Modern medical devices contain many software components and are growing exponentially in complexity. Medical device engineering has typically struggled to threat model while the practice has become standard procedure for software systems. To help solve the problem for their engineers, GE Healthcare created a template that combines the software and medical device threat modeling specifics together. Learning Objectives: 1: Understand the unique and common aspects of medical device technology. 2: See how to use a medical device threat model template. 3: Learn how the model presented may apply in any IoT environment. (Source: RSA Conference USA 2018)

1. SESSION ID:
#RSAC
Valery Berestetsky
MEDICAL DEVICE THREAT MODELING
WITH TEMPLATES
MBS-W12
Principal Product Security Leader
GE Healthcare
Jonathan Schaaf
Staff Product Security Analyst
GE Healthcare

2. # R S A C
Threat Modeling:
What Could Possibly Go Wrong?
2
Murphy’s law is not a curse,
it’s a design approach

3. # R S A C
Threat Modeling: Life Cycle
3
Model
Identify
Threats
Mitigate
Validate
Vision

4. # R S A C
Vision:
Software Applications vs Medical Devices
4
How is your product different?

5. # R S A C
Model: What’s Different?
5
How is your product different?

6. # R S A C
Model: What’s Different?
6
Medical Environment
How is your product different?
Web Application
Device
Control
Process
Sensor
Radiation
Source
Image
Repository

7. # R S A C
Identify Threats: Are We Covered with STRIDE?
7
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
Abuse
Patient Safety

8. # R S A C
There are tools for this!
8

9. # R S A C
Demo Time – Our Template
9

10. # R S A C
Summary
10
Threat modeling answers “What can
possibly go wrong?” question
If nothing else, threat model. Use
STRIDE (or another framework)
Tooling isn’t essential, but can make
life a lot easier

11. # R S A C
11
Anything can be threat modeled.
Ask “What can possibly go wrong?”
jonathan.p.schaaf@ge.com
valery.berestetsky@ge.com

12. # R S A C
Apply What You Have Learned Today
12
3 weeks: Familiarize yourself with threat
modeling; consider reading a book, downloading a
tool and make yourself familiar with it
6 weeks: get a customized template and build a
threat model with it
3 months: create your own template and submit to
the community!

13. # R S A C
Bibliography, References, and Suggested
Reading
13
“Whatever can go wrong, will go wrong,” by Nick T. Spark, ISBN 978-1411684690
“Threat Modeling: Designing for Security,” by Adam Shostack, ISBN 978-1118809990
Microsoft Threat Modeling Github: https://github.com/Microsoft/threat-modeling-templates
Existing NCC Group Automotive Threat Modeling Template
https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/july/the-automotive-threat-
modeling-template/
Image attributions:
XKCD number 319, https://xkcd.com/319/ Creative Commons BY-NC version 2.5
Microsoft Threat Modeling Tool
2016 Release: https://www.microsoft.com/en-us/download/details.aspx?id=49168
Preview Release https://aka.ms/tmtpreview, includes Microsoft Azure template