CCE Medical Device Cybersecurity and Information Security 2

Question 1

What is the primary cybersecurity concern when medical devices run legacy operating systems such as Windows XP?

Accepted Answer

Lack of manufacturer support and availability of security patches

Answer

Legacy operating systems no longer receive security patches from vendors, leaving known vulnerabilities permanently unaddressed and exposing devices to exploitation.

Question 2

Which IEC standard specifically addresses risk management for IT networks that incorporate medical devices?

Accepted Answer

IEC 80001-1 (Risk management of IT networks incorporating medical devices)

Answer

IEC 80001-1 specifically addresses risk management for IT networks incorporating medical devices, guiding healthcare organizations in managing risks from networked clinical technology.

Question 3

What does the security principle of 'defense in depth' mean in the context of medical device cybersecurity?

Accepted Answer

Implementing multiple overlapping layers of security controls to protect medical devices

Answer

Defense in depth employs multiple overlapping security layers so that if one control fails, additional controls remain to protect the system from compromise.

Question 4

What is a 'zero-day vulnerability' in the context of medical device security?

Accepted Answer

A security flaw unknown to the vendor with no available patch

Answer

A zero-day vulnerability is a security flaw unknown to the device vendor, meaning no patch exists at the time of discovery, making it particularly dangerous for patient safety.

Question 5

Which organization maintains the Common Vulnerability Scoring System (CVSS) used to rate cybersecurity vulnerability severity?

Accepted Answer

FIRST (Forum of Incident Response and Security Teams)

Answer

CVSS is maintained by FIRST (Forum of Incident Response and Security Teams), providing a standardized, vendor-neutral method for rating the severity of cybersecurity vulnerabilities.

CCE - Certified Clinical Engineer Practice Test

CCE - Certified Clinical Engineer Practice Test

CCE Medical Device Cybersecurity and Information Security 2