5 ms·

I'm not the biggest fan of Microsoft Windows but I realize it has its place. Is one of those places, though, really on mission critical medical devices, and if

by Spoom 14y ago

I'm not the biggest fan of Microsoft Windows but I realize it has its place. Is one of those places, though, really on mission critical medical devices, and if so, what advantages does it provide over the alternatives, such as a hardened or more use-specific operating system?

viraptor 14y ago
Although I never saw one myself, I heard that during NT times, it was relatively easy to get a custom (but still supported) build of the system from MS that matched some requirements if you had reasons and enough cash for it (which medical device producers did). I'm not sure if that's still possible these days, considering windows server weights in disk space and memory than an usual device should ever require... Maybe someone has first-hand / more up to data information about it?
- zb 14y ago
  It's even easier than you are suggesting, you just customise it yourself: http://en.wikipedia.org/wiki/Windows_Embedded http://en.wikipedia.org/wiki/Windows_Embedded
- pdw 14y ago
  At we had a few (non-medical) products that ran on Windows XP Embedded [1]. It was pretty nice, it had something much like a Linux package manager where you could select which components you wanted and didn't want, and it would generate a disk image that you could dump on your target device. And no, we didn't offer security updates (although Microsoft did provide some infrastructure to do this). This was a hardware company, the idea of providing anything other than consumables and spare parts was quite alien. [1] The original plan was to use Linux, but we needed to connect various hardware that only came with Windows drivers...
  - viraptor 14y ago
    I think that's exactly what I was told about. Thanks for the details.
- sseveran 14y ago
  Yes. We had systems running a custom build of windows 2000.
cbhl 14y ago
My understanding is that one of the biggest challenges (expenses) for these systems is getting them certified. If I recall correctly, reusing an Operating System that has already been used in certified products helps make the various certification bodies more convinced that the software involved will function "correctly". I think the other issue here is liability -- if the manufacturer provides a "security update" and subsequently causes an error which kills a patient, it's the manufacturer's fault. Whereas if there's malware on the device, then it's the hospital's fault for not keeping the device clean. Plus, there's a great deal of vendor lock-in in the medical devices industry, so I wouldn't expect to see hospitals suddenly adding devices from $NEW_VENDOR which bothers to spend the extra money to write security updates and spend millions getting them recertified.
- SchwarzerHund 14y ago
  This is incorrect. All COTS in a medical device is considered SOUP (Software Of Unknown Pedigree). All COTS must be validated for its intended use regardless of the supplier and a risk analysis must be performed for the use of the COTS. The device manufacturer is held liable for defects, not the supplier.
EvanAnderson 14y ago
Why use Windows? It's easy and inexpensive to get developers who are familiar with the platform. You can leverage a lot of tools that already exist for the platform. You get a lot of hardware support "for free" using manufacturer-provided drivers. Medical device manufacturers are for-profit entities looking to make a profit. If using Windows makes it easier to make a profit then they'll use it. If that's problematic to society, from a security perspective, then regulations should be put in place to put make security costs impact the manufacturer's bottom line. Personally, I'd like to see pentesting as part of device certification requirements.
eswangren 14y ago
Have fun finding device drivers for off the shelf components which run on *nix. I work on a medical device and ican assure you that some vendors simply do not supply them. Problem is that I need to use their hardware and this isn't an area in which there always exist numerous alternatives. We run windows because it was impractical to do anything else. That said, I've been pushing for Windows embedded for years...

by Spoom 14y ago

viraptor 14y ago

Although I never saw one myself, I heard that during NT times, it was relatively easy to get a custom (but still supported) build of the system from MS that matched some requirements if you had reasons and enough cash for it (which medical device producers did). I'm not sure if that's still possible these days, considering windows server weights in disk space and memory than an usual device should ever require... Maybe someone has first-hand / more up to data information about it?

zb 14y ago
It's even easier than you are suggesting, you just customise it yourself: http://en.wikipedia.org/wiki/Windows_Embedded http://en.wikipedia.org/wiki/Windows_Embedded
pdw 14y ago
At we had a few (non-medical) products that ran on Windows XP Embedded [1]. It was pretty nice, it had something much like a Linux package manager where you could select which components you wanted and didn't want, and it would generate a disk image that you could dump on your target device. And no, we didn't offer security updates (although Microsoft did provide some infrastructure to do this). This was a hardware company, the idea of providing anything other than consumables and spare parts was quite alien. [1] The original plan was to use Linux, but we needed to connect various hardware that only came with Windows drivers...
- viraptor 14y ago
  I think that's exactly what I was told about. Thanks for the details.
sseveran 14y ago
Yes. We had systems running a custom build of windows 2000.

cbhl 14y ago

My understanding is that one of the biggest challenges (expenses) for these systems is getting them certified. If I recall correctly, reusing an Operating System that has already been used in certified products helps make the various certification bodies more convinced that the software involved will function "correctly". I think the other issue here is liability -- if the manufacturer provides a "security update" and subsequently causes an error which kills a patient, it's the manufacturer's fault. Whereas if there's malware on the device, then it's the hospital's fault for not keeping the device clean. Plus, there's a great deal of vendor lock-in in the medical devices industry, so I wouldn't expect to see hospitals suddenly adding devices from $NEW_VENDOR which bothers to spend the extra money to write security updates and spend millions getting them recertified.

SchwarzerHund 14y ago
This is incorrect. All COTS in a medical device is considered SOUP (Software Of Unknown Pedigree). All COTS must be validated for its intended use regardless of the supplier and a risk analysis must be performed for the use of the COTS. The device manufacturer is held liable for defects, not the supplier.

EvanAnderson 14y ago

Why use Windows? It's easy and inexpensive to get developers who are familiar with the platform. You can leverage a lot of tools that already exist for the platform. You get a lot of hardware support "for free" using manufacturer-provided drivers. Medical device manufacturers are for-profit entities looking to make a profit. If using Windows makes it easier to make a profit then they'll use it. If that's problematic to society, from a security perspective, then regulations should be put in place to put make security costs impact the manufacturer's bottom line. Personally, I'd like to see pentesting as part of device certification requirements.

eswangren 14y ago

Have fun finding device drivers for off the shelf components which run on *nix. I work on a medical device and ican assure you that some vendors simply do not supply them. Problem is that I need to use their hardware and this isn't an area in which there always exist numerous alternatives. We run windows because it was impractical to do anything else. That said, I've been pushing for Windows embedded for years...