## 2 Background and Related Work
### Regulations and Standards
* Medical device software should be developed in accordance with the state-of-the-art principles of the development life cycle, risk management, including information security, verification and validation. * Manufacturers shall set out minimum requirements concerning hardware, IT networks security measures, including protection against unauthorized access. * Implement proper safeguards to avoid unauthorized access, disclosure, dissemination, alteration or loss of information and personal data processed. * Implement adequate safeguards to ensure confidentiality of records and personal data of subjects. * Implement proper incident response plan and safeguards in case of a data security breach in order to mitigate the possible adverse effects. * GDPR: The General Data Protection Regulation (GDPR) is a regulation on data protection and privacy for citizens in the European Union (EU) and European Economic Area [13]. It was introduced in May 2018. The EU commission designed the GDPR to achieve key goals such as, (1) protect the rights, privacy and freedom of individuals in the EU, (2) reduce the barrier for free movement of data inside the EU, (3) inform individuals how personal data will be processed and who will be given access, (4) individuals will be able to obtain their data and reuse it for their own purposes and (5) individuals have the right to restrict access and erase their data. Adoption of the following standards can help an organization achieve regulatory compliance from a security and privacy perspective:  
* FDA premarket and postmarket guidelines: The FDA provides premarket and postmarket guidelines for organizations and developers that need to be considered during the development lifecycle of a medical device or healthcare application. The premarket guidance [14] outlines the following key security and privacy related recommendations for medical device manufacturers: \[\bigcirc\] To employ a risk-based approach to the design and development of medical devices with appropriate cybersecurity protections. \[\bigcirc\] Take a holistic approach to device cybersecurity by assessing risks and mitigations throughout the product's lifecycle. \[\bigcirc\] Identify the assets, threats, and vulnerabilities. \[\bigcirc\] Perform an impact assessment of the threats and vulnerabilities on device functionality and end-users. \[\bigcirc\] Assess the likelihood of a threat and of a vulnerability being exploited. \[\bigcirc\] Determine the risk levels and suitable mitigation strategies. As cybersecurity risks to medical devices are continuously evolving, it is impossible to mitigate the risk within the premarket controls alone. Therefore, the FDA provides the following key guidance for manufacturers as part of postmarket medical device development [15]:  
* Take an approach to monitor the cybersecurity information sources for identification and detection of cybersecurity vulnerabilities and risk. \[\bigcirc\] Identify and assess the threats and vulnerabilities being exploited. \[\bigcirc\] Take a holistic approach to detect and assess the threat sources. \[\bigcirc\] Establish a communication process for incident response. \[\bigcirc\]0 Design a verification and validation process for software updates and patches used to remediate the vulnerabilities. * IEC 62304: IEC 62304 provides guidelines for each stage of the medical device software lifecycle with activities and tasks required for the safe design and maintenance of medical device software [16]. This standard is recognized by the FDA, EU and other regulatory agencies across the world. IEC 62304 recommends that organizations establish and maintain a risk management process to manage risk associated with security. The process should provide a methodology to identify the vulnerabilities, evaluate the associated threats, and implement risk controls to mitigate these threats. Finally, the process should also monitor the effectiveness of the risk control.