# Cybersecurity and Medical Imaging: A Simulation-Based Approach to DICOM Communication
## 5 Simulation Results and Analysis
### Setting Up Orthanc to Accept Data from the Modality Simulator
Insecure communication: without encryption, sensitive DICOM data transmitted over the network are vulnerable to eavesdropping and unauthorized access. 2. Weak authentication: insufficient user authentication mechanisms can lead to unauthorized users gaining access to DICOM systems, resulting in compromised data integrity. 3. Outdated software: running outdated DICOM software components can expose vulnerabilities that malicious actors can exploit for unauthorized access or data manipulation. 4. Insufficient training: lack of user awareness and training can result in successful social engineering attacks, leading to unauthorized data access. 5. Unprotected networks: failure to segment and secure the network exposes DICOM systems to potential breaches from unauthorized network traffic. 6. Data manipulation: without proper integrity checks, attackers might manipulate DICOM data during transmission, leading to compromised diagnoses or treatments. 7. Unauthorized access: poorly managed access control can result in unauthorized users gaining entry to DICOM resources. 8. Lack of intrusion detection: absence of intrusion detection mechanisms makes it challenging to detect and respond to unauthorized network activities. 9. Auditing and weakness identification (M1047): it is crucial to perform regular audits and scans on DICOM systems in order to identify weaknesses that could compromise communication security. Similarly, OWASP has published a comprehensive guide to the secure deployment of medical devices [48]. Furthermore, a CSRF vulnerability for ORTHANC was presented in [49]. Similarly, Nmap Scripting Engine (NSE) scripts have been published related to DICOM [50; 51]. These scripts aim to perform brute force attacks on the AET of a DICOM server. Table 2 outlines a set of MITRE mitigation actions along with their relevance to DICOM communication security. Each MITRE ID corresponds to a specific mitigation action designed to address a particular security concern in the context of DICOM communication. In regard to the OWASP guide and the vulnerabilities and threats mentioned above, Table 2 lists MITRE mitigation actions that correspond to the above-mentioned security issues. According to MITRE [52], mitigations embody security principles and categories of technologies that can be employed to thwart the successful execution of a technique or subtechnique. As such, the information in Table 2 can be used to identify other potential cyberthreats by looking to the relevant MITRE ATT&CK Navigator Layer according to the particular mitigation measures. The DICOM simulation featured in this research provides valuable insights into addressing potential cybersecurity vulnerabilities and implementing corresponding mitigation strategies. However, it is crucial to acknowledge certain inherent limitations and constraints associated with the simulation's findings. The simulation's results are contingent upon a series of assumptions and simplifications made during the modeling phase. These assumptions might not always align with the intricacies of real-world scenarios, introducing the potential for variations that could impact the accuracy of the conclusions derived from the simulation. Furthermore, the simulation did not involve the actual execution of cyberattacks or vulnerability assessments. This omission is attributed to the reliance on specific deployment parameters, making it difficult to accurately replicate authentic cyberattack scenarios. Consequently, the simulation's representations of real-world cyberattacks may lack full complexity and nuanced intricacies, potentially influencing the realism of its findings. Moreover, the simulation's scope might not encompass the entirety of potential cyberthreats. The rapidly evolving landscape of cybersecurity introduces the possibility of emerging and sophisticated threats that were not explicitly accounted for in the simulation. This limitation is a result of the inherent challenge of predicting and accommodating the myriad attack vectors that can emerge over time.