@article{SteinPilgermannSedlmayr2025, author = {Stein, Stefan and Pilgermann, Michael and Sedlmayr, Martin}, title = {Systematic Evaluation of Manufacturer Disclosure Statements for Medical Device Security (MDS2) to Strengthen Hospital OT Security Measures - Lessons Learned}, series = {Studies in health technology and informatics}, volume = {331}, journal = {Studies in health technology and informatics}, doi = {10.3233/SHTI251404}, pages = {256 -- 264}, year = {2025}, abstract = {The growing number of connected medical devices in hospitals poses serious operational technology (OT) security challenges. Effective countermeasures require a structured analysis of the communication interfaces and security configurations of individual devices. State of the art: Although Manufacturer Disclosure Statements for Medical Device Security (MDS2, Version 2019) offer relevant information, they are rarely integrated into cybersecurity workflows. Existing studies are limited in scope and lack scalable methodologies for systematic evaluation. Concept: This study analyzed 209 MDS2 documents and 161 security white papers to extract structured information on ports, protocols, and protective measures. Over 52,000 question-answer pairs were converted into a machine-readable format using customized parsing and validation routines. The aim was to establish whether this dataset could inform risk assessments and future applications involving Large Language Models (LLMs). Implementation: The analysis revealed 367 distinct ports, including common protocols such as HTTPS (443), DICOM (104), and RDP (3389), as well as vendor-specific proprietary ports. Approximately 40\% of the devices used over 20 ports, indicating a broad attack surface. OCR errors and inconsistent formatting required manual corrections. A consolidated dataset was developed to support clustering, comparison across vendors and versions, and preparation for downstream LLM use, particularly via structured SBOM and configuration data. Lessons learned: Although no model training was conducted, the structured dataset can support AI-based OT security workflows. The findings highlight the critical need for up-to-date, machine-readable manufacturer data in standardized formats and schemas. Such information could greatly enhance the automation, comparability, and scalability of hospital cybersecurity measures.}, language = {en} } @article{SteinPilgermannWeberetal.2025, author = {Stein, Stefan and Pilgermann, Michael and Weber, Simon and Sedlmayr, Martin}, title = {Leveraging MDS2 and SBOM data for LLM-assisted vulnerability analysis of medical devices}, series = {Computational and Structural Biotechnology Journal}, volume = {28}, journal = {Computational and Structural Biotechnology Journal}, publisher = {Elsevier}, doi = {10.1016/j.csbj.2025.07.012}, pages = {267 -- 280}, year = {2025}, abstract = {This study investigated the use of a semi-automated, Retrieval-Augmented Generation (RAG)-based multi-agent architecture to analyze security-relevant data and assemble specialized exploitation paths targeting medical devices. The input dataset comprised device-specific sources, namely, the Manufacturer Disclosure Statement for Medical Device Security (MDS2) documents and Software Bills of Materials (SBOMs), enriched with public vulnerability databases, including Common Vulnerabilities and Exposures (CVE), Known Exploited Vulnerabilities (KEV), and Metasploit exploit records. The objective was to assess whether a modular, Large Language Model (LLM)-driven agent system could autonomously correlate device metadata with known vulnerabilities and existing exploit information to support structured threat modeling. The architecture follows a static RAG design based on predefined prompts and fixed retrieval logic, without autonomous agent planning or dynamic query adaptation. The developed Vulnerability Intelligence for Threat Analysis in Medical Security (VITAMedSec) system operates under human-prompted supervision and successfully synthesizes actionable insights and exploitation paths without requiring manual step-by-step input during execution. Although technically coherent results were obtained under controlled conditions, real-world validation remains a critical avenue for future research. This study further discusses the dual-use implications of such an agent-based framework, its relevance to patient safety in medical device cybersecurity, and the broader applicability of the proposed architecture to other critical infrastructure sectors. These findings emphasize both the technical potential and ethical responsibility for applying semi-automated AI workflows in medical cybersecurity contexts.}, language = {en} } @article{SteinWeberPilgermannetal.2024, author = {Stein, Stefan and Weber, Simon and Pilgermann, Michael and Schrader, Thomas and Sedlmayr, Martin}, title = {A Novel Approach to Medical Device IT Security Landscape Analysis Leveraging Manufacturer Disclosure Statements}, series = {IEEE Access}, journal = {IEEE Access}, number = {12}, publisher = {IEEE}, issn = {2169-3536}, doi = {10.1109/ACCESS.2024.3487824}, pages = {160506 -- 160515}, year = {2024}, abstract = {The growing number of cyberattacks targeting the healthcare sector increasingly threatens network-enabled medical devices that are vital for life-sustaining patient care. Security researchers and healthcare IT managers are pursuing effective methods to assess the IT security landscape of medical devices. Their goal is to develop a comprehensive understanding of the devices' IT security status. Recent studies have successfully uncovered structural deficiencies in medical device security. However, the limitations of their data sources, particularly in evaluating features like logging capabilities and third-party libraries, restrict the scope of their findings. In this study, we present the first systematic analysis of Manufacturer Disclosure Statement for Medical Device Security (MDS2) documents to evaluate their use in creating holistic statements regarding the IT security posture of medical devices. We examined a total of 147 MDS2 documents encompassing devices from 105 different classes. Our findings indicate that MDS2 documents, especially those from the second version (2013) onwards, are suitable for this purpose. We also discuss the shortcomings of the latest MDS2 version in meeting current IT security requirements. Based on the gaps identified, we developed several recommendations to improve MDS2 documents and enhance their effectiveness across the global healthcare sector. In the future, these documents could be used not only for comprehensive landscape analyses but also for organization-specific reports, providing healthcare managers with direct insights into the IT security status within their institutions.}, language = {en} }