Aperio GT 450 IT Manager and Lab Administrator Guide, Revision E © Leica Biosystems Imaging, Inc. 2022
37
This chapter discusses how Aperio products protect electronic protected health information (EPHI) and provide protections
against cybersecurity threats. We also discuss the measures you can take to protect client workstations and Aperio servers
on your network. This chapter gives information for IT network administrators, Aperio product administrators, and Aperio
product end users.
Many of the recommendations in this section apply to the Windows-based workstations that are used in conjunction with
the Aperio scanners, and the servers used to host the Aperio applications and components, such as SAM. In these cases,
the security and network settings are configured through the Windows operating system and administrative tools. The
information here is provided for reference only. Refer to your Windows documentation for specific instructions.
In many cases, your facility may require security settings and configurations more restrictive than those listed here. If that is
the case, use the stricter guidelines and requirements dictated by your facility.
i
After installation of the Aperio GT 450 product, the Leica Biosystems representative will turn over to your IT staff
sensitive cybersecurity items such as SSL certificate credentials, SAM server disk encryption key, and so on. The
customer assumes ownership of these items, and it is the customer’s responsibility to safeguard this information
Aperio GT 450 and SAM Cybersecurity Features
Cybersecurity features included in the Aperio GT 450 product protect critical functionality despite cybersecurity compromise.
These include:
`
To reduce cybersecurity vulnerability, the respective operating systems on the Aperio GT 450 VPU and SAM server
are hardened with CIS (Center for Internet Security) benchmarks.
`
The Aperio GT 450 scanner and SAM are not intended to store sensitive data, only to export/upload data to
connected applications on separate network servers. The connection between the Aperio GT 450 scanner and the
SAM server is authenticated through an encrypted, secure SSL/TLS connection.
`
Allow/deny listing is used on the Aperio GT 450 scanner and recommended for use on the SAM server. This
prevents unauthorized software from running on these components.
`
The daily maintenance for the Aperio GT 450 scanner includes rebooting it every day. (See the
Aperio GT 450
User’s
Guide
for details.) This refreshes the firmware.
`
The GT 450 Console.log file contains user login events with user names. It can also show “Possible Intrusion
Detected” in case of log-in discrepancies while accessing the scanner remotely through SSH. For details on
downloading the log files, see
“Working With the Event Log” on page 32.
6
Cybersecurity and Network
Recommendations
