NEMECYS: NEw MEdical CYbersecurity assessment and design Solutions

在社区提供的个性化医疗服务是未来的趋势，并得到“互联医疗设备”（CMD）的支持。这些是连接到互联网的医疗设备（MD），例如葡萄糖传感器、血液检测设备或输液泵。CMD提供了显著的优势，通过家庭监测和治疗减少患者的旅行和压力，改进临床决策支持系统或自动远程调整治疗。然而，他们与互联网的连接也带来了重大的安全挑战，因此需要适当的网络安全：网络安全太少可能导致病人护理受到损害、数据被破坏、关键系统被渗透或个人信息暴露;但是太多的安全性是昂贵的并且可能妨碍临床护理。在这种情况下，NEMECYS项目将通过向三个关键利益相关者提供工具来提高联网医疗设备的安全性：设备制造商（通过设计支持安全性）、在临床场景中部署设备的系统集成商以及运营这些场景的医疗保健提供商。NEMECYS帮助从业者（1）遵守MD法规;（2）能够应用适当的MD网络安全;（3）通过设计为MD及其操作的连接场景构建网络安全。这是通过以下方式实现的：（1）提供MD网络安全设计的最佳实践和指南建议，沿着合规保证工具;（2）提供风险受益计划，以解决网络安全风险，并与临床受益相平衡;以及（3）提供一套特定的工具，通过在连接场景中的设计和部署来解决MD网络安全问题。NEMECYS团队拥有网络安全风险专家，两家已经在实施物联网和远程护理方案的医院，三家医疗设备制造商，主要的计算机科学研究参与者和经验丰富的系统集成商。该项目将在不同的案例研究中得到验证，NEMECYS的结果将使网络安全社区，MD制造商，CMD场景系统集成商和CMD场景运营商等从业人员受益，并通过有效和简化的网络安全实现更具成本效益和效率的护理，为患者和更广泛的公众带来下游利益。

Personalised healthcare services delivered in the community are the future, supported by “Connected Medical Devices” (CMDs). These are Medical Devices (MDs), e.g. glucose sensors, blood testing devices or infusion pumps, that are connected to the Internet. CMDs offer significant advantages, from reducing travel and stress for patients via home-based monitoring & treatment, improved clinical decision support systems or automated remote adjustments of treatments. However, their connection to the Internet also presents significant security challenges, so proportionate cybersecurity is needed: too little cybersecurity may lead to compromise of patient care, corruption of data, infiltration of critical systems or exposure of personal information; but too much security is costly and can obstruct clinical care.In this context, the NEMECYS project will improve Connected Medical Device security by offering tools to three key stakeholders: Device Manufacturers (supporting security by design), System Integrators deploying the devices in clinical scenarios and Healthcare Providers operating those scenarios. NEMECYS helps practitioners to (1) comply with MD regulations; (2) to be able to apply proportionate MD cybersecurity and (3) build in cybersecurity by design for both MDs and the connected scenarios they operate in. This is achieved by (1) providing recommendations for best practice and guidelines for MD cybersecurity by design, along with compliance assurance tooling; (2) providing a risk-benefit scheme to address cybersecurity risk, balanced with clinical benefit; and (3) providing a set of specific tools to address MD cybersecurity by design and deployment in connected scenarios.The NEMECYS team has cybersecurity risk experts, two hospitals who are already implementing IoT and remote care-based scenarios, three medical device manufacturers, major computer science research players and experienced systems integrators. The project be validated in diverse case studies, and the NEMECYS results will benefit practitioners such as cybersecurity communities, MD manufacturers, CMD scenario system integrators and CMD scenario operators, with downstream benefits to patients and the wider public, through more cost-effective and efficient care enabled via effective and streamlined cybersecurity.