Medical Device Threat Modeling Bootcamp (March 2023)

Intermediate (level 2)

Bootcamp Begins In

00 Days
00 Hours
00 Minutes
00 Seconds

Threat Modeling for Technical and Regulatory Professionals

MDIC and Shostack + Associates have come together to offer the Medical Device Threat Modeling Bootcamp. This learning opportunity is a five-day intensive workshop on managing cybersecurity risks in medical devices and diagnostics.

The Bootcamp will be held the week of March 13th 2023.

During the Bootcamp you will:

Class: 2-hours (9AM – 11AM Pacific daily)
Break, Videos, and Practice (11AM – 12PM Pacific daily)
Group Work: 1-hour (12– 1PM Pacific daily)
Individual Assignments: 1-hour

Why is Medical Device Cybersecurity Threat Modeling Important?

A key piece of managing medical device and diagnostic cybersecurity risks is the integration of threat modelling (TM). TM provides a blueprint to strengthen security through the total product lifecycle of the devices, thereby ensuring improved safety and effectiveness of medical products.

Objectives & discussed topics of the MDIC threat modeling bootcamps:

Intensive, hands-on sessions on threat modeling.
Learning about structured, systematic and comprehensive approach to threat modeling for engineering more secure systems.

To learn more about the bootcamp along with various other MDIC cybersecurity initiatives, email us at [email protected]

Course curriculum

1. Welcome + Introduction
2. Preparing for Distributed Learning
3. Update Your Calendar
4. Order Physical Materials
5. Using the LMS
6. Join Slack
7. How We Use Slack
8. Readiness Survey
9. Welcome
10. Syllabus
11. Assignments checklist
12. Learning Online
13. Welcome to Threat Modeling
14. Slide Book (downloadable)
15. Exercises File (downloadable)
16. Exercise: Drawing tools
17. Exercise: Propose a System for Analysis
18. Premarket Draft: Context
19. Zoom
1. Link to Live Class
1. The Question: What Are We Working On?
2. DFDs: Diagrams + Models
3. Trust Boundaries Slide Supplement
4. Understanding Boundaries
5. Boundaries Technical
6. Models (answer key)
7. (OPTIONAL) Exercise: Data Flow Diagram Essay
8. (OPTIONAL) Exercises: Trust Boundaries Essay
1. Group Exercise: Data Flow Diagram Creation
1. Individual Exercise: Data Flow Diagram Creation (Medical Device)
2. Premarket Draft: Security Architecture Views
3. Premarket Draft: Appendix 2 - Views
4. Premarket Draft: SBOMs + Threat Modeling
1. Link to Live Class
1. STRIDE (Introduction)
2. Applying STRIDE
3. Tracking Threats + Assumptions
4. Sketching
5. DFDs in Depth
6. What Can Go Wrong? Brainstorming
7. (OPTIONAL) Exercise: STRIDE Essay
1. Group Exercise: Apply STRIDE
1. Individual Exercise: Apply STRIDE to Medical Device
2. Premarket Draft: Appendix 1 - What Can Go Wrong
1. Link to Live Class
1. Tools in Context
2. Elevation of Privilege
3. Attack Trees
4. Final Tips + Recap: What Can Go Wrong
5. Mitigations
6. Strategies for Addressing Threats
7. Addressing Threats
1. Group Exercise: Design Control - Broadly
2. Group Exercise: Design Controls in Depth
3. Group Exercise: Risk Mitigation
1. Individual Exercise: Design Controls for Medical Device - Broadly
2. Individual Exercise: Design Controls for Medical Device - In Depth
3. Individual Exercise: Risk Mitigation for Medical Device
4. Premarket Draft: Appendix 1 - What to Do About It
5. Did we do a good job?
6. Retrospectives
1. Thursday Live Class Zoom Link
1. Introduction to Kill Chains
2. Applying the Kill Chain
3. "Act On Objectives" Stage of the Kill Chain
4. MITRE'S ATT&CK Kill Chain
5. (OPTIONAL) Exercise: Kill Chain Essay
6. (OPTIONAL) Prioritization
7. (OPTIONAL) Kill Chain Cheat Sheet
8. (OPTIONAL) Managing "What We're Going to Do About it"
9. (OPTIONAL) A Sense of Urgency
10. (OPTIONAL) Models of Change
11. (OPTIONAL) Chess and Arms Races
1. Group Exercise: Apply a Kill Chain
1. Individual Exercise: Apply a Kill Chain to Medical Device
2. Premarket Draft: Using an SPDF
3. MDIC TM Playbook Bootcamp March 2023
4. Premarket TIR-57
5. Individual Exercise: End-to-End Threat Model
1. Friday Live Class Zoom Link
1. Answer Key
2. Threat Modeling Lessons From Star Wars
3. Threat Modeling in 2020
4. The Threat Modeling Manifesto
1. Sign up for our mailing lists.
2. How Did We Do? Give us survey feedback
3. Participate in a Retrospective of Medical Device Threat Modeling Bootcamp

About this course

$5,500.00
87 lessons
5.5 hours of video content

Every participant receives

printed and electronic copies of:

Slidebook (125 pages, spiral bound)
Elevation of Privilege game
Exercises booklet
Threat modeling stencil
Whiteboard sketchbook

Why The Medical Device Threat Modeling Bootcamp is The Learning Opportunity for You

In September 2019, FDA awarded funding to MDIC to increase awareness on systematic approaches to TM that can enable manufacturers to effectively address system level risks. Through an FDA funded cybersecurity initiative, MDIC delivered two bootcamps on TM for medical device stakeholders which were held August 17-21, 2020 and February 22-26, 2021. MDIC collaborated with over two dozen SMEs on threat modeling – both from MedTech and non-MedTech sector, led by Shostack & Associates, in developing the modules for bootcamps.

After receiving a tremendous response for the limited number of spaces, MDIC limited participation to no more than two individuals from the same organization. To ensure diversity, the selected participants included both technical professionals working in the product development sector as well as regulatory professionals in the medical device public and private sectors. In parallel to the bootcamps, MDIC worked closely with MITRE to develop a Medical Device Threat Modeling Playbook released in October 2021.

This Bootcamp is an opportunity to learn from the team that produced the first Medical Device Threat Modeling Bootcamps and the Medical Device Threat Modeling Playbook.

Reviews

"One of the top professional development courses in my 35+ year career. - Charles F."

Enroll in the Medical Device Bootcamp Now!

Enroll Today

FAQ

Which virtual meeting platform is used for the Instructor-led discussions?

Instructor-led discussions are conducted via Zoom. The best way to utilize Zoom is with the installed desktop client. Zoom can be used in your browser without losing access to any of the features used in class.
Where do I go to access the video lessons?

Video lessons are hosted here in our Learning Management System. Once you enroll you will find the course in your Student Dashboard. We have structured the course so that each video and assignment you need to complete is found in the chapter for the day in which it is due.
When will I be able to access the video lessons?

We make all digital course materials available the week prior to the Bootcamp, and they remain available to learners for 30 days after the course.
What else do I need in order to participate in the bootcamp?

1) We use Slack for course communications. You will be able to Join Slack using a link found in the First Actions chapter. 2) We use Miro as a collaborative tool. You can create a free Miro account here: https://miro.com The free (3 drawing) version is fine for the class, as is the web version. That is, you don’t need to install their software as a local app. 3) We use Google Docs as a collaborative tool to record group session notes. 4) You should have a good microphone and camera so that you can fully participate in the instructor-led and group work. Headphones may be useful if you are in an environment with background noise.
Who is providing the training?

1) MDIC is the promoting agency who is hosting the Bootcamp. 2) Our lead Instructor is Adam Shostack, a leading expert on threat modeling. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. His accomplishments include: Helped create the CVE. Now an Emeritus member of the Advisory Board; Fixing Autorun for hundreds of millions of systems; Lead the design and delivery of the Microsoft SDL Threat Modeling Tool (v3); Created the Elevation of Privilege threat modeling game; Wrote Threat Modeling: Designing for Security; Co-authored The New School of Information Security. 3) Adam will be supported by Threat Modeling Professionals with Medical Device experience and knowledge.
What if the physical materials do not arrive before the bootcamp?

The physical materials are “nice-to-haves” and not required for the training itself. The materials necessary for the class (Course Slide Book and Exercise Book) are also found in the learning management system (LMS). They can be downloaded in their entirety as PDFs. The slides will appear on screen in the video lessons and during live discussion. Exercises are also individually placed as lesson modules in the LMS at the appropriate places for a streamlined independent-study learning journey. The primary purpose of the physical materials is to provide a resource for continued study and reference as participants integrate threat modeling into their daily activities.
Who do I reach out to with questions?

You can reach out with questions and issues at [email protected]

Pricing options

$5,500.00

Regular price

Enroll Now