Cyber Security of Digital Medical Devices: Establishing UK Capability for a New Design and Development Route.

Digital healthcare technologies underpin a spectrum of personalised medical devices such as glucose monitoring insulin delivery systems that are fundamental to supporting NHS aspirations for digitally-enabled healthcare proposed by the NHS long-term plan and reinforced more recently by the NHS plan for digital health and social care. This justifies the Government’s strategy for a cyber resilient health and social care system, making this Connectivity Award essential and extremely timely in supporting Government ambitions for the future sustainability of the NHS. As highlighted by recent research, current cyber security vulnerabilities of personal digital medical devices: pose an existential threat to digital medical devices (and connected systems) used within the NHS, compromise realization of EPSRC’s three challenge and priority areas, and prevent effective delivery of the NHS plan for digital health and social care. This Award will support the PI to build on their extensive health domain expertise in digital medical device research by learning new skills and techniques in cyber security . The School of Computing and Communications at Lancaster University (Host), provides the foundation for all research training and development, supplemented by external project partners. The focus of this Award will be protection from direct malicious cyber-attacks on personal digital medical devices – a largely neglected area of research. Two key Aims of the pilot project are: Understanding the cyber-clinical risk, range and nature of cyber security vulnerabilities for a defined spectrum of digital medical devices and using these portals to develop novel cyber-physical technologies and strategies to prevent/mitigate cyber-attacks. Understand the life cycle of a spectrum of digital medical devices including cyber-clinical risk profiles, cyber security vulnerabilities and key stakeholder requirements. This will enable development of a novel framework of understanding underpinning an innovative cyber security design and development route for new digital medical devices. The embedded pilot project will focus on data manipulation attacks, initially using a defined range of Class I and IIa medical devices as proof-of-concept for novel technology development and to establish workflow, with progression to the highest clinical risk level (Class III) device. The focus will be on diabetes-related devices to align with the PI’s expertise and clinical network. To address aim 2, based on the knowledge, skills and techniques developed as part of this award and working with all key stakeholders, the PI will have continued engagement with cross-sector project partners to understand cyber-clinical risk management, technical aspects of cyber vulnerabilities, current device design and development routes and stakeholder requirements. To help engage more widely with industrial partners, this Award benefits from Lancaster University being lead academic partner in multiple business engagement and co-working incubators including the Digital Security Hub (DiSH) in Greater Manchester, co-located with the public offices of GCHQ, and ‘North West Cyber Security Connect for Commercialisation’ (NW CyberCom), partnering with investors, entrepreneurs, government and businesses to transform cutting-edge innovations into new products and services. This Connectivity Award will benefit from Lancaster University’s £19m strategic investment in ‘Security and Protection Science’, including new campus facilities with state-of-the-art ‘Data Cyber Quarter’, supporting new partnership opportunities with cyber industry. This Award will develop cross-disciplinary knowledge, capability and cross-sector network capacity, laying the foundations for supporting the PI’s ambition for leading a UK centre of excellence for research and translation in cyber security of digital medical devices.