Process of designing robust, dependable, safe and secure software for medical devices: Point of care testing device as a case study

This article has been made available through the Brunel Open Access Publishing Fund.Copyright © 2013 Sivanesan Tulasidas et al. This paper presents a holistic methodology for the design of medical device software, which encompasses of a new way of eliciting requirements, system design process, security design guideline, cloud architecture design, combinatorial testing process and agile project management. The paper uses point of care diagnostics as a case study where the software and hardware must be robust, reliable to provide accurate diagnosis of diseases. As software and software intensive systems are becoming increasingly complex, the impact of failures can lead to significant property damage, or damage to the environment. Within the medical diagnostic device software domain such failures can result in misdiagnosis leading to clinical complications and in some cases death. Software faults can arise due to the interaction among the software, the hardware, third party software and the operating environment. Unanticipated environmental changes and latent coding errors lead to operation faults despite of the fact that usually a significant effort has been expended in the design, verification and validation of the software system. It is becoming increasingly more apparent that one needs to adopt different approaches, which will guarantee that a complex software system meets all safety, security, and reliability requirements, in addition to complying with standards such as IEC 62304. There are many initiatives taken to develop safety and security critical systems, at different development phases and in different contexts, ranging from infrastructure design to device design. Different approaches are implemented to design error free software for safety critical systems. By adopting the strategies and processes presented in this paper one can overcome the challenges in developing error free software for medical devices (or safety critical systems).Brunel Open Access Publishing Fund

Service Level Agreement-based GDPR Compliance and Security assurance in (multi)Cloud-based systems

Compliance with the new European General Data Protection Regulation (Regulation (EU) 2016/679) and security assurance are currently two major challenges of Cloud-based systems. GDPR compliance implies both privacy and security mechanisms definition, enforcement and control, including evidence collection. This paper presents a novel DevOps framework aimed at supporting Cloud consumers in designing, deploying and operating (multi)Cloud systems that include the necessary privacy and security controls for ensuring transparency to end-users, third parties in service provision (if any) and law enforcement authorities. The framework relies on the risk-driven specification at design time of privacy and security level objectives in the system Service Level Agreement (SLA) and in their continuous monitoring and enforcement at runtime.The research leading to these results has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 644429 and No 780351, MUSA project and ENACT project, respectively. We would also like to acknowledge all the members of the MUSA Consortium and ENACT Consortium for their valuable help

Architecture-based Qualitative Risk Analysis for Availability of IT Infrastructures

An IT risk assessment must deliver the best possible quality of results in a time-effective way. Organisations are used to customise the general-purpose standard risk assessment methods in a way that can satisfy their requirements. In this paper we present the QualTD Model and method, which is meant to be employed together with standard risk assessment methods for the qualitative assessment of availability risks of IT architectures, or parts of them. The QualTD Model is based on our previous quantitative model, but geared to industrial practice since it does not require quantitative data which is often too costly to acquire. We validate the model and method in a real-world case by performing a risk assessment on the authentication and authorisation system of a large multinational company and by evaluating the results w.r.t. the goals of the stakeholders of the system. We also perform a review of the most popular standard risk assessment methods and an analysis of which one can be actually integrated with our QualTD Model

MSUO Information Technology and Geographical Information Systems: Common Protocols & Procedures. Report to the Marine Safety Umbrella Operation

The Marine Safety Umbrella Operation (MSUO) facilitates the cooperation between Interreg funded Marine Safety Projects and maritime stakeholders. The main aim of MSUO is to permit efficient operation of new projects through Project Cooperation Initiatives, these include the review of the common protocols and procedures for Information Technology (IT) and Geographical Information Systems (GIS). This study carried out by CSA Group and the National Centre for Geocomputation (NCG) reviews current spatial information standards in Europe and the data management methodologies associated with different marine safety projects. International best practice was reviewed based on the combined experience of spatial data research at NCG and initiatives in the US, Canada and the UK relating to marine security service information and acquisition and integration of large marine datasets for ocean management purposes. This report identifies the most appropriate international data management practices that could be adopted for future MSUO projects

Performance-Based Financing: Report on Feasibility and Implementation Options Final September 2007

This study examines the feasibility of introducing a performance-related bonus scheme in the health sector. After describing the Tanzania health context, we define “Performance-Based Financing”, examine its rationale and review the evidence on its effectiveness. The following sections systematically assess the potential for applying the scheme in Tanzania. On the basis of risks and concerns identified, detailed design options and recommendations are set out. The report concludes with a (preliminary) indication of the costs of such a scheme and recommends a way forward for implementation. We prefer the name “Payment for Performance” or “P4P”. This is because what is envisaged is a bonus payment that is earned by meeting performance targets1. The dominant financing for health care delivery would remain grant-based as at present. There is a strong case for introducing P4P. Its main purpose will be to motivate front-line health workers to improve service delivery performance. In recent years, funding for council health services has increased dramatically, without a commensurate increase in health service output. The need to tighten focus on results is widely acknowledged. So too is the need to hold health providers more accountable for performance at all levels, form the local to the national. P4P is expected to encourage CHMTs and health facilities to “manage by results”; to identify and address local constraints, and to find innovative ways to raise productivity and reach under-served groups. As well as leveraging more effective use of all resources, P4P will provide a powerful incentive at all levels to make sure that HMIS information is complete, accurate and timely. It is expected to enhance accountability between health facilities and their managers / governing committees as well as between the Council Health Department and the Local Government Authority. Better performance-monitoring will enable the national level to track aggregate progress against goals and will assist in identifying under-performers requiring remedial action. We recommend a P4P scheme that provides a monetary team bonus, dependent on a whole facility reaching facility-specific service delivery targets. The bonus would be paid quarterly and shared equally among health staff. It should target all government health facilities at the council level, and should also reward the CHMT for “whole council” performance. All participating facilities/councils are therefore rewarded for improvement rather than absolute levels of performance. Performance indicators should not number more than 10, should represent a “balanced score card” of basic health service delivery, should present no risk of “perverse incentive” and should be readily measurable. The same set of indicators should be used by all. CHMTs would assist facilities in setting targets and monitoring performance. RHMTs would play a similar role with respect to CHMTs. The Council Health Administration would provide a “check and balance” to avoid target manipulation and verify bonus payments due. The major constraint on feasibility is the poor state of health information. Our study confirmed the findings of previous ones, observing substantial omission and error in reports from facilities to CHMTs. We endorse the conclusion of previous reviewers that the main problem lies not with HMIS design, but with its functioning. We advocate a particular focus on empowering and enabling the use of information for management by facilities and CHMTs. We anticipate that P4P, combined with a major effort in HMIS capacity building – at the facility and council level – will deliver dramatic improvements in data quality and completeness. We recommend that the first wave of participating councils are selected on the basis that they can first demonstrate robust and accurate data. We anticipate that P4P for facilities will not deliver the desired benefits unless they have a greater degree of control to solve their own problems. We therefore propose - as a prior and essential condition – the introduction of petty cash imprests for all health facilities. We believe that such a measure would bring major benefits even to facilities that have not yet started P4P. It should also empower Health Facility Committees to play a more meaningful role in health service governance at the local level. We recommend to Government that P4P bonuses, as described here, are implemented across Mainland Tanzania on a phased basis. The main constraint on the pace of roll-out is the time required to bring information systems up to standard. Councils that are not yet ready to institute P4P should get an equivalent amount of money – to be used as general revenue to finance their comprehensive council health plans. We also recommend that up-to-date reporting on performance against service delivery indicators is made a mandatory requirement for all councils and is also agreed as a standard requirement for the Joint Annual Health Sector Review. P4P can also be applied on the “demand-side” – for example to encourage women to present in case of obstetric emergencies. There is a strong empirical evidence base from other countries to demonstrate that such incentives can work. We recommend a separate policy decision on whether or not to introduce demand-side incentives. In our view, they are sufficiently promising to be tried out on an experimental basis. When taken to national scale (all councils, excepting higher level hospitals), the scheme would require annual budgetary provision of about 6 billion shillings for bonus payments. This is equivalent to 1% of the national health budget, or about 3% of budgetary resources for health at the council level. We anticipate that design and implementation costs would amount to about 5 billion shillings over 5 years – the majority of this being devoted to HMIS strengthening at the facility level across the whole country

The Federal Big Data Research and Development Strategic Plan

This document was developed through the contributions of the NITRD Big Data SSG members and staff. A special thanks and appreciation to the core team of editors, writers, and reviewers: Lida Beninson (NSF), Quincy Brown (NSF), Elizabeth Burrows (NSF), Dana Hunter (NSF), Craig Jolley (USAID), Meredith Lee (DHS), Nishal Mohan (NSF), Chloe Poston (NSF), Renata Rawlings-Goss (NSF), Carly Robinson (DOE Science), Alejandro Suarez (NSF), Martin Wiener (NSF), and Fen Zhao (NSF). A national Big Data1 innovation ecosystem is essential to enabling knowledge discovery from and confident action informed by the vast resource of new and diverse datasets that are rapidly becoming available in nearly every aspect of life. Big Data has the potential to radically improve the lives of all Americans. It is now possible to combine disparate, dynamic, and distributed datasets and enable everything from predicting the future behavior of complex systems to precise medical treatments, smart energy usage, and focused educational curricula. Government agency research and public-private partnerships, together with the education and training of future data scientists, will enable applications that directly benefit society and the economy of the Nation. To derive the greatest benefits from the many, rich sources of Big Data, the Administration announced a “Big Data Research and Development Initiative” on March 29, 2012.2 Dr. John P. Holdren, Assistant to the President for Science and Technology and Director of the Office of Science and Technology Policy, stated that the initiative “promises to transform our ability to use Big Data for scientific discovery, environmental and biomedical research, education, and national security.” The Federal Big Data Research and Development Strategic Plan (Plan) builds upon the promise and excitement of the myriad applications enabled by Big Data with the objective of guiding Federal agencies as they develop and expand their individual mission-driven programs and investments related to Big Data. The Plan is based on inputs from a series of Federal agency and public activities, and a shared vision: We envision a Big Data innovation ecosystem in which the ability to analyze, extract information from, and make decisions and discoveries based upon large, diverse, and real-time datasets enables new capabilities for Federal agencies and the Nation at large; accelerates the process of scientific discovery and innovation; leads to new fields of research and new areas of inquiry that would otherwise be impossible; educates the next generation of 21st century scientists and engineers; and promotes new economic growth. The Plan is built around seven strategies that represent key areas of importance for Big Data research and development (R&D). Priorities listed within each strategy highlight the intended outcomes that can be addressed by the missions and research funding of NITRD agencies. These include advancing human understanding in all branches of science, medicine, and security; ensuring the Nation’s continued leadership in research and development; and enhancing the Nation’s ability to address pressing societal and environmental issues facing the Nation and the world through research and development

The Federal Big Data Research and Development Strategic Plan

This document was developed through the contributions of the NITRD Big Data SSG members and staff. A special thanks and appreciation to the core team of editors, writers, and reviewers: Lida Beninson (NSF), Quincy Brown (NSF), Elizabeth Burrows (NSF), Dana Hunter (NSF), Craig Jolley (USAID), Meredith Lee (DHS), Nishal Mohan (NSF), Chloe Poston (NSF), Renata Rawlings-Goss (NSF), Carly Robinson (DOE Science), Alejandro Suarez (NSF), Martin Wiener (NSF), and Fen Zhao (NSF). A national Big Data1 innovation ecosystem is essential to enabling knowledge discovery from and confident action informed by the vast resource of new and diverse datasets that are rapidly becoming available in nearly every aspect of life. Big Data has the potential to radically improve the lives of all Americans. It is now possible to combine disparate, dynamic, and distributed datasets and enable everything from predicting the future behavior of complex systems to precise medical treatments, smart energy usage, and focused educational curricula. Government agency research and public-private partnerships, together with the education and training of future data scientists, will enable applications that directly benefit society and the economy of the Nation. To derive the greatest benefits from the many, rich sources of Big Data, the Administration announced a “Big Data Research and Development Initiative” on March 29, 2012.2 Dr. John P. Holdren, Assistant to the President for Science and Technology and Director of the Office of Science and Technology Policy, stated that the initiative “promises to transform our ability to use Big Data for scientific discovery, environmental and biomedical research, education, and national security.” The Federal Big Data Research and Development Strategic Plan (Plan) builds upon the promise and excitement of the myriad applications enabled by Big Data with the objective of guiding Federal agencies as they develop and expand their individual mission-driven programs and investments related to Big Data. The Plan is based on inputs from a series of Federal agency and public activities, and a shared vision: We envision a Big Data innovation ecosystem in which the ability to analyze, extract information from, and make decisions and discoveries based upon large, diverse, and real-time datasets enables new capabilities for Federal agencies and the Nation at large; accelerates the process of scientific discovery and innovation; leads to new fields of research and new areas of inquiry that would otherwise be impossible; educates the next generation of 21st century scientists and engineers; and promotes new economic growth. The Plan is built around seven strategies that represent key areas of importance for Big Data research and development (R&D). Priorities listed within each strategy highlight the intended outcomes that can be addressed by the missions and research funding of NITRD agencies. These include advancing human understanding in all branches of science, medicine, and security; ensuring the Nation’s continued leadership in research and development; and enhancing the Nation’s ability to address pressing societal and environmental issues facing the Nation and the world through research and development