How not just one but TWO medical device companies have helped keep their customers safer with threat modeling

Customer 1  

Challenge

Historically, the Client has been threat modeling using a combination of manual approaches and Microsoft Threat Modeling Tool, plus STRIDE Methodology, as recommended by The FDA:

“In September 2019, FDA awarded funding to MDIC to increase awareness on systematic approaches to threat modeling that can enable manufacturers to effectively address system level risks” - MDIC (Medical Device Innovation Consortium).

Microsoft Threat Modelling Tool hasn't been great for security classification of assets, and is inefficient for creating reliable threat models, because of this, it doesn’t scale well. They have 50+ teams they aim to implement IriusRisk into - they need a solution which has full RBAC and BU integration.

Solution

IriusRisk can be adapted to STRIDE methodologies. They assign an ‘IriusRisk’ groomer to manage the program holistically - ensuring risk intel is centralized at a library level. Customization was the main driver for this tool - being able to use custom rules, workflows, and custom fields allows the  Client to generate the specifics needed to conclude a comprehensive threat model quickly and automatically.

Results

IriusRisk demonstrates great capabilities as a tool for scalable threat modeling which can be easily understood by all teams, whether security architects, devs, or security engineers. They are excited to see the introduction of Product Components in their threat models, as these will be used to represent the wider relationship between one threat model to another.

They are also heavily using the versioning feature and recognise its importance in order to embed threat modeling within the SDLC, which previously they were unable to do.

Customer 2

Challenge

Were previously threat modeling using a single, very large Visio diagram.

  • This was difficult to update
  • No real output, no threats or controls
  • No primary source of truth for their product or proven compliance efforts

Solution

  • They need tooling, their current process didn’t work well
  • It needs to be more than a diagram, it needs to have the context behind what the diagram means
  • It needs to have reporting capability and self serving
  • Big key aspect is compliance, so the tool needs to understand and enforce compliance but also provide flexible customization where needed

Results

  • The Client has spent a lot of time customizing IriusRisk
  • The AWS threat library has been a big focus and benefit
  • Standards have been essential for compliance to demonstrate efforts to the FDA
  • The Client was able to use one of our Partners to support on management and ownership of the product due to resource constraints

The outcomes...

Standards and compliance has become much easier to achieve
Threat modeling now embedded into the SDLC process
All development and security teams are now able to use and understand threat models