Hospital biomedical engineering teams are responsible for establishing and regulating medical equipment management programs (MEMPs); these programs ensure the safety and reliability of medical devices. Concomitant with rapid technological advancements, medical devices have been developed that are now being integrated with information and communication technology. However, with the convergence of such diverse technologies, internal and external security threats are continuously increasing. Thus, to reduce medical device security threats, important devices must be identified and prioritized. In this study, we propose a multicriteria decision-making model that prioritizes medical devices by extending the Fennigkoh and Smith model to include security threats. First, we formulate criteria for evaluating medical device functions based on the classification of the medical devices according to their unique functions, connections, and data types. Then, through threat modeling, we develop a method of identifying and evaluating security threats to these devices. We discuss establishing a safer MEMP by analyzing the attack occurrence probability (AOP) and attack success probability (ASP) of medical devices and the inherent security threats that these devices face, none of which are considered in the existing model. Thus, by using the enhanced Fennigkoh and Smith model, our proposed approach enables the development of improved security-enhanced MEMPs, including cybersecurity risk assessments.

中文翻译：

---

使用网络安全风险分析进行医疗器械安全管理

医院生物医学工程团队负责建立和规范医疗设备管理计划（MEMP）；这些程序可确保医疗设备的安全性和可靠性。随着技术的快速进步，医疗设备已经开发出来，现在正在与信息和通信技术相结合。然而，随着各种技术的融合，内部和外部的安全威胁不断增加。因此，为了减少医疗设备安全威胁，必须识别重要设备并确定其优先级。在这项研究中，我们提出了一个多标准决策模型，通过扩展 Fennigkoh 和 Smith 模型以包括安全威胁来优先考虑医疗设备。第一的，我们根据医疗器械的独特功能、连接和数据类型对医疗器械进行分类，制定评估医疗器械功能的标准。然后，通过威胁建模，我们开发了一种识别和评估对这些设备的安全威胁的方法。我们通过分析医疗设备的攻击发生概率 (AOP) 和攻击成功概率 (ASP) 以及这些设备面临的固有安全威胁来讨论建立更安全的 MEMP，现有模型中均未考虑这些因素。因此，通过使用增强的 Fennigkoh 和 Smith 模型，我们提出的方法能够开发改进的安全增强型 MEMP，包括网络安全风险评估。我们开发了一种识别和评估对这些设备的安全威胁的方法。我们通过分析医疗设备的攻击发生概率 (AOP) 和攻击成功概率 (ASP) 以及这些设备面临的固有安全威胁来讨论建立更安全的 MEMP，现有模型中均未考虑这些因素。因此，通过使用增强的 Fennigkoh 和 Smith 模型，我们提出的方法能够开发改进的安全增强型 MEMP，包括网络安全风险评估。我们开发了一种识别和评估对这些设备的安全威胁的方法。我们通过分析医疗设备的攻击发生概率 (AOP) 和攻击成功概率 (ASP) 以及这些设备面临的固有安全威胁来讨论建立更安全的 MEMP，现有模型中均未考虑这些因素。因此，通过使用增强的 Fennigkoh 和 Smith 模型，我们提出的方法能够开发改进的安全增强型 MEMP，包括网络安全风险评估。