产品安全
In support of our mission to save and sustain lives, we take product security seriously.
跳转到
产品安全公告和其他资源
For the latest product security bulletins, please check our global website at http://www.baxter.com/product-security
-
请求文件
索取下列体育外围网站文件, click and submit your request along with your business contact information (i.e. Your Name, Role, Company, Address, Phone Number) or contact your Baxter service representative.
-
产品安全问题
Customers with a specific question about any Baxter product can reach out to (电子邮件保护) 或联系他们的体育外围网站服务代表.
-
全球隐私政策
体育外围网站建立了一个 全球隐私政策 以反映上述原则，这些原则是体育外围网站公司文化和运营的重要组成部分.
体育外围网站的协调漏洞披露流程
体育外围网站的使命是拯救和维持生命. 对我们的使命和战略至关重要, 我们致力于设计, 制造业, 维护医疗设备的安全. We also know that cybersecurity threats and vulnerabilities change rapidly. 因此, 我们致力于与安全研究人员社区合作，验证和响应合法漏洞，并要求研究人员参与我们负责任的报告流程，如下所述.
范围
体育外围网站为安全研究人员创建了这个协调的披露流程，以报告与体育外围网站商业产品相关的潜在漏洞. 本手册不用于提供有关体育外围网站产品的技术支持信息，也不用于报告不良事件或产品质量投诉. 所有这些其他事项，请访问我们的 体育外围网站 页面.
如何提交
If you have discovered a potential vulnerability related to a Baxter product, 我们希望您用英语与我们联系 (电子邮件保护). 请使用我们的 GPG (GnuPG)公钥.
请提供以下资料:
- 联系方式，以便我们与您取得联系. (姓名、单位、电邮地址及电话).
- 您是否认为多个供应商受到影响
- 漏洞被发现的时间和地点
- Technical description of the vulnerability and environment in which it was discovered
- Name, version, and configuration details of the affected product
- Specific impact and how you envision this vulnerability could be used in an attack
- Information about the tools and techniques you used to discover this vulnerability
- 任何概念证明或漏洞利用代码
- 漏洞被利用的任何迹象
- Prior or intended disclosure of vulnerability information to other parties (e.g. 监管机构、漏洞协调者、供应商)
Please do not include any personal information, such as sensitive/health information.
巴克斯特会怎么做
- 我们将在7天内确认收到报告.
- 我们将把报告升级到适当的团队，以验证和重现报告的漏洞. You may be contacted during this time to support our verification efforts.
- 我们将评估报告的漏洞，并进行风险分析，以确定采取适当的行动.
- 如果巴克斯特认为有必要披露此事, 我们将在此页面上发布通知, 并将其报告给适当的外部方，如网络应急响应小组(CERTs)和信息共享与分析组织(ISAOs)。.
安全研究人员的其他信息:
Please only conduct testing in secure environments, which comply with the following:
- 所有法律法规
- Avoiding any testing that could hurt patients, cause a privacy issue, or damage equipment
- Avoiding testing on devices in use or software that is in a production environment
- 避免采取行动利用任何漏洞
- Avoiding action that could make changes to a product or system after the test is completed
注意:
通过这个过程提交信息, you agree that it will be considered non-proprietary and non-confidential, 巴克斯特被允许以任何方式使用这些信息, 全部地或部分地, 没有任何限制. 您还同意，提交此类信息不会为您带来任何权利，也不会为体育外围网站带来任何义务.
专门小组
我们有一个专门的团队，致力于并热衷于确保足球外围最靠谱的网站在预期的临床使用中安全可靠. We have developed our products with cybersecurity controls integrated into the design, 使用医疗设备通用网络安全控制框架，该框架考虑了行业领先的标准, 规定, 指导文件. While we have focused resources on developing safe and secure products, we know that the cybersecurity threat landscape changes every day. Baxter prides itself on being responsive and transparent with our customers about cybersecurity.
我们很自豪拥有一支致力于产品安全的全球网络安全专业团队. Our team members are passionate about security and care about the safety of our patients. 有专门的资源来支持新产品的安全开发和我们现场设备的持续维护. 我们知道网络安全是一个充满活力的领域，我们致力于在整个产品生命周期中保护我们的患者.
我们为每个业务部门都有专门的业务信息安全官(BISO)而感到自豪. biso带来了丰富的经验和知识, to serve as a trusted advisor for our business and product leaders. This allows cybersecurity to be integrated into everything we do. 还有专门的网络安全工程师，在特定产品的开发过程中支持特定产品，以满足特定的产品安全需求. 最后但同样重要的, 我们有专门的资源来执行与我们高标准的产品风险管理相一致的全面的网络安全风险管理程序.
网络安全设计
We have proudly developed a Cybersecurity Common Controls Framework for Medical Devices (C3FMD). 网络安全通用控制框架(C3FMD)的目的是提供一个一致和通用的网络安全控制框架，以解决医疗器械设计和工程中的上述安全问题, 这是基于行业标准和最佳实践的, 其安全保障是否全面, and that addresses the demands of a rapidly evolving cybersecurity landscape. In the C3FMD, cybersecurity is driven first and foremost by patient health and safety concerns.
确保任何影响患者健康和安全的医疗设备的操作至关重要, 在保险箱中部署和管理, 安全可靠的方式. 该框架确保足球外围最靠谱的网站开发与医疗设备内置的网络安全功能一致. C3FMD covers the following key categories of controls: authentication, 授权, 访问控制, 审计, 和密码. 该框架是一套规定的基线网络安全控制措施，可增强安全态势并降低针对目标医疗设备的妥协风险.
响应 & 透明的
We are committed providing transparent information to our customers about product security. 为了共享信息, we provide a Manufacturer Disclosure Statement for Medical Device Security (MDS2), 来自国家电气制造商协会和医疗保健信息和管理系统协会, which contains important cybersecurity design features such as:
- 审计控制
- 授权
- 数据备份和容灾
- 侦测/防护恶意软件
- 系统与应用加固
- 传输机密性和完整性
除MDS2所提供的资料外, we provide cybersecurity information in our user manuals and customer communications. 如有任何进一步查询, customers can feel free to work with their sales or service representatives.
合作伙伴关系
The healthcare ecosystem is increasingly complex and interconnected. In order to protect patients and ensure our products are safe and secure, 整个医疗保健行业必须紧密合作. 实现更大的安全性, we value the relationships and partnerships it maintains across the healthcare ecosystem. We are proud of all the thought leaders that make up our product security team. 有几个组织与我们合作收集和共享网络信息，例如:
- National Health Information Sharing and Analysis Center (NH-ISAC)
- Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)
- 先进医疗技术协会(AdvaMed)
- Association for the Advancement of Medical Instrumentation (AAMI)
- 国土安全信息网络(HSIN)
- Medical Device Innovation, Safety, and Security Consortium (MDISS)
- 医疗器械安全信息共享委员会(MDSISC)
- 医疗器械创新联盟(MDIC)