Lion Cipher Lab
Assess a medical device against FDA premarket cybersecurity expectations
- GRC / Compliance
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Connected medical devices — infusion pumps, pacemakers, imaging systems, patient monitors, insulin pumps — now sit on hospital networks and, increasingly, in patients' homes. A vulnerability in one is not an abstract data-privacy problem; it can affect whether a device delivers the right dose or keeps working at all, which is why regulators treat device security as a patient-safety issue. Since the US PATCH Act added section 524B to the Food, Drug, and Cosmetic Act, the FDA can refuse to even accept a submission for a "cyber device" that does not come with a cybersecurity plan, a software…
What you'll learn
- medical-device cybersecurity fundamentals
- FDA premarket cybersecurity expectations (FD&C Act section 524B)
- distinguishing safety risk (ISO 14971) from security risk (AAMI TIR57)
- device attack-surface and interface inventory
- threat modeling a connected device (STRIDE)
- building a security-risk register mapped to patient safety
- planning an SBOM for a device and continuous vulnerability monitoring
- coordinated vulnerability disclosure and postmarket vuln management
- writing a gap assessment against a regulatory expectation
Steps in this lab
- The words you need first — cyber device, 524B, premarket vs postmarket
- WHEN this applies, and WHY security risk is assessed separately from safety risk
- Pick your device and write the device profile
- Inventory the interfaces — map the attack surface
- Threat model the device with STRIDE
- Build the security-risk register (and keep it tied to safety)
- Plan the SBOM — the components you did not write
- Postmarket: coordinated disclosure and ongoing vulnerability management
- Write the gap list against 524B — and do it better
- What you just did — and why it's a hireable skill