5-Day Intensive Prep Healthcare Cybersecurity Boot Camp

Transitioning from SOC to Medical Device Security

🚀 Course Overview

A 5-day intensive program designed to help junior SOC analysts transition into medical device and healthcare cybersecurity roles. Gain hands-on experience with healthcare-specific security frameworks, threat modeling, and penetration testing techniques.

🎯 Key Learning Objectives

• Master healthcare security standards: ISO 81001, FDA guidance, NHS CyberEssentials
• Develop threat modeling skills: STRIDE analysis for medical devices
• Execute medical device pentesting: DICOM security testing, FHIR API security
• Implement secure SDLC: SAST/DAST, SBOM management, vulnerability patching
• Communicate security risks: Tailor messages for executives, regulators, and developers

🧑‍💻 Who Should Attend?

• SOC analysts targeting healthcare cybersecurity roles
• Junior security professionals interested in medical device security
• Candidates preparing for security interviews in regulated industries

🏆 Program Outcomes

By completing this boot camp, participants will:
✔ Understand healthcare-specific security requirements
✔ Be able to conduct medical device security assessments
✔ Have practical experience with healthcare security tools
✔ Be prepared for junior analyst roles in medical device security

Day 1: Medical Device Security Foundations

Regulatory Standards Comparison

Implementation Examples for Radiotherapy Systems:

1. DICOM Security: Configure Orthanc server with TLS 1.3 using DICOM Supplement 142 Basic TLS Profile.
2. User Access: Implement CyberEssentials Control 4 by integrating Mosaiq with Okta for MFA.
3. Patch Management: Automated Windows updates for treatment planning workstations per FDA Section VII.

Healthcare Standards & Architecture

DICOM Security (Supplement 142)

SMART on FHIR Security Framework

2020 Elekta Vulnerabilities Case Study

Threat Modeling Practice

STRIDE Analysis for Radiotherapy System

Mini Security Risk Management Report

Day 2: Secure SDLC & Technical Documentation

Security Documentation Practice

Medical Device Documentation Requirements

Security Risk Management Report Template

1. Executive Summary
   - System: Cloud-connected radiotherapy planning  
   - Scope: DICOM, FHIR, and treatment plan storage  
   2. Risk Assessment Methodology
   - Standards: ISO 14971, ISO 81001
   - Tools: Threat Dragon, Microsoft TMT

1. Identified Risks

   Risk ID	Description	Severity	Mitigation
   R-001	Unauthorized plan modify	Critical	HSM signatures

    

2. Residual Risk Evaluation
   • Justification for acceptable risks
3. Appendices
   • STRIDE diagrams
   • Testing results

Security Testing Tools

SAST/DAST/SCA Command Reference

Medical Device Code Review Findings

Day 3: Penetration Testing & Vulnerability Management

Medical Device Testing Frameworks

Medical Device Penetration Testing (MD-PT)

Radiotherapy System Test Cases

1. DICOM Service DOS:

   echoscu -aet HACKER -aec TARGET -n 1000 target-ip 104
   

2. Treatment Plan Tampering:

   dcmodify -i "(300a,00b0)=HACKED" plan.dcm
   

3. FHIR API Abuse:

   curl -H "Authorization: Bearer token" /Patient/*/RTPlan
   

DICOM Security Testing with dcmtk

DICOM Security Test Commands

Penetration Test Report Excerpt

Day 4: Automation & Technical Leadership

Security Automation Examples

SBOM CVE Monitor (Python)

import requests
from datetime import datetime, timedelta

# Configuration
SBOM_FILE = "sbom.json"
SEVERITY = "CRITICAL"
NVD_API = "https://services.nvd.nist.gov/rest/json/cves/1.0"

def check_sbom_vulnerabilities():
    # Parse SBOM (CycloneDX format)
    with open(SBOM_FILE) as f:
        sbom = json.load(f)
    
    # Check components against NVD
    for comp in sbom["components"]:
        if "purl" in comp:
            pkg = comp["purl"].split("@")[0]
            res = requests.get(f"{NVD_API}?cpeMatchString={pkg}")
            
            # Process vulnerabilities
            for vuln in res.json().get("result", {}).get("CVE_Items", []):
                if vuln["impact"]["baseMetricV2"]["severity"] == SEVERITY:
                    print(f"[!] Critical CVE found: {vuln['cve']['CVE_data_meta']['ID']}")
                    print(f"    Affects: {comp['name']}@{comp['version']}")
                    print(f"    Score: {vuln['impact']['baseMetricV2']['cvssV2']['baseScore']}")

if __name__ == "__main__":
    check_sbom_vulnerabilities()

GitHub Actions Security Gates

Explain TLS requirements to different audiences:

• Regulatory Team: “Per ISO 81001 5.3.2 and FDA guidance, TLS 1.2+ is required to protect PHI in transit during DICOM transfers. Non-compliance could delay our 510(k) submission.”
• Executives: “Implementing TLS prevents $2M+ breach penalties under HIPAA while meeting NHS contract requirements, with minimal performance impact.”
• Developers: “Use OpenSSL 1.1.1+ with AES-256-GCM and certificate pinning in dcmtk configuration - here’s the code sample.”

Behavioral Question: “Describe implementing security in a regulated environment”

• Situation: “At [Company], our radiotherapy system needed FDA clearance with cybersecurity requirements.”
• Task: “I led the effort to implement ISO 81001 controls for the DICOM interface.”
• Action: “Deployed TLS 1.3 with mutual auth, threat modeled using STRIDE, and documented risk mitigations.”
• Result: “Achieved FDA clearance 3 weeks early with zero cybersecurity findings.”

Final Interview Checklist

Good Luck Back to Top