Scoring Security Vulnerabilities in Medical Devices: Rubric for CVSS
Channel: FIRST
Date: 2021-06-17

Speakers: Sumanth Naropanth (Deep Armor, IN), Rahul U (Deep Armor, IN)

The Common Vulnerability Scoring System (CVSS) is one of the most widely used frameworks for scoring security vulnerabilities. The CVSS is a generic scoring system that can be applied to a broad spectrum of software and hardware products. These definitions are intentionally product or industry agnostic, making CVSS a versatile tool that can be used for scoring a vulnerability in, say a mobile application, just as well as in a pacemaker device. This versatility brings with it certain limitations. CVSS scoring can often be very subjective.

Use of the “default” CVSS may lead to ambiguities and inconsistencies when used for vulnerabilities affecting Internet of Things (IoT). Taking particularly the healthcare and medical devices sector as an example, the CVSS framework does not take into account clinical environment conditions, patient safety and other typical healthcare conditions. To address these challenges, produce accurate severity ratings for vulnerabilities, and to make the CVSS framework more applicable to medical devices, the United States Food & Drug Administration (US FDA) has qualified a cybersecurity Medical Device Development Tool (MDDT) in partnership with the MITRE organization. This MDDT introduces a rubric for CVSS, and defines a series of structured questions and metric definitions for each vector in the CVSS by considering the effect on the patient safety and other medical conditions.

In this presentation, we break down the guidance document from MITRE. We also demonstrate applying the rubric to actual security vulnerabilities in market products, and compare the outcome with regular CVSS 3.1 scores and vectors. We talk about the purpose of the rubric and how it adds value to the medical device cybersecurity community. We also introduce the attendees to the only web-version (at the time of writing) of a calculator for this MDDT. This calculator has been developed by Deep Armor and is available for public use.

About the Speakers
Sumanth Naropanth is a business & technical expert in security research, architecture & design, vulnerability assessments, and incident response. He has held several security leadership positions in large corporations and startups, where has championed next-generation Security Development Lifecycle (SDL) frameworks, architected secure solutions, and has managed global security assurance teams.

Sumanth is the founder and CEO of Deep Armor -- an internationally recognized security consulting firm. He previously worked for Sun Microsystems, Palm/HP and Intel.

He and his team regularly speak and conduct workshops at well-known security conferences, including at Black Hat Asia, Black Hat Europe, FIRST, Troopers, AppSec, Nuit du Hack, and so on. Sumanth was nominated as one among the top 11 IoT Thought Leaders in 2018 in India. He has a Masters degree in Computer Science (Security) from Columbia University.

Rahul is a Security Analyst at Deep Armor. He is skilled in web application, networking and cloud security topics. He has worked on several projects in cybersecurity, particularly on Bigdata. Rahul has been part of the core technical team from Deep Armor that conducts corporate trainings. He has a Bachelor’s degree in Computer Science.