Managing Software of Unknown Provenance (SOUP) is a major aspect of medical software development, especially under the guidelines of IEC 62304. While SOUP offers developers a way to integrate existing software components, it also introduces several risks that can impact both the security and compliance of the final product. In this blog, we’ll explore some common pitfalls associated with SOUP management and how to make your way through them effectively.

1. Ignoring New Risks When Updating Libraries: 

One of the most overlooked pitfalls in SOUP management is the failure to reassess safety risks when libraries are updated to address security vulnerabilities. While it's common to update libraries for improved security, this process often introduces new risks that require a fresh SOUP analysis. Developers must make sure that every update is accompanied by a thorough review of the associated risks, considering how changes might affect the overall safety and functionality of the software.

When a library is updated, especially due to security vulnerabilities, it’s not just a matter of swapping out one version for another. Each update might introduce changes in the software’s behavior, dependencies, or interaction with other components. For instance, a library designed to manage data encryption might update to address a newly discovered security flaw.

However, this update could alter the way the encryption keys are handled, requiring a reassessment of the software’s overall security posture. Neglecting this step could leave the software vulnerable, defeating the purpose of the update.

2. Overlooking Security Vulnerabilities: 

Security vulnerabilities represent a significant risk in SOUP management. When integrating third-party software, it’s important to continuously monitor for vulnerabilities that could compromise the entire system. This involves not only assessing the known risks associated with the SOUP, but also keeping an eye on new threats that may arise as the software environment evolves. Proactive monitoring and regular updates are essential to mitigating these risks and maintaining compliance with regulatory standards.

In the context of medical devices, where patient safety is paramount, the stakes are even higher. For example, if a SOUP component is used to manage patient data, any security vulnerability could potentially expose sensitive information, leading to regulatory penalties and loss of trust. The challenge is to balance the integration of innovative third-party solutions with rigorous security protocols that support the integrity of the entire system. Regular security assessments, penetration testing, and vulnerability scans should be standard practice, particularly in environments where SOUP is heavily utilised.

Using a Software Composition Analysis (SCA) tool can help identify 

3. The Importance of Package Managers: 

Package managers are indispensable in modern software development because they lead to consistent and reproducible builds. In the context of medical devices, they help manage different versions of packages and libraries, which is vital for maintaining the integrity of the software. Without package managers, tracking and updating the numerous dependencies in a project can become unmanageable, increasing the risk of non-compliance. Package managers help address the challenge of transient dependencies, checking that these do not require individual SOUP analyses, thus simplifying the compliance process.

Package managers like npm (for Node.js), pip (for Python), or Maven (for Java) automate the retrieval, installation, and management of software libraries, making it easier for developers to maintain consistent environments. They also handle the complexities of dependency management, which can be particularly challenging when dealing with multiple libraries that have their own dependencies, also known as transient dependencies. By using package managers, developers can confirm that their software builds are reproducible, meaning that the correct versions of dependencies are used. This consistency is so important for maintaining compliance with IEC 62304 SOUP requirements, which requires that all software components be thoroughly risk assessed.

4. Failing to Update SOUP Analyses: 

In the maintenance phase of software development, there’s often a reluctance to update libraries due to the additional work involved in SOUP analysis and regression testing. This approach can lead to significant security risks as unpatched libraries may harbour vulnerabilities. A proactive strategy involves regularly updating libraries and checking that the corresponding SOUP analysis is also kept up to date. Tools like Coauthor’s Smart SOUP feature can assist in this process by cross-referencing your Software Bill of Materials (SBOM) with your SOUP analysis to identify any gaps.

Maintaining an up-to-date SOUP analysis is not just a regulatory requirement, it’s a big component of your software’s security strategy. Each time a library is updated, it’s important to conduct a fresh analysis to identify any new risks or dependencies that may have been introduced. This can be a time-consuming process, but it must be done so that your software remains secure and compliant over time. By using tools that automate this process, such as Coauthor’s Smart SOUP feature, you can streamline the process and reduce the risk of human error.

5. Misunderstanding Transient Dependencies: 

Transient dependencies, those that are indirectly included in your project through other packages, can complicate SOUP management. You must understand that not all transient dependencies require a separate SOUP analysis. By using package managers effectively, you can manage these dependencies without adding unnecessary complexity to your compliance efforts. The key is to make sure that your primary dependencies are well-documented and that their transient dependencies are recognised within your overall risk management framework.

For instance, if your software uses a library for data encryption that, in turn, depends on a lower-level library for mathematical computations, the latter is a transient dependency. It is often unnecessary to perform a full SOUP analysis on these transient dependencies, provided they are well-documented and have a strong security track record. Package managers simplify this process by automatically handling these dependencies and making sure that they are included in your software build in a consistent and secure manner.

Conclusion

Through avoiding these common pitfalls, such as failing to reassess risks with library updates, overlooking security vulnerabilities, and misunderstanding the role of package managers, you can maintain a robust compliance strategy. Incorporating tools like Coauthor can further streamline this process, allowing you to focus on innovation while maintaining the highest standards of quality and safety.