A method for protecting a medical device having a processor from malicious software, the method comprising: providing at the medical device at least one control software module (6110, 6206) that controls the operation of the medical device and is executable on the processor, a data management module that manages data flow between the at least one control software module and exterior sources and is arranged to check for update files from a remote server, and an agent module having access to only predetermined memory locations (13032, 13034) in the medical device; creating an update request file to be transmitted to the remote server by the agent module to check for updates from the remote server; enabling a communications link from the medical device to the remote server; by the agent module: transmitting the update request file to the remote server via the enabled communications link, receiving files for the medical device from the remote server, and storing the received files from the remote server in the predetermined memory locations accessible by the agent module; continuing creating and transmitting the update request file at a predefined rate until a stop polling is called; validating the received files, by the data management module, prior to transferring the received files stored within the predetermined memory locations into an internal memory location accessible by the at least one control software module; transferring the received files into the internal memory location if the received files are validated by the data management module for storage within the internal memory location; deleting all received files in the predetermined memory locations if any part of validation fails; and disabling the communications link before a therapy using the medical device is started. providing at the medical device at least one control software module (6110, 6206) that controls the operation of the medical device and is executable on the processor, a data management module that manages data flow between the at least one control software module and exterior sources and is arranged to check for update files from a remote server, and an agent module having access to only predetermined memory locations (13032, 13034) in the medical device; creating an update request file to be transmitted to the remote server by the agent module to check for updates from the remote server; enabling a communications link from the medical device to the remote server; by the agent module: transmitting the update request file to the remote server via the enabled communications link, receiving files for the medical device from the remote server, and storing the received files from the remote server in the predetermined memory locations accessible by the agent module; continuing creating and transmitting the update request file at a predefined rate until a stop polling is called; validating the received files, by the data management module, prior to transferring the received files stored within the predetermined memory locations into an internal memory location accessible by the at least one control software module; transferring the received files into the internal memory location if the received files are validated by the data management module for storage within the internal memory location; deleting all received files in the predetermined memory locations if any part of validation fails; and disabling the communications link before a therapy using the medical device is started.