What if you found out there was a way to interrogate medical devices and automatically generate cybersecurity bill of materials (CBOM)? Although you may initially miss the manual effort, you and fellow MDMs can now use artificial intelligence to begin automatically generating, maintaining, and monitoring medical device SBOMs/CBOMs.
The Solution
Utilizing the cloud, the Vigilant Ops InSight platform introduces a solution for generating, updating, and monitoring device software bills of materials. The InSight CBOM Generator automatically detects the Operating System of the medical device and executes the appropriate commands to interrogate the device and inventory all of the software components.
How It Works
- The generated cybersecurity bill of materials is uploaded to the InSight Platform, where it can be reviewed and approved before publication.
- An approved CBOM is automatically sent for certification by Vigilant Ops trained security specialists.
- Once certified, the cybersecurity bill of materials (CBOM) can be published and shared with confidence.
Your Biggest Pain Points Solved
The general consensus is that the Cybersecurity Bill of Materials (CBOM) is a valuable document that can help improve healthcare security, but it comes at a cost. And, if you are not utilizing a tool to help automate the CBOM generation process, then that cost is substantially higher.
- Manually generating and maintaining a single medical device SBOM takes hours of effort plus hardware and software tools.
- If your organization is on a quarterly release cycle, you will have to generate four cybersecurity bill of materials annually per device, in addition to continuously monitoring sources for vulnerability updates.
- Every cybersecurity bill of materials is a snapshot in time, so manually generating a CBOM is taking the risk that the information is not already obsolete.
- Manual generation and maintenance of medical device CBOMs is not practical or scalable, and is possibly misleading, in that it could contain outdated information.
The Stats
As a medical device manufacturer, the FDA is clear that you “are responsible for remaining vigilant about identifying risks and hazards associated with your medical devices, including risks related to cybersecurity.”
According to Health IT Security, 70% of medical devices have vulnerable software components, and with an average of 40 new CVEs being received daily at the National Vulnerability Database, disaster is looming. It is evident that the manual CBOM process can’t keep up, challenging even the most tenured security experts, without the introduction of CBOM monitoring and automation.
Why You Cannot Afford To Go Without The Vigilant Ops CBOM Generator
- Using manual effort to generate a medical device CBOM always leaves you asking – “Did I get all of the components?”
- Monitoring CBOM component vulnerabilities using public data sources requires time and patience. Do you really have hours to spend trying to match components to CPEs just so you can try to find them in the NVD?
- How are you planning to respond to your sales team’s onslaught of emails asking for CBOM documentation to send to their demanding hot prospect who happens to be contemplating a million-dollar deal?
CBOMs are all about managing medical device cybersecurity risk and providing actionable insight in order to create a safer, more secure healthcare environment. The use of a cloud-based platform to securely generate and maintain CBOMs is a vigilant and efficient way to enable compliance, improve organizational awareness, and implement a proactive approach to medical device security within your organization.
Ken Zalevsky
CEO, Vigilant Ops
Former Head of Medical Device Cybersecurity, Bayer
