Cloud Hosting

The FDA introduced a new cybersecurity policy for medical devices on 29th March 2023, as part of the Federal Food, Drug, and Cosmetic Act. Medical devices defined as cyber devices must now comply with specific cybersecurity requirements, including post-market monitoring, addressing vulnerabilities, and providing updates and patches. The Refuse to Accept policy empowers the FDA to reject submissions that fail to meet these standards. The policy comes in response to the rising number of cyberattacks targeting medical devices and aims to ensure patient safety, device performance, and cybersecurity from the initial stages of development. It does not apply retroactively for currently deployed insecure devices and legacy technologies.

Medical devices are increasingly connected to the internet, hospital networks, and other devices to improve healthcare and enable healthcare providers to treat patients more effectively. However, these features also increase potential cybersecurity risks. Medical devices, like other computer systems, can be vulnerable to security breaches, which could impact the safety and effectiveness of the device. The healthcare environment is complex, and manufacturers, hospitals, and facilities must work together to manage cybersecurity risks.

Manufacturers must design and release updates, patches, provide a software bill of materials, and submit a plan for identifying and addressing post-market cybersecurity vulnerabilities. These rules affect devices with software and internet connections, such as insulin pumps, blood sugar monitors, and certain pacemakers. The new focus on device manufacturers aligns with the governments focus on accountability for software makers and industry for product defects.

Tiffany Gallagher, PwC Health Industries Risk & Regulatory Leader, said to The Record, As innovations in healthcare technology continue to grow, these regulations will help ensure that cybersecurity is baked into devices from the very beginning and continues to be a top-of-mind priority beyond the initial implementation.

The medical industry has been increasingly targeted by cyberattacks, with a significant spike in 2022. The FBI warned in September 2022 of vulnerabilities in medical devices, with over 50% of connected devices having critical vulnerabilities. The new regulations aim to address these vulnerabilities and protect patients safety and privacy.

Chris Warner, Operational Technology Cybersecurity Expert at GuidePoint Security, said, We are seeing a Shift Left strategy to push the responsibilities from the operators of the device to the manufacturers of IoMT [Internet of Medical Things] equipment and devices. The FDAs new policy is a crucial step towards a more secure healthcare ecosystem, benefiting patients, healthcare providers, and manufacturers alike.

While the new policy marks a significant milestone in medical device cybersecurity, it is essential to continue monitoring and addressing cybersecurity risks in the healthcare industry. Collaboration between manufacturers, healthcare providers, and regulators will be crucial to ensure the safety and effectiveness of medical devices in an increasingly connected world.

Read the original here:
US regulator takes action to ensure internet security in connected ... - Innovation Origins

Read More..

Conrad Prince is a Distinguished Fellow and senior cyber adviser at RUSI. He is the former director general for operations and deputy head of the U.K. governments signals intelligence and cyber security agency, GCHQ.

The last decade has seen a notable increase in openness and engagement from the United Kingdoms intelligence and security agencies especially in contrast to the days, not all that long ago, when the government didnt even officially admit to their existence. But today, we have speeches and media appearances from agency heads, extensive websites and even a presence on social media.

Now, that process has taken a significant step further with a publication by one of the newest additions to this secret world the National Cyber Force (NCF). The NCF has released a document setting out the operating principles behind the U.K.s use of what is sometimes called offensive cyber. That is, operations in cyberspace to disrupt an adversarys ability to use the Internet and digital technology to further their ends.

The guide is the first of its kind, giving us unprecedented insight into the U.K.s thinking on cyber operations.

The NCF was created in 2020 from elements of the Government Communications Headquarters its cyber intelligence and security agency the Ministry of Defence and the Secret Intelligence Service. And although its creation represents a significant increase in focus on this area, the U.K. isnt new to the world of offensive cyber operations by the governments own account, its been carrying them out for over 20 years. But up until now, very little has been said in public about the U.K.s approach to this capability.

Public understanding of cyber operations is sometimes hampered by some of the overblown language used to describe it. Terms like cyber 9/11 or cyber-Pearl Harbor reinforce the seriously misleading notion that a cyberattack is something analogous to a nuclear one, and is mainly about widespread and catastrophic destruction to swathes of critical infrastructure.

But nuclear is about the worst possible analogy for cyber. Cyber operations are much closer to covert action, to clandestine operations below the threshold of a shooting war, designed to achieve a particular effect in a targeted way.

The NCFs new guide acknowledges that cyber operations are unlikely to be strategically decisive on their own. They can, however, achieve a valuable targeted effect such as preventing a terrorist group communicating at a critical moment, or disrupting an adversarys access to situational awareness information which can be particularly effective when combined with other actions in the physical world.

As our adversaries whether terrorists, criminals or hostile states increasingly depend on digital technology to achieve their ends, having an ability to disrupt this dependency is important. And, according to the guide, the NCF is carrying out such operations on a daily basis.

Among the details revealed, perhaps most striking are those into the thought process behind the U.K.s cyber operations, in particular, what is termed the doctrine of cognitive effect. This approach focuses on how cyber operations that limit or affect the information available to an adversary, and undermine their confidence in their technology and the information it provides, can weaken their ability to plan and conduct activities with confidence. It shows an intent to use cyber operations for a more subtle and pervasive effect, beyond simple tactical short-term disruption of technology.

This reveals some innovative thinking but evidencing the impact of these operations remains difficult. The NCF is clear we shouldnt expect to see details of specific operations, and there are clearly difficult security issues involved in being more open maintaining ambiguity about operations is also a core part of the U.K. approach. But in the spirit of transparency, it would be good if the NCF could find some ways to give the public a sense of its effectiveness.

Theres also a question as to whether publishing this statement will contribute to deterrence. Much has been written on cyber deterrence, and much of it suffers from false analogies to the nuclear environment. But in practice, theres little evidence that knowledge of a countrys cyber capabilities plays a material part in deterring action, whether in the virtual or physical world.

A critical part of the guide is about making the case that it is possible to carry out cyber operations in a responsible and ethical way.

The U.K. government has committed itself to the principle of a free, open, peaceful and secure Internet, and has repeatedly emphasized the need for states to act responsibly in cyberspace. But how does that sit with the government at the same time investing apparently significant resources in an organization dedicated to launching cyberattacks?

The starting point is that our adversaries are using the Internet and digital technology to do us harm, and it seems perverse to deny ourselves the possibility of making that harder for them. So, the key questions are how to do so in a legal, ethical and properly managed way. And the guide sets out a strong case for the U.K. position.

The NCF has set out three principles for its operations that they be accountable, precise and calibrated. It states that the U.K. operates under a robust legal framework of domestic and international law with independent oversight, including from judges and parliament, via its Intelligence and Security Committee. And the guide describes how the NCFs operations are carefully designed to be targeted with precision, using capabilities that are controllable, predictable and subject to extensive clearance procedures.

Some of this must inevitably be taken on trust, of course, and not everyone may be satisfied. But as an approach, its in stark contrast to the behavior exhibited by countries like Russia and Iran, which generally lack legitimacy and are disproportionate and indiscriminate, frequently impacting those who werent the intended target.

As such, this guide is a valuable step toward starting to put some much-needed flesh on the bones of what goes into making responsible cyber operations.

Not so long ago, it would have been unthinkable for the U.K. to have published a document of this sort. That they have done so is to be greatly welcomed as is the NCF explicitly recognizing it needs a license to operate from the public, and that achieving this requires more openness and engagement.

The NCFs guide is a significant step in providing more transparency about U.K. cyber operations. It does, however, need to be the start of a process, not the conclusion of one. There is much to be gained from shining more light on this complex and often misunderstood field.

View post:
Government shines a light on UK cyber operations - POLITICO Europe

Read More..

Several days ago, an urgent call for help in a WeChat group in China solved a mystery that has puzzled many Chinese netizens for nearly two years. After the WeChat exchange, we now know what happened to an anonymous blogger who is regarded as the Chinese "Cyber Prometheus."

He is the godfather of many Chinese netizens who learned from him how to "jump over the Great Firewall."

We also finally know the blogger's name.

The urgent WeChat call for help was sent to a neighborhood chat group in China with 37 members. A woman in the chat identified herself as Bei from Unit 701. Her husband is Ruan Xiaohuan, who blogs under the name "Program-think" ().

Ruan Xiaohuan was taken away by the Chinese police on May 10, 2021, and was sentenced on February 10, 2023. Bei is helping Ruan appeal his sentence.

On February 19, Bei was blocked at her neighborhood gate. The police then forced Bei to listen to a "talk" for more than two hours. Obviously, the police didn't want Bei to hire lawyers for her husband. The police "talk" was meant to intimidate Ruan Xiaohuan's wife.

After the police stopped her and berated her, Bei was afraid that she could also be arrested. She asked her neighbors in the chat group to call her parents or her lawyers should something happen to her.

A typical case of Communist brutality, something that happens in the People's Republic of China (PRC) every day.

But Bei added something that makes her case stand out. She told her fellow chat members that her husband was the Chief Engineer of the information security system for the 2008 Beijing Olympics and had contributed a lot to this country. "He is patriotic," she said.

She also posted her lawyers' telephone numbers for her neighbors to call.A picture of Ruan Xiaohuan, "Program-think" taken during an interview. ( via Jennifer Zeng)

When the screenshot of Bei's chats was circulated on the internet, many Chinese people both inside and outside of China were extremely shocked. Bei had, inadvertently perhaps, revealed two big puzzle pieces at the same time: What happened to "Program-think"? And what was his real name?

"Program-think" was arrested and sentenced. His name is Ruan Xiaohuan.

There's more. People were equally shocked that "Program-think" was also the Chief Engineer of the information security system for the 2008 Beijing Olympics!

In 2009, "Program-think" started a blog that eventually became very influential. "Program-think" posted many articles about online safety, and about how to bypass the Chinese Communist Party's (CCP) "Great Firewall" of online censorship. He also published a lot of other articles on "improving thinking ability," "popularizing political knowledge," and "revealing the true face of the Party-state."

He also provided the public with many e-books on politics, psychology, history, economics, management, sociology, literature, philosophy, science popularization, and military affairs.

Via his blog and other platforms, "Program-think" taught Chinese people how to safely jump over the CCP's Great Firewall without being caught. His deep thoughts and marvelous online techniques inspired many people, and many regarded him as a mentor, an enlightener.

For many, he was the ideological mentor of most of the netizens who know how to climb over the Great Firewall today. Some even say he was as dear as a father to them, and a true hero.

"Program-think" was gaining a tremendous following, and great respect, among the Chinese people. But he suddenly stopped updating his blog on May 9, 2021.

"Program-think" had previously said that if he was silent for more than two weeks, then he had either died or been caught by the People's Republic of China (PRC) authorities.

So, people knew something bad must have happened to him after he fell silent. But his online security awareness was so strong, his skills were so good, and he kept teaching others how to go over the Great Firewall without getting caught or discovered. So, it was hard for people to imagine how he could have gotten into trouble.

And yet, the fact was that "Program-think" had disappeared. Nobody knew where he was, what happened to him, or his true identity. But many Chinese netizens still talked about him from time to time. Many people missed him too.

Then, on March 21, 2023, a month or so after her "talk" from the Chinese police, the call for help from his wife Bei suddenly appeared on WeChat.

When people learned that "Program-think" was also the chief engineer of the information security system for the 2008 Beijing Olympics, they thought: "No wonder he knew so much about online safety. No wonder he knew how to jump over the Great Firewall."

The CCP had been thwarted by someone on the inside. "Program-think" was a double agent, an online freedom fighter for the Chinese people.

After some digging, one netizen in China later revealed how "Program-think" got caught.

More than ten years ago, Ruan Xiaohuan had registered an account at a Chinese online database and social networking service called Douban. He used the same name for that as his later blog handle, "Program-think."

Ruan later deleted that Douban account. However, Douban didn't delete his account information. They kept it, and this became the final clue for the CCP to track Ruan down.

Although he had been very cautious and had very advanced internet security techniques, Ruan might have forgotten about the old Douban account that he hadn't used much.

However, there are other people who suggest that Ruan was caught because western companies cooperated with the CCP, using big data technology to help the CCP find their quarry. Right now we don't know for sure.

It is now confirmed that Ruan Xiaohuan "Program-think" is currently detained in the Yangpu District Detention Center in Shanghai. He was sentenced to seven years in prison by the Second Intermediate People's Court of Shanghai on Feb 10, 2023.

Ruan's court-appointed "lawyer" did not disclose any details of the case to his family until the trial.

After the first trial, Ruan filed an appeal. His wife, Bei, hired two lawyers in Beijing, Mo Shaoping and Shang Baojun, to defend him.

However, his wife was then forcibly interrogated by the police outside her apartment building that day in February of 2023. She couldn't reach the lawyers she had hired to represent her husband. Also, Ruan's case has been transferred to the Shanghai High People's Court. The court again "appointed" two "official lawyers" for Ruan. This was done so that Ruan could not hire his own counsel.

According to his "criminal judgment," Ruan Xiaohuan, aka "Program-think," was basically charged with "Subversion of State Power."

His judgment states:

From June 2009 to May 2021, the defendant Ruan Xiaohuan, due to his long-standing dissatisfaction with China's political system and social governance model, wrote over a hundred fabricated and defamatory inciting articles using his personal computer at his place of residence. The content involved attacking and smearing China's existing political system, inciting subversion of state power, and attempting to overthrow the socialist system, and was published through overseas online platforms, resulting in a large number of netizens viewing, commenting, forwarding, imitating, and other adverse consequences.

This statement, for me, is no doubt an official confirmation of Ruan's online influence.

The judgment also states that the police seized and confiscated quite a number of computers, cellphones, hard drives, USB drives, and so forth from Ruan. One Chinese netizen commented that he hopes the police keep these items so that they can become exhibits in future Chinese museums after the fall of the CCP.

In the past few days, many Chinese people have been circulating the latest news about Ruan Xiaohuan, "Program-think."

Ruan was well-known among internet-savvy Chinese people and considered a legendary figure. So, it was surprising and saddening to learn that he taught people how to bypass censorship and protect online anonymity, only to be caught due to an oversight in his own account information, or big tech's cooperation with the CCP.

For me, however, Ruan's arrest and legacy should be highlighted for the following three reasons:

First, he was the Chief Engineer of the information security system for the 2008 Beijing Olympics. His situation deserves attention from the international community, from anyone who attended or watched that great event.

Second, even someone like Ruan, who is very knowledgeable about network security technology, can be arrested. This shows how much effort the CCP has put into internet control.

It was said it took the CCP ten years of painstaking effort to catch "Program-think."

Third, the fact that Ruan was once entrusted by the CCP with the important task of ensuring information security for the 2008 Beijing Olympics indicates that he still had the trust of the Party in 2008. If someone like him can become an "enemy" of the CCP just one year later, then Xi Jinping and other high-ranking Communist officials should indeed have nightmares every day.

How many such "enemies" are hidden within the CCP? How long can rule maintained by high pressure last?

According to those who know him, Ruan Xiaohuan actually had the opportunity to go abroad. He could have done so, escaping from the inhuman system he fought against.

However, he chose to stay in China to help more Chinese people learn how to "climb over the Great Firewall" and master safe internet technology while spreading ideas of freedom and democracy.

During an early interview with him by a Chinese media outlet, "Program-think" said he was someone who was passionate about new technology, and only new technology could make him passionate.

He also said later, as the anonymous "Program-think," that:

I believe it is exactly this kind of thinking and sense of responsibility that made him stay in China at the risk of his life to do enlightenment work on cybersecurity. It is a reminder that freedom from China will come from the Chinese people standing up to the Chinese Communist Party.

But the help of those outside of China is also indispensable. Let's hope that more people will know Ruan Xiaohuan's story and call for his release so that he can regain his freedom as soon as possible.

Author: Jennifer Zeng

Read the original here:
Legend of the Chinese 'Cyber Prometheus' of China's Great Firewall - JAPAN Forward

Read More..