[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"node-by-slug-\u002Fen\u002Finsights\u002Fcybersecurity-in-practice-en":3,"related-content-view-366-en":346},["Reactive",4],{"entity":5,"errors":-1},{"__typename":6,"status":7,"metatag":8,"id":202,"path":203,"hideNavigation":204,"title":205,"translations":206,"sharedHeaderRefMedia":210,"sharedTeaserTitle":13,"sharedTeaserText":234,"sharedTeaserRefMedia":236,"sharedParagraphs":238,"sharedTaxrefIndustries":337,"sharedTaxrefExpertises":341,"sharedIntroText":342,"sharedCtaLink":204,"sharedDate":344,"sharedAuthor":204},"NodeInsight",true,[9,14,18,21,25,30,34,38,42,46,50,54,58,62,66,69,73,76,79,81,84,87,91,95,99,103,107,111,115,119,123,127,131,135,139,142,145,148,151,154,157,160,163,166,170,174,177,181,185,189,193,196,200],{"tag":10,"attributes":11},"meta",{"name":12,"content":13},"title","Cybersecurity in practice",{"tag":10,"attributes":15},{"name":16,"content":17},"description","Ten years ago, probably the only kind of medical device network would have been the nurse call system. Today, both in hospitals and for home healthcare devices, it’s a very different picture.",{"tag":10,"attributes":19},{"name":20,"content":17},"abstract",{"tag":10,"attributes":22},{"name":23,"content":24},"icbm","51.525772, -0.082716",{"tag":26,"attributes":27},"link",{"rel":28,"href":29},"shortlink","https:\u002F\u002Fcms.zuehlke.com\u002Fapi\u002Fgraphql",{"tag":26,"attributes":31},{"rel":32,"href":33},"canonical","https:\u002F\u002Fcms.zuehlke.com\u002Fen\u002Finsights\u002Fcybersecurity-in-practice",{"tag":10,"attributes":35},{"name":36,"content":37},"robots","index, follow",{"tag":26,"attributes":39},{"rel":40,"href":41},"image_src","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Fmax_1300x1300\u002Fpublic\u002Fimages\u002Fcybersecurity-practice.jpg?itok=oucGzApJ,https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":43},{"name":44,"content":45},"referrer","unsafe-url",{"tag":10,"attributes":47},{"name":48,"content":49},"rights","Copyright ©2026 | Zühlke Engineering AG | All rights reserved.",{"tag":10,"attributes":51},{"property":52,"content":53},"og:site_name","Zühlke Engineering AG",{"tag":10,"attributes":55},{"property":56,"content":57},"og:type","website",{"tag":10,"attributes":59},{"property":60,"content":61},"og:url","https:\u002F\u002Fwww.zuehlke.com\u002Fen\u002Finsights\u002Fcybersecurity-in-practice",{"tag":10,"attributes":63},{"property":64,"content":65},"og:title","Cybersecurity in practice – Zühlke",{"tag":10,"attributes":67},{"property":68,"content":17},"og:description",{"tag":10,"attributes":70},{"property":71,"content":72},"og:image","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Fmax_1300x1300\u002Fpublic\u002Fimages\u002Fcybersecurity-practice.jpg?itok=oucGzApJ",{"tag":10,"attributes":74},{"property":71,"content":75},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":77},{"property":78,"content":72},"og:image:url",{"tag":10,"attributes":80},{"property":78,"content":75},{"tag":10,"attributes":82},{"property":83,"content":72},"og:image:secure_url",{"tag":10,"attributes":85},{"property":83,"content":86},"https:\u002F\u002Fwww.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":88},{"property":89,"content":90},"og:updated_time","2025-11-20",{"tag":10,"attributes":92},{"property":93,"content":94},"og:image:alt","image",{"tag":10,"attributes":96},{"property":97,"content":98},"place:location:latitude","46.947944",{"tag":10,"attributes":100},{"property":101,"content":102},"place:location:longitude","7.438014",{"tag":10,"attributes":104},{"property":105,"content":106},"og:street_address","80 Great Eastern Street",{"tag":10,"attributes":108},{"property":109,"content":110},"og:locality","London",{"tag":10,"attributes":112},{"property":113,"content":114},"og:region","England",{"tag":10,"attributes":116},{"property":117,"content":118},"og:postal_code","EC2A 3JL",{"tag":10,"attributes":120},{"property":121,"content":122},"og:country_name","United Kingdom",{"tag":10,"attributes":124},{"property":125,"content":126},"og:email","london@zuhlke.com",{"tag":10,"attributes":128},{"property":129,"content":130},"og:phone_number","+44 20 7113 5000",{"tag":10,"attributes":132},{"property":133,"content":134},"og:locale","en_CH",{"tag":10,"attributes":136},{"property":137,"content":138},"og:locale:alternate","de_CH",{"tag":10,"attributes":140},{"property":137,"content":141},"de_DE",{"tag":10,"attributes":143},{"property":137,"content":144},"en_DE",{"tag":10,"attributes":146},{"property":137,"content":147},"en_AT",{"tag":10,"attributes":149},{"property":137,"content":150},"de_AT",{"tag":10,"attributes":152},{"property":137,"content":153},"en_HK",{"tag":10,"attributes":155},{"property":137,"content":156},"en_SR",{"tag":10,"attributes":158},{"property":137,"content":159},"en_BG",{"tag":10,"attributes":161},{"property":137,"content":162},"en_SG",{"tag":10,"attributes":164},{"property":137,"content":165},"en_GB",{"tag":10,"attributes":167},{"property":168,"content":169},"article:publisher","https:\u002F\u002Fwww.facebook.com\u002Fzuehlke.group",{"tag":10,"attributes":171},{"property":172,"content":173},"article:published_time","2020-05-28",{"tag":10,"attributes":175},{"property":176,"content":90},"article:modified_time",{"tag":10,"attributes":178},{"name":179,"content":180},"twitter:card","summary_large_image",{"tag":10,"attributes":182},{"name":183,"content":184},"twitter:site","@zuehlke_group",{"tag":10,"attributes":186},{"name":187,"content":188},"twitter:site:id","247189965",{"tag":10,"attributes":190},{"name":191,"content":192},"twitter:image","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Fmax_1300x1300\u002Fpublic\u002Fimages\u002Fcybersecurity-practice.jpg?itok=oucGzApJ,https:\u002F\u002Fwww.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fzuhlke_innovation_social.jpg",{"tag":10,"attributes":194},{"name":195,"content":94},"twitter:image:alt",{"tag":10,"attributes":197},{"name":198,"content":199},"google-site-verification","VEzolc1Vxy1KyRIlIqUSmVS7fqP_3_ZeBqPRby4g2mE",{"tag":201},"script","366","\u002Fen\u002Finsights\u002Fcybersecurity-in-practice",null,"Cybersecurity in practice ",[207],{"path":203,"langcode":208},{"id":209},"en",{"id":211,"sharedMediaLegend":204,"mediaImage":212,"name":233},"903",{"url":213,"width":214,"height":215,"alt":216,"title":204,"size":217,"mime":218,"variations":204,"headerMinimalVariations":219},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Fcybersecurity-practice.jpg",693,520,"Cybersecurity medical software",247086,"image\u002Fjpeg",[220,224,225,229,232],{"name":221,"url":222,"width":214,"height":223},"FOCAL_POINT32_SMALL","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002Fcybersecurity-practice.jpg.webp?itok=rSEk_sTL",462,{"name":221,"url":222,"width":214,"height":223},{"name":226,"url":227,"width":214,"height":228},"FOCAL_POINT169_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_16_9_medium\u002Fpublic\u002Fimages\u002Fcybersecurity-practice.jpg.webp?itok=_7D706v9",390,{"name":230,"url":231,"width":214,"height":228},"FOCAL_POINT169_LARGE","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_16_9_large\u002Fpublic\u002Fimages\u002Fcybersecurity-practice.jpg.webp?itok=Z5m4flrj",{"name":230,"url":231,"width":214,"height":228},"cybersecurity-practice.jpg",{"processed":235},"\u003Cp>Ten years ago, probably the only kind of medical device network would have been the nurse call system. Today, both in hospitals and for home healthcare devices, it’s a very different picture.\u003C\u002Fp>",{"id":211,"sharedMediaLegend":204,"mediaImage":237,"name":233},{"url":213,"width":214,"height":215,"alt":216,"title":204,"size":217,"mime":218,"variations":204},[239,246,251,279,284,290,296,321,326,331],{"__typename":240,"id":241,"ctaLink":204,"pgSharedText":242,"pgSharedTitle":204,"pgSharedCtaLink":204},"ParagraphPgText","23070",{"value":243,"processed":244,"format":245},"\u003Cul>\r\n\t\u003Cli>\r\n\t\u003Cp class=\"text-lead\">Medical Device cybersecurity and Safety go hand-in-hand.\u003C\u002Fp>\r\n\t\u003C\u002Fli>\r\n\t\u003Cli>\r\n\t\u003Cp class=\"text-lead\">Growing demand for up-to-date methods in security audits.\u003C\u002Fp>\r\n\t\u003C\u002Fli>\r\n\t\u003Cli>\r\n\t\u003Cp class=\"text-lead\">Our approach: Five steps to cybersecurity.\u003C\u002Fp>\r\n\t\u003C\u002Fli>\r\n\u003C\u002Ful>\r\n","\u003Cul>\n\t\u003Cli>\n\t\u003Cp class=\"text-lead\">Medical Device cybersecurity and Safety go hand-in-hand.\u003C\u002Fp>\n\t\u003C\u002Fli>\n\t\u003Cli>\n\t\u003Cp class=\"text-lead\">Growing demand for up-to-date methods in security audits.\u003C\u002Fp>\n\t\u003C\u002Fli>\n\t\u003Cli>\n\t\u003Cp class=\"text-lead\">Our approach: Five steps to cybersecurity.\u003C\u002Fp>\n\t\u003C\u002Fli>\n\u003C\u002Ful>","full_html",{"__typename":240,"id":247,"ctaLink":204,"pgSharedText":248,"pgSharedTitle":204,"pgSharedCtaLink":204},"9830",{"value":249,"processed":250,"format":245},"\u003Cp>Ten years ago, probably the only kind of medical device network would have been the nurse call system. Today, both in hospitals and for home healthcare devices, it’s a very different picture.\u003C\u002Fp>\r\n\r\n\u003Cp>More and more devices are connecting to the same shared networks, and with an increasingly broad range of interfaces and data, basic IT security is becoming ever more important. Cybersecurity is now a key part of medical device development.\u003C\u002Fp>\r\n","\u003Cp>Ten years ago, probably the only kind of medical device network would have been the nurse call system. Today, both in hospitals and for home healthcare devices, it’s a very different picture.\u003C\u002Fp>\n\n\u003Cp>More and more devices are connecting to the same shared networks, and with an increasingly broad range of interfaces and data, basic IT security is becoming ever more important. Cybersecurity is now a key part of medical device development.\u003C\u002Fp>",{"__typename":252,"id":253,"caption":204,"imageRight":204,"pgSharedTitle":254,"pgSharedCtaLink":204,"textMedia":255,"pgSharedText":276},"ParagraphPgTextMedia","416","Why is cybersecurity so important for the medical device sector?",{"id":256,"sharedMediaLegend":204,"mediaImage":257,"name":275},"91",{"url":258,"width":259,"height":260,"alt":261,"title":204,"size":262,"mime":218,"variations":204,"textMediaVariations":263},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Finterrelationship-between-security-and-safety-risk-management-processes_0.jpg",922,588," Interrelationship between security and safety risk management processes",120362,[264,269,270,271,274],{"name":265,"url":266,"width":267,"height":268},"FIXED_WIDTH_SMALL","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_small\u002Fpublic\u002Fimages\u002Finterrelationship-between-security-and-safety-risk-management-processes_0.jpg.webp?itok=ObPLNsOO",900,574,{"name":265,"url":266,"width":267,"height":268},{"name":265,"url":266,"width":267,"height":268},{"name":272,"url":273,"width":259,"height":260},"FIXED_WIDTH_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_medium\u002Fpublic\u002Fimages\u002Finterrelationship-between-security-and-safety-risk-management-processes_0.jpg.webp?itok=72N7Le_w",{"name":272,"url":273,"width":259,"height":260},"interrelationship-between-security-and-safety-risk-management-processes_0.jpg",{"value":277,"processed":278,"format":245},"\u003Cp>• More devices mean more connectivity\u003Cbr \u002F>\r\n• More data interfaces mean more attack surfaces\u003Cbr \u002F>\r\n• Public awareness of IT risks is leading to greater regulation\u003Cbr \u002F>\r\n• New technology is resulting in more complexity\u003Cbr \u002F>\r\n\u003Cbr \u002F>\r\nThe threat to medical device systems from hackers and other bad actors is becoming ever more acute. There are a number of standards dealing with medical device security, but each tackles the issue from specific angles only. The ISO 27000 series of standards, Common Criteria and OWASP, for example, deal with technical and organisational measures for improving the security of IT systems. These standards do not look at the specific case of medical devices, in particular they do not consider the impact of cybersecurity on safety. ISO 80001 is limited to managing risks relating to the networks used by medical devices. AAMI Technical Report TIR 57, however, offers a combined security and safety risk management procedure specifically for medical devices (see figure 1). Safety management, in particular documenting product safety, is a key issue in medical device development.\u003Cbr \u002F>\r\n\u003Cbr \u002F>\r\nThe\u003Cstrong> foreword to AAMI Technical Report TIR 57\u003C\u002Fstrong> neatly illustrates the interrelationship between safety and security: \u003Cem>“The objective of this TIR is to provide guidance on how medical device manufacturers can manage risks from security threats that could impact the confidentiality, integrity, and\u002For availability of the device or the information processed by the device.”\u003C\u002Fem>\u003C\u002Fp>\r\n","\u003Cp>• More devices mean more connectivity\u003Cbr>\n• More data interfaces mean more attack surfaces\u003Cbr>\n• Public awareness of IT risks is leading to greater regulation\u003Cbr>\n• New technology is resulting in more complexity\u003Cbr>\n\u003Cbr>\nThe threat to medical device systems from hackers and other bad actors is becoming ever more acute. There are a number of standards dealing with medical device security, but each tackles the issue from specific angles only. The ISO 27000 series of standards, Common Criteria and OWASP, for example, deal with technical and organisational measures for improving the security of IT systems. These standards do not look at the specific case of medical devices, in particular they do not consider the impact of cybersecurity on safety. ISO 80001 is limited to managing risks relating to the networks used by medical devices. AAMI Technical Report TIR 57, however, offers a combined security and safety risk management procedure specifically for medical devices (see figure 1). Safety management, in particular documenting product safety, is a key issue in medical device development.\u003Cbr>\n\u003Cbr>\nThe\u003Cstrong> foreword to AAMI Technical Report TIR 57\u003C\u002Fstrong> neatly illustrates the interrelationship between safety and security: \u003Cem>“The objective of this TIR is to provide guidance on how medical device manufacturers can manage risks from security threats that could impact the confidentiality, integrity, and\u002For availability of the device or the information processed by the device.”\u003C\u002Fem>\u003C\u002Fp>",{"__typename":240,"id":280,"ctaLink":204,"pgSharedText":281,"pgSharedTitle":204,"pgSharedCtaLink":204},"420",{"value":282,"processed":283,"format":245},"\u003Cp>TIR 57 offers a recognised process framework for managing security risks in the specific context of medical devices (AAMI TIR 57, FDA Recognition Number 13-83, published June 27, 2016). Given the fast-paced IT sector, the TIR 57 doesn’t specify concrete methods for security analysis or security measures. Whilst a variety of standardised approaches have been developed for industries ranging from air travel to IT services, there are none for the medical technology sector. It’s a similar picture when it comes to device safety. Here at Zühlke we have therefore developed a cybersecurity management toolkit specifically designed for medical device development. Our approach is based on IT best practices, the Common Criteria (ISO\u002FIEC 15408) and AAMI TIR 57.\u003C\u002Fp>\r\n","\u003Cp>TIR 57 offers a recognised process framework for managing security risks in the specific context of medical devices (AAMI TIR 57, FDA Recognition Number 13-83, published June 27, 2016). Given the fast-paced IT sector, the TIR 57 doesn’t specify concrete methods for security analysis or security measures. Whilst a variety of standardised approaches have been developed for industries ranging from air travel to IT services, there are none for the medical technology sector. It’s a similar picture when it comes to device safety. Here at Zühlke we have therefore developed a cybersecurity management toolkit specifically designed for medical device development. Our approach is based on IT best practices, the Common Criteria (ISO\u002FIEC 15408) and AAMI TIR 57.\u003C\u002Fp>",{"__typename":240,"id":285,"ctaLink":204,"pgSharedText":286,"pgSharedTitle":289,"pgSharedCtaLink":204},"421",{"value":287,"processed":288,"format":245},"\u003Cp>Our procedure for cybersecurity management is designed so that it can be applied early in the project cycle and so that results can be incrementally completed. As development progresses, the security concept (see below) matures in tandem with the product. It allows factors relating to security to be identified, analysed and monitored at each phase of the software life cycle:\u003C\u002Fp>\r\n\r\n\u003Cp>• starting with the product vision\u003Cbr \u002F>\r\n• during elicitation of user needs\u003Cbr \u002F>\r\n• during technical requirements engineering\u003Cbr \u002F>\r\n• during implementation\u003Cbr \u002F>\r\n• during unit and integration testing\u003Cbr \u002F>\r\n• during rollout planning\u003Cbr \u002F>\r\n• during operational support and monitoring\u003C\u002Fp>\r\n\r\n\u003Cp>The key document for managing cybersecurity activities is the security risk management plan. This is drafted early in the project cycle and updated regularly. The procedural model set out in the security risk management plan can be tailored to the development project as required.\u003Cbr \u002F>\r\n\u003Cbr \u002F>\r\nInitial security analysis identifies key application-specific assets and vulnerabilities based on the system context, external interfaces and intended use. As the project progresses, security analysis becomes more concerned with technical details. Technical details become more important once we reach the point of analysing the solution architecture and key system components such as libraries and connectivity. Once the implementation stage is reached, security analysis remains an important element for identifying vulnerabilities and changes. Security analysis also includes ongoing penetration testing during the development process.\u003C\u002Fp>\r\n","\u003Cp>Our procedure for cybersecurity management is designed so that it can be applied early in the project cycle and so that results can be incrementally completed. As development progresses, the security concept (see below) matures in tandem with the product. It allows factors relating to security to be identified, analysed and monitored at each phase of the software life cycle:\u003C\u002Fp>\n\n\u003Cp>• starting with the product vision\u003Cbr>\n• during elicitation of user needs\u003Cbr>\n• during technical requirements engineering\u003Cbr>\n• during implementation\u003Cbr>\n• during unit and integration testing\u003Cbr>\n• during rollout planning\u003Cbr>\n• during operational support and monitoring\u003C\u002Fp>\n\n\u003Cp>The key document for managing cybersecurity activities is the security risk management plan. This is drafted early in the project cycle and updated regularly. The procedural model set out in the security risk management plan can be tailored to the development project as required.\u003Cbr>\n\u003Cbr>\nInitial security analysis identifies key application-specific assets and vulnerabilities based on the system context, external interfaces and intended use. As the project progresses, security analysis becomes more concerned with technical details. Technical details become more important once we reach the point of analysing the solution architecture and key system components such as libraries and connectivity. Once the implementation stage is reached, security analysis remains an important element for identifying vulnerabilities and changes. Security analysis also includes ongoing penetration testing during the development process.\u003C\u002Fp>","Cybersecurity management and the software development life cycle",{"__typename":240,"id":291,"ctaLink":204,"pgSharedText":292,"pgSharedTitle":295,"pgSharedCtaLink":204},"422",{"value":293,"processed":294,"format":245},"\u003Cp>\u003Cstrong>• Security concept:\u003C\u002Fstrong> A combination of underlying assumptions, constraints and policies affecting IT security, plus constructive security measures for the product\u003Cbr \u002F>\r\n\u003Cstrong>• Security analysis\u003C\u002Fstrong>\u003Cbr \u002F>\r\n\u003Cstrong>• Vulnerability analysi\u003C\u002Fstrong>s of the tools and libraries used\u003Cbr \u002F>\r\n\u003Cstrong>• Retirement plan\u003C\u002Fstrong>: Policy for archiving and deleting data (taking into account any legal requirements)\u003Cbr \u002F>\r\n\u003Cstrong>• Final report\u003C\u002Fstrong> on and \u003Cstrong>evaluation\u003C\u002Fstrong> of cybersecurity.\u003C\u002Fp>\r\n","\u003Cp>\u003Cstrong>• Security concept:\u003C\u002Fstrong> A combination of underlying assumptions, constraints and policies affecting IT security, plus constructive security measures for the product\u003Cbr>\n\u003Cstrong>• Security analysis\u003C\u002Fstrong>\u003Cbr>\n\u003Cstrong>• Vulnerability analysi\u003C\u002Fstrong>s of the tools and libraries used\u003Cbr>\n\u003Cstrong>• Retirement plan\u003C\u002Fstrong>: Policy for archiving and deleting data (taking into account any legal requirements)\u003Cbr>\n\u003Cstrong>• Final report\u003C\u002Fstrong> on and \u003Cstrong>evaluation\u003C\u002Fstrong> of cybersecurity.\u003C\u002Fp>","Cybersecurity activities give rise to the following documentation:",{"__typename":252,"id":297,"caption":204,"imageRight":204,"pgSharedTitle":298,"pgSharedCtaLink":204,"textMedia":299,"pgSharedText":318},"423","Five steps to better cybersecurity",{"id":300,"sharedMediaLegend":204,"mediaImage":301,"name":317},"94",{"url":302,"width":303,"height":304,"alt":305,"title":204,"size":306,"mime":218,"variations":204,"textMediaVariations":307},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002F5-steps-to-better-cybersecurity.jpg",2048,1306,"Five steps that lead to a better cyber security",71080,[308,310,311,312,316],{"name":265,"url":309,"width":267,"height":268},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_small\u002Fpublic\u002Fimages\u002F5-steps-to-better-cybersecurity.jpg.webp?itok=_czRLq5O",{"name":265,"url":309,"width":267,"height":268},{"name":265,"url":309,"width":267,"height":268},{"name":272,"url":313,"width":314,"height":315},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffixed_width_medium\u002Fpublic\u002Fimages\u002F5-steps-to-better-cybersecurity.jpg.webp?itok=s4jlitfK",1200,765,{"name":272,"url":313,"width":314,"height":315},"5-steps-to-better-cybersecurity.jpg",{"value":319,"processed":320,"format":245},"\u003Cp>For cybersecurity analysis, we use an incremental five-step iterative model. It can be used to perform initial analysis as early as the project definition phase – even where only a few key functions have been identified, the overall scope is still under discussion and technical details are still largely up in the air. Our model is also excellent for producing a lightweight review of the security concept in ongoing projects.\u003C\u002Fp>\r\n","\u003Cp>For cybersecurity analysis, we use an incremental five-step iterative model. It can be used to perform initial analysis as early as the project definition phase – even where only a few key functions have been identified, the overall scope is still under discussion and technical details are still largely up in the air. Our model is also excellent for producing a lightweight review of the security concept in ongoing projects.\u003C\u002Fp>",{"__typename":240,"id":322,"ctaLink":204,"pgSharedText":323,"pgSharedTitle":204,"pgSharedCtaLink":204},"424",{"value":324,"processed":325,"format":245},"\u003Cp>1. Define assets\u003Cbr \u002F>\r\n2. Identify potential threats\u003Cbr \u002F>\r\n3. Analyse attack scenarios\u003Cbr \u002F>\r\n4. Define security measures and security objectives\u003Cbr \u002F>\r\n5. Detail intrinsic security measures (security requirements)\u003C\u002Fp>\r\n\r\n\u003Cp>These five steps iterate throughout the project, leading to an increasing level of detail as the project progresses.\u003C\u002Fp>\r\n","\u003Cp>1. Define assets\u003Cbr>\n2. Identify potential threats\u003Cbr>\n3. Analyse attack scenarios\u003Cbr>\n4. Define security measures and security objectives\u003Cbr>\n5. Detail intrinsic security measures (security requirements)\u003C\u002Fp>\n\n\u003Cp>These five steps iterate throughout the project, leading to an increasing level of detail as the project progresses.\u003C\u002Fp>",{"__typename":240,"id":327,"ctaLink":204,"pgSharedText":328,"pgSharedTitle":204,"pgSharedCtaLink":204},"426",{"value":329,"processed":330,"format":245},"\u003Cp>\u003Cstrong>Assets:\u003C\u002Fstrong>\u003Cbr \u002F>\r\nA list of assets represents the starting point for security analysis. Assets are those data, functions or properties of a system that need protecting. Sources for identifying assets include lists of data items, performance requirements (such as system availability), or things which the product owner believes should be encrypted. Significant new assets will usually be added to the system during development and when adding new features to the system. These assets then need to be analysed and the steps below repeated. When identifying assets, a defined taxonomy can help to ensure that common function types are not overlooked.\u003C\u002Fp>\r\n\r\n\u003Cp>\u003Cstrong>Threats:\u003C\u002Fstrong>\u003Cbr \u002F>\r\nSimilar to an FMEA, which considers specific error scenarios (failure, incorrect results, delayed results), threat analysis looks at a range of typical attack scenarios for each asset. Microsoft published its STRIDE model for threat analysis in 2005 (see the article “\u003Ca href=\"https:\u002F\u002Fdocs.microsoft.com\u002Fde-de\u002Fprevious-versions\u002Ftechnical-content\u002Fcc405496(v=msdn.10)?redirectedfrom=MSDN\" target=\"_blank\">Sicherheit ist Risikomanagement\u003C\u002Fa>” – only available in German):\u003C\u002Fp>\r\n\r\n\u003Cp>The acronym STRIDE relates to the following six attack scenarios:\u003C\u002Fp>\r\n\r\n\u003Cul>\r\n\t\u003Cli>Spoofing of identity\u003C\u002Fli>\r\n\t\u003Cli>Tampering of data\u003C\u002Fli>\r\n\t\u003Cli>Repudiation\u003C\u002Fli>\r\n\t\u003Cli>Information disclosure\u003C\u002Fli>\r\n\t\u003Cli>Denial of service\u003C\u002Fli>\r\n\t\u003Cli>Elevation of privilege\u003C\u002Fli>\r\n\u003C\u002Ful>\r\n\r\n\u003Cp>Detailed descriptions of these six categories can be found online – see for example this \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fsecurity\u002Fblog\u002F2007\u002F09\u002F11\u002Fstride-chart\u002F\" target=\"_blank\">STRIDE chart on the Microsoft blog\u003C\u002Fa>.\u003C\u002Fp>\r\n\r\n\u003Cp>\u003Cstrong>Threat anaylsis:\u003C\u002Fstrong>\u003Cbr \u002F>\r\nDetailed threat analysis involves examining potential attack scenarios relating to the various threats. What potentially exploitable vulnerabilities are there in the system? Once these have been described, they can then be assessed. Assessing how critical they are involves looking both at the consequences of an exploit and at the exploit likelihood. From this it is possible to determine the magnitude of the security risk and to decide whether further action needs to be taken.\u003Cbr \u002F>\r\n\u003Cbr \u002F>\r\nOrdinarily, security analysis is principally concerned with avoiding financial losses. For medical applications, however, it’s important that we do not lose sight of the patient. A key question for threat analysis, therefore, is: could an attack impact patient safety? If the answer to this question is yes, this needs to be dealt with in the safety analysis.\u003C\u002Fp>\r\n\r\n\u003Cp>\u003Cstrong>Security objectives:\u003C\u002Fstrong>\u003Cbr \u002F>\r\nSecurity objectives describe actions and objectives for countering threats. Security objectives can relate to the system itself or the system environment. Examples of system-related objectives include signatures for firmware updates or secure cryptographic key storage. Implementation of these system-related objectives involves determining security requirements.\u003C\u002Fp>\r\n\r\n\u003Cp>\u003Cstrong>Security requirements:\u003C\u002Fstrong>\u003Cbr \u002F>\r\nSecurity requirements are based on system objectives and describe specific additional functions which the product under development needs to include. In the above example, this might mean specifying the signature procedure and defining requirements for the Trusted Platform Module. Security requirements are fed into the requirements management system and traced as per the process specifications. With this, the planned verification procedures can also be documented.\u003C\u002Fp>\r\n","\u003Cp>\u003Cstrong>Assets:\u003C\u002Fstrong>\u003Cbr>\nA list of assets represents the starting point for security analysis. Assets are those data, functions or properties of a system that need protecting. Sources for identifying assets include lists of data items, performance requirements (such as system availability), or things which the product owner believes should be encrypted. Significant new assets will usually be added to the system during development and when adding new features to the system. These assets then need to be analysed and the steps below repeated. When identifying assets, a defined taxonomy can help to ensure that common function types are not overlooked.\u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>Threats:\u003C\u002Fstrong>\u003Cbr>\nSimilar to an FMEA, which considers specific error scenarios (failure, incorrect results, delayed results), threat analysis looks at a range of typical attack scenarios for each asset. Microsoft published its STRIDE model for threat analysis in 2005 (see the article “\u003Ca href=\"https:\u002F\u002Fdocs.microsoft.com\u002Fde-de\u002Fprevious-versions\u002Ftechnical-content\u002Fcc405496(v=msdn.10)?redirectedfrom=MSDN\" target=\"_blank\">Sicherheit ist Risikomanagement\u003C\u002Fa>” – only available in German):\u003C\u002Fp>\n\n\u003Cp>The acronym STRIDE relates to the following six attack scenarios:\u003C\u002Fp>\n\n\u003Cul>\n\t\u003Cli>Spoofing of identity\u003C\u002Fli>\n\t\u003Cli>Tampering of data\u003C\u002Fli>\n\t\u003Cli>Repudiation\u003C\u002Fli>\n\t\u003Cli>Information disclosure\u003C\u002Fli>\n\t\u003Cli>Denial of service\u003C\u002Fli>\n\t\u003Cli>Elevation of privilege\u003C\u002Fli>\n\u003C\u002Ful>\n\n\u003Cp>Detailed descriptions of these six categories can be found online – see for example this \u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fsecurity\u002Fblog\u002F2007\u002F09\u002F11\u002Fstride-chart\u002F\" target=\"_blank\">STRIDE chart on the Microsoft blog\u003C\u002Fa>.\u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>Threat anaylsis:\u003C\u002Fstrong>\u003Cbr>\nDetailed threat analysis involves examining potential attack scenarios relating to the various threats. What potentially exploitable vulnerabilities are there in the system? Once these have been described, they can then be assessed. Assessing how critical they are involves looking both at the consequences of an exploit and at the exploit likelihood. From this it is possible to determine the magnitude of the security risk and to decide whether further action needs to be taken.\u003Cbr>\n\u003Cbr>\nOrdinarily, security analysis is principally concerned with avoiding financial losses. For medical applications, however, it’s important that we do not lose sight of the patient. A key question for threat analysis, therefore, is: could an attack impact patient safety? If the answer to this question is yes, this needs to be dealt with in the safety analysis.\u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>Security objectives:\u003C\u002Fstrong>\u003Cbr>\nSecurity objectives describe actions and objectives for countering threats. Security objectives can relate to the system itself or the system environment. Examples of system-related objectives include signatures for firmware updates or secure cryptographic key storage. Implementation of these system-related objectives involves determining security requirements.\u003C\u002Fp>\n\n\u003Cp>\u003Cstrong>Security requirements:\u003C\u002Fstrong>\u003Cbr>\nSecurity requirements are based on system objectives and describe specific additional functions which the product under development needs to include. In the above example, this might mean specifying the signature procedure and defining requirements for the Trusted Platform Module. Security requirements are fed into the requirements management system and traced as per the process specifications. With this, the planned verification procedures can also be documented.\u003C\u002Fp>",{"__typename":240,"id":332,"ctaLink":204,"pgSharedText":333,"pgSharedTitle":336,"pgSharedCtaLink":204},"427",{"value":334,"processed":335,"format":245},"\u003Cp>As with safety analysis also in cybersecurity management new functions of devices can again throw up new assets and attack scenarios. Consequently, security analysis should not be a one-time event, but should be performed repeatedly.\u003Cbr \u002F>\r\n\u003Cbr \u002F>\r\nThis systematic approach to cybersecurity management delivers a comprehensive security concept which is in full compliance with regulatory requirements. Requirements tracing and the integration with safety analysis are easily incorporated into existing development processes. By feeding security requirements into system design at an early stage, the risk of being forced to make time-consuming changes late in the project is minimised.\u003C\u002Fp>\r\n","\u003Cp>As with safety analysis also in cybersecurity management new functions of devices can again throw up new assets and attack scenarios. Consequently, security analysis should not be a one-time event, but should be performed repeatedly.\u003Cbr>\n\u003Cbr>\nThis systematic approach to cybersecurity management delivers a comprehensive security concept which is in full compliance with regulatory requirements. Requirements tracing and the integration with safety analysis are easily incorporated into existing development processes. By feeding security requirements into system design at an early stage, the risk of being forced to make time-consuming changes late in the project is minimised.\u003C\u002Fp>","A comprehensive approach to cybersecurity",[338],{"id":339,"name":340},"13","MedTech",[],{"processed":343},"\u003Cp>More and more devices are connecting to the same shared networks, and with an increasingly broad range of interfaces and data, basic IT security is becoming ever more important. Cybersecurity is now a key part of medical device development.\u003C\u002Fp>",{"timestamp":345},1543320000,[347,400,427,452],{"id":348,"path":349,"sharedTeaserTitle":350,"sharedTeaserRefMedia":351,"sharedTaxrefIndustries":371,"sharedTaxrefExpertises":375},"26408","\u002Fen\u002Finsights\u002Fhannover-messe-2025-is-ai-enough-to-future-proof-the-industrial-sector","Hannover Messe 2025: What’s driving the industrial sector?",{"id":352,"sharedMediaLegend":204,"mediaImage":353,"name":370},"171446",{"url":354,"width":355,"height":356,"alt":357,"title":204,"size":358,"mime":218,"variations":204,"relatedContentVariations":359},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002FHeader.Minimal-Industrial-Tool-Operated-by-AI.jpg",1920,1617,"\"\"",262396,[360,364,365,368,369],{"name":221,"url":361,"width":362,"height":363},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002FHeader.Minimal-Industrial-Tool-Operated-by-AI.jpg.webp?itok=gEKixBZw",800,533,{"name":221,"url":361,"width":362,"height":363},{"name":366,"url":367,"width":314,"height":362},"FOCAL_POINT32_MEDIUM","https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_medium\u002Fpublic\u002Fimages\u002FHeader.Minimal-Industrial-Tool-Operated-by-AI.jpg.webp?itok=yPpNgEwo",{"name":366,"url":367,"width":314,"height":362},{"name":366,"url":367,"width":314,"height":362},"Header.Minimal-Industrial-Tool-Operated-by-AI.jpg",[372],{"id":373,"name":374},"10","Industrial sector",[376,379,382,385,388,391,394,397],{"id":377,"name":378},"110","AI",{"id":380,"name":381},"874","GenAI",{"id":383,"name":384},"125","Cybersecurity",{"id":386,"name":387},"875","Data",{"id":389,"name":390},"19","Digital strategy",{"id":392,"name":393},"887","Business transformation",{"id":395,"name":396},"892","Ecosystems",{"id":398,"name":399},"891","New technologies",{"id":401,"path":402,"sharedTeaserTitle":403,"sharedTeaserRefMedia":404,"sharedTaxrefIndustries":422,"sharedTaxrefExpertises":424},"26858","\u002Fen\u002Finsights\u002Fphysical-ai-in-the-industrial-sector-from-automation-to-intelligent-action","Physical AI in the industrial sector: From automation to intelligent action",{"id":405,"sharedMediaLegend":406,"mediaImage":407,"name":421},"172656","Robotic arms meticulously assemble circuit boards in a clean, high-tech factory setting, embodying automation and precision.",{"url":408,"width":409,"height":410,"alt":411,"title":204,"size":412,"mime":218,"variations":204,"relatedContentVariations":413},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002FAdobeStock_1650877047.jpeg",2912,1632,"Robotic arms in a factory",750727,[414,416,417,419,420],{"name":221,"url":415,"width":362,"height":363},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002FAdobeStock_1650877047.jpeg.webp?itok=buHQhm6J",{"name":221,"url":415,"width":362,"height":363},{"name":366,"url":418,"width":314,"height":362},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_medium\u002Fpublic\u002Fimages\u002FAdobeStock_1650877047.jpeg.webp?itok=nSPVpehS",{"name":366,"url":418,"width":314,"height":362},{"name":366,"url":418,"width":314,"height":362},"AdobeStock_1650877047.jpeg",[423],{"id":373,"name":374},[425,426],{"id":377,"name":378},{"id":386,"name":387},{"id":428,"path":429,"sharedTeaserTitle":430,"sharedTeaserRefMedia":431,"sharedTaxrefIndustries":446,"sharedTaxrefExpertises":450},"26441","\u002Fen\u002Finsights\u002Fprocess-optimisation-why-ai-is-now-a-strategic-imperative","Process optimisation: why AI is now a strategic imperative",{"id":432,"sharedMediaLegend":204,"mediaImage":433,"name":445},"171591",{"url":434,"width":314,"height":362,"alt":435,"title":204,"size":436,"mime":218,"variations":204,"relatedContentVariations":437},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002FAI_Driven_Process.jpg","Close up fo a person's hand holding an AI bubble in front of a computer",207685,[438,440,441,443,444],{"name":221,"url":439,"width":362,"height":363},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002FAI_Driven_Process.jpg.webp?itok=AgdFHcuw",{"name":221,"url":439,"width":362,"height":363},{"name":366,"url":442,"width":314,"height":362},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_medium\u002Fpublic\u002Fimages\u002FAI_Driven_Process.jpg.webp?itok=XnyXtFkN",{"name":366,"url":442,"width":314,"height":362},{"name":366,"url":442,"width":314,"height":362},"AI_Driven_Process.jpg",[447],{"id":448,"name":449},"855","All industries",[451],{"id":377,"name":378},{"id":453,"path":454,"sharedTeaserTitle":455,"sharedTeaserRefMedia":456,"sharedTaxrefIndustries":474,"sharedTaxrefExpertises":475},"1681","\u002Fen\u002Finsights\u002Fcontact-tracing-how-secure-is-swisscovid","Contact-tracing: How secure is SwissCovid?",{"id":457,"sharedMediaLegend":204,"mediaImage":458,"name":473},"1317",{"url":459,"width":460,"height":461,"alt":462,"title":204,"size":463,"mime":218,"variations":204,"relatedContentVariations":464},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fimages\u002Ftarget-pin.jpg",700,524,"Target Pin",51978,[465,468,469,471,472],{"name":221,"url":466,"width":460,"height":467},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_small\u002Fpublic\u002Fimages\u002Ftarget-pin.jpg.webp?itok=FGxmFaX7",467,{"name":221,"url":466,"width":460,"height":467},{"name":366,"url":470,"width":460,"height":467},"https:\u002F\u002Fcms.zuehlke.com\u002Fsites\u002Fdefault\u002Ffiles\u002Fstyles\u002Ffocal_point_3_2_medium\u002Fpublic\u002Fimages\u002Ftarget-pin.jpg.webp?itok=I0KvdXhG",{"name":366,"url":470,"width":460,"height":467},{"name":366,"url":470,"width":460,"height":467},"target-pin.jpg",[],[476],{"id":477,"name":478},"21","Software engineering"]