{"id":57,"date":"2018-01-12T09:00:53","date_gmt":"2018-01-12T08:00:53","guid":{"rendered":"http:\/\/www.johner-institut.de\/blog\/?p=57"},"modified":"2023-05-08T18:05:04","modified_gmt":"2023-05-08T16:05:04","slug":"security-patch","status":"publish","type":"post","link":"https:\/\/www.johner-institut.de\/blog\/iec-62304-medizinische-software\/security-patch\/","title":{"rendered":"Security Patches – aus der regulatorischen Brille betrachtet"},"content":{"rendered":"\n

Unter einem Security Patch<\/strong> versteht man eine Nachbesserung an einer Software, um eine Sicherheitsl\u00fccke zu stopfen. F\u00fcr einen Security Patch gelten teilweise andere regulatorische Anforderungen als an andere Software Updates. Auf was Sie achten m\u00fcssen, erfahren Sie in diesem Beitrag.<\/p>\n\n\n\n\n\n\n\n

Security Patch<\/h2>\n\n\n\n

Definition<\/h3>\n\n\n\n

Eine etwas l\u00e4ngliche aber hilfreiche Definition des Begriffs stammt von der FDA<\/a>:<\/p>\n\n\n\n

\n
<\/i> Definition: Begriff<\/dfn><\/div>\n

\u201eCybersecurity \u201croutine updates and patches\u201d are updates or patches to a device to increase device security and\/or remediate vulnerabilities associated with controlled risk and not to reduce a risk to health or correct a violation of the FD&C Act. They include any regularly scheduled security updates or patches to a device, including upgrades to the software, firmware, programmable logic, hardware, or security of a device to increase device security as well as updates or patches to address vulnerabilities associated with controlled risk performed earlier than their regularly scheduled deployment cycle even if they are distributed to multiple units.\u201c<\/p>\n

Quelle: FDA Guidance „Postmarket Management of Cybersecurity in Medical Devices“<\/div>\n<\/div>\n\n\n\n

Abgrenzung von Security Patches und Software Updates<\/h3>\n\n\n\n

Ein Security Patch unterscheidet sich von einem „normalen“ Software Update, dadurch, dass er<\/p>\n\n\n\n