Product security information guide: Thermo Scientific™ OMNIC™ Paradigm software | version 2.8 | July 2025

Significance of the topic

Effective cybersecurity for laboratory software is essential to protect analytical data integrity, ensure regulatory compliance and maintain instrument availability. OMNIC Paradigm 2.8 is an integrated spectroscopy software suite that collects, processes and stores FTIR measurement data; therefore its secure deployment and lifecycle management directly affect research reproducibility, quality systems (including 21 CFR Part 11 requirements) and operational continuity in regulated and industrial environments.

Objectives and overview of the document

This product security information guide documents the security posture, architecture, recommended configurations and lifecycle practices for Thermo Scientific OMNIC Paradigm software version 2.8. The guide is aimed at customers deploying the software within their environments and describes: scope and applicability, system and network architectures (companion PC and onboard PC deployments), security features (authentication, authorization, encryption, logging), secure development and maintenance practices, and operational recommendations. It clarifies that the guide is advisory, does not extend contractual terms and that the customer retains responsibility for final configuration and risk management.

Methodology and instrumentation used

The document summarizes the system architecture and components used by OMNIC Paradigm 2.8 and describes recommended operational practices rather than experimental methods. Key instrumentation and hardware/software elements referenced include:

• Supported FTIR instruments: Nicolet Summit X, Summit LITE, Summit PRO, S5, iS20, iS50, iN5 and Apex.
• Deployment models: separate companion PC (external PC hosts full application) and onboard PC (instrument-embedded PC running server components).
• Databases: built-in MariaDB by default; compatible alternatives include Microsoft SQL Server, Amazon Aurora and Oracle. Customers are responsible for provisioning and configuring databases per vendor guidance.
• Communication and middleware: RabbitMQ message bus (AMQP) for messaging; Password Manager, Library, Discovery, Workflow, History and Thermo Fisher Cloud Connection services as server components; web APIs exposed over HTTPS.
• Operating systems: Windows 10 supported on embedded or companion PC; Windows 11 supported for companion PC only (note Nicolet Summit embedded PC currently not compatible with Windows 11).

Main results and discussion

The guide presents a consolidated security configuration and operational baseline: authentication options (local Windows or domain authentication), role-based access control via the Security Suite, and recommendations to operate under least-privilege Windows accounts. Network controls and firewall rules are documented for the services and ports used; customers should restrict unused ports and apply standard network hardening.

Encryption recommendations include enabling database-at-rest encryption for MariaDB or selected database engines and using TLS (HTTPS) for telemetry and web API traffic (TLS 1.2 minimum). OMNIC Paradigm supports importing SSL certificates via a configuration utility intended for administrators.

Logging and audit capabilities are provided through an Audit Manager that captures user actions, system events and instrument events. Remote support uses Thermo Fisher–managed third-party remote session tools with policies for secure handling of customer data.

Secure development practices described include static analysis on commits, peer code review, artifact management, CI/CD pipelines, penetration testing against OWASP IoT Top 10, vendor assessments and security-focused product assessments. System hardening measures are applied to Thermo Fisher–provided PCs (CIS-derived Windows hardening scripts, disabling PowerShell, Windows Defender deployment).

Maintenance guidance emphasizes vulnerability and patch management, backing up database and file systems for disaster recovery, and reporting security issues through the vendor process. The guide also documents limitations: security guidance does not guarantee elimination of all risks and customers retain responsibility to validate configurations and remediate exposures.

Benefits and practical applications of the method

The documented controls and recommendations provide practical benefits for laboratories and organizations:

• Improved data integrity and auditability supporting regulatory frameworks (e.g., 21 CFR Part 11) via Security Suite audit trails and electronic signature management.
• Operational resilience by following prescribed hardening, backup and patching procedures to reduce downtime and data loss risk.
• Scalable deployment options (companion PC vs onboard PC) to suit laboratory architecture and network policies.
• Integration readiness: API-driven workflows and RabbitMQ messaging facilitate automation and downstream integration with LIMS or analytics platforms.

Future trends and potential applications

Key directions for enhancing software security and operational value include:

• Stronger Zero Trust architecture patterns: per-service authentication, microsegmentation and continuous verification for instrument and client communications.
• Cloud-native and hybrid deployment models with hardened cloud database offerings and managed security services to centralize telemetry, monitoring and backups.
• Advanced telemetry and SIEM integration for continuous monitoring, anomaly detection and automated response to instrument or data-layer threats.
• Automated certificate management and support for modern TLS versions and cipher suites, plus hardware-backed key storage for improved key protection.
• Containerization of back-end services (where feasible) to improve update/rollback mechanisms and isolate components.
• Stronger supply-chain and third-party component tracking, including SBOM (software bill of materials) publication and rapid vulnerability response workflows.

Conclusion

Thermo Scientific OMNIC Paradigm 2.8 provides a comprehensive set of security-capable features and deployment guidance aimed at protecting spectral data and instrument access. The guide outlines practical recommendations across authentication, authorization, encryption, logging, secure development and maintenance. While the vendor supplies secure defaults and testing practices, the responsibility for final configuration, patching cadence and local risk management resides with the customer. Adopting the guide’s recommendations will materially reduce common exposure vectors and help meet regulatory and operational requirements when combined with local IT governance and routine security lifecycle practices.

Reference

Thermo Fisher Scientific. 2025. Thermo Scientific OMNIC Paradigm software, version 2.8: Product security information guide. Document valid through July 31, 2026. Contact: [email protected]