TRUSTED BY
Several American and European standards and guidance for medical device cybersecurity highly recommend fuzz testing. The most important guidance documents advocating for fuzz testing:
- Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions by the U.S. Food and Drug Administration (FDA)
- AAMI TIR 57:2016 Principles For Medical Device Security - Risk Management
- Guidance on Cybersecurity for Medical Devices (MDCG 2019-16) by the European Commission and the Medical Device Coordination Group
- IEC 81001-5-1 Health Software and Health IT Systems Safety, Effectiveness and Security. Part 5-1: Security — Activities in the Product Life Cycle.
In this paper, we discuss 4 reasons why these documents advocate for fuzz testing for medical devices.
“Fuzz testing is state-of-the-art for testing robustness. Although you can write your own tests, you can never perform as many random and denial-of-service tests as you can with fuzzing. You must perform fuzz testing to prove to the FDA that your device is reliable and that the most common bugs are caught.”
Verena WieserMedical Device Consultant, Lorit Consultancy
“Fuzz testing is state-of-the-art for testing robustness. Although you can write your own tests, you can never perform as many random and denial-of-service tests as you can with fuzzing. You must perform fuzz testing to prove to the FDA that your device is reliable and that the most common bugs are caught.”
Verena WieserMedical Device Consultant, Lorit Consultancy