Security: can CVSS be used for medical device software?

Taken from TIR57 Principles for medical device security – Risk management

So, to finally address the question from the title – can CVSS be used for medical device software, or is its use limited to non-medical software only?

Let’s start by explaining what it is, and what it is used for.

CVSS, which stands for Common Vulnerability Scoring System, is an open industry standard for assessing the severity and the characteristics of computer system security vulnerabilities. It comprises three metric groups:

• Base
• Temporal
• Environmental

According to First, CVSS is commonly used as the standard system in various organizations and industries because it provides scores that are consistent and accurate. It calculates the vulnerability severity in a system but also serves as a factor in prioritizing the activities for vulnerability remediation. Almost all known vulnerability scores can be found in the National Vulnerability Database (NVD).

When it comes to the use of CVSS, it is by no means limited to non-medical software, which means that the answer to the question from the title is yes, it can be used for medical device software too.

However, to go back to the beginning of this article, when dealing with security risk assessment, one needs to pay special attention to the aforementioned conflict between security and safety. Taking this into consideration means avoiding potentially catastrophic consequences. Moreover, this is the reason behind the fact that there are no clear references to industry standards in medical device software – there usually needs to be done more than simply pick one security standard and follow its requirements. There needs to be a balance between safety and security, and decisions need to be made to allow the two to coexist.

It is up to you to choose from the available alternatives for conducting security assessments and find the best solution for your company.

One of the sources of learning about this is the IEC TR 60601-4-5 Medical electrical equipment – Part 4-5: Guidance and interpretation – Safety-related technical security specifications. According to it,

To determine the required ESSENTIAL FUNCTION, a benefit-risk analysis (between safety and security) should be conducted to determine which functionality can be sacrificed, and which cannot.