began seeing benefits that made them more competitive, faster-to-market, and quicker to repair exploitable vulnerabilities found in their code.