How secure is R and RStudio?

Question

I work at a clinic where we need to pseudonymize patient data. I wrote a small app for this using R (RStudio). R will be installed on computers with access to internet but my idea is to use R offline, i.e. fully blocking it with a firewall in order to prevent hacks on our pseudonymization app.

But before anything gets installed on any computer in our clinic it must be approved by our unit responsible for security. One worker from the unit asked me how the security updates will be installed since I want to use R offline. But I learnt that there are no security updates in R at all. Therefore it seems like my R app will get no approval from the security unit. I am surprised because R and RStudio seem to be widely used in professional context.

I am completely unfamiliar with cyber security. So in simple terms: How secure is the usage of R and RStudio in my context?

Edit

• Internet access: Not the computer itself will be connected to the internet but it will be connected to the local work network.

• "how do you get the data onto your computer to begin with": Data will be entered by the staff. This is also now the case. There will be no need for usb transfer.

Answer 1

Let's chat about the general security model for software.

Other than supply-chain attacks, software does not just wake up one day and decide to have a security incident. Broadly speaking, security incidents happen when a bad guy sends input to your software that causes it do something that it shouldn't. Generally that input comes from a network connection; a web server handling a malicious request, a browser connecting to a malicious website, an SMS app handling a malicious message, etc.

I assume that your R program will not make or receive any network connections of any kind (you imply as much by calling it "offline"), so that entire category of attacks is moot.

You could also consider that the data file it's processing could be crafted to exploit vulnerabilities in the R program, but you can probably convince your security people that your data files are created by your employees and so is a very low-risk attack surface.

Answer 2

How secure is the usage of R and RStudio in my context?

You have not provided enough details about your "context" for anyone to give you a definitive answer.

You said that the R/Shiny computer is not "connected to the Internet." But is it connected to any network whatsoever? E.g., your local work network? If so, then it is connected to some computer that is connected to the Internet.

If it is really not connected to any network whatsoever, it would be referred to as "air gapped." In that case, I would not be very worried about attacks, since most come from the network. But, in that case, how do you get the data onto your computer to begin with? You have to plug in a USB every time you want to look at new data?

If it is air gapped it can not easily receive updates, but this is usually offset by the protection air gapping provides.

Anyways, I think you should just explain what you want to do to your IS team as clearly as you can and then go with their recommendation unless it seems totally crazy.