Medical Devices are getting increasingly complex.

We're now dealing with interconnected medical devices with tens of inputs, dozens of connections, and a plethora of connections. How can you handle security in this context?

Threat modeling is the process recommended by the FDA in which you discover vulnerabilities, respond to risks, and analyze your work. It's done in a 4 question framework:

1. What are we working on?
2. What can go wrong?
3. What are we going to do about it?
4. Did we do a good job?

To guide us through the intricacies of threat modeling, we have a true luminary in the field, Adam Shostack. Adam is the author of "Threat Modeling: Designing for Security" and "Threats: What Every Engineer Should Learn from Star Wars." He’s a leading expert on threat modeling, a consultant, expert witness, and game designer. With decades of experience delivering security, Adam's insights range from founding startups to nearly a decade at Microsoft.

What you'll understand after listening to the episode:

1. Threat modeling is built on simple questions. Ask them early in development when changes are easier to make.
2. Visibility is key. Start with simple whiteboard sketches to get everyone on the same page before moving to more formal diagrams.
3. Focus on practical solutions. Sometimes, redesigning to avoid problems entirely is better than trying to calculate and mitigate specific risks.

Want to dive even deeper into threat modeling and medical device cybersecurity?

🔹 Stay up-to-date with the latest in medical device cybersecurity with my weekly newsletter at⁠⁠cyberdoctornotes.com⁠⁠

🔹 Explore Adam's groundbreaking work on threat modeling at ⁠shostack.org

🔹 Read Adam's latest bookon Amazon

Please share with a fellow medical device security pioneer!

Securely yours,Cyber Doctor