TY - JOUR A1 - Pilgermann, Michael A1 - Bocklisch, Thomas A1 - Creutzburg, Reiner T1 - Conception and implementation of a course for professional training and education in the field of IoT and smart home security JF - Electronic Imaging KW - Internet of Things KW - IoT KW - Smart Home KW - Smart Home Security KW - Cybersecurity KW - Connected Home Y1 - 2020 U6 - https://doi.org/10.2352/ISSN.2470-1173.2020.3.MOBMU-277 SN - 2470-1173 SP - 277-1 EP - 277-8 PB - Society for Imaging Science and Technology ER - TY - JOUR A1 - Pilgermann, Michael A1 - Werth, Sören A1 - Creutzburg, Reiner T1 - Towards sector specific security operation JF - Electronic Imaging KW - cybersecurity KW - information security KW - network security KW - IT security KW - Security Information Center KW - SOC KW - Security Information and Event Management KW - SIEM KW - security monitoring KW - health care KW - critical infrastructures KW - hospitals KW - HL7 KW - MLLP Y1 - 2020 U6 - https://doi.org/10.2352/ISSN.2470-1173.2020.3.MOBMU-254 SN - 2470-1173 SP - 254-1 EP - 254-10 PB - Society for Imaging Science and Technology CY - Springfield, VA ER - TY - INPR A1 - Tuset-Peiro, Pere A1 - Pilgermann, Michael A1 - Pegueroles, Josep A1 - Vilajosana, Xavier T1 - Assessing Cybersecurity of Internet-Facing Medical IT Systems in Germany & Spain Using OSINT Tools N2 - This paper investigates cybersecurity threats in medical IT (Information Technology) systems exposed to the Internet. To that end, we develop a methodology and build a data processing pipeline that allows to gather data from different OSINT (Open Source Intelligence) sources, and processes it to obtain relevant cybersecurity metrics. To validate its operation and usefulness, we apply it to two countries, Germany and Spain, allowing to study the main threats that affect medical IT systems in these countries. Our initial findings reveal that 20% of German hosts and 15% of Spanish hosts tagged as medical devices have at least one CVE (Common Vulnerabilities and Exposures) with a CVSS (Common Vulnerability Scoring System) graded as critical (i.e., value 8 or greater). Moreover, we found that 74% of CVEs found in German hosts are dated from earlier than 2020, whereas for Spanish hosts the percentage is 60%. This indicates that medical IT systems exposed to the Internet are seldom updated, which further increases their exposure to cyberthreats. Based on these initial findings, we finish the paper providing some insights on how to improve cybersecurity of these systems. Y1 - 2025 U6 - https://doi.org/10.20944/preprints202503.1340.v1 SP - 190 EP - 197 ER - TY - JOUR A1 - Weber, Simon B. A1 - Stein, Stefan A1 - Pilgermann, Michael A1 - Schrader, Thomas T1 - Attack Detection for Medical Cyber-Physical Systems – A Systematic Literature Review JF - IEEE Access N2 - The threat situation due to cyber attacks in hospitals is emerging and patient life is at risk. One significant source of potential vulnerabilities is medical cyber-physical systems (MCPS). Detecting intrusions in this environment faces challenges different from other domains, mainly due to the heterogeneity of devices, the diversity of connectivity types, and the variety of terminology. To summarize existing results, we conducted a structured literature review (SLR) following the guidelines of Kitchenham et al. for SLRs in software engineering. We developed six research questions regarding detection approach, detection location, included features, adversarial focus, utilized datasets, and intrusion prevention. We identified that most researchers focused on an anomaly-based detection approach at the network layer. The primary focus was on the detection of malicious insiders. While several researchers used publicly available datasets for training and testing their algorithms, the lack of suitable datasets resulted in the development of testbeds consisting of various medical devices. Based on the results, we formulated five future research topics. First, the special conditions of hospital networks, the MCPS deployed within them, and the contrasts to other IT and OT environments should be examined. Thereupon, MCPS-specific datasets should be created that allow researchers to address the health domain’s unique requirements and possibilities. At the same time, endeavors aimed at standardization in this area should be supported and expanded. Moreover, the use of medical context for attack detection should be further explored. Last but not least, efforts for MCPS-tailored intrusion prevention should be intensified. This way, the emerging threat landscape can be addressed, IT security in hospitals can be improved, and patient health can be protected. Y1 - 2023 U6 - https://doi.org/10.1109/ACCESS.2023.3270225 IS - 11 SP - 41796 EP - 41815 PB - IEEE ER - TY - CHAP A1 - Vielhauer, Claus A1 - Loewe, Fabian A1 - Pilgermann, Michael T1 - Towards Modeling Hidden & Steganographic Malware Communication based on Images T2 - IH&MMSEC '25: ACM Workshop on Information Hiding and Multimedia Security, San Jose, CA, USA, 2025 N2 - Recently, an increasing number of IT security incidents involving malware, which makes use of hidden and steganographic channels for malicious communication (a.k.a. as "stegomalware"), can be observed in the wild. Especially the use of images to hide malicious code is rising. In consideration of this shift, a new model is proposed in this paper, which aims to help security professionals to identify and analyze incidents revolving around steganographic malware in the future. The model focuses on practical aspects of steganalysis of communication data to elaborate linking properties to previous code analysis knowledge. The model features two distinct roles that interact with a knowledge base which stores malware features and helps building a context for the incident. For evaluation, two image steganography malware types are chosen from popular databases (malpedia and MITRE ATT&CK®), which are analyzed in multiple steps including steganalysis and code analysis. It is conceptually shown, how the extracted features can be stored in a knowledge base for later use to identify stegomalware from communication data without the need of a thorough code analysis. This allows to uncover previously hidden meta-information about the examined malicious programs, enrich the incident’s forensic context traces and thus allows for thorough forensic insights, including attribution and improved preventive security measures in the future. Y1 - 2025 UR - https://dl.acm.org/doi/pdf/10.1145/3733102.3733152 U6 - https://doi.org/10.1145/3733102.3733152 SP - 52 EP - 63 ER - TY - JOUR A1 - Stein, Stefan A1 - Pilgermann, Michael A1 - Sedlmayr, Martin T1 - Systematic Evaluation of Manufacturer Disclosure Statements for Medical Device Security (MDS2) to Strengthen Hospital OT Security Measures – Lessons Learned JF - Studies in health technology and informatics N2 - The growing number of connected medical devices in hospitals poses serious operational technology (OT) security challenges. Effective countermeasures require a structured analysis of the communication interfaces and security configurations of individual devices. State of the art: Although Manufacturer Disclosure Statements for Medical Device Security (MDS2, Version 2019) offer relevant information, they are rarely integrated into cybersecurity workflows. Existing studies are limited in scope and lack scalable methodologies for systematic evaluation. Concept: This study analyzed 209 MDS2 documents and 161 security white papers to extract structured information on ports, protocols, and protective measures. Over 52,000 question–answer pairs were converted into a machine-readable format using customized parsing and validation routines. The aim was to establish whether this dataset could inform risk assessments and future applications involving Large Language Models (LLMs). Implementation: The analysis revealed 367 distinct ports, including common protocols such as HTTPS (443), DICOM (104), and RDP (3389), as well as vendor-specific proprietary ports. Approximately 40% of the devices used over 20 ports, indicating a broad attack surface. OCR errors and inconsistent formatting required manual corrections. A consolidated dataset was developed to support clustering, comparison across vendors and versions, and preparation for downstream LLM use, particularly via structured SBOM and configuration data. Lessons learned: Although no model training was conducted, the structured dataset can support AI-based OT security workflows. The findings highlight the critical need for up-to-date, machine-readable manufacturer data in standardized formats and schemas. Such information could greatly enhance the automation, comparability, and scalability of hospital cybersecurity measures. Y1 - 2025 U6 - https://doi.org/10.3233/SHTI251404 VL - 331 SP - 256 EP - 264 ER - TY - JOUR A1 - Stein, Stefan A1 - Pilgermann, Michael A1 - Weber, Simon A1 - Sedlmayr, Martin T1 - Leveraging MDS2 and SBOM data for LLM-assisted vulnerability analysis of medical devices JF - Computational and Structural Biotechnology Journal N2 - This study investigated the use of a semi-automated, Retrieval-Augmented Generation (RAG)-based multi-agent architecture to analyze security-relevant data and assemble specialized exploitation paths targeting medical devices. The input dataset comprised device-specific sources, namely, the Manufacturer Disclosure Statement for Medical Device Security (MDS2) documents and Software Bills of Materials (SBOMs), enriched with public vulnerability databases, including Common Vulnerabilities and Exposures (CVE), Known Exploited Vulnerabilities (KEV), and Metasploit exploit records. The objective was to assess whether a modular, Large Language Model (LLM)-driven agent system could autonomously correlate device metadata with known vulnerabilities and existing exploit information to support structured threat modeling. The architecture follows a static RAG design based on predefined prompts and fixed retrieval logic, without autonomous agent planning or dynamic query adaptation. The developed Vulnerability Intelligence for Threat Analysis in Medical Security (VITAMedSec) system operates under human-prompted supervision and successfully synthesizes actionable insights and exploitation paths without requiring manual step-by-step input during execution. Although technically coherent results were obtained under controlled conditions, real-world validation remains a critical avenue for future research. This study further discusses the dual-use implications of such an agent-based framework, its relevance to patient safety in medical device cybersecurity, and the broader applicability of the proposed architecture to other critical infrastructure sectors. These findings emphasize both the technical potential and ethical responsibility for applying semi-automated AI workflows in medical cybersecurity contexts. Y1 - 2025 U6 - https://doi.org/10.1016/j.csbj.2025.07.012 VL - 28 SP - 267 EP - 280 PB - Elsevier ER -