The Cybersecurity and Infrastructure Security Agency and other U.S. and international agencies July 29 released joint guidance outlining minimum elements for a “software bill of materials” for organizations to better understand and improve their cybersecurity efforts. The guidance updates and replaces minimum elements suggested by the National Telecommunications and Information Administration in 2021. An SBOM lists all components contained in a software product. Other types of software, such as artificial intelligence and software-as-a-service in cloud environments, may require additional elements. Section 524B of the Federal Food, Drug, and Cosmetic Act requires medical device manufacturers to provide an SBOM. This applies to new medical device applications submitted to the Food and Drug Administration after Oct. 1, 2023.
“Take a look at the many software components that run a medical imaging device as an example,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “The device itself may not be listed as compromised, but one deeply embedded software component could contain an unpatched technical vulnerability that may lead to compromise of the device and, therefore, the hospital network it’s attached to.”
For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org or John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org. For the latest cyber and risk re
Cybersecurity
Headline
Blog spotlights FBI intel on healthcare cyberthreats and best-practice defense
John Riggi, AHA national advisor for cybersecurity and risk, shares insights from a conversation with two FBI leaders about the surge of cyberattacks on the U.…
AHA Cyber Intel
Lessons Learned from Conversations with the FBI: Healthcare Cyberthreats and Best-practice Defense
Earlier this year, the FBI launched a two-month national campaign, Operation Winter SHIELD (Securing Homeland Infrastructure by Enhancing Layered Defense),…
Headline
Agencies issue updated advisory on Iranian cyber actors targeting programmable logic controllers
The Cybersecurity and Infrastructure Security Agency and other U.S. and international partners July 22 released an updated advisory on Iranian-affiliated cyber…
Headline
AHA podcast discusses hidden cybersecurity risks of AI in healthcare
Edward You, former FBI Supervisory Special Agent and founder of EHY Consulting, explains why healthcare organizations must look beyond artificial intelligence…
Headline
CISA warns of SharePoint vulnerabilities exploited by hackers
The Cybersecurity and Infrastructure Security Agency has issued an alert warning of four Microsoft SharePoint vulnerabilities being exploited by cyber threat…
Headline
White House announces Gold Eagle initiative to improve cybersecurity for critical infrastructure
The White House July 14 announced the establishment of Gold Eagle, a clearinghouse to enhance cybersecurity for critical infrastructure entities that will…
