Cybersecurity at ZEISS Medical Technology

Baseline requirements

Cybersecurity and data protection requirements are defined in the first steps of our product generation process.

In addition to compliance with international standards, laws and regulations, ZEISS has established standards to ensure state-of-the-art cybersecurity across our product portfolio. These standards are based on best practices, the current threat landscape, international security frameworks and other sources, such as customer requirements, or product-specific security objectives.

Threat modeling

As an essential part of product design and defining product architecture, threat modeling is used early in the product design process to identify security threats, risks and potential vulnerabilities.

In threat modeling, we systematically analyze applicable threats to a product, assessing and rating the criticality to that product. Based on this criticality rating, in combination with known weaknesses and vulnerabilities, the design and/or architecture of a product is adapted accordingly to tackle threats before they become risks.

Additionally, as an important part of our “Security by Design” approach, the product design and architecture are reviewed by dedicated security experts.

Secure Coding

Secure code reviews are performed throughout the product development process to ensure critical security flaws or potential vulnerabilities are identified early within the lifecycle.

Additionally, specially trained security engineers are mandatory members of the product development teams to ensure best practices and state-of-the-art cybersecurity in coding. A team of dedicated, highly qualified security experts are also available for consultation on any security questions.

Static & Dynamic Application Security Testing (SAST/DAST)

Static application security testing, with a white-box approach and focus on source code content, as well as dynamic application security testing, with a black-box approach and focus on vulnerabilities is performed throughout the development process to identify potential vulnerabilities and errors which could impact software quality.

Software Composition Analysis (SCA)

Monitoring of third-party software components regarding known vulnerabilities is performed across the lifecycle to minimize risks from open source software.

Vulnerability testing

Products are scanned for vulnerabilities across the lifecycle to proactively identify vulnerabilities which may pose a risk.

Penetration testing

Products are penetration tested by trusted third-party entities to identify potential threats or vulnerabilities.
 

Continuous threat and vulnerability management

We monitor software and conduct assessments to detect, identify and prioritize threats and risks of our supported products in the market. Threat and vulnerability scans are conducted, and based on the results, assessments are done to identify new threats and risks. Subsequently, actions to maintain appropriate levels of cybersecurity are defined, according to the level of criticality.

Security patch management

Security patches are developed, tested and released according to the level of criticality to mitigate risks to customers’ products and their infrastructure.