Another hot day in paradise. Sunny and 34C.
Not a disaster but still a PITA
We just spent 2 days bug-fixing and regression-testing code that was broken by Microsoft’s June security update to Windows operating systems and Explorer 11. Most of the customers of the FlaskData EDC, ePRO, eSource and automated detection and response platform use Chrome or Firefox on their desktops. This was no solace to site coordinators in one of the sites using Flaskdata. They came into work on Monday and the hospital-standard Explorer 11 no longer supported our application.
Microsoft published KB4503259 as a cumulative security update but it was much more. The update included major changes to the Explorer JavaScript engine. Its because of delightful black swans like this, running a SaaS business is not for the faint of heart.
I once wrote an essay on my cybersecurity for medical device blog called The Microsoft Monoculture as a threat to national security.
Why Microsoft is evil for medical devices
I suggested that the FDA might consider banning Windows as an operating system platform for medical devices and their accompanying information management systems.
One of my readers took umbrage at the notion of legislating one monoculture (Microsoft) with another (Linux) and how the Linux geeks are hooked on the CLI just like Windows users are hooked on a GUI.
The combination of large numbers of software vulnerabilities, user lock in created by integrating applications with Windows, complexity of Microsoft products and their code and Microsoft predatory trade practices are diametrically different than Linux and the FOSS movement.
The biggest threats to medical devices in hospitals is old Windows versions
One of the biggest threats to medical devices in hospitals is the widespread use of USB flash disk drives and Windows notebooks to update medical device software. With the infamous auto-run feature on Microsoft USB drives – flash memory is an easy attack vector for propagating malware via Windows based medical devices into a hospital network. This is one (and not the only) reason, why I am campaigning against use of Windows in medical devices.
This has nothing to do with the CLI or GUI of the operating system and personal preferences for a user interface.
This has everything to do with manufacturing secure embedded medical devices that must survive in most demanding, heterogeneous and mission critical environment one can imagine – a modern hospital.
I never advocated mandating Linux by law for medical devices.
It might be possible to mandate a complex set of software security requirements instead of outlawing Windows in embedded medical devices as a more politically-correct but far more costly alternative for the the FDA and the US taxpayer.
Regardless of the politics involved (and they are huge…) – if the FDA were to remove Windows from an approved list of embedded medical device operating systems – the costs to the FDA would decrease since the FDA would need less Windows expertise for audits and the threat surface they would have to cover for critical events would be smaller.
