Cybersecurity: Common Questions Answered

by Anže Videnič | 31. 01. 2025 | Ask our experts

Reading Time: 4 minutes

Cybersecurity remains a critical concern in life science software, where protecting sensitive data and ensuring compliance with industry regulations are top priorities. To address key challenges and areas of interest, our experts have provided insights on questions received from our community on the topic of cybersecurity:

Can we use the TPM module to store arbitrary private keys?

Yes, a TPM (Trusted Platform Module) can, in theory, store arbitrary private keys, but several technical limitations and compatibility factors need to be considered. The feasibility depends on multiple aspects, including:

Key properties – The TPM has restrictions on key size, type, and format. It supports specific cryptographic algorithms, such as RSA and ECC, and enforces size limitations. If a key does not align with these specifications, storing and using it within the TPM will not be possible.
TPM module version – Different versions of the TPM (e.g., TPM 1.2 vs. TPM 2.0) have varying capabilities and support for cryptographic functions. TPM 2.0, for instance, introduces more flexibility and additional algorithms compared to TPM 1.2, which may impact whether a specific key can be stored and used effectively.
Operating system compatibility – The OS plays a crucial role in how TPM interacts with applications. Different OS versions provide different levels of TPM support, drivers, and APIs. Some operating systems offer native support for TPM-backed key storage, while others may require additional configuration, libraries, drivers, or tools or lack certain features altogether.
Application integration and tooling – The way an application is designed to interact with the TPM can influence key storage feasibility. If an application lacks TPM integration or uses proprietary key management approaches, additional tooling or modifications may be necessary to utilize the TPM for key storage.

While TPMs provide a robust hardware-based security mechanism, these factors determine whether a TPM can effectively store and manage a given private key. Therefore, careful evaluation and ensuring compatibility are necessary for implementation.

We have an application that we want to use in regulated environments. A requirement is that the user is logged out after a time of inactivity. What are things we need to consider or take care of?

Enforcing automatic logout due to inactivity is a common requirement in regulated environments. Still, the implementation depends on the type of application and how it interacts with other processes or systems. Key considerations include:

Application behavior and dependencies – If the application interacts with external processes, machines, or long-running tasks, an automatic logout that terminates the session might disrupt critical operations. In such cases, implementing a screen lock rather than a full logout is often a better approach. This ensures that sensitive data is protected while allowing essential processes to continue running without interruption.
User session management and data integrity – If the application allows users to make changes that can be safely discarded upon logout, enforcing an automatic logout is a viable option. However, for applications where users need to save work before logging out, implementing session expiration warnings can improve user experience and prevent unintended data loss.

While automatic logout improves security, the right approach depends on how the application operates and interacts with other systems. A well-balanced implementation should enhance security without compromising operational integrity.

How can data be secured when devices are connected to cloud systems?

When exchanging data between on-premises devices and cloud systems, several security measures should be considered. While requirements vary depending on the system, the following best practices help mitigate risks and ensure data integrity:

Securing data in transit – Encrypting data during transmission is fundamental but often overlooked. While HTTPS and SSL/TLS certificates (easily obtainable through services like Let’s Encrypt) provide secure communication, not all protocols offer encryption by default. Ensuring that all data exchanges use secure channels is crucial.
Device authentication and authorization – Cloud systems typically expose API endpoints for data exchange. It’s essential to verify that connected devices are legitimate and restrict their access to only necessary resources. Implementing role-based access control (RBAC) is a best practice to minimize exposure.
Cloud service authentication – Even if you manage both the cloud service and the devices, it’s best to assume that any part of the system could be compromised. Cyberattacks are becoming more sophisticated, and even a simple DNS misconfiguration can reroute sensitive data to an unauthorized third party. Authenticating the cloud service itself helps protect against such risks.
Securing data at rest – Depending on its sensitivity, encrypting stored data may be necessary. Many cloud providers offer built-in encryption features, but these are often optional. Reviewing security configurations and cloud provider’s terms of service is recommended to ensure compliance with data protection requirements.
Using private connections – New VPN protocols, such as WireGuard, simplify the setup and maintenance of secure connections. If data is highly sensitive or the operating environment is considered high-risk, the additional overhead of a VPN is often a worthwhile investment.
Ensuring devices are not a “black box” – Once deployed, devices should be actively monitored and maintained:
- Monitoring for suspicious activity – Real-time monitoring enables quick detection and response to security threats. Modern tools, including machine learning-based anomaly detection, can help identify unusual patterns.
- Regular firmware and software updates – The cybersecurity landscape evolves constantly, and keeping devices up to date is one of the most effective ways to mitigate zero-day vulnerabilities.
Implementing a reliable backup strategy – Regular backups are critical for recovery in case of a breach or failure. If automated backups are not feasible, clear backup instructions should be provided to end users, following best practices such as the 3-2-1 backup strategy (three copies, two different media types, one off-site).
Conducting penetration testing – The best way to assess software security is through penetration testing performed by ethical hackers. External security experts provide unbiased assessments and identify vulnerabilities before attackers can exploit them. Simulating real-world attack scenarios improves system resilience.
User education and awareness – Human error remains the weakest link in security. Regular training on cybersecurity best practices, such as recognizing phishing attempts, significantly reduces the risk of breaches caused by social engineering attacks.

Cybersecurity in life science software comes with unique challenges, but proactive measures can significantly enhance protection. Stay tuned for the next Ask Our Experts topic, where we’ll tackle more key industry questions.