Risk Management When Using Open-source Software in Medical Devices
Talkat Embedded Linux Conference @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 12:00· Room 203/204 (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Explains how ISO 14971-driven risk management applies to third‑party code, shows that Linux can be trimmed to under 32 MB for embedded devices, and compares choices: RTOS vs Linux with preempt-RT for soft real‑time. Defines SOUP (software of unknown provenance) and lists checks: development process mapping to IEC 62304, CVE monitoring (about 300 CVEs/week to triage), update strategy, secure boot and encryption, and lifecycle support with commercial or Debian/Yocto-based distributions.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:10Medical Risk Management
- 1:46Risk Management
- 5:16A Risk Management File
- 5:29Key Points
- 14:33Data Privacy
- 18:09The Principle of Least Privilege
- 24:16Managing Linux
- 27:46What We Do at Siemens Embedded
- 28:32Summary
related talks
19mResponsible consumption of open source
32mDeveloping Open Source for Safety and Security
34mOpen Source in Safety Critical Applications: the Next Frontier
39mFrom a Security Expert's Diary: DOs and DON'Ts When Choosing Software for your...
30mDevSecOps: Understanding Open Source Software risk in your applications
10mLightning Talk: Secure Consumption of Open Source Software: Evaluating, Util...
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
25mOWASP Top 10 Risks for Open Source Software