medical device threat modeling with … · medical device threat modeling with templates. ......
TRANSCRIPT
![Page 1: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/1.jpg)
SESSION ID:
#RSAC
Valery Berestetsky
MEDICAL DEVICE THREAT MODELINGWITH TEMPLATES
MBS-W12
Principal Product Security LeaderGE Healthcare
Jonathan Schaaf
Staff Product Security AnalystGE Healthcare
![Page 2: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/2.jpg)
# R S A C
Threat Modeling: What Could Possibly Go Wrong?
2
Murphy’s law is not a curse, it’s a design approach
![Page 3: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/3.jpg)
# R S A C
Threat Modeling: Life Cycle
3
Model
Identify Threats
Mitigate
Validate
Vision
![Page 4: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/4.jpg)
# R S A C
Vision: Software Applications vs Medical Devices
4
How is your product different?
![Page 5: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/5.jpg)
# R S A C
Model: What’s Different?
5
How is your product different?
![Page 6: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/6.jpg)
# R S A C
Model: What’s Different?
6
Medical Environment
How is your product different?
Web Application
Device Control Process
Sensor
Radiation Source
Image Repository
![Page 7: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/7.jpg)
# R S A C
Identify Threats: Are We Covered with STRIDE?
7
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
Abuse
Patient Safety
![Page 8: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/8.jpg)
# R S A C
There are tools for this!
8
![Page 9: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/9.jpg)
# R S A C
Demo Time – Our Template
9
![Page 10: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/10.jpg)
# R S A C
Summary
10
Threat modeling answers “What can possibly go wrong?” questionIf nothing else, threat model. Use STRIDE (or another framework)Tooling isn’t essential, but can make life a lot easier
![Page 11: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/11.jpg)
# R S A C
11
Anything can be threat modeled. Ask “What can possibly go wrong?”
[email protected]@ge.com
![Page 12: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/12.jpg)
# R S A C
Apply What You Have Learned Today
12
3 weeks: Familiarize yourself with threat modeling; consider reading a book, downloading a tool and make yourself familiar with it6 weeks: get a customized template and build a threat model with it3 months: create your own template and submit to the community!
![Page 13: MEDICAL DEVICE THREAT MODELING WITH … · MEDICAL DEVICE THREAT MODELING WITH TEMPLATES. ... Software Applications vs Medical Devices 4 ... Image attributions: XKCD number 319,](https://reader035.vdocuments.mx/reader035/viewer/2022062306/5b79a47c7f8b9a703b8e0f31/html5/thumbnails/13.jpg)
# R S A C
Bibliography, References, and Suggested Reading
13
“Whatever can go wrong, will go wrong,” by Nick T. Spark, ISBN 978-1411684690
“Threat Modeling: Designing for Security,” by Adam Shostack, ISBN 978-1118809990
Microsoft Threat Modeling Github: https://github.com/Microsoft/threat-modeling-templates
Existing NCC Group Automotive Threat Modeling Templatehttps://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/july/the-automotive-threat-modeling-template/
Image attributions:XKCD number 319, https://xkcd.com/319/ Creative Commons BY-NC version 2.5
Microsoft Threat Modeling Tool2016 Release: https://www.microsoft.com/en-us/download/details.aspx?id=49168Preview Release https://aka.ms/tmtpreview, includes Microsoft Azure template