Automatic External Defibrillator

Harbor Labs was engaged by an industry leading manufacturer of automated external defibrillators (AED) to help resolve a security issue that was impeding both regulatory approvals and corporate business objectives.

The AED in question was the subject of an academic research paper, published several years prior, that analyzed the manufacturer’s deployment model and the methods used to update device firmware post-market. The authors of this paper highlighted several security flaws in the manufacturer’s model that would have made it susceptible to eavesdropping and a man-in-the-middle attack.

When brought to the attention of FDA regulators, the CDRH/Office of Device Evaluation deemed the reported vulnerabilities severe enough to warrant a hold letter. At the time the hold was issued, the client had nearly 500,000 devices already deployed, restricting their ability to update their fielded systems and to sell and deploy new units. Despite several attempts by the client to redesign the patch model to meet FDA approval, the lead examiner continued to identify vulnerabilities in their designs that disqualified them.

At this point, Harbor Labs was brought in to assess the client’s patch model and to assist in the Q-Submission process. Harbor Labs engineers reviewed the client’s cloud distribution network, key generation and management processes, and signing policies, and compared them against common FDA regulatory criteria. The FDA objections were well founded, reflecting both the expertise and thoroughness of the regulatory scientists responsible for medical device security.

After identifying the flaws in their system, Harbor Labs redesigned the client’s architecture and processes, and provided engineering consulting to assist in its implementation. The redesign was diagrammed and documented in detail, signed by Dr. Mike Rushanan and Dr. Avi Rubin, and resubmitted to FDA examiners for approval. With every disqualifying characteristic of the client system now remediated and verified by Harbor Labs, the client was authorized intervened on their behalf, after which their regulatory obstacles were cleared.