Alpinion Medical Systems X-CUBE 70, Quick Manual

Page: 118 / 125

4-8 Safety
Anti-Virus Program
Anti-Virus Program
Since the X-CUBE ultrasound systems are integrated into your IT-network, ALPINION MEDICAL
SYSTEMS Co., LTD wants to make sure that you are aware of the proactive measures we are
taking to secure the system. Below are measures we have implemented to secure the X-CUBE
ultrasound systems.
•
Use of Windows* Embedded Standard 10, a componentized version of Windows 10
specifically made for embedded systems. Only the components required are used for
the X-CUBE scanners, thereby reducing the OS attack surface. Please note that Windows
Embedded Standard 7 is not the same operating system as Windows 10.
•
Disable the user’s ability to access the internet and Windows desktop.
•
Disable, or make inaccessible, functionality that is typically used as malware vectors for
spreading viruses (e.g. email services, web browsers).
•
Disable the AutoRun functionality on removable media.
ALPINION MEDICAL SYSTEMS Co., LTD believes that this Defense in Depth strategy using
the combination of the security measures above and the security standards of Microsoft’s
Windows Embedded Standard 10 will provide security against malware, especially for a system
used in a professional, hospital grade networking environment that itself should provide a high
level of security measures.
Finally, a few points as to why ALPINION MEDICAL SYSTEMS Co., LTD do not use the anti-virus
software. Commercial anti-virus software is commonly used on general-purpose computers to
detect the presence of malicious software (e.g. virus, Trojan horse, worm). Anti-virus software
is useful on general-purpose computers as they typically cannot be sufficiently hardened
against the attack vectors used by malicious software.
The X-CUBE ultrasound systems however are single purpose devices that have controlled
intended use, and thus are well hardened. For the X-CUBE ultrasound systems, the potential
patient safety and security risks introduced by using commercial anti-virus software would
outweigh the security benefits. Such risks include:
• Real-time anti-virus scanning can affect ultrasound system performance.
•
The effectiveness of anti-virus software depends on regular updates of the virus definitions
files. This would typically require internet connectivity for the ultrasound system.
•
The anti-virus software itself is a popular attack vector.
•
Disruptive nature of the support of the anti-virus software throughout the life cycle of the
medical device. The operating system of a medical ultrasound system is part of a medical
device that requires a special and controlled release process. Any update of the anti-virus
software would require a change of the system software.
Due to the cited risks, the use of commercial anti-virus software is not part of the X-CUBE
ultrasound systems product security strategy.