Do You Speak Cyber? Talking Security With Developers of Health Systems and Devices

Security and privacy concerns are vital in software for health-related applications. Yet often their development teams in small companies have little professional security support. To work effectively with them we should accept the complexity of their decision-making, create stories as a basis for discussion, and use different jargon from cyber-professionals. What is the Problem? Security and privacy are vital software properties, and critical in health-related devices and applications [40]. many cyber security practices can be poorly suited to modern agile development approaches and to systems involving many internet-accessible components [3], such as Health Internet of Things (HIoT) systems [8]. Further, the cost and lack of availability of cyber security professionals makes it unrealistic to have dedicated cyber security support in small companies. Instead, responsibility for security and privacy is typically delegated to non-security-specialist developers.