Supporting Cybersecurity Risk Management for Medical Devices via the SECUMAN Ontology and Shapes

• URL: http://arxiv.org/abs/2608.00698v1
• Date: Sat, 01 Aug 2026 14:55:48 GMT
• Title: Supporting Cybersecurity Risk Management for Medical Devices via the SECUMAN Ontology and Shapes
• Abstract summary: SECUMAN represents and analyses cybersecurity risk-management documentation for medical devices.<n>It provides a formal OWL-based vocabulary for modelling security-risk context, assessment, control measures, and residual-risk evaluation.<n>It supports automated first-pass validation, traceability, and integration of cybersecurity and safety risk-management documentation.
• Score: 0.7388859384645264
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: We propose the SECUMAN ontology and shapes for representing and analysing cybersecurity risk-management documentation for medical devices. Cybersecurity risks are increasingly relevant for connected medical devices and may have direct consequences for patient safety. Current risk-management files are often maintained as semi-structured natural language text, which makes consistency checking, certification review, and reuse difficult. SECUMAN provides a formal OWL-based vocabulary for modelling security-risk context, assessment, control measures, and residual-risk evaluation, and uses SHACL constraints to check structural completeness and conformity with the intended documentation model. The ontology is aligned with VDE Spec 90025 and the related RISKMAN ontology and shapes, while extending their safety-oriented approach to concepts relevant to cybersecurity risk documentation such as threat scenarios, protection goals, attacker profiles, exposure levels, assets, and secure design arguments. SECUMAN is intended to support automated first-pass validation, traceability, and integration of cybersecurity and safety risk-management documentation.

Related papers

• Toward Comprehensive Risk Assessments and Assurance of AI-Based Systems [0.0]
  Safety, socio-economic, and ethical harms arising from the deployment of AI-based systems have led to a breadth of work seeking to map, measure, and mitigate against newly found risks.<n>Previous attempts to adapt risk assessment techniques and terminology from the safety and security fields have been insufficient.<n>We propose a novel end-to-end AI risk framework that integrates the concept of an Operational Design Domains (ODD) for more general AI-based systems.
  arXiv  Detail & Related papers  (2026-06-28T13:26:03Z)
• SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents [87.26967184869198]
  SeClaw is a framework that combines specification-driven security task synthesis with execution-based security evaluation for Autonomous agents.<n> benchmark covers risks arising from resources, user tasks, environments, and intrinsic agent behaviors.
  arXiv  Detail & Related papers  (2026-06-01T14:23:42Z)
• DeepSight: An All-in-One LM Safety Toolkit [49.27916339801296]
  We propose an open-source project, namely DeepSight, to practice a new safety evaluation-diagnosis integrated paradigm.<n>DeepSight is low-cost, reproducible, efficient, and highly scalable large-scale model safety evaluation project consisting of a evaluation toolkit DeepSafe and a diagnosis toolkit DeepScan.<n>By unifying task and data protocols, we build a connection between the two stages and transform safety evaluation from black-box to white-box insight.
  arXiv  Detail & Related papers  (2026-02-12T15:43:14Z)
• ORCA -- An Automated Threat Analysis Pipeline for O-RAN Continuous Development [57.61878484176942]
  Open-Radio Access Network (O-RAN) integrates numerous software components in a cloud-like deployment, opening the radio access network to previously unconsidered security threats.<n>Current vulnerability assessment practices often rely on manual, labor-intensive, and subjective investigations, leading to inconsistencies in the threat analysis.<n>We propose an automated pipeline that leverages Natural Language Processing (NLP) to minimize human intervention and associated biases.
  arXiv  Detail & Related papers  (2026-01-20T07:31:59Z)
• Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem [0.0]
  The Model Context Protocol (MCP) has emerged as the de facto standard for connecting Large Language Models to external data and tools.<n>This paper provides a taxonomy of risks in the MCP ecosystem, distinguishing between adversarial security threats and safety hazards.<n>We demonstrate how "context" can be weaponized to trigger unauthorized operations in multi-agent environments.
  arXiv  Detail & Related papers  (2025-12-09T06:39:21Z)
• AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions [64.85086226439954]
  We present SAFE, a benchmark for assessing the safety of embodied VLM agents on hazardous instructions.<n> SAFE comprises three components: SAFE-THOR, SAFE-VERSE, and SAFE-DIAGNOSE.<n>We uncover systematic failures in translating hazard recognition into safe planning and execution.
  arXiv  Detail & Related papers  (2025-06-17T16:37:35Z)
• Towards Safety and Security Testing of Cyberphysical Power Systems by Shape Validation [42.350737545269105]
  complexity of cyberphysical power systems leads to larger attack surfaces to be exploited by malicious actors.<n>We propose to meet those risks with a declarative approach to describe cyber power systems and automatically evaluate security and safety controls.
  arXiv  Detail & Related papers  (2025-06-14T12:07:44Z)
• Comprehensive Digital Forensics and Risk Mitigation Strategy for Modern Enterprises [0.0]
  This study outlines an approach to cybersecurity, including proactive threat anticipation, forensic investigations, and compliance with regulations like CCPA.<n>Key threats such as social engineering, insider risks, phishing, and ransomware are examined, along with mitigation strategies leveraging AI and machine learning.<n>The findings emphasize the importance of continuous monitoring, policy enforcement, and adaptive security measures to protect sensitive data.
  arXiv  Detail & Related papers  (2025-02-26T23:18:49Z)
• EARBench: Towards Evaluating Physical Risk Awareness for Task Planning of Foundation Model-based Embodied AI Agents [53.717918131568936]
  Embodied artificial intelligence (EAI) integrates advanced AI models into physical entities for real-world interaction.<n>Foundation models as the "brain" of EAI agents for high-level task planning have shown promising results.<n>However, the deployment of these agents in physical environments presents significant safety challenges.<n>This study introduces EARBench, a novel framework for automated physical risk assessment in EAI scenarios.
  arXiv  Detail & Related papers  (2024-08-08T13:19:37Z)
• A Farewell to Harms: Risk Management for Medical Devices via the Riskman Ontology & Shapes [1.2435714232193142]
  We introduce the Riskman ontology & shapes for representing and analysing information about risk management for medical devices. Our proposed methodology has the potential to save many person-hours for both manufacturers and notified bodies.
  arXiv  Detail & Related papers  (2024-05-16T07:53:07Z)
• Leveraging Traceability to Integrate Safety Analysis Artifacts into the Software Development Process [51.42800587382228]
  Safety assurance cases (SACs) can be challenging to maintain during system evolution. We propose a solution that leverages software traceability to connect relevant system artifacts to safety analysis models. We elicit design rationales for system changes to help safety stakeholders analyze the impact of system changes on safety.
  arXiv  Detail & Related papers  (2023-07-14T16:03:27Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.