NEMECYS: NEw MEdical CYbersecurity assessment and design Solutions

在“互联医疗设备”（cmd）的支持下，在社区提供个性化医疗服务是未来的趋势。这些是连接到互联网的医疗设备（MDs），例如葡萄糖传感器、血液检测设备或输液泵。cmd提供了显著的优势，通过家庭监测和治疗减少了患者的旅行和压力，改进了临床决策支持系统或自动远程调整治疗。然而，它们与互联网的连接也带来了重大的安全挑战，因此需要适当的网络安全：网络安全过少可能导致患者护理受损、数据损坏、关键系统渗透或个人信息暴露；但过多的安全措施代价高昂，并可能阻碍临床护理。在这种情况下，NEMECYS项目将通过向三个关键利益相关者提供工具来提高联网医疗设备的安全性：设备制造商（通过设计支持安全性）、在临床场景中部署设备的系统集成商和运营这些场景的医疗保健提供商。NEMECYS帮助从业者(1)遵守MD法规；(2)能够应用相称的MD网络安全；(3)通过设计为MD及其操作的连接场景构建网络安全。这是通过以下方式实现的：(1)通过设计为MD网络安全提供最佳实践和指南建议，以及合规性保证工具；(2)提供风险-收益方案以应对网络安全风险，平衡临床收益；(3)提供一套特定工具，通过设计和部署互联场景来解决MD网络安全问题。NEMECYS团队有网络安全风险专家、两家已经实施物联网和远程护理方案的医院、三家医疗设备制造商、主要的计算机科学研究参与者和经验丰富的系统集成商。该项目将在不同的案例研究中进行验证，NEMECYS的结果将使网络安全社区、MD制造商、CMD场景系统集成商和CMD场景运营商等从业人员受益，并通过有效和精简的网络安全实现更具成本效益和高效的护理，为患者和更广泛的公众带来下游利益。

Personalised healthcare services delivered in the community are the future, supported by “Connected Medical Devices” (CMDs). These are Medical Devices (MDs), e.g. glucose sensors, blood testing devices or infusion pumps, that are connected to the Internet. CMDs offer significant advantages, from reducing travel and stress for patients via home-based monitoring & treatment, improved clinical decision support systems or automated remote adjustments of treatments. However, their connection to the Internet also presents significant security challenges, so proportionate cybersecurity is needed: too little cybersecurity may lead to compromise of patient care, corruption of data, infiltration of critical systems or exposure of personal information; but too much security is costly and can obstruct clinical care.In this context, the NEMECYS project will improve Connected Medical Device security by offering tools to three key stakeholders: Device Manufacturers (supporting security by design), System Integrators deploying the devices in clinical scenarios and Healthcare Providers operating those scenarios. NEMECYS helps practitioners to (1) comply with MD regulations; (2) to be able to apply proportionate MD cybersecurity and (3) build in cybersecurity by design for both MDs and the connected scenarios they operate in. This is achieved by (1) providing recommendations for best practice and guidelines for MD cybersecurity by design, along with compliance assurance tooling; (2) providing a risk-benefit scheme to address cybersecurity risk, balanced with clinical benefit; and (3) providing a set of specific tools to address MD cybersecurity by design and deployment in connected scenarios.The NEMECYS team has cybersecurity risk experts, two hospitals who are already implementing IoT and remote care-based scenarios, three medical device manufacturers, major computer science research players and experienced systems integrators. The project be validated in diverse case studies, and the NEMECYS results will benefit practitioners such as cybersecurity communities, MD manufacturers, CMD scenario system integrators and CMD scenario operators, with downstream benefits to patients and the wider public, through more cost-effective and efficient care enabled via effective and streamlined cybersecurity.