医療機器における 情報 ... - ipa.go.jp

1 2014 4 1.. 1 2.. 2 3.. 3 4.. 5 .. 5 .. 8 .. 8 /ICD Daniel Halperin .. 8 Jerome Radcliffe .. 10 Barnaby Jack .. 11 Roche Symantec pcAnywhere .. 12 Roche .. 13 ICS-CERT .. 14 2013 6 FDA .. 14 ICS-CERT Alert Medical Devices Hard-Coded Passwords .. 14 5.. 16 .. 16 .. 16 .. 17 .. 26 .. 26 .. 26 .. 29 .. 29 .. 30 .. 32 .. 32 .. 35 .. 45 6.. 48 .. 48 .. 49 .. 49 .. 50 .. 51 .. 53 .. 54 7.. 57 .. 57 .. 57 .. 59 BSI British Standards Institution CDRH Center for Devices and Radiological Health DHS Department of Homeland Security DOD Department of Defense EC Europiean Commission EMA European Medicines Agency ENISA European Network and Information Security Agency EU European Union FDA Food and Drug Administration GAO Gorovernment Accountability Organization HHS Department of Health and Human Services HIMSS Healthcare Information and Management Systems Society ICS-CERT The Industrial Control Systems Cyber Emergency Response Team IEC International Electrotechnical Commission IEEE The Institute of Electrical and Electronics Engineers, Inc IHE Integrating the Healthcare Enterprise ISO International Organization for Standardization NEMA National Electrical Manufacturers Association SPC Joint NEMA/COCIR/JIRA Security and Privacy Committee UL Underwriters Laboratories Inc.

2 IPA Information-technology Promotion Agency, Japan JAAME Japan Association for the Advancement of Medical Equipment JAHIS Japanese Association of Healthcare Information Systems Industry JCQHC Japan Council for Quality Health Care JEITA Japan Electronics and Information Technology Industries Association JFMDA The Japan Federation of Medical Devices Associations JIRA Japan Medical Imaging and Radiological Systems Industries Association JMARI Japan Medical Association Research Institute MEDIS-DC Medical Information System Development Center NHO National Hospital Organization NIHS National Institute of Health Sciences PMDA Pharmaceuticals Medical Devices Agency,Japan CGM Continuous Glucose Monitors CT Computed Tomography ICD Implantable Cardioverter Defibrillator MRI Magnetic Resonance Imaging PACS Picture Archiving and Communication System CE Communaut Europ enne DIACAP DoD Information Assurance Certification and Accreditation Process DICOM Digital Imaging and Communications in Medicine HPKI Healthcare Public Key Infrastructure ISMS Information Security Management System MDS2 Manufactures Disclosure Statement for Medical Device Security PKI Public Key Infrastructure PREMISs Program of Rating Evaluation for Medical Information System Safety control SQL Structured Query Language STIG Security Technical Implementation Guide TPP Trans-Pacific Strategic Economic Partnership Agreement 1.

3 IPA 1 2 3 4 2013 1 2010 2 3 4 1 2. (1) (2) Web 2 3.

4 3 -1 3-1 MRI Magnetic Resonance Imaging MRI II MRI X III IV I / II 3 5 5 21 3 4 4.

5 2011 Black Hat Jerome Radcliffe Barnaby Jack 6 2012 8 ICS -CERT Monthly Monitor 2013 6 ICS -CERT 4-1 6 USENIX HealthSec Nathanael Paul, Tadayoshi Kohno, Security Risks, Low-tech User Interfaces, and Implantable Medical Devices: A Case Study with Insulin Pump Infusion Systems, USENIX HealthSec 12 Fei Hu, Qi Hao, Marcin Lukowiak, Implantable Medical Device Communication Security: Pattern vs. Signal Encryption, USENIX HealthSec 11 5 4-1 Beth Israel Deaconess Medical Center 7.

6 8 Beth Israel Deaconess Medical Center Philips 9 USB 1000 /ICD 10 2008 Medical Device Security Center /ICD Implantable Cardioverter Defibrillator Black Hat 11 2011 Black Hat Jerome Radcliffe McAfee FOCUS 11 Barnaby Jack 2011 McAfee FOCUS 11 Barnaby Jack BreakPoint security conference 2012 Black Hat 2013 7 WashingtonPost, 8 COMPUTERWORLD, 9 , , 10 Daniel Halperin, Thomas S.

7 Heydt-Benjamin, Benjamin Ransford, Shane S. Clark, Benessa Defend, Will Morgan, Kevin Fu, Tadayoshi Kohno, William H. Maisel, Pacemakers and Implantable Cardiac Defibrillators: Software Radio Attacks and Zero-Power Defenses, Proceedings of the 2008 IEEE Symposium on Security and Privacy, May 18-21, 2008 11 J. Radcliffe, Hacking medical devices for fun and insulin: Breaking the human scada system, Black Hat USA 2011 6 ICS-CERT Monthly Monitor 2012 8 Roche Symantec pcAnywhere 12 Roche Symantec pcAnywhere Roche FDA Food and Drug Administration 2012 6 Enforcement Report Roche Oracle 13 Roche COBAS INTEGRA 400/400 plus Analyzer Oracle FDA 2013 1 Enforcement Report / 2013 6 FDA 14 2013 6 13 FDA FDA Safety Communication.

8 Cybersecurity for Medical Devices and Hospital Networks 15 40 300 2013 6 ICS- CERT Alert 12 FDA Enforcement Report - Week of December 19, 2012 13 FDA Enforcement Report - Week of January 30, 2013, 14 FDA Safety Communication: Cybersecurity for Medical Devices and Hospital Networks, 15 ICS-CERT, Alert (ICS-A LERT-13-164-01) Medical Devices Hard-Coded Passwords, 7 Beth Israel Deaconess Medical Center Philips Beth Israel Deaconess Medical Center 15,000 500 OS 1 4-1 Philips Avalon FM40 and FM50 fetal monitors Philips Web 16 /ICD Daniel Halperin 2008 Daniel Halperin University of Washington Kevin Fu University of Massachusetts University of Michigan 2008 IEEE Symposium on Security and Privacy /ICD 10 /ICD Implantable Cardioverter Defibrillator ICD ICD 16 8 4-2 Medtronic Web 17 St.

9 Jude Medical Web 18 Washington Heart Rhythm Associates Web 19 ICD Daniel Halperin ICD USRP Universal Software Radio Peripheral 4-3 USRP BasicTX ICD ICD 17 18 19 MagneticFieldintroducedTelemetryACKAuto- IDModel,Serial #InterrogatePatientdataCommandResponse ICDP rogrammerICD9 ICD GNUR adio Radcliffe 2011 Black Hat Jerome Radcliffe 11 Jerome Radcliffe 4-4 MEDICAL DEVICES FDA Should Expand Its Consideration of Information Security for Certain Types of Devices GAO TheRegister Web 20 CGM 21 1.

10 20 21 CGM continuous glucose monitors 10 Federal Communication Commission (FCC) ID 2. Web site CGM continuous glucose monitors CGM CGM 2011 10 ATM Barnaby Jack Jack ATM 2011 Barnaby Jack BreakPoint security conference 2012 2012 10 /ICD 11 4-5 /ICD MEDICAL DEVICES FDA Should Expand Its Consideration of Information Security for Certain Types of Devices, GAO.