NEMECYS: NEw MEdical CYbersecurity assessment and design Solutions

在“互联医疗设备”(CMD)的支持下，在社区中提供的个性化医疗服务是未来的趋势。这些是连接到互联网的医疗设备(MD)，例如葡萄糖传感器、血液检测设备或输液泵。CMDS提供了显著的优势，从通过基于家庭的监测和治疗减少患者的旅行和压力，改进的临床决策支持系统或自动远程调整治疗。然而，他们与互联网的连接也带来了巨大的安全挑战，因此需要适当的网络安全：太少的网络安全可能会导致患者护理受到威胁、数据被破坏、关键系统被渗透或个人信息泄露；但太多的安全是昂贵的，可能会阻碍临床护理。在这种情况下，NEMECYS项目将通过向三个关键利益相关者提供工具来提高互联医疗设备的安全性：设备制造商(设计上支持安全)、在临床场景中部署设备的系统集成商以及运营这些场景的医疗保健提供商。NEMECYS帮助从业者(1)遵守MD法规；(2)能够应用适当的MD网络安全；(3)通过为MD及其操作所在的互联场景设计内置的网络安全。这是通过(1)通过设计为MD网络安全提供最佳实践和指南的建议，以及合规保证工具；(2)提供风险-收益方案来应对网络安全风险，平衡临床利益；以及(3)通过在互联场景中的设计和部署提供一套特定的工具来应对MD网络安全。NEMECYS团队拥有网络安全风险专家，两家已经实施物联网和基于远程护理的场景的医院，三家医疗器械制造商，主要的计算机科学研究参与者和经验丰富的系统集成商。该项目将在不同的案例研究中得到验证，NEMECYS的结果将使网络安全社区、MD制造商、CMD场景系统集成商和CMD场景运营商等从业者受益，通过有效和简化的网络安全实现更具成本效益和效率的护理，为患者和更广泛的公众带来下游好处。

Personalised healthcare services delivered in the community are the future, supported by “Connected Medical Devices” (CMDs). These are Medical Devices (MDs), e.g. glucose sensors, blood testing devices or infusion pumps, that are connected to the Internet. CMDs offer significant advantages, from reducing travel and stress for patients via home-based monitoring & treatment, improved clinical decision support systems or automated remote adjustments of treatments. However, their connection to the Internet also presents significant security challenges, so proportionate cybersecurity is needed: too little cybersecurity may lead to compromise of patient care, corruption of data, infiltration of critical systems or exposure of personal information; but too much security is costly and can obstruct clinical care.In this context, the NEMECYS project will improve Connected Medical Device security by offering tools to three key stakeholders: Device Manufacturers (supporting security by design), System Integrators deploying the devices in clinical scenarios and Healthcare Providers operating those scenarios. NEMECYS helps practitioners to (1) comply with MD regulations; (2) to be able to apply proportionate MD cybersecurity and (3) build in cybersecurity by design for both MDs and the connected scenarios they operate in. This is achieved by (1) providing recommendations for best practice and guidelines for MD cybersecurity by design, along with compliance assurance tooling; (2) providing a risk-benefit scheme to address cybersecurity risk, balanced with clinical benefit; and (3) providing a set of specific tools to address MD cybersecurity by design and deployment in connected scenarios.The NEMECYS team has cybersecurity risk experts, two hospitals who are already implementing IoT and remote care-based scenarios, three medical device manufacturers, major computer science research players and experienced systems integrators. The project be validated in diverse case studies, and the NEMECYS results will benefit practitioners such as cybersecurity communities, MD manufacturers, CMD scenario system integrators and CMD scenario operators, with downstream benefits to patients and the wider public, through more cost-effective and efficient care enabled via effective and streamlined cybersecurity.