Product security information guide: Thermo Scientific™ OMNIC™ Paradigm software | version 2.8 | July 2025

Importance of the topic

Modern laboratory software that controls instruments, stores spectral data and supports regulated workflows must balance usability with robust cybersecurity. OMNIC Paradigm v2.8 is a representative example of a domain-specific software package where data integrity, user authentication, auditability and secure connectivity are essential for protecting scientific results, satisfying regulatory requirements such as 21 CFR Part 11 and reducing operational risk in research and QA/QC environments.

Study objectives and overview

This product security information guide documents the security design, deployment options and recommended operational practices for Thermo Fisher Scientific’s OMNIC Paradigm software version 2.8. The guide’s aims are to describe architectural components, authentication and authorization controls, data protection mechanisms, secure development practices, and customer responsibilities for deploying and maintaining secure systems. The document applies only to OMNIC Paradigm v2.8 deployed in customer environments and excludes security details of the optional Thermo Fisher Connect Platform.

Methodology and applied approach

The guide consolidates design decisions, deployment topologies and operational guidance rather than experimental data. Its methodology is descriptive and prescriptive, covering: the system architecture (companion PC and onboard PC deployments), component-level responsibilities, network and firewall recommendations, database options and hardening practices. It also details the secure product development lifecycle used by Thermo Fisher Scientific for OMNIC Paradigm, including static analysis, peer code review, artifact management, penetration testing and vulnerability handling.

Instrumentation used

OMNIC Paradigm v2.8 is designed for use with multiple Thermo Fisher Fourier-transform infrared (FTIR) spectrometers, including:

• Nicolet Summit X, Summit LITE, Summit PRO
• Nicolet S5
• Nicolet iS20 and iS50
• Nicolet iN5
• Nicolet Apex

The software runs on a companion PC (customer- or Thermo-provided) or on an instrument-embedded PC depending on the instrument model. Databases supported include MariaDB (default), Microsoft SQL Server, Amazon Aurora and Oracle; database choice and configuration are the customer’s responsibility.

System architecture and key components

The architecture separates client and server components and supports two primary deployments: an external companion PC and an onboard (embedded) PC within the instrument. Core components and their roles include:

• OMNIC Paradigm client — desktop application on Windows 10/11
• OMNIC Paradigm server — collection of services (Password Manager, Library, Discovery, Workflow, History, Cloud Connection)
• RabbitMQ message bus — AMQP messaging between client and services
• Password Manager — credential storage for back-end services
• History and Workflow services — APIs over HTTPS for prior results and workflow control
• Database — local MariaDB or configured external DB for storing measurements, users and system data

The guide includes connectivity matrices for server-to-client, server-to-database and hardware links (USB for instrument-to-companion PC, Ethernet/Wi‑Fi for instrument network connections and optional Thermo Fisher Connect telemetry).

Authentication, authorization and access controls

OMNIC Paradigm supports local Windows authentication, standard domain (Active Directory) authentication and role-based access control (RBAC) through the Security Suite add-on. Key recommendations include using least-privilege Windows accounts for day-to-day operation, leveraging domain controllers for centralized authentication where available, and configuring RBAC to limit system and data access according to job function. Password policies should follow organizational standards; the installer resets service root passwords and can generate strong credentials for RabbitMQ and MariaDB.

Network security and firewall guidance

Installation configures required firewall rules to permit communication between client and services; the guide provides port mappings in the product user guide. Recommended practices include restricting unused ports, implementing firewall rules that permit only necessary traffic, and validating connectivity when troubleshooting instrument access. For wireless links, WPA2 or WPA3 is recommended.

Data protection: encryption at rest and in transit

Encryption at rest: OMNIC Paradigm stores data in the local MariaDB by default; customers are advised to enable database-provided encryption-at-rest (MariaDB, SQL Server, Aurora, Oracle) and follow vendor-specific configuration steps.

Encryption in transit: inter-process and inter-component traffic uses RabbitMQ over TLS/SSL and HTTPS for web APIs (History service, Cloud telemetry). Telemetry to Thermo Fisher Connect uses HTTPS/TLS 1.2. The product supports importing custom SSL certificates via an administrator configuration utility.

Logging, auditability and remote support

OMNIC Paradigm records user actions, system events and instrument events in an internal audit store. The Security Suite’s Audit Manager provides views and reports of logged security events and supports audit trail capabilities for workflows and tagging. Remote support is delivered via Thermo Fisher-managed third-party remote session tools; internal policies govern secure handling, retention and disposal of customer data accessed during support sessions.

Secure development lifecycle and testing

Thermo Fisher applies a multi-layered secure development approach: secure coding training for developers, static analysis of code at commits, manual peer code reviews, artifact management, CI/CD pipelines and product-specific security assessments. Penetration testing targets core components against OWASP IoT Top 10 threats. Vendor assessments and a risk-based third-party review are used to manage supply-chain security risk.

Vulnerability management, patching and system hardening

The vendor validates and publishes security updates for OMNIC Paradigm and recommends customers apply patches promptly following notification. System hardening practices include applying Center for Internet Security (CIS)-derived Windows hardening scripts, disabling PowerShell on vendor-provided systems and using Windows Defender as the default onboard antivirus. Customers are advised to maintain OS updates, close unused ports and perform regular file system and database backups as part of disaster recovery planning.

Main findings and discussion

The guide demonstrates that OMNIC Paradigm v2.8 incorporates industry-standard security controls across authentication, encryption, logging and development practices. It emphasizes shared responsibility: Thermo Fisher secures product design and provides secure defaults and guidance, while customers must correctly configure network, database encryption, backup regimes, firewall rules and user accounts. Limitations include exclusion of details for the Thermo Fisher Connect Platform and the recognition that no controls can fully eliminate risk; ongoing patching, monitoring and appropriate configuration are essential.

Benefits and practical applications

Adopting the guide’s recommendations delivers these practical benefits:

• Improved data integrity and regulatory readiness (support for audit trails and electronic signatures via Security Suite).
• Reduced attack surface by following least-privilege and hardening recommendations.
• Operational continuity through backup guidance and vendor-provided patch validation.
• Flexibility in deployment (onboard vs companion PC) to meet laboratory workflows and network policies.

Future trends and potential applications

Relevant future directions and opportunities include:

• Tighter integration with cloud platforms under stronger zero-trust models while preserving offline regulatory workflows.
• Broader use of hardware-backed key management and database encryption to simplify compliance for regulated labs.
• Enhanced telemetry and centralized monitoring services with privacy-preserving telemetry options for fleet management and predictive maintenance.
• Continued adoption of automated vulnerability scanning and continuous penetration testing to shorten remediation cycles.

Conclusion

OMNIC Paradigm v2.8 provides a comprehensive, security-conscious architecture suitable for FTIR spectroscopy workflows when installed and configured per vendor guidance. The product combines standard encryption, RBAC, audit logging and a documented secure development lifecycle. Effective risk reduction depends on customers following recommended hardening, patching and backup practices and making informed choices about database configuration and network exposure.

References

1. Thermo Fisher Scientific. OMNIC Paradigm software, version 2.8: Product Security Information Guide. July 2025. Document valid through July 31, 2026.