Windows 7 End-of-Support: Securing the Future

Windows 7 end-of-support is coming soon. OEMs need to have solutions in place to transition away from the Windows 7 OS and onto alternative platforms. While managing the Windows 7 transition is the short-term goal, ultimately, every OS will eventually reach end-of-life. Technology is constantly changing, evolving, and improving, and OSes won’t be maintained forever. How can organisations ensure long-term security while handling device updates? By implementing security best practices during development.

Technology is constantly evolving – you need to be able to continuously secure and upgrade your devices.

Handling Long-Term Security and Device Updates

Wind River has adopted industry best practices for security, which are applied in two ways. One is to ensure that products are secure and that development is done in the most secure way possible. The second is to extend the security envelope to customers. To do that, we take a holistic approach.

Security Assessment

Our assessment covers the customer’s products, processes, tools, and technologies. We complete initial assessments and also run periodic checkups. This helps to ensure that security recommendations are being updated and completed, and that action items are tracked so that our customers’ systems remain secure.

The CIA Triad

Our security assessment is based on the industry-recognised CIA (Confidentiality, Integrity, Availability) triad, each principle is broken into security-related categories. Each category is then decomposed into security-related implementations. When the implementations are brought together, a customised Security Policy is defined.

Ongoing Updates

It is also recognised that:

1.       To stay secure, medical devices have to be constantly updated with the latest and greatest software and patches.

2.       Medical device OEMs may or may not have a full security team that monitors all the vulnerabilities coming out every single year. Even when a security team exists, filtering OS-level vulnerabilities may be hard.

To ensure that a sufficient level of security has been provided, we recommend partnering with:

1.       A silicon vendor who has inherent security features built into their chips

2.       An OS provider, such as Wind River, which enables those silicon-level security features

3.       A medical SI or medical device OEM

When these entities work together in a secure medical device development process, the result is a more secure device and associated firmware.

However, to remain secure, updates need to be applied to this firmware on a periodic basis. Wind River offers a managed service that regularly incorporates updates into the firmware and provides new versions of firmware to the medical device OEM. While the cadence is usually covered in the business terms, we generally recommend getting new firmware every three months, even if it isn’t deployed. This strategy ensures that if a new and critical security vulnerability is found, a medical device OEM would be no more than three months behind on a security fix.

This approach also aligns well with new FDA recommendations, which advises that fixes be deployed within 60 days of discovery of a critical security vulnerability.

Securing the Future with Wind River

Unfortunately, this current upgrade cycle issue was driven by vendor changes and mandates. As we migrate away from this problem, we want to create mechanisms that allow medical device OEMs to have a continuous integration and deployment (CI/CD) pipeline. This will help solve tomorrow’s problems quickly while adhering to customer and market requirements.

If you want to explore the security strength of your current medical devices, try taking our security assessment.

Courtesy of Wind River.