医療機器における 情報 ... - ipa.go.jp

1 2014 4 1.. 1 2.. 2 3.. 3 4.. 5 .. 5 .. 8 .. 8 /ICD Daniel Halperin .. 8 Jerome Radcliffe .. 10 Barnaby Jack .. 11 Roche Symantec pcAnywhere .. 12 Roche .. 13 ICS-CERT .. 14 2013 6 FDA .. 14 ICS-CERT Alert Medical Devices Hard-Coded Passwords .. 14 5.. 16 .. 16.

2 16 .. 17 .. 26 .. 26 .. 26 .. 29 .. 29 .. 30 .. 32 .. 32 .. 35 .. 45 6.. 48 .. 48 .. 49 .. 49 .. 50 .. 51 .. 53 .. 54 7.. 57 .. 57 .. 57 .. 59 BSI British Standards Institution CDRH Center for Devices and Radiological Health DHS Department of Homeland Security DOD Department of Defense EC Europiean Commission EMA European Medicines Agency ENISA European Network and Information Security Agency EU European Union FDA Food and Drug Administration GAO Gorovernment Accountability Organization HHS Department of Health and Human Services HIMSS Healthcare Information and Management Systems Society ICS-CERT The Industrial

3 Control Systems Cyber Emergency Response Team IEC International Electrotechnical Commission IEEE The Institute of Electrical and Electronics Engineers, Inc IHE Integrating the Healthcare Enterprise ISO International Organization for Standardization NEMA National Electrical Manufacturers Association SPC Joint NEMA/COCIR/JIRA Security and Privacy Committee UL Underwriters Laboratories Inc. IPA Information-technology Promotion Agency, Japan JAAME Japan Association for the Advancement of Medical Equipment JAHIS Japanese Association of Healthcare Information Systems Industry JCQHC Japan Council for Quality Health Care JEITA Japan Electronics and Information Technology Industries Association JFMDA The Japan Federation of Medical Devices Associations JIRA Japan Medical Imaging and Radiological Systems Industries Association

4 JMARI Japan Medical Association Research Institute MEDIS-DC Medical Information System Development Center NHO National Hospital Organization NIHS National Institute of Health Sciences PMDA Pharmaceuticals Medical Devices Agency,Japan CGM Continuous Glucose Monitors CT Computed Tomography ICD Implantable Cardioverter Defibrillator MRI Magnetic Resonance Imaging PACS Picture Archiving and Communication System CE Communaut Europ enne DIACAP DoD Information Assurance Certification and Accreditation Process DICOM Digital Imaging and Communications in Medicine HPKI Healthcare Public Key Infrastructure ISMS Information Security Management System MDS2 Manufactures Disclosure

5 Statement for Medical Device Security PKI Public Key Infrastructure PREMISs Program of Rating Evaluation for Medical Information System Safety control SQL Structured Query Language STIG Security Technical Implementation Guide TPP Trans-Pacific Strategic Economic Partnership Agreement 1. IPA 1 2 3 4 2013 1 2010 2 3 4 1 2.

6 (1) (2) Web 2 3.

7 3 -1 3-1 MRI Magnetic Resonance Imaging MRI II MRI X III IV I / II

8 3 5 5 21 3 4 4. 2011 Black Hat Jerome Radcliffe Barnaby Jack 6 2012 8 ICS -CERT Monthly Monitor 2013 6 ICS

9 -CERT 4-1 6 USENIX HealthSec Nathanael Paul, Tadayoshi Kohno, Security Risks, Low-tech User Interfaces, and Implantable Medical Devices: A Case Study with Insulin Pump Infusion Systems, USENIX HealthSec 12 Fei Hu, Qi Hao, Marcin Lukowiak, Implantable Medical Device Communication Security: Pattern vs. Signal Encryption, USENIX HealthSec 11 5 4-1 Beth Israel Deaconess Medical Center 7.

10 8 Beth Israel Deaconess Medical Center Philips 9 USB 1000 /ICD 10 2008 Medical Device Security Center /ICD Implantable Cardioverter Defibrillator Black Hat 11 2011 Black Hat Jerome Radcliffe McAfee FOCUS 11 Barnab