Black-Box Cybersecurity Assessment of Software as a Medical Device (SaMD): A Case Study

Abstract

Based on Sommerville’s robust software reliability theory and eight design principles based on best practices (DPG), this study conducted a comparative assessment of two Dexcom software platforms: the Dexcom Clarity web portal and the Dexcom ONE+ iPhone application. The first phase of the study employed a “black-box” assessment framework, combining off-the-shelf security analysis tools with application-layer behavioral testing workflows developed specifically for this project. The initial two phases focused on the web portal, analyzing communication encryption and HTTP security header configurations. Subsequent phases involved a more in-depth implementation assessment, focusing on actual interactive features, data types, and automated responses triggered by glucose sensor alerts within the application. However, this approach also revealed that certain system elements required access to the source code for verification. The resulting workflow enables the assessment of all externally visible security attributes while identifying system components that necessitate source code access for validation. Of the eight assessment criteria, four were found to have issues, either in whole or in part. Key issues identified include: session cookies missing the SameSite attribute (G1); acceptance of clinically abnormal carbohydrate values without rejection or warning (G2); inclusion of the unsafe-inline directive in the Content Security Policy (CSP), increasing the risk of Cross-Site Scripting (XSS) attacks (G4); and the absence of a dedicated alert mechanism for Wi-Fi connectivity loss during critical medical functions (G7). Due to the requirement for source code access, this “black-box” approach could not evaluate the remaining four criteria (G3, G5, G6, and G8). Finally, this paper presents a re-producible evaluation procedure and offers applicable, standards-compliant mitigation recommendations for each identified issue.