{ "type": "bundle", "id": "bundle--718a4bfe-81ef-597e-9381-01baccb9747d", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "name": "Jonathan Brett Crawley", "identity_class": "individual", "contact_information": "https://ostering.com/" }, { "type": "extension-definition", "spec_version": "2.1", "id": "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3", "created": "2026-10-26T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "name": "ostering.com threat taxonomy properties", "description": "Properties of an entry in an ostering.com threat taxonomy: its stable reference, group, STRIDE and LINDDUN categories, mitigation principle, design measures and prompts.", "schema": "https://ostering.com/taxonomies/ostering-taxonomy-stix-extension.schema.json", "version": "1.3.0", "extension_types": [ "property-extension" ] }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "created": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "name": "Hospital and Medical Device Threat Taxonomy licence", "definition_type": "statement", "definition": { "statement": "© 2026 Jonathan Brett Crawley. Hospital and Medical Device Threat Taxonomy v1.0, licensed under CC BY-NC-ND 4.0 with additional permissions: threat modeling with it (including for paying clients), internal use and training, and quoting entries with credit are allowed; shipping it in a product needs written permission. Terms: https://ostering.com/taxonomies/hospitals-and-medical-devices/#licence" } }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487", "created": "2022-10-01T00:00:00.000Z", "name": "TLP:CLEAR", "extensions": { "extension-definition--60a3c5c5-0d10-413e-aab3-9e08dde9e88d": { "extension_type": "property-extension", "tlp_2_0": "clear" } } }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--087ba118-60af-55f7-a5a3-02e5c3e70e21", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unauthenticated therapy commands over the air", "description": "The implant accepts programming commands over its radio link without proving the programmer is genuine. Anyone within range with a suitable transmitter could change pacing, stop therapy or deliver a shock.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-594", "url": "https://capec.mitre.org/data/definitions/594.html", "description": "Traffic Injection" }, { "source_name": "capec", "external_id": "CAPEC-216", "url": "https://capec.mitre.org/data/definitions/216.html", "description": "Communication Channel Manipulation" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "Manipulation of Control" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "Medtronic Conexus telemetry, 2019", "url": "https://cisa.gov/ics/advisories/ICSMA-19-080-01", "description": "CISA: ICS Medical Advisory ICSMA-19-080-01" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-A", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "S", "T", "E" ], "mds2": [ "NAUT", "AUTH", "TXIG" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How does the implant know the programmer talking to it is genuine?", "Which therapy changes can be made over the radio link at all?", "What stops a nearby transmitter injecting a programming command?" ], "seen_in": [ "Medtronic Conexus telemetry, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--fc3385ec-0040-527e-b84a-c206dff7f68f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-A mitigation: Unauthenticated therapy commands over the air", "description": "An implant acts only on commands from a programmer it has authenticated, over a link protected for integrity.\n\n1. Require mutual authentication between implant and programmer before any therapy-changing command is accepted.\n2. Protect every command with message integrity and freshness so injected or altered commands are rejected.\n3. Limit the commands available over long-range radio; keep therapy changes to close-range sessions.\n4. Log every programming session in the implant for review at the next follow-up.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-A", "mitigation_principle": "An implant acts only on commands from a programmer it has authenticated, over a link protected for integrity.", "design_measures": [ "Require mutual authentication between implant and programmer before any therapy-changing command is accepted.", "Protect every command with message integrity and freshness so injected or altered commands are rejected.", "Limit the commands available over long-range radio; keep therapy changes to close-range sessions.", "Log every programming session in the implant for review at the next follow-up." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--12f22c99-11e1-51df-ae6a-8b9feedcfc4a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fc3385ec-0040-527e-b84a-c206dff7f68f", "target_ref": "attack-pattern--087ba118-60af-55f7-a5a3-02e5c3e70e21" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7175ace0-7eb9-5b27-991b-b9c26d13db6e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Malicious firmware loaded into the body", "description": "Firmware for the implant can be installed from a programmer or home transmitter without verifying who signed it. A modified build changes therapy or bricks the device, and the only recovery is surgery to replace it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-669", "url": "https://capec.mitre.org/data/definitions/669.html", "description": "Alteration of a Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T1495", "url": "https://attack.mitre.org/techniques/T1495/", "description": "Firmware Corruption" }, { "source_name": "mitre-emb3d", "external_id": "TID-211", "url": "https://emb3d.mitre.org/threats/TID-211.html", "description": "Device Allows Unauthenticated Firmware Installation" }, { "source_name": "mitre-emb3d", "external_id": "TID-213", "url": "https://emb3d.mitre.org/threats/TID-213.html", "description": "Faulty FW/SW Update Integrity Verification" }, { "source_name": "mitre-emb3d", "external_id": "TID-216", "url": "https://emb3d.mitre.org/threats/TID-216.html", "description": "Firmware Update Rollbacks Allowed" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "Abbott (St. Jude Medical) pacemakers, 2017", "url": "https://www.helpnetsecurity.com/2017/08/31/pacemakers-firmware-update/", "description": "Help Net Security: Patients with St. Jude pacemakers called in for firmware update" }, { "source_name": "Abbott (St. Jude Medical) pacemakers, 2017", "url": "https://www.csoonline.com/article/3222068/465000-abbott-pacemakers-vulnerable-to-hacking-need-a-firmware-fix.html", "description": "CSO: 465,000 Abbott pacemakers vulnerable to hacking need a firmware fix" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-K", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "T", "E", "D" ], "mds2": [ "IGAU", "CSUP" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Who signs implant firmware, and where does the implant check it?", "Can an older, weaker firmware version be installed again?", "What happens to therapy if an update fails part way?" ], "seen_in": [ "Abbott (St. Jude Medical) pacemakers, 2017" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--892c47ee-9e18-5af6-9bc0-1ad1c270d01d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-K mitigation: Malicious firmware loaded into the body", "description": "Implant firmware is accepted only when signed by the manufacturer and is never allowed to roll back to a weaker version.\n\n1. Verify a manufacturer signature in the implant before installing any firmware, whatever channel delivered it.\n2. Refuse rollback to earlier firmware with known vulnerabilities.\n3. Keep a protected fallback image and safe therapy mode if an update fails or is interrupted.\n4. Restrict firmware installation to in-clinic sessions with a clinician present unless risk analysis justifies remote delivery.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-K", "mitigation_principle": "Implant firmware is accepted only when signed by the manufacturer and is never allowed to roll back to a weaker version.", "design_measures": [ "Verify a manufacturer signature in the implant before installing any firmware, whatever channel delivered it.", "Refuse rollback to earlier firmware with known vulnerabilities.", "Keep a protected fallback image and safe therapy mode if an update fails or is interrupted.", "Restrict firmware installation to in-clinic sessions with a clinician present unless risk analysis justifies remote delivery." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb59e06e-e4f5-5da7-8f96-34d5781c773c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--892c47ee-9e18-5af6-9bc0-1ad1c270d01d", "target_ref": "attack-pattern--7175ace0-7eb9-5b27-991b-b9c26d13db6e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--984a62cd-2846-507a-88a9-3160a3d38b15", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remote monitoring cloud controls thousands", "description": "Home transmitters link implants to the manufacturer's cloud for follow-up and updates. If that cloud or its update path is compromised, an attacker reaches every connected patient at once: harvesting their data, altering transmitters or pushing changes towards implants.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-187", "url": "https://capec.mitre.org/data/definitions/187.html", "description": "Malicious Automated Software Update via Redirection" }, { "source_name": "capec", "external_id": "CAPEC-439", "url": "https://capec.mitre.org/data/definitions/439.html", "description": "Manipulation During Distribution" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "mitre-attack", "external_id": "T1195.002", "url": "https://attack.mitre.org/techniques/T1195/002/", "description": "Compromise Software Supply Chain" }, { "source_name": "mitre-emb3d", "external_id": "TID-303", "url": "https://emb3d.mitre.org/threats/TID-303.html", "description": "Excessive Trust in Offboard Management/IDE Software" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-Q", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "S", "T", "I", "E" ], "linddun": [ "DD", "L" ], "mds2": [ "RMOT", "NAUT", "CONN" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What can the monitoring cloud actually change in a patient's implant?", "How many patients would one cloud compromise reach?", "Who reviews changes pushed to home transmitters before release?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8bc41176-d2e5-551b-b554-a1888bf88e25", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-Q mitigation: Remote monitoring cloud controls thousands", "description": "A compromise of the remote monitoring service cannot change therapy in the body or reach all patients at once.\n\n1. Never let the cloud issue therapy changes; reserve them for authenticated clinician sessions.\n2. Sign transmitter updates offline and verify them on the transmitter, so cloud compromise alone cannot push code.\n3. Segment the service by region and clinic, and rate-limit any fleet-wide action with human approval.\n4. Encrypt implant data end to end from transmitter to the clinic, not only to the cloud.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-Q", "mitigation_principle": "A compromise of the remote monitoring service cannot change therapy in the body or reach all patients at once.", "design_measures": [ "Never let the cloud issue therapy changes; reserve them for authenticated clinician sessions.", "Sign transmitter updates offline and verify them on the transmitter, so cloud compromise alone cannot push code.", "Segment the service by region and clinic, and rate-limit any fleet-wide action with human approval.", "Encrypt implant data end to end from transmitter to the clinic, not only to the cloud." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8e995a5d-80a5-5512-bed0-fce1df5e1264", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8bc41176-d2e5-551b-b554-a1888bf88e25", "target_ref": "attack-pattern--984a62cd-2846-507a-88a9-3160a3d38b15" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4ab581e6-43d0-507d-8ae3-b1fcc6a086e7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Locked out in an emergency", "description": "Locking the implant to authenticated programmers can stop an emergency team reading or adjusting it for an unconscious patient far from their clinic. Leaving it open to any programmer instead leaves it open to anyone. Either design can harm the patient.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-J", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "S", "E", "D" ], "mds2": [ "EMRG", "AUDT", "PAUT" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How does an emergency team read this implant far from its clinic?", "What can emergency access change, and for how long?", "Where is an emergency session recorded, and who reviews it?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4c2591a2-be20-54ec-ae19-ccca4a8aa176", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-J mitigation: Locked out in an emergency", "description": "Emergency access is a deliberate, narrow and logged path, designed with clinicians, not a side effect of weak authentication.\n\n1. Provide an emergency mode that needs close physical proximity, such as an inductive or magnet trigger, and expires quickly.\n2. Limit emergency mode to reading status and applying safe therapy settings.\n3. Record every emergency session in the implant and report it at the next follow-up.\n4. Give patients an ID card and publish the emergency procedure for emergency departments worldwide.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-J", "mitigation_principle": "Emergency access is a deliberate, narrow and logged path, designed with clinicians, not a side effect of weak authentication.", "design_measures": [ "Provide an emergency mode that needs close physical proximity, such as an inductive or magnet trigger, and expires quickly.", "Limit emergency mode to reading status and applying safe therapy settings.", "Record every emergency session in the implant and report it at the next follow-up.", "Give patients an ID card and publish the emergency procedure for emergency departments worldwide." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--14a82eb6-cc67-5013-87d2-59bafafdfca8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4c2591a2-be20-54ec-ae19-ccca4a8aa176", "target_ref": "attack-pattern--4ab581e6-43d0-507d-8ae3-b1fcc6a086e7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9caed72b-546e-5b66-9dd3-08680e8c326e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Replayed programming sessions", "description": "Programming messages carry no freshness check, so a recorded session can be played back later. A therapy change the patient once needed is reapplied when it is no longer safe, or a reset is repeated.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "cwe", "external_id": "CWE-294", "url": "https://cwe.mitre.org/data/definitions/294.html", "description": "Authentication Bypass by Capture-replay" }, { "source_name": "mitre-attack", "external_id": "T0830", "url": "https://attack.mitre.org/techniques/T0830/", "description": "Adversary-in-the-Middle" }, { "source_name": "mitre-emb3d", "external_id": "TID-407", "url": "https://emb3d.mitre.org/threats/TID-407.html", "description": "Missing Message Replay Protection" }, { "source_name": "mitre-emb3d", "external_id": "TID-221", "url": "https://emb3d.mitre.org/threats/TID-221.html", "description": "Authentication Bypass By Message Replay" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-10", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "S", "T" ], "mds2": [ "TXIG", "NAUT" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What makes each programming command unusable a second time?", "How is a command tied to one programming session?", "Would the implant notice a recorded session played back next week?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1acd0bbb-39e4-573a-8b67-76f0b8191e18", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-10 mitigation: Replayed programming sessions", "description": "Every programming command is fresh, bound to one session and useless if replayed.\n\n1. Bind commands to a session key agreed at the start of each authenticated session.\n2. Use counters or nonces so the implant rejects any message it has already processed.\n3. Expire sessions on a short timer and when the programmer moves out of range.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-10", "mitigation_principle": "Every programming command is fresh, bound to one session and useless if replayed.", "design_measures": [ "Bind commands to a session key agreed at the start of each authenticated session.", "Use counters or nonces so the implant rejects any message it has already processed.", "Expire sessions on a short timer and when the programmer moves out of range." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6de80ae-a805-55dd-ae90-1fd31d14fe91", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1acd0bbb-39e4-573a-8b67-76f0b8191e18", "target_ref": "attack-pattern--9caed72b-546e-5b66-9dd3-08680e8c326e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c5bbafb7-dc29-5761-8c21-49277089568d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Magnet and test modes as backdoors", "description": "Magnet modes, factory test commands and undocumented engineering functions stay reachable in released implants. They suspend shocks, force fixed-rate pacing or expose memory without any electronic authentication, and few clinicians know they exist.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-36", "url": "https://capec.mitre.org/data/definitions/36.html", "description": "Using Unpublished Interfaces or Functionality" }, { "source_name": "capec", "external_id": "CAPEC-121", "url": "https://capec.mitre.org/data/definitions/121.html", "description": "Exploit Non-Production Interfaces" }, { "source_name": "cwe", "external_id": "CWE-912", "url": "https://cwe.mitre.org/data/definitions/912.html", "description": "Hidden Functionality" }, { "source_name": "cwe", "external_id": "CWE-1269", "url": "https://cwe.mitre.org/data/definitions/1269.html", "description": "Product Released in Non-Release Configuration" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "Change Operating Mode" }, { "source_name": "mitre-emb3d", "external_id": "TID-224", "url": "https://emb3d.mitre.org/threats/TID-224.html", "description": "Excessive Access via Software Diagnostic Features" }, { "source_name": "mitre-emb3d", "external_id": "TID-401", "url": "https://emb3d.mitre.org/threats/TID-401.html", "description": "Undocumented Protocol Features" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-9", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "T", "E" ], "mds2": [ "SAHD", "AUDT" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which magnet, test or engineering modes remain in the released implant?", "Who knows these modes exist, and are they documented for clinicians?", "Can any of these modes be triggered without authentication?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ec9d678c-a07c-521b-b222-7cebfca611d4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-9 mitigation: Magnet and test modes as backdoors", "description": "Every mode that changes therapy is documented, intended for clinical use and controlled; nothing from manufacturing survives in release.\n\n1. Remove or permanently lock factory test and debug commands before implantation.\n2. Document every magnet and special mode and its clinical effect in the labelling.\n3. Log entry into special modes and show it at the next interrogation.\n4. Test released firmware for undocumented commands as part of security verification.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-9", "mitigation_principle": "Every mode that changes therapy is documented, intended for clinical use and controlled; nothing from manufacturing survives in release.", "design_measures": [ "Remove or permanently lock factory test and debug commands before implantation.", "Document every magnet and special mode and its clinical effect in the labelling.", "Log entry into special modes and show it at the next interrogation.", "Test released firmware for undocumented commands as part of security verification." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--56567f24-1116-53a8-b163-356257b57676", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ec9d678c-a07c-521b-b222-7cebfca611d4", "target_ref": "attack-pattern--c5bbafb7-dc29-5761-8c21-49277089568d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a60091bb-7005-5333-b1bd-752410bd2b66", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Abandoned implants", "description": "The manufacturer leaves the market, is sold or stops supporting a product. Patients keep an implant that no clinic can program, no one patches and no one answers for, and replacing it means surgery.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-682", "url": "https://capec.mitre.org/data/definitions/682.html", "description": "Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities" }, { "source_name": "cwe", "external_id": "CWE-1277", "url": "https://cwe.mitre.org/data/definitions/1277.html", "description": "Firmware Not Updateable" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "Argus II retinal implant, 2020", "url": "https://spectrum.ieee.org/bionic-eye-obsolete", "description": "IEEE Spectrum: Their bionic eyes are now obsolete and unsupported" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-8", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "D" ], "mds2": [ "RDMP", "CSUP" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who programs and patches this implant if the maker stops supporting it?", "Is support promised for the full life of the patient's device?", "What would patients and clinics be told if the product were withdrawn?" ], "seen_in": [ "Argus II retinal implant, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b16dcf35-0bbf-5d13-855e-ea612d47f131", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-8 mitigation: Abandoned implants", "description": "Support for an implant is planned for the life of the patient's device, including what happens if the manufacturer cannot provide it.\n\n1. Publish an end-of-support date and a support plan covering programmers, updates and vulnerability handling.\n2. Escrow programmer software, keys and specifications so a successor or regulator can support patients.\n3. Design implants to keep safe default therapy if their programmers and services disappear.\n4. Tell patients and clinicians early when support is ending, with options.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-8", "mitigation_principle": "Support for an implant is planned for the life of the patient's device, including what happens if the manufacturer cannot provide it.", "design_measures": [ "Publish an end-of-support date and a support plan covering programmers, updates and vulnerability handling.", "Escrow programmer software, keys and specifications so a successor or regulator can support patients.", "Design implants to keep safe default therapy if their programmers and services disappear.", "Tell patients and clinicians early when support is ending, with options." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9559a34-02fe-55b9-8a21-3ad12c6df102", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b16dcf35-0bbf-5d13-855e-ea612d47f131", "target_ref": "attack-pattern--a60091bb-7005-5333-b1bd-752410bd2b66" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a36a003b-3e26-5709-b3aa-67043cd61d74", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Battery drained by wake-ups", "description": "The implant's radio can be woken by unauthenticated requests. Repeated wake-ups drain a battery that cannot be recharged, forcing early replacement surgery and, before that, possible loss of therapy.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "cwe", "external_id": "CWE-799", "url": "https://cwe.mitre.org/data/definitions/799.html", "description": "Improper Control of Interaction Frequency" }, { "source_name": "mitre-attack", "external_id": "T1499", "url": "https://attack.mitre.org/techniques/T1499/", "description": "Endpoint Denial of Service" }, { "source_name": "mitre-emb3d", "external_id": "TID-405", "url": "https://emb3d.mitre.org/threats/TID-405.html", "description": "Network Stack Resource Exhaustion" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-7", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "D" ], "mds2": [ "CONN", "NAUT" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Can an unauthenticated request wake the implant's radio?", "How much battery could repeated wake-ups cost over a month?", "Would the clinic notice unusual radio activity draining the battery?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a85078bc-04d9-5b63-b0bf-410a1aa8ec60", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-7 mitigation: Battery drained by wake-ups", "description": "Unauthenticated traffic cannot make the implant spend meaningful energy.\n\n1. Keep the radio asleep until a close-range, low-energy wake mechanism or a scheduled window.\n2. Rate-limit wake-ups and authentication attempts, and back off sharply after failures.\n3. Track energy spent on communication and raise an alert at follow-up if it is abnormal.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-7", "mitigation_principle": "Unauthenticated traffic cannot make the implant spend meaningful energy.", "design_measures": [ "Keep the radio asleep until a close-range, low-energy wake mechanism or a scheduled window.", "Rate-limit wake-ups and authentication attempts, and back off sharply after failures.", "Track energy spent on communication and raise an alert at follow-up if it is abnormal." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f0fc5c6-761c-5fc0-95eb-ee191b30ebad", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a85078bc-04d9-5b63-b0bf-410a1aa8ec60", "target_ref": "attack-pattern--a36a003b-3e26-5709-b3aa-67043cd61d74" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e23bebac-df8d-5bc2-b473-5dabdc43f24b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Silent remote follow-up", "description": "The home transmitter stops sending, is unplugged, loses its connection or sends stale data, and the clinic treats no news as good news. Alerts for arrhythmias, lead faults or low battery are missed for weeks.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "Loss of View" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-6", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "D", "T" ], "mds2": [ "CONN", "IGAU" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does the clinic learn that a transmitter has gone silent?", "Who is told when follow-up data stops or goes stale?", "Does no news get treated as good news anywhere in this process?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--45b87e16-352c-5a2a-9cff-c4d6908a4115", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-6 mitigation: Silent remote follow-up", "description": "Loss of remote follow-up is itself an alert, raised to the clinic and the patient.\n\n1. Expect a heartbeat from every transmitter and alert the clinic when one is overdue.\n2. Timestamp and sequence readings so stale or repeated data is visible.\n3. Tell the patient on the transmitter or their phone when it cannot reach the service.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-6", "mitigation_principle": "Loss of remote follow-up is itself an alert, raised to the clinic and the patient.", "design_measures": [ "Expect a heartbeat from every transmitter and alert the clinic when one is overdue.", "Timestamp and sequence readings so stale or repeated data is visible.", "Tell the patient on the transmitter or their phone when it cannot reach the service." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b9c0a2c6-cb2e-5f52-9704-7b5b084e7798", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--45b87e16-352c-5a2a-9cff-c4d6908a4115", "target_ref": "attack-pattern--e23bebac-df8d-5bc2-b473-5dabdc43f24b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--32785976-a042-5ac1-b188-4cf4522882ea", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Clinic programmer as the weak link", "description": "Clinic programmers run old operating systems, use shared logins and leave the building with field staff. They hold keys and patient data, and a stolen or compromised programmer can reprogram any implant of that make.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-191", "url": "https://capec.mitre.org/data/definitions/191.html", "description": "Read Sensitive Constants Within an Executable" }, { "source_name": "cwe", "external_id": "CWE-321", "url": "https://cwe.mitre.org/data/definitions/321.html", "description": "Use of Hard-coded Cryptographic Key" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "mitre-emb3d", "external_id": "TID-214", "url": "https://emb3d.mitre.org/threats/TID-214.html", "description": "Secrets Extracted from Device Root of Trust" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-5", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "S", "I", "E" ], "linddun": [ "DD" ], "mds2": [ "PAUT", "PLOK", "SAHD" ], "deck": "The Patient", "rank": "5", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What secrets does a clinic programmer hold, and could one unlock every implant?", "Who may use the programmer, and how is each use attributed?", "What happens when a programmer is lost or stolen?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--deece510-1814-5d98-8159-24ff1a3c707e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-5 mitigation: Clinic programmer as the weak link", "description": "A programmer holds no secret that unlocks every implant, and its use is tied to a named, authorised clinician.\n\n1. Use per-device or per-session keys issued by a back end, not a fixed key shared by every programmer.\n2. Require clinician login on the programmer and revoke lost or stolen programmers remotely.\n3. Harden and patch the programmer's operating system, and encrypt patient data stored on it.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-5", "mitigation_principle": "A programmer holds no secret that unlocks every implant, and its use is tied to a named, authorised clinician.", "design_measures": [ "Use per-device or per-session keys issued by a back end, not a fixed key shared by every programmer.", "Require clinician login on the programmer and revoke lost or stolen programmers remotely.", "Harden and patch the programmer's operating system, and encrypt patient data stored on it." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5558ac06-0280-51f9-ab3d-b8b2a5d1dc2a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--deece510-1814-5d98-8159-24ff1a3c707e", "target_ref": "attack-pattern--32785976-a042-5ac1-b188-4cf4522882ea" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9f3798ff-8ac7-5d08-8ffb-b8db782a079a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telemetry reveals the patient", "description": "Implant telemetry and home transmitter traffic travel unencrypted. Anyone nearby with a receiver learns the device serial, the patient's identity or diagnosis and their heart data.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1040", "url": "https://attack.mitre.org/techniques/T1040/", "description": "Network Sniffing" }, { "source_name": "mitre-emb3d", "external_id": "TID-408", "url": "https://emb3d.mitre.org/threats/TID-408.html", "description": "Unencrypted Sensitive Data Communication" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "Medtronic Conexus telemetry, 2019", "url": "https://cisa.gov/ics/advisories/ICSMA-19-080-01", "description": "CISA: ICS Medical Advisory ICSMA-19-080-01" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-4", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "I" ], "linddun": [ "I", "DD", "L" ], "mds2": [ "TXCF" ], "deck": "The Patient", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "What can a listener learn from implant or transmitter traffic?", "Is the patient's identity or diagnosis visible on the radio link?", "Which links between implant, transmitter and cloud are encrypted?" ], "seen_in": [ "Medtronic Conexus telemetry, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--62e96057-b2a9-5a77-b8e6-737d78aefc1d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-4 mitigation: Telemetry reveals the patient", "description": "Implant and transmitter traffic reveals nothing about the patient to a listener.\n\n1. Encrypt all telemetry carrying patient or device identifiers.\n2. Avoid sending names or diagnoses over the radio; use identifiers the clinic resolves.\n3. Verify encryption on the air during security testing, not only in the design.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-4", "mitigation_principle": "Implant and transmitter traffic reveals nothing about the patient to a listener.", "design_measures": [ "Encrypt all telemetry carrying patient or device identifiers.", "Avoid sending names or diagnoses over the radio; use identifiers the clinic resolves.", "Verify encryption on the air during security testing, not only in the design." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--aacef953-8dce-5f94-8b66-51639c30b921", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--62e96057-b2a9-5a77-b8e6-737d78aefc1d", "target_ref": "attack-pattern--9f3798ff-8ac7-5d08-8ffb-b8db782a079a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7aeca888-46ee-597b-88e3-3a3df7e31d00", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Radio identifiers track the patient", "description": "The implant or its transmitter broadcasts a fixed identifier. It can be used to detect that a person carries a cardiac or neurological implant and to follow them between places.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-651", "url": "https://capec.mitre.org/data/definitions/651.html", "description": "Eavesdropping" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-3", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "I" ], "linddun": [ "L", "I", "D" ], "mds2": [ "CONN", "TXCF" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Does the implant or transmitter broadcast a fixed identifier?", "Could a stranger tell that someone carries an implant?", "How would you stop the radio being used to follow a patient?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--67184a4b-e4bc-54b3-8a08-262c1ab09230", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-3 mitigation: Radio identifiers track the patient", "description": "The radio does not let a stranger recognise or follow the patient.\n\n1. Advertise only when a session is wanted, and with rotating identifiers.\n2. Keep fixed serial numbers inside the encrypted session.\n3. Review radio behaviour against tracking during privacy impact assessment.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-3", "mitigation_principle": "The radio does not let a stranger recognise or follow the patient.", "design_measures": [ "Advertise only when a session is wanted, and with rotating identifiers.", "Keep fixed serial numbers inside the encrypted session.", "Review radio behaviour against tracking during privacy impact assessment." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0176c35b-2149-5afc-827c-14cc78d13fe1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--67184a4b-e4bc-54b3-8a08-262c1ab09230", "target_ref": "attack-pattern--7aeca888-46ee-597b-88e3-3a3df7e31d00" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--75449621-4749-553a-af54-d011b7feaee3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No route for researchers' findings", "description": "Researchers and patients who find flaws in an implant have no clear way to report them, so issues stay unfixed, reach the public without a fix, or are sold. Clinicians learn about them from the news.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/#cri-im-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-188", "url": "https://capec.mitre.org/data/definitions/188.html", "description": "Reverse Engineering" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-2", "group_code": "IM", "group_name": "Implants and Programmers", "stride": [ "R", "I" ], "mds2": [ "SGUD", "CSUP" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "How does a researcher or patient report a flaw in this implant?", "Who tells clinicians and patients what to do about a reported flaw?", "How long does a reported implant flaw usually take to fix?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--0888d9ba-2cdc-5e11-8afb-4ea71346c747", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IM-2 mitigation: No route for researchers' findings", "description": "The manufacturer runs coordinated vulnerability disclosure and tells clinicians and patients what to do.\n\n1. Publish a vulnerability disclosure policy and a monitored contact, and acknowledge reports promptly.\n2. Agree timelines for fixes and advisories with regulators and reporters.\n3. Send clinicians clear guidance on clinical risk and actions when an advisory is issued.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IM-2", "mitigation_principle": "The manufacturer runs coordinated vulnerability disclosure and tells clinicians and patients what to do.", "design_measures": [ "Publish a vulnerability disclosure policy and a monitored contact, and acknowledge reports promptly.", "Agree timelines for fixes and advisories with regulators and reporters.", "Send clinicians clear guidance on clinical risk and actions when an advisory is issued." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8da5dae2-2b03-562d-93c4-fac87d88796b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0888d9ba-2cdc-5e11-8afb-4ea71346c747", "target_ref": "attack-pattern--75449621-4749-553a-af54-d011b7feaee3" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--6d3d6ea3-6f37-53ab-85d6-c849953c9bae", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "IM Implants and Programmers", "description": "Pacemakers, ICDs, neurostimulators, cochlear and retinal implants and implantable pumps, with the programmers, home transmitters and clouds that talk to them.", "context": "unspecified", "object_refs": [ "attack-pattern--087ba118-60af-55f7-a5a3-02e5c3e70e21", "course-of-action--fc3385ec-0040-527e-b84a-c206dff7f68f", "attack-pattern--7175ace0-7eb9-5b27-991b-b9c26d13db6e", "course-of-action--892c47ee-9e18-5af6-9bc0-1ad1c270d01d", "attack-pattern--984a62cd-2846-507a-88a9-3160a3d38b15", "course-of-action--8bc41176-d2e5-551b-b554-a1888bf88e25", "attack-pattern--4ab581e6-43d0-507d-8ae3-b1fcc6a086e7", "course-of-action--4c2591a2-be20-54ec-ae19-ccca4a8aa176", "attack-pattern--9caed72b-546e-5b66-9dd3-08680e8c326e", "course-of-action--1acd0bbb-39e4-573a-8b67-76f0b8191e18", "attack-pattern--c5bbafb7-dc29-5761-8c21-49277089568d", "course-of-action--ec9d678c-a07c-521b-b222-7cebfca611d4", "attack-pattern--a60091bb-7005-5333-b1bd-752410bd2b66", "course-of-action--b16dcf35-0bbf-5d13-855e-ea612d47f131", "attack-pattern--a36a003b-3e26-5709-b3aa-67043cd61d74", "course-of-action--a85078bc-04d9-5b63-b0bf-410a1aa8ec60", "attack-pattern--e23bebac-df8d-5bc2-b473-5dabdc43f24b", "course-of-action--45b87e16-352c-5a2a-9cff-c4d6908a4115", "attack-pattern--32785976-a042-5ac1-b188-4cf4522882ea", "course-of-action--deece510-1814-5d98-8159-24ff1a3c707e", "attack-pattern--9f3798ff-8ac7-5d08-8ffb-b8db782a079a", "course-of-action--62e96057-b2a9-5a77-b8e6-737d78aefc1d", "attack-pattern--7aeca888-46ee-597b-88e3-3a3df7e31d00", "course-of-action--67184a4b-e4bc-54b3-8a08-262c1ab09230", "attack-pattern--75449621-4749-553a-af54-d011b7feaee3", "course-of-action--0888d9ba-2cdc-5e11-8afb-4ea71346c747" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-IM", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/implants-and-programmers/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f25f9394-7c18-526b-ab6d-85c38cb294d7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Spoofed controller doses insulin", "description": "The insulin pump accepts bolus and basal commands from a remote or phone app without strong pairing or authentication. A nearby attacker or rogue app can deliver a fatal overdose or quietly stop insulin.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-594", "url": "https://capec.mitre.org/data/definitions/594.html", "description": "Traffic Injection" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "Manipulation of Control" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "Medtronic MiniMed insulin pumps, 2019", "url": "https://www.infosecurity-magazine.com/news/medtronic-insulin-pumps-recalled-1", "description": "Infosecurity: Insulin pumps recalled by FDA for cybersecurity risks" }, { "source_name": "Medtronic MiniMed insulin pumps, 2019", "url": "https://beckershospitalreview.com/supply-chain/medtronic-recalls-insulin-pumps-that-can-be-wirelessly-hacked.html", "description": "Becker's: Medtronic recalls insulin pumps that can be wirelessly hacked" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-A", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "S", "T", "E" ], "mds2": [ "NAUT", "AUTH", "TXIG" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which controllers can send dose commands to the pump?", "What dose limits does the pump enforce on its own?", "How is a new controller paired, and who must confirm it?" ], "seen_in": [ "Medtronic MiniMed insulin pumps, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c805b8a4-3c76-5796-8b75-b2f0a7502d80", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-A mitigation: Spoofed controller doses insulin", "description": "A pump acts only on dose commands from a paired, authenticated controller, within limits it enforces itself.\n\n1. Require authenticated, encrypted pairing and verify every dose command's origin and integrity.\n2. Enforce maximum bolus and daily limits in the pump, whatever the controller asks.\n3. Ask for confirmation on the pump or the paired phone before large boluses.\n4. Alert the user on the pump when an unknown device tries to connect.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-A", "mitigation_principle": "A pump acts only on dose commands from a paired, authenticated controller, within limits it enforces itself.", "design_measures": [ "Require authenticated, encrypted pairing and verify every dose command's origin and integrity.", "Enforce maximum bolus and daily limits in the pump, whatever the controller asks.", "Ask for confirmation on the pump or the paired phone before large boluses.", "Alert the user on the pump when an unknown device tries to connect." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--febd01b3-72f6-5ba5-aa6e-da777120aaa4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c805b8a4-3c76-5796-8b75-b2f0a7502d80", "target_ref": "attack-pattern--f25f9394-7c18-526b-ab6d-85c38cb294d7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b67dfa5a-bb61-5bc3-a8d4-28ef74289c2e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Closed loop trusts a spoofed sensor", "description": "An automated insulin delivery algorithm doses from glucose sensor readings with no person in the loop. A spoofed, replayed or faulty reading drives it to overdose or withhold insulin, overnight, while the patient sleeps.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-K", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "S", "T" ], "mds2": [ "NAUT", "IGAU" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How does the dosing algorithm know a sensor reading is genuine?", "What does the loop do when readings look implausible?", "What bounds stop the loop overdosing while the patient sleeps?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6d3be648-6a53-5598-a028-b5d0b708c255", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-K mitigation: Closed loop trusts a spoofed sensor", "description": "Automated dosing trusts only authenticated sensor data and stays within safe bounds when data looks wrong.\n\n1. Authenticate the sensor to the controller and protect readings against injection and replay.\n2. Check readings for physiological plausibility and rate of change before dosing on them.\n3. Fall back to a conservative basal rate and alert when sensor data is missing or implausible.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-K", "mitigation_principle": "Automated dosing trusts only authenticated sensor data and stays within safe bounds when data looks wrong.", "design_measures": [ "Authenticate the sensor to the controller and protect readings against injection and replay.", "Check readings for physiological plausibility and rate of change before dosing on them.", "Fall back to a conservative basal rate and alert when sensor data is missing or implausible." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--20c0a59c-2ba4-5f12-82bb-9b320251122a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6d3be648-6a53-5598-a028-b5d0b708c255", "target_ref": "attack-pattern--b67dfa5a-bb61-5bc3-a8d4-28ef74289c2e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0192e867-d6a2-5506-a6e3-0a60909c3a06", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Phone app as the controller", "description": "The app that controls a pump or reads a sensor runs on a phone the manufacturer does not control: rooted, out of date, shared, full of other apps. Malware or an operating system change can alter doses or stop the app working.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "cwe", "external_id": "CWE-602", "url": "https://cwe.mitre.org/data/definitions/602.html", "description": "Client-Side Enforcement of Server-Side Security" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-Q", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "T", "E", "D" ], "mds2": [ "MLDP", "RDMP", "SGUD" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which safety decisions are made on the phone rather than the device?", "What happens to therapy if the phone is rooted or out of date?", "How does the app behave after an operating system update?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6b29fb5c-5f73-5335-bce0-64baf81d82de", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-Q mitigation: Phone app as the controller", "description": "A therapy-critical app assumes the phone may be hostile and keeps safety decisions on the medical device.\n\n1. Keep dose limits and safety checks on the pump, never only in the app.\n2. Check the phone's integrity and operating system version, and warn or degrade safely when unsupported.\n3. Publish a list of supported phones and versions, and test new operating system releases before users get them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-Q", "mitigation_principle": "A therapy-critical app assumes the phone may be hostile and keeps safety decisions on the medical device.", "design_measures": [ "Keep dose limits and safety checks on the pump, never only in the app.", "Check the phone's integrity and operating system version, and warn or degrade safely when unsupported.", "Publish a list of supported phones and versions, and test new operating system releases before users get them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32e1743c-7af4-5148-a118-c6d4a7f38558", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6b29fb5c-5f73-5335-bce0-64baf81d82de", "target_ref": "attack-pattern--0192e867-d6a2-5506-a6e3-0a60909c3a06" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3b0c5d88-5c22-5514-ac73-12a0761a6d3c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Firmware pushed through the phone", "description": "Device updates arrive through the companion app without the device verifying them, or install at a bad moment. A modified update takes control of therapy, and a failed one leaves the patient without insulin or monitoring at night.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T1495", "url": "https://attack.mitre.org/techniques/T1495/", "description": "Firmware Corruption" }, { "source_name": "mitre-emb3d", "external_id": "TID-211", "url": "https://emb3d.mitre.org/threats/TID-211.html", "description": "Device Allows Unauthenticated Firmware Installation" }, { "source_name": "mitre-emb3d", "external_id": "TID-217", "url": "https://emb3d.mitre.org/threats/TID-217.html", "description": "Remotely Initiated Updates Can Cause DoS" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-J", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "T", "D", "E" ], "mds2": [ "CSUP", "IGAU" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Does the device verify an update itself, or trust the app?", "When is an update allowed to install, and who decides?", "What does the patient do if an update fails overnight?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--150bb533-6b7b-5b3c-8b6a-523381b021ff", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-J mitigation: Firmware pushed through the phone", "description": "The device verifies every update itself and installs only when therapy can safely pause or continue.\n\n1. Verify a manufacturer signature on the device; never rely on the app to check.\n2. Schedule installation with the user and keep therapy running from the previous image until the new one is proven.\n3. Prevent rollback to vulnerable versions and keep a recovery image.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-J", "mitigation_principle": "The device verifies every update itself and installs only when therapy can safely pause or continue.", "design_measures": [ "Verify a manufacturer signature on the device; never rely on the app to check.", "Schedule installation with the user and keep therapy running from the previous image until the new one is proven.", "Prevent rollback to vulnerable versions and keep a recovery image." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8dcd47ae-c325-5ba2-8723-9b638b6b56ad", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--150bb533-6b7b-5b3c-8b6a-523381b021ff", "target_ref": "attack-pattern--3b0c5d88-5c22-5514-ac73-12a0761a6d3c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a130d497-a2d9-5f76-94a9-3fd17f4b4b9b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cloud account takeover", "description": "Manufacturer cloud accounts for patients and caregivers use reused passwords and no second factor. Taking one over exposes years of readings and, where the service allows, changes alarm thresholds or therapy settings remotely.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-600", "url": "https://capec.mitre.org/data/definitions/600.html", "description": "Credential Stuffing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-307", "url": "https://cwe.mitre.org/data/definitions/307.html", "description": "Improper Restriction of Excessive Authentication Attempts" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1110", "url": "https://attack.mitre.org/techniques/T1110/", "description": "Brute Force" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-10", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "S", "I", "T" ], "linddun": [ "I", "DD" ], "mds2": [ "PAUT", "AUTH" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What can a caregiver or patient cloud account change remotely?", "Do cloud accounts need a second factor before changing settings?", "Who is alerted when alarm thresholds change from the cloud?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--75e436e3-9abe-5b18-8c49-32ad68047ec9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-10 mitigation: Cloud account takeover", "description": "Cloud accounts that can see or change therapy are protected like clinical systems.\n\n1. Offer and encourage multi-factor authentication, and require it for any account that can change settings.\n2. Detect credential stuffing and unusual logins, and notify the patient of new devices.\n3. Require confirmation on the medical device for any remote settings change.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-10", "mitigation_principle": "Cloud accounts that can see or change therapy are protected like clinical systems.", "design_measures": [ "Offer and encourage multi-factor authentication, and require it for any account that can change settings.", "Detect credential stuffing and unusual logins, and notify the patient of new devices.", "Require confirmation on the medical device for any remote settings change." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73590745-4fb3-5716-8b59-de56f5fe934e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--75e436e3-9abe-5b18-8c49-32ad68047ec9", "target_ref": "attack-pattern--a130d497-a2d9-5f76-94a9-3fd17f4b4b9b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ae0260ce-8728-5f83-aa0a-6c59aa8a66e7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarms lost on the phone", "description": "Low and high glucose or arrhythmia alerts travel through the phone. Battery optimisation, do-not-disturb, revoked permissions or an operating system update silence them, and nobody notices the alarm path has broken until a patient is harmed.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "Alarm Suppression" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-9", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "D" ], "mds2": [ "SGUD", "CONN" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What on the phone could silence a low glucose alert?", "How would anyone know the alarm path had broken?", "Is there a second route for critical alerts besides the phone?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--fce99999-eadc-5f5a-988d-55535699dfc6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-9 mitigation: Alarms lost on the phone", "description": "The alarm path is monitored end to end, and a broken path is itself loud.\n\n1. Use critical-alert channels where the platform offers them, and check permissions on every launch.\n2. Send a periodic test or heartbeat and warn the user when the app cannot raise alerts.\n3. Keep an audible alarm on the medical device itself for the most dangerous conditions.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-9", "mitigation_principle": "The alarm path is monitored end to end, and a broken path is itself loud.", "design_measures": [ "Use critical-alert channels where the platform offers them, and check permissions on every launch.", "Send a periodic test or heartbeat and warn the user when the app cannot raise alerts.", "Keep an audible alarm on the medical device itself for the most dangerous conditions." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bc7cc3af-de02-556e-960a-386f6e4dedae", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fce99999-eadc-5f5a-988d-55535699dfc6", "target_ref": "attack-pattern--ae0260ce-8728-5f83-aa0a-6c59aa8a66e7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e0f10a7f-020c-51c6-be81-3a0d0c2d0d49", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Radio stack crash stops therapy", "description": "Malformed Bluetooth packets crash or hang the device's radio chip or stack. Readings stop, the pump or hearing aid freezes, and the device may not restart into a safe state until someone notices.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-666", "url": "https://capec.mitre.org/data/definitions/666.html", "description": "BlueSmacking" }, { "source_name": "capec", "external_id": "CAPEC-28", "url": "https://capec.mitre.org/data/definitions/28.html", "description": "Fuzzing" }, { "source_name": "cwe", "external_id": "CWE-617", "url": "https://cwe.mitre.org/data/definitions/617.html", "description": "Reachable Assertion" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T1499", "url": "https://attack.mitre.org/techniques/T1499/", "description": "Endpoint Denial of Service" }, { "source_name": "mitre-emb3d", "external_id": "TID-202", "url": "https://emb3d.mitre.org/threats/TID-202.html", "description": "Exploitable System Network Stack Component" }, { "source_name": "mitre-emb3d", "external_id": "TID-404", "url": "https://emb3d.mitre.org/threats/TID-404.html", "description": "Remotely Triggerable Deadlock/DoS" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.raps.org/resource/fda-warns-of-cybersecurity-vulnerabilities-in-pace.html", "description": "RAPS: FDA warns of cybersecurity vulnerabilities in pacemakers and other BLE devices" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.hpnonline.com/healthcare-it/article/21128449/fda-informs-about-potential-cybersecurity-vulnerabilities-in-certain-medical-devices-with-bluetooth-low-energy", "description": "HPN: FDA informs about potential vulnerabilities in medical devices with Bluetooth Low Energy" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-8", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "D" ], "mds2": [ "SAHD", "CSUP" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What happens to therapy if the radio stack crashes or hangs?", "Does the device restart into a safe state on its own?", "Has the Bluetooth stack been tested against malformed packets?" ], "seen_in": [ "SweynTooth Bluetooth flaws, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--2c35c279-fdf8-587c-8fa2-ef8ae7f4bf5e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-8 mitigation: Radio stack crash stops therapy", "description": "Faults in the radio stack cannot stop therapy or leave the device in an unsafe state.\n\n1. Isolate the radio from therapy logic so a radio fault cannot halt delivery or sensing.\n2. Use a watchdog that restarts the radio and alerts the user without interrupting therapy.\n3. Track vulnerabilities in the radio chip's software and fuzz the stack before release.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-8", "mitigation_principle": "Faults in the radio stack cannot stop therapy or leave the device in an unsafe state.", "design_measures": [ "Isolate the radio from therapy logic so a radio fault cannot halt delivery or sensing.", "Use a watchdog that restarts the radio and alerts the user without interrupting therapy.", "Track vulnerabilities in the radio chip's software and fuzz the stack before release." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--17fb4c8a-6127-50a0-832f-094e612cd0b2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2c35c279-fdf8-587c-8fa2-ef8ae7f4bf5e", "target_ref": "attack-pattern--e0f10a7f-020c-51c6-be81-3a0d0c2d0d49" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--25a1ffa9-19d7-5cc8-bb19-862ecc331893", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Weak pairing invites strangers", "description": "Pairing uses fixed PINs, legacy modes or no confirmation, or lets a nearby device push the link down to weak encryption. A stranger pairs, listens in or injects readings and commands.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-668", "url": "https://capec.mitre.org/data/definitions/668.html", "description": "Key Negotiation of Bluetooth Attack (KNOB)" }, { "source_name": "capec", "external_id": "CAPEC-667", "url": "https://capec.mitre.org/data/definitions/667.html", "description": "Bluetooth Impersonation AttackS (BIAS)" }, { "source_name": "capec", "external_id": "CAPEC-620", "url": "https://capec.mitre.org/data/definitions/620.html", "description": "Drop Encryption Level" }, { "source_name": "cwe", "external_id": "CWE-1390", "url": "https://cwe.mitre.org/data/definitions/1390.html", "description": "Weak Authentication" }, { "source_name": "cwe", "external_id": "CWE-326", "url": "https://cwe.mitre.org/data/definitions/326.html", "description": "Inadequate Encryption Strength" }, { "source_name": "mitre-attack", "external_id": "T0860", "url": "https://attack.mitre.org/techniques/T0860/", "description": "Wireless Compromise" }, { "source_name": "mitre-emb3d", "external_id": "TID-411", "url": "https://emb3d.mitre.org/threats/TID-411.html", "description": "Weak/Insecure Cryptographic Protocol" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.raps.org/resource/fda-warns-of-cybersecurity-vulnerabilities-in-pace.html", "description": "RAPS: FDA warns of cybersecurity vulnerabilities in pacemakers and other BLE devices" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.hpnonline.com/healthcare-it/article/21128449/fda-informs-about-potential-cybersecurity-vulnerabilities-in-certain-medical-devices-with-bluetooth-low-energy", "description": "HPN: FDA informs about potential vulnerabilities in medical devices with Bluetooth Low Energy" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-7", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "S", "I", "T" ], "linddun": [ "DD" ], "mds2": [ "NAUT", "TXCF" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How does pairing confirm the user really meant to pair?", "Can a nearby device force the link down to weaker encryption?", "Which pairing modes remain enabled that nobody needs?" ], "seen_in": [ "SweynTooth Bluetooth flaws, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f1af2cf7-c071-5563-8c88-2a98aa00ae2f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-7 mitigation: Weak pairing invites strangers", "description": "Pairing is deliberate, confirmed by the user and resistant to downgrade.\n\n1. Use authenticated pairing with out-of-band confirmation such as a code shown on the device.\n2. Refuse legacy pairing and keys shorter than current standards allow.\n3. Show paired devices to the user and let them remove any they do not recognise.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-7", "mitigation_principle": "Pairing is deliberate, confirmed by the user and resistant to downgrade.", "design_measures": [ "Use authenticated pairing with out-of-band confirmation such as a code shown on the device.", "Refuse legacy pairing and keys shorter than current standards allow.", "Show paired devices to the user and let them remove any they do not recognise." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c65bed12-9bf7-5917-bee4-7b30dd318199", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f1af2cf7-c071-5563-8c88-2a98aa00ae2f", "target_ref": "attack-pattern--25a1ffa9-19d7-5cc8-bb19-862ecc331893" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6a919eb7-300e-5fd4-98cf-e4c2eafa39ff", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No supported way to automate", "description": "With no supported way to automate their therapy, some patients build or download unofficial loops that drive older pumps through weak radio protocols. Nobody else knows what is dosing, and vulnerable pumps stay in service by choice.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-6", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "S", "R", "E" ], "mds2": [ "RDMP", "CONN", "AUDT" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Do patients have a supported way to automate their therapy?", "Would the device or clinic notice an unofficial controller dosing?", "Which older pumps stay in service because unofficial loops need them?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--324a262f-3b54-5ab1-85b4-3b13ed0aef2b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-6 mitigation: No supported way to automate", "description": "Patients have a supported, secure way to get the automation they need, and devices make unofficial control visible.\n\n1. Offer supported interoperability through authenticated, documented interfaces.\n2. Record on the device which controller issued each dose so clinicians can see it.\n3. Give clinicians guidance on reviewing patients who use unofficial controllers, without penalising them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-6", "mitigation_principle": "Patients have a supported, secure way to get the automation they need, and devices make unofficial control visible.", "design_measures": [ "Offer supported interoperability through authenticated, documented interfaces.", "Record on the device which controller issued each dose so clinicians can see it.", "Give clinicians guidance on reviewing patients who use unofficial controllers, without penalising them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--93ee2519-bfd9-55ad-a460-d622e80c2aab", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--324a262f-3b54-5ab1-85b4-3b13ed0aef2b", "target_ref": "attack-pattern--6a919eb7-300e-5fd4-98cf-e4c2eafa39ff" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ccd54b0b-e2ad-568b-b400-8000359e536b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Home readings without provenance", "description": "Readings from home blood pressure cuffs, pulse oximeters or ECG patches upload with no way to tell which device or person produced them. A family member's, replayed or edited values enter the record and shape treatment.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-5", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "S", "T", "R" ], "linddun": [ "I" ], "mds2": [ "IGAU", "NAUT" ], "deck": "The Patient", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does the record know which device and patient produced a reading?", "Could a family member's or replayed reading enter the record?", "Which home readings change treatment without a clinician checking them?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--efb0e518-6563-54e5-9ab6-2b97b43a588a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-5 mitigation: Home readings without provenance", "description": "Every home reading carries authenticated provenance: which device, which patient, when.\n\n1. Bind each device to one patient at enrolment and sign readings on the device.\n2. Show provenance and any manual edits beside the reading in the clinical record.\n3. Flag readings that arrive late, out of sequence or from an unbound device.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-5", "mitigation_principle": "Every home reading carries authenticated provenance: which device, which patient, when.", "design_measures": [ "Bind each device to one patient at enrolment and sign readings on the device.", "Show provenance and any manual edits beside the reading in the clinical record.", "Flag readings that arrive late, out of sequence or from an unbound device." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9af1b3be-cede-5ce6-bd80-08435845f9c1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--efb0e518-6563-54e5-9ab6-2b97b43a588a", "target_ref": "attack-pattern--ccd54b0b-e2ad-568b-b400-8000359e536b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--faa6547a-5f15-5e74-9e76-ff648ad717f7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Own devices on the ward", "description": "Patients bring their own pumps, sensors, hearing aids and phones into hospital. Staff cannot read or control them, they join the guest network or lose their cloud link, and nobody owns their security or the clinical decisions they drive.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-4", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "D", "T" ], "mds2": [ "CONN", "SGUD" ], "deck": "The Patient", "rank": "4", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What is the process for accepting a patient's own device on the ward?", "Who owns the security of patients' own devices while they are inpatients?", "Which network do patients' devices join, and what can they reach?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--63e95443-542d-57c6-b035-ff3d0344e67f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-4 mitigation: Own devices on the ward", "description": "The hospital has an agreed way to accept, use and support patients' own devices.\n\n1. Define a policy for patients' own devices covering who reviews them and how therapy is handed over.\n2. Provide a network path for them that keeps their cloud link without reaching clinical systems.\n3. Record in the patient's notes which personal devices are in use and their settings.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-4", "mitigation_principle": "The hospital has an agreed way to accept, use and support patients' own devices.", "design_measures": [ "Define a policy for patients' own devices covering who reviews them and how therapy is handed over.", "Provide a network path for them that keeps their cloud link without reaching clinical systems.", "Record in the patient's notes which personal devices are in use and their settings." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e3854bb-b10e-5f35-89a2-8a98f34e8cde", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--63e95443-542d-57c6-b035-ff3d0344e67f", "target_ref": "attack-pattern--faa6547a-5f15-5e74-9e76-ff648ad717f7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--90b3b262-d9b5-5d93-8b32-59a25536184c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Companion apps sell health data", "description": "Companion apps for inhalers, sensors and monitors carry analytics and advertising code that sends device identifiers and readings to third parties. Patients do not know, and the data links them to a condition for years.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-569", "url": "https://capec.mitre.org/data/definitions/569.html", "description": "Collect Data as Provided by Users" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-3", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "I" ], "linddun": [ "L", "I", "U", "DD", "Nc" ], "mds2": [ "MPII", "DIDT" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Which third parties receive data from the companion app?", "Does the patient know what leaves the app, and agree to it?", "What analytics or advertising code ships inside the app?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ce3f9357-ebfb-5396-bf42-5d50d59bf9be", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-3 mitigation: Companion apps sell health data", "description": "Health data leaves the app only for the patient's care, and only with their informed agreement.\n\n1. Inventory every third-party SDK in the app and remove any that receive health or device data.\n2. Collect the minimum data and state each use in plain language before collection.\n3. Let patients see, export and delete what is held about them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-3", "mitigation_principle": "Health data leaves the app only for the patient's care, and only with their informed agreement.", "design_measures": [ "Inventory every third-party SDK in the app and remove any that receive health or device data.", "Collect the minimum data and state each use in plain language before collection.", "Let patients see, export and delete what is held about them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7c81a18b-43dd-5e35-840b-5e29f298cab7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ce3f9357-ebfb-5396-bf42-5d50d59bf9be", "target_ref": "attack-pattern--90b3b262-d9b5-5d93-8b32-59a25536184c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--79d74f5c-383d-5c47-9090-a0b6c1b2227b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Second-hand devices keep old data", "description": "Devices that are resold, loaned, refurbished or reused across family phones keep the previous patient's data, pairings or cloud account link. The new user's readings flow to someone else's account or clinic.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/#cri-bw-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-675", "url": "https://capec.mitre.org/data/definitions/675.html", "description": "Retrieve Data from Decommissioned Devices" }, { "source_name": "cwe", "external_id": "CWE-1266", "url": "https://cwe.mitre.org/data/definitions/1266.html", "description": "Improper Scrubbing of Sensitive Data from Decommissioned Device" }, { "source_name": "cwe", "external_id": "CWE-226", "url": "https://cwe.mitre.org/data/definitions/226.html", "description": "Sensitive Information in Resource Not Removed Before Reuse" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-2", "group_code": "BW", "group_name": "Body-worn and Home-use Devices", "stride": [ "I" ], "linddun": [ "DD", "L", "I" ], "mds2": [ "MPII", "STCF" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "What is wiped when a device changes user or is refurbished?", "Which pairings and cloud links survive a change of owner?", "How would a new user notice data flowing to someone else?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ae8db517-2aeb-55b6-b19e-54cbc5641a70", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-BW-2 mitigation: Second-hand devices keep old data", "description": "Every change of user wipes the device and breaks every old link.\n\n1. Provide a factory reset that erases data, pairings and account links, and verify it.\n2. Require fresh enrolment with the clinic before a reused device sends readings.\n3. Tell patients how to reset devices before passing them on.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-BW-2", "mitigation_principle": "Every change of user wipes the device and breaks every old link.", "design_measures": [ "Provide a factory reset that erases data, pairings and account links, and verify it.", "Require fresh enrolment with the clinic before a reused device sends readings.", "Tell patients how to reset devices before passing them on." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4bdb4af3-d065-5f43-ba30-a7c4fbd9ed1f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ae8db517-2aeb-55b6-b19e-54cbc5641a70", "target_ref": "attack-pattern--79d74f5c-383d-5c47-9090-a0b6c1b2227b" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--ebdcd67c-de03-531a-b9b8-56ae2c26175b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "BW Body-worn and Home-use Devices", "description": "Insulin pumps, CGMs and closed loops, patch and Holter ECG, pulse oximeters, BP cuffs, hearing aids and connected inhalers, and the phones that control them.", "context": "unspecified", "object_refs": [ "attack-pattern--f25f9394-7c18-526b-ab6d-85c38cb294d7", "course-of-action--c805b8a4-3c76-5796-8b75-b2f0a7502d80", "attack-pattern--b67dfa5a-bb61-5bc3-a8d4-28ef74289c2e", "course-of-action--6d3be648-6a53-5598-a028-b5d0b708c255", "attack-pattern--0192e867-d6a2-5506-a6e3-0a60909c3a06", "course-of-action--6b29fb5c-5f73-5335-bce0-64baf81d82de", "attack-pattern--3b0c5d88-5c22-5514-ac73-12a0761a6d3c", "course-of-action--150bb533-6b7b-5b3c-8b6a-523381b021ff", "attack-pattern--a130d497-a2d9-5f76-94a9-3fd17f4b4b9b", "course-of-action--75e436e3-9abe-5b18-8c49-32ad68047ec9", "attack-pattern--ae0260ce-8728-5f83-aa0a-6c59aa8a66e7", "course-of-action--fce99999-eadc-5f5a-988d-55535699dfc6", "attack-pattern--e0f10a7f-020c-51c6-be81-3a0d0c2d0d49", "course-of-action--2c35c279-fdf8-587c-8fa2-ef8ae7f4bf5e", "attack-pattern--25a1ffa9-19d7-5cc8-bb19-862ecc331893", "course-of-action--f1af2cf7-c071-5563-8c88-2a98aa00ae2f", "attack-pattern--6a919eb7-300e-5fd4-98cf-e4c2eafa39ff", "course-of-action--324a262f-3b54-5ab1-85b4-3b13ed0aef2b", "attack-pattern--ccd54b0b-e2ad-568b-b400-8000359e536b", "course-of-action--efb0e518-6563-54e5-9ab6-2b97b43a588a", "attack-pattern--faa6547a-5f15-5e74-9e76-ff648ad717f7", "course-of-action--63e95443-542d-57c6-b035-ff3d0344e67f", "attack-pattern--90b3b262-d9b5-5d93-8b32-59a25536184c", "course-of-action--ce3f9357-ebfb-5396-bf42-5d50d59bf9be", "attack-pattern--79d74f5c-383d-5c47-9090-a0b6c1b2227b", "course-of-action--ae8db517-2aeb-55b6-b19e-54cbc5641a70" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-BW", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/body-worn-and-home-use-devices/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3696b28f-95dd-5ad5-8724-ef740ad5c81b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "False values on the monitor", "description": "Monitors and central stations accept data from the monitoring network without checking its source or integrity. Altered values show normal SpO2, heart rate and blood pressure while the patient deteriorates, or alarming values for a stable one, and staff treat the screen.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "MDhex, GE patient monitoring, 2020", "url": "https://www.helpnetsecurity.com/2020/01/24/vulnerabilities-patient-monitoring-devices/", "description": "Help Net Security: MDhex vulnerabilities open GE patient monitoring devices to attackers" }, { "source_name": "MDhex, GE patient monitoring, 2020", "url": "https://www.computerweekly.com/news/252477299/NHS-alerted-to-severe-vulnerabilities-in-GE-health-equipment", "description": "Computer Weekly: NHS alerted to severe vulnerabilities in GE health equipment" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-A", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "S", "T" ], "mds2": [ "TXIG", "NAUT" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does the central station know data came from a genuine monitor?", "What protects vital signs in transit across the monitoring network?", "Would staff notice values that look normal but are false?" ], "seen_in": [ "MDhex, GE patient monitoring, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3de796c4-e0a4-540c-a171-8fe6bdbb226c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-A mitigation: False values on the monitor", "description": "Displayed vital signs come only from authenticated devices over integrity-protected links.\n\n1. Authenticate monitors to central stations and gateways, and protect each message for integrity.\n2. Show the source device and data age beside every value at the central station.\n3. Cross-check related signals, such as SpO2 pulse rate against ECG heart rate, and flag disagreement.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-A", "mitigation_principle": "Displayed vital signs come only from authenticated devices over integrity-protected links.", "design_measures": [ "Authenticate monitors to central stations and gateways, and protect each message for integrity.", "Show the source device and data age beside every value at the central station.", "Cross-check related signals, such as SpO2 pulse rate against ECG heart rate, and flag disagreement." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d81c6ca6-a306-5f0a-a440-2185d465e2be", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3de796c4-e0a4-540c-a171-8fe6bdbb226c", "target_ref": "attack-pattern--3696b28f-95dd-5ad5-8724-ef740ad5c81b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--66827373-88f6-56d4-aafc-47a956cdda43", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarms silenced from afar", "description": "Alarm limits, volume and pause states can be changed from a central station, a remote viewer or the network without authorisation, and alarm forwarding can be turned off. Deterioration alarms never reach a nurse.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0838", "url": "https://attack.mitre.org/techniques/T0838/", "description": "Modify Alarm Settings" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "Alarm Suppression" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-K", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "T", "E", "R" ], "mds2": [ "AUTH", "AUDT" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can change alarm limits, and from where?", "Does the bedside show a remote change, and who made it?", "Can anyone turn alarm forwarding off without a clinician knowing?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ed4cab84-4adb-5696-899b-ef8dee80a080", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-K mitigation: Alarms silenced from afar", "description": "Changes to alarm behaviour are authorised, local where possible, visible and logged.\n\n1. Require clinician authentication for changes to alarm limits, volume or forwarding.\n2. Show any non-default alarm setting prominently on the bedside monitor.\n3. Log every alarm configuration change with who made it and from where.\n4. Prevent alarms being turned off entirely from remote stations.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-K", "mitigation_principle": "Changes to alarm behaviour are authorised, local where possible, visible and logged.", "design_measures": [ "Require clinician authentication for changes to alarm limits, volume or forwarding.", "Show any non-default alarm setting prominently on the bedside monitor.", "Log every alarm configuration change with who made it and from where.", "Prevent alarms being turned off entirely from remote stations." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fff31b6c-8b33-5fcf-bcee-8452cfd805ee", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ed4cab84-4adb-5696-899b-ef8dee80a080", "target_ref": "attack-pattern--66827373-88f6-56d4-aafc-47a956cdda43" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ad02f8e2-fb95-58f0-af11-f2af8672eb66", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telemetry dropout looks quiet", "description": "Wireless telemetry is jammed or drops out and the central station keeps showing the last value or no alarm, instead of a loud loss-of-signal. A patient walking off the ward or behind a lift shaft goes unmonitored.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-601", "url": "https://capec.mitre.org/data/definitions/601.html", "description": "Jamming" }, { "source_name": "capec", "external_id": "CAPEC-604", "url": "https://capec.mitre.org/data/definitions/604.html", "description": "Wi-Fi Jamming" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "Denial of View" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "Loss of View" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-Q", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "D" ], "mds2": [ "CONN" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What does the central station show when telemetry drops out?", "Where on the ward does telemetry coverage fail?", "Is loss of signal an alarm, or just a blank tile?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--71d5b40d-1a31-5996-80ff-995938d2fe40", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-Q mitigation: Telemetry dropout looks quiet", "description": "Loss of monitoring is treated as an alarm in its own right.\n\n1. Raise a technical alarm as soon as telemetry is lost, with escalation if it persists.\n2. Mark stale values clearly and never show them as current.\n3. Survey wireless coverage and monitor the band for interference and jamming.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-Q", "mitigation_principle": "Loss of monitoring is treated as an alarm in its own right.", "design_measures": [ "Raise a technical alarm as soon as telemetry is lost, with escalation if it persists.", "Mark stale values clearly and never show them as current.", "Survey wireless coverage and monitor the band for interference and jamming." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--86506857-d8d6-5855-8e8b-e2e6122266ed", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--71d5b40d-1a31-5996-80ff-995938d2fe40", "target_ref": "attack-pattern--ad02f8e2-fb95-58f0-af11-f2af8672eb66" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--53dc5172-af65-579b-851d-ea5a70694440", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Wrong patient on the monitor", "description": "The link between monitor, bed and patient admission is wrong or can be changed without checks. Readings and alarms are charted to another patient, sent to the wrong nurse, and drive someone else's treatment.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-J", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "S", "T" ], "linddun": [ "DD" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How is a monitor linked to the right patient and bed?", "Who can change that link, and is the change checked?", "Where can staff see which patient a monitor belongs to?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--11b8afe9-b450-5fb4-ac97-c98ea5533025", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-J mitigation: Wrong patient on the monitor", "description": "Every monitor-to-patient association is verified when made and visible all the time.\n\n1. Confirm association by scanning the patient's wristband at the monitor.\n2. Show the patient's name and identifier on the monitor and at the central station.\n3. Log association changes and alert when a monitor is reassigned while readings are flowing.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-J", "mitigation_principle": "Every monitor-to-patient association is verified when made and visible all the time.", "design_measures": [ "Confirm association by scanning the patient's wristband at the monitor.", "Show the patient's name and identifier on the monitor and at the central station.", "Log association changes and alert when a monitor is reassigned while readings are flowing." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76cce52b-228b-51c4-a974-000cf4dea1bc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--11b8afe9-b450-5fb4-ac97-c98ea5533025", "target_ref": "attack-pattern--53dc5172-af65-579b-851d-ea5a70694440" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c617a20e-3ea3-5730-a433-122a173ec17e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Early-warning score goes stale", "description": "Vital signs feed early-warning and sepsis scores in the record. If the feed stops or lags, the score keeps its last value and no escalation is triggered, while staff believe the system is watching.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-1088", "url": "https://cwe.mitre.org/data/definitions/1088.html", "description": "Synchronous Access of Remote Resource without Timeout" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "Loss of View" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-10", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "D", "T" ], "mds2": [ "IGAU", "CONN" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How fresh are the inputs behind the early-warning score?", "What alerts staff when the vital signs feed stops?", "Would a stale score look any different from a current one?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d3d5fcc9-5ccc-5500-80be-6b84200e2657", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-10 mitigation: Early-warning score goes stale", "description": "A score shows how fresh its inputs are and alerts when they are not.\n\n1. Timestamp every input and show its age with the score.\n2. Alert when expected observations are overdue for a patient.\n3. Monitor the interface feeding the score and page someone when it stops.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-10", "mitigation_principle": "A score shows how fresh its inputs are and alerts when they are not.", "design_measures": [ "Timestamp every input and show its age with the score.", "Alert when expected observations are overdue for a patient.", "Monitor the interface feeding the score and page someone when it stops." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7b2c5a06-72e6-594a-bda8-f3b02284a17b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d3d5fcc9-5ccc-5500-80be-6b84200e2657", "target_ref": "attack-pattern--c617a20e-3ea3-5730-a433-122a173ec17e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f016cbcb-e39e-508c-a6da-db6a9d84984d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Monitors as network footholds", "description": "Monitors and central stations run old embedded or desktop operating systems with exposed services that cannot be patched quickly. One compromised device becomes a route to other monitors and the clinical network.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-682", "url": "https://capec.mitre.org/data/definitions/682.html", "description": "Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1395", "url": "https://cwe.mitre.org/data/definitions/1395.html", "description": "Dependency on Vulnerable Third-Party Component" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-202", "url": "https://emb3d.mitre.org/threats/TID-202.html", "description": "Exploitable System Network Stack Component" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "MDhex, GE patient monitoring, 2020", "url": "https://www.helpnetsecurity.com/2020/01/24/vulnerabilities-patient-monitoring-devices/", "description": "Help Net Security: MDhex vulnerabilities open GE patient monitoring devices to attackers" }, { "source_name": "MDhex, GE patient monitoring, 2020", "url": "https://www.computerweekly.com/news/252477299/NHS-alerted-to-severe-vulnerabilities-in-GE-health-equipment", "description": "Computer Weekly: NHS alerted to severe vulnerabilities in GE health equipment" }, { "source_name": "URGENT/11, 2019", "url": "https://healthcareitnews.com/node/544606", "description": "Healthcare IT News: URGENT/11, FDA issues alert" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-9", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "E", "D", "T" ], "mds2": [ "SAHD", "CSUP", "SBOM" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which services do monitors and central stations expose on the network?", "How quickly can a monitor vulnerability actually be patched?", "What else could a compromised monitor reach?" ], "seen_in": [ "MDhex, GE patient monitoring, 2020", "URGENT/11, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--58fb92b5-0a54-575a-ac5c-c73828086490", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-9 mitigation: Monitors as network footholds", "description": "Monitoring devices expose only what they need and sit where a compromise cannot spread.\n\n1. Disable unused services and ports, and document the rest for the hospital.\n2. Place monitors in their own network segment with traffic only to their central station and gateway.\n3. Publish patch and support timelines and validate security fixes quickly.\n4. Supply an SBOM so the hospital can track vulnerable components.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-9", "mitigation_principle": "Monitoring devices expose only what they need and sit where a compromise cannot spread.", "design_measures": [ "Disable unused services and ports, and document the rest for the hospital.", "Place monitors in their own network segment with traffic only to their central station and gateway.", "Publish patch and support timelines and validate security fixes quickly.", "Supply an SBOM so the hospital can track vulnerable components." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db705e39-ca7e-51e5-b5a3-4898271458c4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--58fb92b5-0a54-575a-ac5c-c73828086490", "target_ref": "attack-pattern--f016cbcb-e39e-508c-a6da-db6a9d84984d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--95ffd241-83a2-5d34-9fb9-4c0948d60e0a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Monitor firmware phones home", "description": "Monitor firmware contains hidden functions that send patient data to fixed external addresses or fetch and run files from them. Nobody at the hospital knows the function exists until it is reported.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-443", "url": "https://capec.mitre.org/data/definitions/443.html", "description": "Malicious Logic Inserted Into Product by Authorized Developer" }, { "source_name": "cwe", "external_id": "CWE-912", "url": "https://cwe.mitre.org/data/definitions/912.html", "description": "Hidden Functionality" }, { "source_name": "cwe", "external_id": "CWE-506", "url": "https://cwe.mitre.org/data/definitions/506.html", "description": "Embedded Malicious Code" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "Supply Chain Compromise" }, { "source_name": "mitre-emb3d", "external_id": "TID-401", "url": "https://emb3d.mitre.org/threats/TID-401.html", "description": "Undocumented Protocol Features" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "Contec CMS8000 patient monitors, 2025", "url": "https://cisa.gov/sites/default/files/2025-01/fact-sheet-contec-cms8000-contains-a-backdoor-508c.pdf", "description": "CISA: Fact sheet, Contec CMS8000 contains a backdoor" }, { "source_name": "Contec CMS8000 patient monitors, 2025", "url": "https://thehackernews.com/2025/01/cisa-and-fda-warn-of-critical-backdoor.html", "description": "The Hacker News: CISA and FDA warn of critical backdoor in Contec CMS8000" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-8", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "I", "E" ], "linddun": [ "DD", "U" ], "mds2": [ "CONN", "SBOM" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which external addresses do the monitors contact?", "Who configured each destination a monitor connects to?", "How would the hospital discover hidden functions in monitor firmware?" ], "seen_in": [ "Contec CMS8000 patient monitors, 2025" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9cfd3265-4137-571c-8201-b45f3bd20f04", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-8 mitigation: Monitor firmware phones home", "description": "A monitor connects only to destinations the hospital configured, and contains no hidden functionality.\n\n1. Review firmware and third-party components for undeclared network functions before purchase and release.\n2. Let the hospital configure, and see, every outbound destination.\n3. Block monitor traffic to the internet by default at the network edge.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-8", "mitigation_principle": "A monitor connects only to destinations the hospital configured, and contains no hidden functionality.", "design_measures": [ "Review firmware and third-party components for undeclared network functions before purchase and release.", "Let the hospital configure, and see, every outbound destination.", "Block monitor traffic to the internet by default at the network edge." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bc3f3156-369a-5bc7-8127-c9cfcaaa736c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9cfd3265-4137-571c-8201-b45f3bd20f04", "target_ref": "attack-pattern--95ffd241-83a2-5d34-9fb9-4c0948d60e0a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bbf04993-adb1-5dc7-9639-fbef7ea96437", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Service menus behind default passwords", "description": "Service and configuration menus on monitors use default or shared passwords published in manuals. Anyone with the password changes alarm defaults, calibration or network settings, and the change looks like normal behaviour.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-70", "url": "https://capec.mitre.org/data/definitions/70.html", "description": "Try Common or Default Usernames and Passwords" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "mitre-emb3d", "external_id": "TID-311", "url": "https://emb3d.mitre.org/threats/TID-311.html", "description": "Default Credentials" }, { "source_name": "mitre-emb3d", "external_id": "TID-328", "url": "https://emb3d.mitre.org/threats/TID-328.html", "description": "Hardcoded Credentials" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-7", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "E", "T", "R" ], "mds2": [ "PAUT", "AUTH", "AUDT" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who knows the service password, and is it the same everywhere?", "Is every change made through a service menu logged?", "Could a calibration change be told apart from normal behaviour?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9fcaee96-fad6-5596-a07f-1b8616fc45f8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-7 mitigation: Service menus behind default passwords", "description": "Service access needs individual credentials and leaves a trace.\n\n1. Ship without default service passwords and require a unique one at installation.\n2. Separate clinical configuration from engineering functions with different roles.\n3. Log service-mode entry and every configuration change.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-7", "mitigation_principle": "Service access needs individual credentials and leaves a trace.", "design_measures": [ "Ship without default service passwords and require a unique one at installation.", "Separate clinical configuration from engineering functions with different roles.", "Log service-mode entry and every configuration change." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--afa10bd9-2f10-5476-ac09-fd8a6bc153cc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9fcaee96-fad6-5596-a07f-1b8616fc45f8", "target_ref": "attack-pattern--bbf04993-adb1-5dc7-9639-fbef7ea96437" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5f07243d-6e54-568a-9bc7-541b62a4ea79", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Clocks drift apart", "description": "Monitor and central station clocks are not synchronised, or their time source can be spoofed. Alarms, ECG strips, events and drug times land out of order in the record, misleading diagnosis and undermining the record as evidence.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1293", "url": "https://cwe.mitre.org/data/definitions/1293.html", "description": "Missing Source Correlation of Multiple Independent Data" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-6", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "T", "R" ], "mds2": [ "AUDT", "IGAU" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What time source do monitors and the central station use?", "Could that time source be spoofed or lost?", "How would the record show that a device clock was wrong?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5bcbfbb0-da51-5b10-b8c1-cdbadabb12f9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-6 mitigation: Clocks drift apart", "description": "Every device keeps trusted, synchronised time, and the record shows when it did not.\n\n1. Synchronise clocks to an authenticated hospital time source.\n2. Alert when a device's clock drifts beyond a set tolerance.\n3. Record both device time and receipt time for each event.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-6", "mitigation_principle": "Every device keeps trusted, synchronised time, and the record shows when it did not.", "design_measures": [ "Synchronise clocks to an authenticated hospital time source.", "Alert when a device's clock drifts beyond a set tolerance.", "Record both device time and receipt time for each event." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9f455f6-2839-5c6d-a267-d83b5eca60db", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5bcbfbb0-da51-5b10-b8c1-cdbadabb12f9", "target_ref": "attack-pattern--5f07243d-6e54-568a-9bc7-541b62a4ea79" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b505c3d-398c-579b-b721-fc1a49075905", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Remote viewing open to the internet", "description": "Remote viewers let doctors watch live waveforms from home. Exposed to the internet with weak logins, they leak patients' data and, where they can silence alarms or change settings, give an outsider control.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/", "description": "External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/", "description": "Exploit Public-Facing Application" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-5", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "I", "E", "S" ], "linddun": [ "DD", "I" ], "mds2": [ "PAUT", "RMOT", "AUTH" ], "deck": "The Patient", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How do doctors reach remote viewing from outside the hospital?", "Can remote viewing silence alarms or change settings?", "Who reviews remote viewing logins and failed attempts?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--82a1919e-fe6c-52f6-80f1-45f31ced03cd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-5 mitigation: Remote viewing open to the internet", "description": "Remote viewing is read-only by default and reachable only through the hospital's controlled remote access.\n\n1. Publish remote viewers only behind the hospital's remote access with multi-factor authentication.\n2. Make remote viewing read-only unless a specific, logged role needs control.\n3. Scan regularly for monitoring interfaces reachable from the internet.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-5", "mitigation_principle": "Remote viewing is read-only by default and reachable only through the hospital's controlled remote access.", "design_measures": [ "Publish remote viewers only behind the hospital's remote access with multi-factor authentication.", "Make remote viewing read-only unless a specific, logged role needs control.", "Scan regularly for monitoring interfaces reachable from the internet." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e576bd8-a3c0-5c7a-8992-d834a766b958", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--82a1919e-fe6c-52f6-80f1-45f31ced03cd", "target_ref": "attack-pattern--6b505c3d-398c-579b-b721-fc1a49075905" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--300236d0-920b-5acb-bb85-fc00d86b63a4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Waveform archives stolen in bulk", "description": "Central stations and gateways store waveforms, ECGs and alarm histories unencrypted. Theft of the store reveals cardiac diagnoses for every patient monitored in years.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-545", "url": "https://capec.mitre.org/data/definitions/545.html", "description": "Pull Data from System Resources" }, { "source_name": "cwe", "external_id": "CWE-312", "url": "https://cwe.mitre.org/data/definitions/312.html", "description": "Cleartext Storage of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-4", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "I" ], "linddun": [ "DD", "I" ], "mds2": [ "STCF", "MPII" ], "deck": "The Patient", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "Where are waveforms, ECGs and alarm histories stored, and is that encrypted?", "How long is stored monitoring data kept?", "Who can copy the whole monitoring archive?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e82decec-cba4-5111-9b5f-4d33c315bfb3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-4 mitigation: Waveform archives stolen in bulk", "description": "Stored monitoring data is encrypted and kept no longer than needed.\n\n1. Encrypt waveform and event stores at rest with keys held off the device.\n2. Set retention periods and delete data once it has been written to the record.\n3. Restrict export of waveform data to authorised roles and log it.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-4", "mitigation_principle": "Stored monitoring data is encrypted and kept no longer than needed.", "design_measures": [ "Encrypt waveform and event stores at rest with keys held off the device.", "Set retention periods and delete data once it has been written to the record.", "Restrict export of waveform data to authorised roles and log it." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--11b43027-521a-52a0-95af-24853b50033b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e82decec-cba4-5111-9b5f-4d33c315bfb3", "target_ref": "attack-pattern--300236d0-920b-5acb-bb85-fc00d86b63a4" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c0447b12-1701-5587-b161-9a174d73bd29", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Spot checks under a shared login", "description": "Portable vital-signs devices upload observations under a generic ward login. Nobody can tell who took a reading or entered a manual value, so mistakes and falsified observations cannot be traced.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-3", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "R" ], "linddun": [ "Nr" ], "mds2": [ "PAUT", "AUDT" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Can you tell who took each observation?", "Which devices upload under a shared ward login?", "How would a falsified manual value be traced?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--dd84de7a-6efb-5dcd-b320-c9c760e41f57", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-3 mitigation: Spot checks under a shared login", "description": "Every observation is attributed to the person who took it.\n\n1. Require badge-tap or quick login per user on spot-check devices.\n2. Mark manually entered values differently from measured ones in the record.\n3. Log who submitted each observation and from which device.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-3", "mitigation_principle": "Every observation is attributed to the person who took it.", "design_measures": [ "Require badge-tap or quick login per user on spot-check devices.", "Mark manually entered values differently from measured ones in the record.", "Log who submitted each observation and from which device." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0b9d44a6-2f88-5c84-bba7-9625af9af6d8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dd84de7a-6efb-5dcd-b320-c9c760e41f57", "target_ref": "attack-pattern--c0447b12-1701-5587-b161-9a174d73bd29" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--25c2a624-156c-5587-9955-b360fce41c52", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Discovery traffic maps the ward", "description": "Monitors announce themselves on the network with patient names, bed numbers and demographics in discovery and multicast traffic. Anyone on that network can map who is in which bed and what is being monitored.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/#cri-pm-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-292", "url": "https://capec.mitre.org/data/definitions/292.html", "description": "Host Discovery" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "mitre-attack", "external_id": "T0846", "url": "https://attack.mitre.org/techniques/T0846/", "description": "Remote System Discovery" }, { "source_name": "mitre-emb3d", "external_id": "TID-408", "url": "https://emb3d.mitre.org/threats/TID-408.html", "description": "Unencrypted Sensitive Data Communication" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-2", "group_code": "PM", "group_name": "Patient Monitoring", "stride": [ "I" ], "linddun": [ "I", "L", "D" ], "mds2": [ "TXCF", "CONN" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "What patient data do monitors broadcast in discovery traffic?", "Who else shares the network segment where monitors announce themselves?", "Could the bed board be rebuilt from network traffic alone?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--2e0b1ee8-d1f8-5b51-aa47-720b7ebf18cd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-PM-2 mitigation: Discovery traffic maps the ward", "description": "Network announcements carry no patient data.\n\n1. Remove patient identifiers from discovery and multicast messages.\n2. Encrypt traffic that must carry patient context.\n3. Keep monitor discovery traffic inside the monitoring segment.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-PM-2", "mitigation_principle": "Network announcements carry no patient data.", "design_measures": [ "Remove patient identifiers from discovery and multicast messages.", "Encrypt traffic that must carry patient context.", "Keep monitor discovery traffic inside the monitoring segment." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f605e74b-852d-5bf7-b523-7993665d2595", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2e0b1ee8-d1f8-5b51-aa47-720b7ebf18cd", "target_ref": "attack-pattern--25c2a624-156c-5587-9955-b360fce41c52" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--24481783-354f-59eb-8715-d97117469c48", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "PM Patient Monitoring", "description": "Bedside monitors (ECG, SpO2, NIBP and invasive BP, heart rate, respiration, capnography, temperature), central stations, telemetry and early-warning feeds.", "context": "unspecified", "object_refs": [ "attack-pattern--3696b28f-95dd-5ad5-8724-ef740ad5c81b", "course-of-action--3de796c4-e0a4-540c-a171-8fe6bdbb226c", "attack-pattern--66827373-88f6-56d4-aafc-47a956cdda43", "course-of-action--ed4cab84-4adb-5696-899b-ef8dee80a080", "attack-pattern--ad02f8e2-fb95-58f0-af11-f2af8672eb66", "course-of-action--71d5b40d-1a31-5996-80ff-995938d2fe40", "attack-pattern--53dc5172-af65-579b-851d-ea5a70694440", "course-of-action--11b8afe9-b450-5fb4-ac97-c98ea5533025", "attack-pattern--c617a20e-3ea3-5730-a433-122a173ec17e", "course-of-action--d3d5fcc9-5ccc-5500-80be-6b84200e2657", "attack-pattern--f016cbcb-e39e-508c-a6da-db6a9d84984d", "course-of-action--58fb92b5-0a54-575a-ac5c-c73828086490", "attack-pattern--95ffd241-83a2-5d34-9fb9-4c0948d60e0a", "course-of-action--9cfd3265-4137-571c-8201-b45f3bd20f04", "attack-pattern--bbf04993-adb1-5dc7-9639-fbef7ea96437", "course-of-action--9fcaee96-fad6-5596-a07f-1b8616fc45f8", "attack-pattern--5f07243d-6e54-568a-9bc7-541b62a4ea79", "course-of-action--5bcbfbb0-da51-5b10-b8c1-cdbadabb12f9", "attack-pattern--6b505c3d-398c-579b-b721-fc1a49075905", "course-of-action--82a1919e-fe6c-52f6-80f1-45f31ced03cd", "attack-pattern--300236d0-920b-5acb-bb85-fc00d86b63a4", "course-of-action--e82decec-cba4-5111-9b5f-4d33c315bfb3", "attack-pattern--c0447b12-1701-5587-b161-9a174d73bd29", "course-of-action--dd84de7a-6efb-5dcd-b320-c9c760e41f57", "attack-pattern--25c2a624-156c-5587-9955-b360fce41c52", "course-of-action--2e0b1ee8-d1f8-5b51-aa47-720b7ebf18cd" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-PM", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/patient-monitoring/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6479449e-0758-515f-bbd8-945756e49344", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ventilation settings changed remotely", "description": "The ventilator accepts changes to tidal volume, oxygen fraction, pressure or rate over the network or a connected gateway without a person at the bedside confirming them. A remote change can starve or injure a patient while the screen and the chart look normal.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-137", "url": "https://capec.mitre.org/data/definitions/137.html", "description": "Parameter Injection" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "Manipulation of Control" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-A", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "E" ], "mds2": [ "AUTH", "NAUT", "TXIG" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which ventilator settings can change without someone at the bedside?", "What confirms a remote change before it reaches the patient?", "Would the screen and chart reveal a change made remotely?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a0fb34d5-cf84-58c6-b15d-6d52634381d7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-A mitigation: Ventilation settings changed remotely", "description": "Therapy-critical settings on life support change only with a local, deliberate action by a clinician at the device.\n\n1. Make network interfaces read-only for therapy parameters; any remote write path must be removed or disabled by default.\n2. Require on-device confirmation, showing old and new values, for every therapy change regardless of where it originated.\n3. Log every setting change with source, user and time, and alarm locally when a change arrives from outside the device.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-A", "mitigation_principle": "Therapy-critical settings on life support change only with a local, deliberate action by a clinician at the device.", "design_measures": [ "Make network interfaces read-only for therapy parameters; any remote write path must be removed or disabled by default.", "Require on-device confirmation, showing old and new values, for every therapy change regardless of where it originated.", "Log every setting change with source, user and time, and alarm locally when a change arrives from outside the device." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5470c65b-2a53-514a-82fc-47143066bfd1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a0fb34d5-cf84-58c6-b15d-6d52634381d7", "target_ref": "attack-pattern--6479449e-0758-515f-bbd8-945756e49344" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--62c81af3-de57-566e-b62b-85ded597c3b7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Failure state that stops support", "description": "When the ventilator, ECMO or heart-lung machine meets an unexpected message, crash or update, it reboots, stops or falls back to factory defaults instead of continuing the last safe therapy. A crafted packet or a faulty update can leave a dependent patient without support.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-1088", "url": "https://cwe.mitre.org/data/definitions/1088.html", "description": "Synchronous Access of Remote Resource without Timeout" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "Denial of Service" }, { "source_name": "mitre-attack", "external_id": "T0816", "url": "https://attack.mitre.org/techniques/T0816/", "description": "Device Restart/Shutdown" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "Loss of Safety" }, { "source_name": "mitre-emb3d", "external_id": "TID-404", "url": "https://emb3d.mitre.org/threats/TID-404.html", "description": "Remotely Triggerable Deadlock/DoS" }, { "source_name": "mitre-emb3d", "external_id": "TID-405", "url": "https://emb3d.mitre.org/threats/TID-405.html", "description": "Network Stack Resource Exhaustion" }, { "source_name": "mitre-emb3d", "external_id": "TID-217", "url": "https://emb3d.mitre.org/threats/TID-217.html", "description": "Remotely Initiated Updates Can Cause DoS" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-K", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "D" ], "mds2": [ "SAHD", "CSUP" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What does the device do after a crash, bad message or failed update?", "Does it resume the last safe therapy or factory defaults?", "How was the failure state tested with a patient connected?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4c1462bb-bb34-59c7-9f96-8fc30290fc17", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-K mitigation: Failure state that stops support", "description": "A life-support device keeps delivering its last verified therapy through software, network and update failures.\n\n1. Separate the therapy control function from networking and user interface software so a fault in one cannot stop the other.\n2. Define and test a continue-last-safe-therapy state for every fault, including malformed input and failed updates.\n3. Fuzz every network and data interface during verification, and treat any loss of therapy as a safety failure, not a bug.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-K", "mitigation_principle": "A life-support device keeps delivering its last verified therapy through software, network and update failures.", "design_measures": [ "Separate the therapy control function from networking and user interface software so a fault in one cannot stop the other.", "Define and test a continue-last-safe-therapy state for every fault, including malformed input and failed updates.", "Fuzz every network and data interface during verification, and treat any loss of therapy as a safety failure, not a bug." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58706749-8a3a-56fa-9255-7bc57dbeadd5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4c1462bb-bb34-59c7-9f96-8fc30290fc17", "target_ref": "attack-pattern--62c81af3-de57-566e-b62b-85ded597c3b7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1590ed62-1099-5a0c-9e96-8bb21b5020fd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Life-support alarms silenced", "description": "Alarm volume, limits or delays on ventilators, anaesthesia machines and dialysis can be changed through a service menu, a configuration file or a remote profile. With alarms widened or muted, disconnection, low oxygen or a pressure fault goes unnoticed until the patient deteriorates.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-75", "url": "https://capec.mitre.org/data/definitions/75.html", "description": "Manipulating Writeable Configuration Files" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "cwe", "external_id": "CWE-357", "url": "https://cwe.mitre.org/data/definitions/357.html", "description": "Insufficient UI Warning of Dangerous Operations" }, { "source_name": "mitre-attack", "external_id": "T0838", "url": "https://attack.mitre.org/techniques/T0838/", "description": "Modify Alarm Settings" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "Alarm Suppression" }, { "source_name": "mitre-emb3d", "external_id": "TID-224", "url": "https://emb3d.mitre.org/threats/TID-224.html", "description": "Excessive Access via Software Diagnostic Features" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-Q", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "D" ], "mds2": [ "AUTH", "IGAU", "AUDT" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What is the lowest an alarm limit can be set, and by whom?", "Can a profile, file or remote command mute a life-support alarm?", "How would staff notice alarm settings had been widened?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--36585261-7705-5339-b7c0-749d54c5da3e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-Q mitigation: Life-support alarms silenced", "description": "Alarm limits that protect life have floors that no profile, file or remote command can go below.\n\n1. Enforce non-configurable minimum alarm settings for disconnection, apnoea and low oxygen in the device itself.\n2. Show a persistent indicator whenever any alarm is muted or widened, and limit mute duration.\n3. Sign alarm configuration profiles and reject unsigned or out-of-range profiles at load time.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-Q", "mitigation_principle": "Alarm limits that protect life have floors that no profile, file or remote command can go below.", "design_measures": [ "Enforce non-configurable minimum alarm settings for disconnection, apnoea and low oxygen in the device itself.", "Show a persistent indicator whenever any alarm is muted or widened, and limit mute duration.", "Sign alarm configuration profiles and reject unsigned or out-of-range profiles at load time." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1aa9fb45-88ef-55b6-ba25-ed83c3e369e6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--36585261-7705-5339-b7c0-749d54c5da3e", "target_ref": "attack-pattern--1590ed62-1099-5a0c-9e96-8bb21b5020fd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6d464789-9dc1-5cbc-9668-fc5ff9984896", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Service mode open during treatment", "description": "Engineering and service modes, meant for calibration and repair, can be entered while a patient is connected, by a default code, a key combination, a debug port or a remote service tool. In service mode, safety limits and interlocks may not apply.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-121", "url": "https://capec.mitre.org/data/definitions/121.html", "description": "Exploit Non-Production Interfaces" }, { "source_name": "capec", "external_id": "CAPEC-554", "url": "https://capec.mitre.org/data/definitions/554.html", "description": "Functionality Bypass" }, { "source_name": "cwe", "external_id": "CWE-1244", "url": "https://cwe.mitre.org/data/definitions/1244.html", "description": "Internal Asset Exposed to Unsafe Debug Access Level or State" }, { "source_name": "cwe", "external_id": "CWE-489", "url": "https://cwe.mitre.org/data/definitions/489.html", "description": "Active Debug Code" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "Change Operating Mode" }, { "source_name": "mitre-emb3d", "external_id": "TID-224", "url": "https://emb3d.mitre.org/threats/TID-224.html", "description": "Excessive Access via Software Diagnostic Features" }, { "source_name": "mitre-emb3d", "external_id": "TID-119", "url": "https://emb3d.mitre.org/threats/TID-119.html", "description": "Latent Hardware Debug Port Allows Memory/Code Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-328", "url": "https://emb3d.mitre.org/threats/TID-328.html", "description": "Hardcoded Credentials" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-J", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "E", "T" ], "mds2": [ "AUTH", "PLOK", "RMOT" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Can service mode be entered while a patient is connected?", "Which codes, ports or tools open service mode?", "Which safety interlocks stop working in service mode?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5eb3bebb-c58f-55fe-b9bc-400654fb840d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-J mitigation: Service mode open during treatment", "description": "Service functions are unreachable while the device is delivering therapy.\n\n1. Block entry to service and calibration modes unless the device detects it is not connected to a patient.\n2. Require individual, revocable service credentials, never a code shared across every unit of the model.\n3. Disable or physically protect debug ports in production units and record every service-mode entry.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-J", "mitigation_principle": "Service functions are unreachable while the device is delivering therapy.", "design_measures": [ "Block entry to service and calibration modes unless the device detects it is not connected to a patient.", "Require individual, revocable service credentials, never a code shared across every unit of the model.", "Disable or physically protect debug ports in production units and record every service-mode entry." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6975717f-e2c6-5259-a833-7909b84742da", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5eb3bebb-c58f-55fe-b9bc-400654fb840d", "target_ref": "attack-pattern--6d464789-9dc1-5cbc-9668-fc5ff9984896" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--04f94dba-f1fa-56c0-b9a6-48bc32e8108d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Anaesthesia workstation compromised", "description": "Anaesthesia workstations run general-purpose operating systems and connect to the anaesthesia record and the network. Malware or tampering can change gas and agent delivery, freeze the displayed values, or falsify the anaesthesia record that later decisions rely on.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "Manipulation of Control" }, { "source_name": "mitre-emb3d", "external_id": "TID-204", "url": "https://emb3d.mitre.org/threats/TID-204.html", "description": "Untrusted Programs Can Access Privileged OS Functions" }, { "source_name": "mitre-emb3d", "external_id": "TID-205", "url": "https://emb3d.mitre.org/threats/TID-205.html", "description": "Existing OS Tools Maliciously Used for Device Manipulation" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-10", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "I", "D" ], "mds2": [ "MLDP", "SAHD", "IGAU" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Is gas and agent delivery independent of the networked computer?", "What would a frozen display look like to the anaesthetist?", "How is the anaesthesia record protected from later tampering?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--0c48741f-ff72-5951-91b9-60551661af16", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-10 mitigation: Anaesthesia workstation compromised", "description": "Gas and agent delivery are controlled independently of the networked computer that displays and records them.\n\n1. Keep delivery control on a separate, minimal controller that the record-keeping computer cannot command.\n2. Cross-check displayed and recorded values against an independent sensor and alarm on disagreement.\n3. Harden and allow-list the workstation software, and keep it on a segmented clinical device network.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-10", "mitigation_principle": "Gas and agent delivery are controlled independently of the networked computer that displays and records them.", "design_measures": [ "Keep delivery control on a separate, minimal controller that the record-keeping computer cannot command.", "Cross-check displayed and recorded values against an independent sensor and alarm on disagreement.", "Harden and allow-list the workstation software, and keep it on a segmented clinical device network." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--176fd819-5518-56cd-8f11-7b8d244596d1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0c48741f-ff72-5951-91b9-60551661af16", "target_ref": "attack-pattern--04f94dba-f1fa-56c0-b9a6-48bc32e8108d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--94ecf18b-2112-5a00-93e8-29b058948c17", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Oxygen delivered differs from shown", "description": "Connected oxygen blenders, high-flow systems and concentrators report flow and oxygen fraction from the same software that controls them. If that software is altered, the patient receives less oxygen than the display and the record say, and hypoxia is blamed on the illness.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-emb3d", "external_id": "TID-201", "url": "https://emb3d.mitre.org/threats/TID-201.html", "description": "Inadequate Bootloader Protection and Verification" }, { "source_name": "mitre-emb3d", "external_id": "TID-211", "url": "https://emb3d.mitre.org/threats/TID-211.html", "description": "Device Allows Unauthenticated Firmware Installation" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-9", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "R" ], "mds2": [ "IGAU", "CSUP" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What measures delivered oxygen independently of the controlling software?", "Would anyone notice the display overstating oxygen delivered?", "Who checks that set and measured oxygen agree?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d05e1ca6-1f3b-505d-b9a7-030042392088", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-9 mitigation: Oxygen delivered differs from shown", "description": "Delivered oxygen is measured independently of the component that sets it.\n\n1. Measure delivered oxygen with a separate sensor and alarm when it departs from the set value.\n2. Verify firmware integrity at boot and refuse to run altered control software.\n3. For remotely managed home concentrators, restrict the manufacturer's cloud to reading status, not changing flow.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-9", "mitigation_principle": "Delivered oxygen is measured independently of the component that sets it.", "design_measures": [ "Measure delivered oxygen with a separate sensor and alarm when it departs from the set value.", "Verify firmware integrity at boot and refuse to run altered control software.", "For remotely managed home concentrators, restrict the manufacturer's cloud to reading status, not changing flow." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3cae92d-1df6-5007-84da-1c78f2381534", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d05e1ca6-1f3b-505d-b9a7-030042392088", "target_ref": "attack-pattern--94ecf18b-2112-5a00-93e8-29b058948c17" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e62d86d6-0037-5971-ab7d-7ce5848b0552", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Defibrillator ready status falsified", "description": "Defibrillators and public-access AEDs report self-test results, battery and pad status to fleet dashboards. A tampered device or dashboard can show ready when the unit will not charge or shock, so the failure is found only during a cardiac arrest.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-emb3d", "external_id": "TID-407", "url": "https://emb3d.mitre.org/threats/TID-407.html", "description": "Missing Message Replay Protection" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-8", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "S", "T" ], "mds2": [ "IGAU", "TXIG", "NAUT" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How does the fleet dashboard know a defibrillator is really ready?", "What happens when a self-test report is missing or stale?", "Could a device show ready when it cannot charge?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--0e28fbd7-dfba-5640-bb05-463b8999feaa", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-8 mitigation: Defibrillator ready status falsified", "description": "Readiness is reported from tamper-evident self-tests, and a missing or stale report is treated as not ready.\n\n1. Sign self-test reports on the device and verify them on the dashboard.\n2. Treat missing, late or unsigned reports as a fault that triggers an inspection.\n3. Keep a visible local readiness indicator that does not depend on the fleet service.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-8", "mitigation_principle": "Readiness is reported from tamper-evident self-tests, and a missing or stale report is treated as not ready.", "design_measures": [ "Sign self-test reports on the device and verify them on the dashboard.", "Treat missing, late or unsigned reports as a fault that triggers an inspection.", "Keep a visible local readiness indicator that does not depend on the fleet service." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62bfff5b-4acd-5cf7-ab21-586bcee2578c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0e28fbd7-dfba-5640-bb05-463b8999feaa", "target_ref": "attack-pattern--e62d86d6-0037-5971-ab7d-7ce5848b0552" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--db6f97c3-db1c-58ef-8a7b-11e74657f2fc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Dialysis prescription tampered", "description": "Dialysis machines load the patient's prescription, dialysate composition and fluid removal targets from a clinic system or a patient card. An altered prescription or card can remove too much fluid or deliver dialysate at the wrong conductivity or temperature.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-165", "url": "https://capec.mitre.org/data/definitions/165.html", "description": "File Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-1284", "url": "https://cwe.mitre.org/data/definitions/1284.html", "description": "Improper Validation of Specified Quantity in Input" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-111", "url": "https://emb3d.mitre.org/threats/TID-111.html", "description": "Untrusted External Storage" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-7", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "S" ], "mds2": [ "IGAU", "NAUT", "AUTH" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Where does the dialysis machine load its prescription from?", "How is a prescription checked against safe ranges before treatment?", "Could an altered patient card change fluid removal targets?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--851e5e18-fad9-5e39-acfd-4969df3b6872", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-7 mitigation: Dialysis prescription tampered", "description": "Prescriptions loaded into a dialysis machine are authenticated and checked against safe ranges before treatment starts.\n\n1. Sign prescriptions in the clinic system and verify the signature on the machine.\n2. Hard-code physiological limits for conductivity, temperature and fluid removal that a prescription cannot exceed.\n3. Show the loaded prescription for a nurse to confirm against the order before starting.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-7", "mitigation_principle": "Prescriptions loaded into a dialysis machine are authenticated and checked against safe ranges before treatment starts.", "design_measures": [ "Sign prescriptions in the clinic system and verify the signature on the machine.", "Hard-code physiological limits for conductivity, temperature and fluid removal that a prescription cannot exceed.", "Show the loaded prescription for a nurse to confirm against the order before starting." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1ccd2c1a-3b54-5ecc-ad15-a0a4b79a98f4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--851e5e18-fad9-5e39-acfd-4969df3b6872", "target_ref": "attack-pattern--db6f97c3-db1c-58ef-8a7b-11e74657f2fc" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1301d665-31e0-55fe-a59f-646c83ab8f93", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Surgical robot command link disrupted", "description": "A surgical robot's console sends motion commands to the arms over a cable, a network or, in remote surgery, a wide-area link. Injected, delayed or dropped commands can move an instrument inside the patient or stall it mid-procedure.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-60", "url": "https://capec.mitre.org/data/definitions/60.html", "description": "Reusing Session IDs (aka Session Replay)" }, { "source_name": "cwe", "external_id": "CWE-294", "url": "https://cwe.mitre.org/data/definitions/294.html", "description": "Authentication Bypass by Capture-replay" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T0830", "url": "https://attack.mitre.org/techniques/T0830/", "description": "Adversary-in-the-Middle" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "Manipulation of Control" }, { "source_name": "mitre-emb3d", "external_id": "TID-407", "url": "https://emb3d.mitre.org/threats/TID-407.html", "description": "Missing Message Replay Protection" }, { "source_name": "mitre-emb3d", "external_id": "TID-221", "url": "https://emb3d.mitre.org/threats/TID-221.html", "description": "Authentication Bypass By Message Replay" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-6", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "D", "S" ], "mds2": [ "TXIG", "NAUT" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How are motion commands between console and arms protected?", "What do the arms do when commands are delayed or lost?", "Which links does remote surgery depend on, and who runs them?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--55884f20-1eaf-5370-b286-1f10a9837967", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-6 mitigation: Surgical robot command link disrupted", "description": "Every motion command is authenticated, fresh and checked, and the arms stop safely when the link is in doubt.\n\n1. Authenticate and sequence-number every command between console and arms, rejecting stale or replayed messages.\n2. Stop motion and hold position safely when latency or loss exceeds a validated limit.\n3. Run remote surgery only over dedicated links with monitored quality and a local surgeon able to take over.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-6", "mitigation_principle": "Every motion command is authenticated, fresh and checked, and the arms stop safely when the link is in doubt.", "design_measures": [ "Authenticate and sequence-number every command between console and arms, rejecting stale or replayed messages.", "Stop motion and hold position safely when latency or loss exceeds a validated limit.", "Run remote surgery only over dedicated links with monitored quality and a local surgeon able to take over." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c444bc1-0651-5861-8d4b-9baac19ec93b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--55884f20-1eaf-5370-b286-1f10a9837967", "target_ref": "attack-pattern--1301d665-31e0-55fe-a59f-646c83ab8f93" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--89c78a56-bd32-582f-be90-ad953f881a78", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Neonatal incubator environment altered", "description": "Networked incubators and warmers control air temperature, humidity and oxygen for premature babies and report them to a central station. Altered control or false readings can overheat, chill or over-oxygenate a baby who cannot signal distress.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-137", "url": "https://capec.mitre.org/data/definitions/137.html", "description": "Parameter Injection" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "cwe", "external_id": "CWE-1284", "url": "https://cwe.mitre.org/data/definitions/1284.html", "description": "Improper Validation of Specified Quantity in Input" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-5", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "T", "D" ], "mds2": [ "AUTH", "IGAU" ], "deck": "The Patient", "rank": "5", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Where are temperature and oxygen limits enforced for the baby?", "Does an independent sensor confirm the incubator's readings?", "What would the central station show if control were altered?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d9a03a85-b721-5fcf-b0ea-14951571e74c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-5 mitigation: Neonatal incubator environment altered", "description": "Environmental limits for neonates are enforced in the incubator and verified by an independent sensor.\n\n1. Enforce fixed upper and lower temperature and oxygen limits in the incubator's own controller.\n2. Use an independent probe on the baby that alarms locally when it disagrees with the control sensor.\n3. Make central station connections read-only for environmental settings.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-5", "mitigation_principle": "Environmental limits for neonates are enforced in the incubator and verified by an independent sensor.", "design_measures": [ "Enforce fixed upper and lower temperature and oxygen limits in the incubator's own controller.", "Use an independent probe on the baby that alarms locally when it disagrees with the control sensor.", "Make central station connections read-only for environmental settings." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--880cf068-4322-5efa-b8ab-b5f5adc78006", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d9a03a85-b721-5fcf-b0ea-14951571e74c", "target_ref": "attack-pattern--89c78a56-bd32-582f-be90-ad953f881a78" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2061f520-ea96-5506-83af-7813cbd6221b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Consumable checks that block therapy", "description": "Devices that authenticate circuits, cartridges, filters or licences refuse to run when the check fails, the licence server is unreachable or the clock is wrong. An attacker, an outage or a supplier change can stop ventilation, dialysis or surgery when no approved consumable is accepted.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0813", "url": "https://attack.mitre.org/techniques/T0813/", "description": "Denial of Control" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "Denial of Service" }, { "source_name": "mitre-emb3d", "external_id": "TID-222", "url": "https://emb3d.mitre.org/threats/TID-222.html", "description": "Critical System Service May Be Disabled" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-4", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "D" ], "mds2": [ "EMRG", "RDMP" ], "deck": "The Patient", "rank": "4", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What happens to therapy if a consumable or licence check fails?", "Which outages could make the device refuse an approved consumable?", "Does a failed check warn and record, or stop treatment?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3feda614-416f-5776-9675-fbf147ff2d37", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-4 mitigation: Consumable checks that block therapy", "description": "Consumable and licence checks never stop life-sustaining therapy; they warn and record instead.\n\n1. Let therapy continue with a clear warning and a log entry when a consumable or licence check fails.\n2. Never make therapy depend on reaching a remote licence or activation service.\n3. Document a clinical override for emergencies and test it during verification.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-4", "mitigation_principle": "Consumable and licence checks never stop life-sustaining therapy; they warn and record instead.", "design_measures": [ "Let therapy continue with a clear warning and a log entry when a consumable or licence check fails.", "Never make therapy depend on reaching a remote licence or activation service.", "Document a clinical override for emergencies and test it during verification." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--81d5bd16-fe0c-5821-a809-392b7a957a69", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3feda614-416f-5776-9675-fbf147ff2d37", "target_ref": "attack-pattern--2061f520-ea96-5506-83af-7813cbd6221b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b8186258-df8d-5a20-bb2d-2cc2f554bfd4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Setting history that proves nothing", "description": "Life-support devices keep setting and event logs that are unsigned, editable by service tools, or stamped by an unsynchronised clock. After an incident nobody can tell whether a setting was changed by a clinician, a fault or an attacker, so the cause is never found.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-117", "url": "https://cwe.mitre.org/data/definitions/117.html", "description": "Improper Output Neutralization for Logs" }, { "source_name": "mitre-attack", "external_id": "T0872", "url": "https://attack.mitre.org/techniques/T0872/", "description": "Indicator Removal on Host" }, { "source_name": "mitre-emb3d", "external_id": "TID-225", "url": "https://emb3d.mitre.org/threats/TID-225.html", "description": "Logs can be manipulated on the device" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-3", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "R" ], "linddun": [ "Nr" ], "mds2": [ "AUDT", "IGAU" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Are device event logs signed and protected from service tools?", "Could investigators tell a clinician's change from an attacker's?", "Which clock stamps the setting history?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c327fdf4-c838-5933-8376-b8e69b15bb51", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-3 mitigation: Setting history that proves nothing", "description": "Device event logs are complete, tamper-evident and trustworthy in time.\n\n1. Sign or hash-chain event logs on the device and protect them from service-tool edits.\n2. Synchronise device clocks to a trusted hospital time source and record clock changes.\n3. Export logs automatically to a central store the device cannot rewrite.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-3", "mitigation_principle": "Device event logs are complete, tamper-evident and trustworthy in time.", "design_measures": [ "Sign or hash-chain event logs on the device and protect them from service-tool edits.", "Synchronise device clocks to a trusted hospital time source and record clock changes.", "Export logs automatically to a central store the device cannot rewrite." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c60f999-ea17-532c-a7f9-0a09279c0fd1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c327fdf4-c838-5933-8376-b8e69b15bb51", "target_ref": "attack-pattern--b8186258-df8d-5a20-bb2d-2cc2f554bfd4" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--61321563-47b6-5d67-80c0-30068956e8ee", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Service log exports leak patients", "description": "Service and error logs exported from ventilators, anaesthesia machines and dialysis units for vendor support include patient identifiers, settings and timestamps. Sent by email or left on service laptops, they disclose patient data outside the hospital.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/#cri-ls-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-497", "url": "https://capec.mitre.org/data/definitions/497.html", "description": "File Discovery" }, { "source_name": "cwe", "external_id": "CWE-532", "url": "https://cwe.mitre.org/data/definitions/532.html", "description": "Insertion of Sensitive Information into Log File" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "mitre-emb3d", "external_id": "TID-226", "url": "https://emb3d.mitre.org/threats/TID-226.html", "description": "Device leaks security information in logs" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-2", "group_code": "LS", "group_name": "Life Support and Therapy", "stride": [ "I" ], "linddun": [ "DD", "I", "U" ], "mds2": [ "DIDT", "STCF", "MPII" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "What patient data is in exported service logs?", "Where do exported logs travel, and who keeps them?", "Can identifiers be removed before logs leave the device?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--cffa7bdc-ba4a-5ebd-acd2-463bdaea8706", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LS-2 mitigation: Service log exports leak patients", "description": "Logs leaving the device carry only what the vendor needs, with patient identifiers removed.\n\n1. Strip or pseudonymise patient identifiers in every log export by default.\n2. Encrypt exported logs and send them through an approved, audited channel.\n3. Document in the security guide exactly what each export contains.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LS-2", "mitigation_principle": "Logs leaving the device carry only what the vendor needs, with patient identifiers removed.", "design_measures": [ "Strip or pseudonymise patient identifiers in every log export by default.", "Encrypt exported logs and send them through an approved, audited channel.", "Document in the security guide exactly what each export contains." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bb5c9f3d-63c7-5519-8bf2-078a3055a5c2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cffa7bdc-ba4a-5ebd-acd2-463bdaea8706", "target_ref": "attack-pattern--61321563-47b6-5d67-80c0-30068956e8ee" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--acf2773c-fe52-5994-8a73-fa6209bbec23", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "LS Life Support and Therapy", "description": "Ventilators and respirators, anaesthesia workstations, oxygen, defibrillators, dialysis, ECMO, neonatal incubators and surgical robots.", "context": "unspecified", "object_refs": [ "attack-pattern--6479449e-0758-515f-bbd8-945756e49344", "course-of-action--a0fb34d5-cf84-58c6-b15d-6d52634381d7", "attack-pattern--62c81af3-de57-566e-b62b-85ded597c3b7", "course-of-action--4c1462bb-bb34-59c7-9f96-8fc30290fc17", "attack-pattern--1590ed62-1099-5a0c-9e96-8bb21b5020fd", "course-of-action--36585261-7705-5339-b7c0-749d54c5da3e", "attack-pattern--6d464789-9dc1-5cbc-9668-fc5ff9984896", "course-of-action--5eb3bebb-c58f-55fe-b9bc-400654fb840d", "attack-pattern--04f94dba-f1fa-56c0-b9a6-48bc32e8108d", "course-of-action--0c48741f-ff72-5951-91b9-60551661af16", "attack-pattern--94ecf18b-2112-5a00-93e8-29b058948c17", "course-of-action--d05e1ca6-1f3b-505d-b9a7-030042392088", "attack-pattern--e62d86d6-0037-5971-ab7d-7ce5848b0552", "course-of-action--0e28fbd7-dfba-5640-bb05-463b8999feaa", "attack-pattern--db6f97c3-db1c-58ef-8a7b-11e74657f2fc", "course-of-action--851e5e18-fad9-5e39-acfd-4969df3b6872", "attack-pattern--1301d665-31e0-55fe-a59f-646c83ab8f93", "course-of-action--55884f20-1eaf-5370-b286-1f10a9837967", "attack-pattern--89c78a56-bd32-582f-be90-ad953f881a78", "course-of-action--d9a03a85-b721-5fcf-b0ea-14951571e74c", "attack-pattern--2061f520-ea96-5506-83af-7813cbd6221b", "course-of-action--3feda614-416f-5776-9675-fbf147ff2d37", "attack-pattern--b8186258-df8d-5a20-bb2d-2cc2f554bfd4", "course-of-action--c327fdf4-c838-5933-8376-b8e69b15bb51", "attack-pattern--61321563-47b6-5d67-80c0-30068956e8ee", "course-of-action--cffa7bdc-ba4a-5ebd-acd2-463bdaea8706" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-LS", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/life-support-and-therapy/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--16ce0c3f-be31-5f8a-8e4a-0718f38e576a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Drug library limits rewritten fleet-wide", "description": "Drug libraries set the concentrations and hard dose limits for every infusion pump and are pushed to the whole fleet from one server. A tampered library raises or removes limits on every pump at once, so overdoses become possible across the hospital with no error on screen.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-75", "url": "https://capec.mitre.org/data/definitions/75.html", "description": "Manipulating Writeable Configuration Files" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0889", "url": "https://attack.mitre.org/techniques/T0889/", "description": "Modify Program" }, { "source_name": "mitre-emb3d", "external_id": "TID-213", "url": "https://emb3d.mitre.org/threats/TID-213.html", "description": "Faulty FW/SW Update Integrity Verification" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-A", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "T", "E" ], "mds2": [ "IGAU", "CSUP", "AUTH" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Who can change the drug library, and who reviews each change?", "How does a pump know a library came from pharmacy unchanged?", "Would a raised hard limit show anywhere before a patient is harmed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c44d9c5f-cd9c-5de7-b272-a50fdba1cbcb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-A mitigation: Drug library limits rewritten fleet-wide", "description": "Drug libraries are authenticated end to end and every change is reviewed by pharmacy before it reaches a pump.\n\n1. Sign approved libraries in the pharmacy tool and have pumps verify the signature before loading.\n2. Require two-person pharmacy approval for any change that raises or removes a hard limit.\n3. Show the library version on each pump and alert centrally when pumps run an unapproved version.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-A", "mitigation_principle": "Drug libraries are authenticated end to end and every change is reviewed by pharmacy before it reaches a pump.", "design_measures": [ "Sign approved libraries in the pharmacy tool and have pumps verify the signature before loading.", "Require two-person pharmacy approval for any change that raises or removes a hard limit.", "Show the library version on each pump and alert centrally when pumps run an unapproved version." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3e17e3dc-ec52-5558-b774-3c9d808ab667", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c44d9c5f-cd9c-5de7-b272-a50fdba1cbcb", "target_ref": "attack-pattern--16ce0c3f-be31-5f8a-8e4a-0718f38e576a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e949f8cf-8aa2-55d3-b5b7-134806f7f6a6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Infusion pump reprogrammed over network", "description": "An infusion pump that accepts commands over Wi-Fi or Ethernet without strong authentication can have its rate, volume or drug changed, or be stopped, by anyone on the network. The pump may show the change as a normal programme.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-137", "url": "https://capec.mitre.org/data/definitions/137.html", "description": "Parameter Injection" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0886", "url": "https://attack.mitre.org/techniques/T0886/", "description": "Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-328", "url": "https://emb3d.mitre.org/threats/TID-328.html", "description": "Hardcoded Credentials" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "Hospira Symbiq infusion pumps, 2015", "url": "https://www.mddionline.com/regulatory-quality/fda-stop-using-infusion-pump-vulnerable-to-hacking", "description": "MDDI: FDA, stop using infusion pump vulnerable to hacking" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-K", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "S", "T", "E" ], "mds2": [ "NAUT", "AUTH", "SAHD" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which systems can send commands to a pump over the network?", "Can a rate or drug change without a clinician at the pump?", "How would a remote change look different from a normal programme?" ], "seen_in": [ "Hospira Symbiq infusion pumps, 2015" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--0dd516d8-6026-5aa0-9d7f-941a1825b5ba", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-K mitigation: Infusion pump reprogrammed over network", "description": "Pumps accept network commands only from authenticated systems, and dose changes need a clinician at the pump.\n\n1. Mutually authenticate the pump and its server, and refuse all commands from anything else.\n2. Disable network services the clinical workflow does not use, such as remote shells or diagnostic ports.\n3. Require confirmation at the pump for any change to rate, volume or drug.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-K", "mitigation_principle": "Pumps accept network commands only from authenticated systems, and dose changes need a clinician at the pump.", "design_measures": [ "Mutually authenticate the pump and its server, and refuse all commands from anything else.", "Disable network services the clinical workflow does not use, such as remote shells or diagnostic ports.", "Require confirmation at the pump for any change to rate, volume or drug." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8d5a0f1-65f8-555f-a57f-858ec4f6f7c9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0dd516d8-6026-5aa0-9d7f-941a1825b5ba", "target_ref": "attack-pattern--e949f8cf-8aa2-55d3-b5b7-134806f7f6a6" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0313dba2-a653-50be-97d5-3a06814d51c0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unsigned pump firmware accepted", "description": "Pumps that install firmware without verifying who built it can be given modified software through the update server, a service laptop or a USB port. Altered firmware can change dose calculation or alarms on every pump that takes the update.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-533", "url": "https://capec.mitre.org/data/definitions/533.html", "description": "Malicious Manual Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T0800", "url": "https://attack.mitre.org/techniques/T0800/", "description": "Activate Firmware Update Mode" }, { "source_name": "mitre-attack", "external_id": "T0862", "url": "https://attack.mitre.org/techniques/T0862/", "description": "Supply Chain Compromise" }, { "source_name": "mitre-emb3d", "external_id": "TID-211", "url": "https://emb3d.mitre.org/threats/TID-211.html", "description": "Device Allows Unauthenticated Firmware Installation" }, { "source_name": "mitre-emb3d", "external_id": "TID-213", "url": "https://emb3d.mitre.org/threats/TID-213.html", "description": "Faulty FW/SW Update Integrity Verification" }, { "source_name": "mitre-emb3d", "external_id": "TID-216", "url": "https://emb3d.mitre.org/threats/TID-216.html", "description": "Firmware Update Rollbacks Allowed" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-Q", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "T", "E" ], "mds2": [ "CSUP", "IGAU" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Where does the pump verify that firmware is genuine?", "Which routes can deliver firmware: update server, laptop, USB?", "How many pumps would one bad update reach?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--47bc8080-a50f-5a6a-8c94-5429b85b5125", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-Q mitigation: Unsigned pump firmware accepted", "description": "Pumps run only firmware signed by the manufacturer and verified on the device.\n\n1. Verify a manufacturer signature at install and at every boot, with the key held in hardware.\n2. Block rollback to older, vulnerable firmware versions.\n3. Restrict update installation to an authenticated, logged service path.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-Q", "mitigation_principle": "Pumps run only firmware signed by the manufacturer and verified on the device.", "design_measures": [ "Verify a manufacturer signature at install and at every boot, with the key held in hardware.", "Block rollback to older, vulnerable firmware versions.", "Restrict update installation to an authenticated, logged service path." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--907d0d25-c61a-5196-9f33-292a1d0edcd0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--47bc8080-a50f-5a6a-8c94-5429b85b5125", "target_ref": "attack-pattern--0313dba2-a653-50be-97d5-3a06814d51c0" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--67c51e02-cdd6-5372-8154-ccecf1ee75bd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Auto-programming sends a wrong dose", "description": "When the EHR programmes the pump directly from the order, nurses learn to trust the prefilled values. A tampered message, a mapping error between order units and pump units, or a spoofed integration server can load the wrong drug, rate or patient.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T0830", "url": "https://attack.mitre.org/techniques/T0830/", "description": "Adversary-in-the-Middle" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-J", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "S", "T" ], "mds2": [ "TXIG", "NAUT", "IGAU" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How is an auto-programming message authenticated between EHR and pump?", "Where could order units and pump units be mapped wrongly?", "What makes the nurse check prefilled values against the order?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--bdd3216a-0d23-5981-81e0-f79808fa88d5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-J mitigation: Auto-programming sends a wrong dose", "description": "Pump-EHR messages are authenticated and every auto-programmed infusion is checked by a person against the order.\n\n1. Authenticate and integrity-protect messages between the EHR, the interoperability server and the pump.\n2. Match patient, drug and concentration by scanned identifiers before the programme is accepted.\n3. Show the full programme at the pump and require confirmation; never start automatically.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-J", "mitigation_principle": "Pump-EHR messages are authenticated and every auto-programmed infusion is checked by a person against the order.", "design_measures": [ "Authenticate and integrity-protect messages between the EHR, the interoperability server and the pump.", "Match patient, drug and concentration by scanned identifiers before the programme is accepted.", "Show the full programme at the pump and require confirmation; never start automatically." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a9f4155b-bfda-5a46-beff-f9a3ebef5b55", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bdd3216a-0d23-5981-81e0-f79808fa88d5", "target_ref": "attack-pattern--67c51e02-cdd6-5372-8154-ccecf1ee75bd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--00d8cf00-5f48-51d6-92ed-dc70f0dda223", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "PCA limits loosened", "description": "Patient-controlled analgesia pumps let patients give themselves opioid doses within a lockout and hourly limit. If those limits can be changed remotely, by a shared clinician code or through a weak key lock, a patient can receive a fatal dose.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "capec", "external_id": "CAPEC-391", "url": "https://capec.mitre.org/data/definitions/391.html", "description": "Bypassing Physical Locks" }, { "source_name": "cwe", "external_id": "CWE-1391", "url": "https://cwe.mitre.org/data/definitions/1391.html", "description": "Use of Weak Credentials" }, { "source_name": "cwe", "external_id": "CWE-1263", "url": "https://cwe.mitre.org/data/definitions/1263.html", "description": "Improper Physical Access Control" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-emb3d", "external_id": "TID-311", "url": "https://emb3d.mitre.org/threats/TID-311.html", "description": "Default Credentials" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-10", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "T", "E" ], "mds2": [ "PAUT", "AUTH", "PLOK" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Who can change PCA lockout and hourly limits, and how?", "Are clinician codes on PCA pumps individual or shared?", "What bounds does pharmacy set that no one can exceed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--db40c06c-06dc-598d-8fc7-3c17254a5be1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-10 mitigation: PCA limits loosened", "description": "PCA limits change only with individual clinician authentication at the pump and stay within pharmacy-approved bounds.\n\n1. Require individual clinician authentication at the pump to change PCA limits.\n2. Enforce library hard limits on lockout and hourly dose that the bedside cannot override.\n3. Use a physical lock for the drug reservoir and alarm on door opening.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-10", "mitigation_principle": "PCA limits change only with individual clinician authentication at the pump and stay within pharmacy-approved bounds.", "design_measures": [ "Require individual clinician authentication at the pump to change PCA limits.", "Enforce library hard limits on lockout and hourly dose that the bedside cannot override.", "Use a physical lock for the drug reservoir and alarm on door opening." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--45b79a98-28dd-5a30-bdc0-c71532c1387b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--db40c06c-06dc-598d-8fc7-3c17254a5be1", "target_ref": "attack-pattern--00d8cf00-5f48-51d6-92ed-dc70f0dda223" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--34f6cd80-f51f-5115-b34d-c900cd6f592f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Barcode checks quietly bypassed", "description": "Barcode medication administration only protects patients when the scans are real. Relabelled drugs, copied wristbands, a scanner that accepts typed numbers, or a degraded mode that skips checks during an outage lets the wrong drug reach the wrong patient.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-554", "url": "https://capec.mitre.org/data/definitions/554.html", "description": "Functionality Bypass" }, { "source_name": "cwe", "external_id": "CWE-807", "url": "https://cwe.mitre.org/data/definitions/807.html", "description": "Reliance on Untrusted Inputs in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-602", "url": "https://cwe.mitre.org/data/definitions/602.html", "description": "Client-Side Enforcement of Server-Side Security" }, { "source_name": "mitre-attack", "external_id": "T1036", "url": "https://attack.mitre.org/techniques/T1036/", "description": "Masquerading" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-9", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "S", "T", "R" ], "mds2": [ "AUDT", "IGAU" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Can a scanner accept a typed number instead of a scan?", "What happens to bedside checks when the system is down?", "How would copied wristbands or relabelled drugs be caught?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a1d44826-2d69-5dea-84da-e490cc6d6088", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-9 mitigation: Barcode checks quietly bypassed", "description": "Bedside checks depend on scanned identifiers that cannot be typed or copied, and degraded modes are visible and recorded.\n\n1. Disable manual entry of drug and patient identifiers, or require a second clinician to witness it.\n2. Make any bypass or degraded mode visible on the ward and report bypass rates daily.\n3. Use tamper-evident wristbands and verify barcodes against the pharmacy dispensing record.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-9", "mitigation_principle": "Bedside checks depend on scanned identifiers that cannot be typed or copied, and degraded modes are visible and recorded.", "design_measures": [ "Disable manual entry of drug and patient identifiers, or require a second clinician to witness it.", "Make any bypass or degraded mode visible on the ward and report bypass rates daily.", "Use tamper-evident wristbands and verify barcodes against the pharmacy dispensing record." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d20f6678-523f-5f2a-83ed-90c14ed6b068", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a1d44826-2d69-5dea-84da-e490cc6d6088", "target_ref": "attack-pattern--34f6cd80-f51f-5115-b34d-c900cd6f592f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0d680531-01fd-5b1a-84ac-7015953d9bdd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Compounding robot recipes altered", "description": "Pharmacy robots and compounding systems prepare chemotherapy, parenteral nutrition and syringes from stored recipes and the order feed. An altered recipe or calibration produces many wrong-strength doses that look correctly labelled.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-165", "url": "https://capec.mitre.org/data/definitions/165.html", "description": "File Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-8", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "T" ], "mds2": [ "IGAU", "AUTH", "AUDT" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Who controls changes to compounding recipes and calibration?", "How is a prepared dose checked independently of the robot?", "How many doses would one altered recipe affect before anyone noticed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9ee6ab4e-d848-5189-9116-4628f295c9fe", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-8 mitigation: Compounding robot recipes altered", "description": "Recipes and calibration in compounding systems are controlled documents, and outputs are verified independently.\n\n1. Sign recipes and require pharmacist approval for each change, with version history.\n2. Verify each preparation by gravimetric or analytical check independent of the robot's own software.\n3. Restrict the robot's network access to the pharmacy system it serves.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-8", "mitigation_principle": "Recipes and calibration in compounding systems are controlled documents, and outputs are verified independently.", "design_measures": [ "Sign recipes and require pharmacist approval for each change, with version history.", "Verify each preparation by gravimetric or analytical check independent of the robot's own software.", "Restrict the robot's network access to the pharmacy system it serves." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--00265bdc-88d8-5700-b240-71ae60916d35", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9ee6ab4e-d848-5189-9116-4628f295c9fe", "target_ref": "attack-pattern--0d680531-01fd-5b1a-84ac-7015953d9bdd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--47ce7a6a-6a91-58bb-8c2e-1933c8d79af0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pumps report infusing when stopped", "description": "Central infusion views and alarm routing depend on status messages from pumps. A flood of traffic, a crashed pump stack or a forged status can stop an infusion of a vasoactive or sedative drug while the ward screen still shows it running.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "cwe", "external_id": "CWE-392", "url": "https://cwe.mitre.org/data/definitions/392.html", "description": "Missing Report of Error Condition" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "Denial of View" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "Denial of Service" }, { "source_name": "mitre-emb3d", "external_id": "TID-405", "url": "https://emb3d.mitre.org/threats/TID-405.html", "description": "Network Stack Resource Exhaustion" }, { "source_name": "mitre-emb3d", "external_id": "TID-202", "url": "https://emb3d.mitre.org/threats/TID-202.html", "description": "Exploitable System Network Stack Component" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "URGENT/11, 2019", "url": "https://healthcareitnews.com/node/544606", "description": "Healthcare IT News: URGENT/11, FDA issues alert" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-7", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "D", "S" ], "mds2": [ "TXIG", "SAHD" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How does the ward know an infusion has really stopped?", "Does the pump alarm locally, or only through the network?", "Could a forged status hide a stopped vasoactive infusion?" ], "seen_in": [ "URGENT/11, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8ca11cfb-8267-573a-a1a3-9cce49527cfc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-7 mitigation: Pumps report infusing when stopped", "description": "Loss of infusion is detected and alarmed at the pump, not inferred from network status.\n\n1. Alarm locally at the pump on any stop or occlusion, independent of the network.\n2. Show stale or missing pump status as unknown at the central view, never as the last good value.\n3. Test pump network stacks against flooding and malformed traffic.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-7", "mitigation_principle": "Loss of infusion is detected and alarmed at the pump, not inferred from network status.", "design_measures": [ "Alarm locally at the pump on any stop or occlusion, independent of the network.", "Show stale or missing pump status as unknown at the central view, never as the last good value.", "Test pump network stacks against flooding and malformed traffic." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--063841da-22fc-59f7-bcc4-f24d47bae1d4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8ca11cfb-8267-573a-a1a3-9cce49527cfc", "target_ref": "attack-pattern--47ce7a6a-6a91-58bb-8c2e-1933c8d79af0" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3e23ea57-67a7-5a67-bd5b-8bf232d12186", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Dispensing cabinets fail closed", "description": "Automated dispensing cabinets unlock drawers only after checking orders and users with a central server. During a network outage or ransomware the cabinets lock, and emergency drugs are out of reach on the ward.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0813", "url": "https://attack.mitre.org/techniques/T0813/", "description": "Denial of Control" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-6", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "D" ], "mds2": [ "EMRG", "DTBK" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Can staff reach emergency drugs when the cabinet server is down?", "How is offline cabinet access recorded and reconciled later?", "When was cabinet failure last rehearsed on a ward?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b2f47b52-66c2-572d-b740-9411a158c457", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-6 mitigation: Dispensing cabinets fail closed", "description": "Cabinets keep emergency drugs available offline, with access recorded for later reconciliation.\n\n1. Hold a cached order and user list on each cabinet with an offline emergency mode.\n2. Keep a sealed emergency key procedure and practise it in downtime drills.\n3. Record all offline access locally and reconcile it when the server returns.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-6", "mitigation_principle": "Cabinets keep emergency drugs available offline, with access recorded for later reconciliation.", "design_measures": [ "Hold a cached order and user list on each cabinet with an offline emergency mode.", "Keep a sealed emergency key procedure and practise it in downtime drills.", "Record all offline access locally and reconcile it when the server returns." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a5e9217e-189f-52f6-905b-2285aba39677", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b2f47b52-66c2-572d-b740-9411a158c457", "target_ref": "attack-pattern--3e23ea57-67a7-5a67-bd5b-8bf232d12186" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7d1bd04c-9ba3-5846-9fce-53468873889a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pharmacy labels misprinted", "description": "Labels for prepared doses and patient medication are printed from pharmacy systems through shared print queues. Altered label templates or queue tampering can print the wrong strength, route or patient on correctly prepared doses.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-75", "url": "https://capec.mitre.org/data/definitions/75.html", "description": "Manipulating Writeable Configuration Files" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-5", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "T" ], "mds2": [ "IGAU" ], "deck": "The Patient", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Where are label templates kept, and who can change them?", "Is the printed label checked against the dispensing record?", "Who else shares the print queues that pharmacy labels use?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4416090d-8880-575e-9b37-820afb2ded14", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-5 mitigation: Pharmacy labels misprinted", "description": "What is printed on a label is generated and checked from the verified dispensing record.\n\n1. Print labels only from the verified dispensing record, with the label content signed or check-summed.\n2. Isolate pharmacy label printers from general print queues.\n3. Scan the printed label back against the record before release.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-5", "mitigation_principle": "What is printed on a label is generated and checked from the verified dispensing record.", "design_measures": [ "Print labels only from the verified dispensing record, with the label content signed or check-summed.", "Isolate pharmacy label printers from general print queues.", "Scan the printed label back against the record before release." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--355a69e8-b992-57b0-9608-343e48f02ddf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4416090d-8880-575e-9b37-820afb2ded14", "target_ref": "attack-pattern--7d1bd04c-9ba3-5846-9fce-53468873889a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--81458ad4-79d6-5ff5-aa6f-702a68aaec01", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Controlled drug records falsified", "description": "Electronic controlled-drug registers and cabinet logs can be edited by privileged users, shared accounts or service tools. Diversion of opioids is hidden, patients get substituted or short doses, and investigations cannot show who took what.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-4", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "R", "T" ], "linddun": [ "Nr" ], "mds2": [ "AUDT", "PAUT", "AUTH" ], "deck": "The Patient", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "Can every controlled drug entry be traced to one person?", "Who can edit the register, including service tools?", "How would opioid diversion show up in these records?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--caf1c8c4-3452-5313-903e-e74e169536b6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-4 mitigation: Controlled drug records falsified", "description": "Controlled drug records are attributable to individuals and cannot be changed without trace.\n\n1. Require individual authentication and a witness for every controlled-drug transaction.\n2. Make the register append-only, with corrections as new entries.\n3. Analyse transactions for diversion patterns and review them routinely.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-4", "mitigation_principle": "Controlled drug records are attributable to individuals and cannot be changed without trace.", "design_measures": [ "Require individual authentication and a witness for every controlled-drug transaction.", "Make the register append-only, with corrections as new entries.", "Analyse transactions for diversion patterns and review them routinely." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85191fdf-2a5f-5c32-a7d6-f7f1b23db61f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--caf1c8c4-3452-5313-903e-e74e169536b6", "target_ref": "attack-pattern--81458ad4-79d6-5ff5-aa6f-702a68aaec01" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--35e34eb4-288e-53ef-a290-a0eb36762e90", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pumps run stale drug libraries", "description": "Pumps that are off the network, in storage or on loan never receive library updates, and nothing reports which version each pump holds. A withdrawn concentration or an unsafe old limit stays in use without anyone knowing.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-672", "url": "https://cwe.mitre.org/data/definitions/672.html", "description": "Operation on a Resource after Expiration or Release" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-3", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "T" ], "mds2": [ "CSUP" ], "deck": "The Patient", "rank": "3", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How do you know which library version each pump holds?", "What happens to pumps in storage or on loan when libraries change?", "Can a pump with an outdated library still be used on a patient?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b9d12f5c-071b-5130-82eb-36dfef0c8dcf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-3 mitigation: Pumps run stale drug libraries", "description": "Every pump's library version is known, and outdated pumps are kept out of use.\n\n1. Report each pump's library version centrally and flag pumps that have not checked in.\n2. Block programming from a library older than an approved minimum version.\n3. Include library checks in the process for pumps returning from storage, repair or loan.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-3", "mitigation_principle": "Every pump's library version is known, and outdated pumps are kept out of use.", "design_measures": [ "Report each pump's library version centrally and flag pumps that have not checked in.", "Block programming from a library older than an approved minimum version.", "Include library checks in the process for pumps returning from storage, repair or loan." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b86a731d-622d-5a79-a307-3c21ce644857", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b9d12f5c-071b-5130-82eb-36dfef0c8dcf", "target_ref": "attack-pattern--35e34eb4-288e-53ef-a290-a0eb36762e90" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4de57671-91f8-5e1a-a218-336058642e87", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Infusion history leaks patient data", "description": "Pumps and their servers keep infusion histories with drug, dose, time and often patient identifiers. Transmitted in clear, stored unencrypted on the pump, or left on decommissioned units, they reveal sensitive treatments such as chemotherapy or HIV therapy.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/#cri-md-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-117", "url": "https://capec.mitre.org/data/definitions/117.html", "description": "Interception" }, { "source_name": "capec", "external_id": "CAPEC-675", "url": "https://capec.mitre.org/data/definitions/675.html", "description": "Retrieve Data from Decommissioned Devices" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-226", "url": "https://cwe.mitre.org/data/definitions/226.html", "description": "Sensitive Information in Resource Not Removed Before Reuse" }, { "source_name": "mitre-attack", "external_id": "T0882", "url": "https://attack.mitre.org/techniques/T0882/", "description": "Theft of Operational Information" }, { "source_name": "mitre-emb3d", "external_id": "TID-408", "url": "https://emb3d.mitre.org/threats/TID-408.html", "description": "Unencrypted Sensitive Data Communication" }, { "source_name": "mitre-emb3d", "external_id": "TID-108", "url": "https://emb3d.mitre.org/threats/TID-108.html", "description": "ROM/NVRAM Data Extraction or Modification" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-2", "group_code": "MD", "group_name": "Medication Delivery", "stride": [ "I" ], "linddun": [ "DD", "I", "L" ], "mds2": [ "STCF", "TXCF", "MPII" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "What patient details do pumps keep in their infusion history?", "Is infusion history encrypted on the pump and in transit?", "What is wiped before a pump leaves the hospital?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--016ee411-8099-562e-b14d-1ade930c36f1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-MD-2 mitigation: Infusion history leaks patient data", "description": "Infusion histories are minimised, encrypted and wiped when a pump leaves service.\n\n1. Encrypt pump data at rest and in transit to the server.\n2. Keep only the identifiers the workflow needs on the pump itself.\n3. Wipe pumps verifiably before repair, resale or disposal.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-MD-2", "mitigation_principle": "Infusion histories are minimised, encrypted and wiped when a pump leaves service.", "design_measures": [ "Encrypt pump data at rest and in transit to the server.", "Keep only the identifiers the workflow needs on the pump itself.", "Wipe pumps verifiably before repair, resale or disposal." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3bac0ad8-4583-511d-8ad8-d0cd7b9c2a7e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--016ee411-8099-562e-b14d-1ade930c36f1", "target_ref": "attack-pattern--4de57671-91f8-5e1a-a218-336058642e87" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--71c6ba94-0712-5f92-b545-148fa653338e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "MD Medication Delivery", "description": "Infusion and PCA pumps, drug libraries, pump-EHR auto-programming, barcode administration, dispensing cabinets, pharmacy robots and controlled drug records.", "context": "unspecified", "object_refs": [ "attack-pattern--16ce0c3f-be31-5f8a-8e4a-0718f38e576a", "course-of-action--c44d9c5f-cd9c-5de7-b272-a50fdba1cbcb", "attack-pattern--e949f8cf-8aa2-55d3-b5b7-134806f7f6a6", "course-of-action--0dd516d8-6026-5aa0-9d7f-941a1825b5ba", "attack-pattern--0313dba2-a653-50be-97d5-3a06814d51c0", "course-of-action--47bc8080-a50f-5a6a-8c94-5429b85b5125", "attack-pattern--67c51e02-cdd6-5372-8154-ccecf1ee75bd", "course-of-action--bdd3216a-0d23-5981-81e0-f79808fa88d5", "attack-pattern--00d8cf00-5f48-51d6-92ed-dc70f0dda223", "course-of-action--db40c06c-06dc-598d-8fc7-3c17254a5be1", "attack-pattern--34f6cd80-f51f-5115-b34d-c900cd6f592f", "course-of-action--a1d44826-2d69-5dea-84da-e490cc6d6088", "attack-pattern--0d680531-01fd-5b1a-84ac-7015953d9bdd", "course-of-action--9ee6ab4e-d848-5189-9116-4628f295c9fe", "attack-pattern--47ce7a6a-6a91-58bb-8c2e-1933c8d79af0", "course-of-action--8ca11cfb-8267-573a-a1a3-9cce49527cfc", "attack-pattern--3e23ea57-67a7-5a67-bd5b-8bf232d12186", "course-of-action--b2f47b52-66c2-572d-b740-9411a158c457", "attack-pattern--7d1bd04c-9ba3-5846-9fce-53468873889a", "course-of-action--4416090d-8880-575e-9b37-820afb2ded14", "attack-pattern--81458ad4-79d6-5ff5-aa6f-702a68aaec01", "course-of-action--caf1c8c4-3452-5313-903e-e74e169536b6", "attack-pattern--35e34eb4-288e-53ef-a290-a0eb36762e90", "course-of-action--b9d12f5c-071b-5130-82eb-36dfef0c8dcf", "attack-pattern--4de57671-91f8-5e1a-a218-336058642e87", "course-of-action--016ee411-8099-562e-b14d-1ade930c36f1" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-MD", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/medication-delivery/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4a515025-ee2e-55e9-b212-7ed51c213cd7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Radiotherapy plan altered before delivery", "description": "Treatment plans pass from the planning system through the oncology information system to the linac. A changed dose, field shape, gantry angle or patient position between approval and delivery can give a serious overdose or miss the tumour, and harm may appear only weeks later.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-165", "url": "https://capec.mitre.org/data/definitions/165.html", "description": "File Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-354", "url": "https://cwe.mitre.org/data/definitions/354.html", "description": "Improper Validation of Integrity Check Value" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-A", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T", "R" ], "mds2": [ "IGAU", "AUDT", "NAUT" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How do you prove the plan delivered matches the plan approved?", "Which systems can change a plan between approval and the linac?", "Would a changed field or dose be caught before the first fraction?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ddb545c2-024f-53b3-b0a6-ba1d720a2ac8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-A mitigation: Radiotherapy plan altered before delivery", "description": "The plan delivered is provably the plan the clinicians approved.\n\n1. Sign the approved plan in the planning system and verify the signature at the treatment console.\n2. Run independent dose verification of the delivered plan before the first fraction.\n3. Log every plan modification with user and reason, and alert on changes after approval.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-A", "mitigation_principle": "The plan delivered is provably the plan the clinicians approved.", "design_measures": [ "Sign the approved plan in the planning system and verify the signature at the treatment console.", "Run independent dose verification of the delivered plan before the first fraction.", "Log every plan modification with user and reason, and alert on changes after approval." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a981aaa-5589-5095-8ca0-6c6c6ab01e64", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ddb545c2-024f-53b3-b0a6-ba1d720a2ac8", "target_ref": "attack-pattern--4a515025-ee2e-55e9-b212-7ed51c213cd7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1597674-a863-5bbb-bd20-7a86d7f9f84b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Radiotherapy service halted", "description": "Linacs depend on planning systems, oncology information systems and, increasingly, vendor-hosted cloud services. Ransomware at the hospital or the vendor stops treatment courses that must not be interrupted, and patients' cancers progress.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490/", "description": "Inhibit System Recovery" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Elekta cloud outage, 2021", "url": "https://compliancy-group.com/healthcare-vendor-ransomware-attack-170-health-systems-hit/", "description": "Compliancy Group: Healthcare vendor ransomware attack, 170 health systems hit" }, { "source_name": "Elekta cloud outage, 2021", "url": "https://yaledailynews.com/blog/2021/04/27/ynhhs-pauses-radiotherapy-treatment-for-six-days-after-software-breach", "description": "Yale Daily News: YNHHS pauses radiotherapy treatment for six days" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-K", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "D" ], "mds2": [ "DTBK", "RDMP" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How long can radiotherapy continue without its planning and cloud systems?", "Which vendor services does treatment delivery depend on?", "Who decides which patients' courses continue during an outage?" ], "seen_in": [ "Elekta cloud outage, 2021" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--62add64b-389e-5586-b2ad-7edfc56968c7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-K mitigation: Radiotherapy service halted", "description": "Radiotherapy can continue safely for a defined period when its supporting systems are lost.\n\n1. Hold an offline, verified copy of active treatment plans and schedules for each linac.\n2. Plan and rehearse transfer of patients to partner centres with compatible equipment.\n3. Require vendors to document continuity for cloud-hosted components in the contract.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-K", "mitigation_principle": "Radiotherapy can continue safely for a defined period when its supporting systems are lost.", "design_measures": [ "Hold an offline, verified copy of active treatment plans and schedules for each linac.", "Plan and rehearse transfer of patients to partner centres with compatible equipment.", "Require vendors to document continuity for cloud-hosted components in the contract." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--52401d29-0114-5d9a-8d9e-28ed5ac9202f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--62add64b-389e-5586-b2ad-7edfc56968c7", "target_ref": "attack-pattern--b1597674-a863-5bbb-bd20-7a86d7f9f84b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--24e52c6d-f8cc-5c82-8edb-3639edc79931", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Image tampering adds or removes findings", "description": "Images move from scanner to archive to reporting workstation, often without integrity protection. An attacker can add or remove a tumour, bleed or fracture in CT, MRI or X-ray images, leading to unnecessary surgery or missed treatment that radiologists cannot detect by eye.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-408", "url": "https://emb3d.mitre.org/threats/TID-408.html", "description": "Unencrypted Sensitive Data Communication" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-Q", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T" ], "mds2": [ "IGAU", "TXIG" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Where are images integrity-protected between scanner and reporting?", "Could a radiologist tell that a finding had been added or removed?", "Who can write to the image archive?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5f923b18-968a-5529-b3d7-c2ca00e6da1e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-Q mitigation: Image tampering adds or removes findings", "description": "Diagnostic images are integrity-protected from acquisition to reporting.\n\n1. Sign or hash images at the modality and verify them in the archive and on the viewer.\n2. Use TLS for all DICOM transfers inside the hospital, not only external ones.\n3. Alert when an image object is modified after acquisition and keep the original.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-Q", "mitigation_principle": "Diagnostic images are integrity-protected from acquisition to reporting.", "design_measures": [ "Sign or hash images at the modality and verify them in the archive and on the viewer.", "Use TLS for all DICOM transfers inside the hospital, not only external ones.", "Alert when an image object is modified after acquisition and keep the original." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6796af27-dfb8-5b7f-a80b-a07b2f662222", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5f923b18-968a-5529-b3d7-c2ca00e6da1e", "target_ref": "attack-pattern--24e52c6d-f8cc-5c82-8edb-3639edc79931" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--61cb5d39-05bd-55bb-ba63-e2f2074591c1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Imaging dose protocols raised", "description": "CT, fluoroscopy, mammography and X-ray dose depends on protocol libraries pushed to scanners. A tampered protocol raises tube current or exposure time across many patients, and the extra radiation is not noticed until audits or injuries appear.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-75", "url": "https://capec.mitre.org/data/definitions/75.html", "description": "Manipulating Writeable Configuration Files" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-J", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T" ], "mds2": [ "IGAU", "AUTH", "AUDT" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Who can change scanner dose protocols, and is it reviewed?", "How is dose outside reference levels caught at the scanner?", "How long would raised doses go unnoticed across many patients?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1cdc9795-99f7-5ce2-bf7d-271d6e1544ac", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-J mitigation: Imaging dose protocols raised", "description": "Dose protocols are controlled, and dose outside reference levels is caught at the scanner.\n\n1. Sign protocol libraries and require physicist approval for changes.\n2. Enforce dose alerts and notifications at the scanner against reference levels.\n3. Monitor dose records centrally and alarm on shifts in average dose per protocol.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-J", "mitigation_principle": "Dose protocols are controlled, and dose outside reference levels is caught at the scanner.", "design_measures": [ "Sign protocol libraries and require physicist approval for changes.", "Enforce dose alerts and notifications at the scanner against reference levels.", "Monitor dose records centrally and alarm on shifts in average dose per protocol." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0dbdb7c9-a9fd-539a-8392-a44c46c0347c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1cdc9795-99f7-5ce2-bf7d-271d6e1544ac", "target_ref": "attack-pattern--61cb5d39-05bd-55bb-ba63-e2f2074591c1" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e3532cc2-33e8-5828-bde3-d58cc2e20a63", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "DICOM files carry malware", "description": "DICOM image files can also be valid executables, and images arrive on CDs, USB drives, shares and from other hospitals. Malware hides in patient images, and anti-malware that quarantines the file deletes clinical evidence.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-636", "url": "https://capec.mitre.org/data/definitions/636.html", "description": "Hiding Malicious Data or Code within Files" }, { "source_name": "capec", "external_id": "CAPEC-457", "url": "https://capec.mitre.org/data/definitions/457.html", "description": "USB Memory Attacks" }, { "source_name": "cwe", "external_id": "CWE-434", "url": "https://cwe.mitre.org/data/definitions/434.html", "description": "Unrestricted Upload of File with Dangerous Type" }, { "source_name": "cwe", "external_id": "CWE-1287", "url": "https://cwe.mitre.org/data/definitions/1287.html", "description": "Improper Validation of Specified Type of Input" }, { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/", "description": "Malicious File" }, { "source_name": "mitre-attack", "external_id": "T1027.009", "url": "https://attack.mitre.org/techniques/T1027/009/", "description": "Embedded Payloads" }, { "source_name": "mitre-emb3d", "external_id": "TID-111", "url": "https://emb3d.mitre.org/threats/TID-111.html", "description": "Untrusted External Storage" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" }, { "source_name": "DICOM files carrying malware, 2019", "url": "https://web.nvd.nist.gov/vuln/detail/CVE-2019-11687", "description": "NVD: CVE-2019-11687" }, { "source_name": "DICOM files carrying malware, 2019", "url": "https://www.govinfosecurity.com/researchers-malware-be-hidden-in-medical-images-a-12388", "description": "GovInfoSecurity: Researchers, malware can be hidden in medical images" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-10", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T", "E" ], "mds2": [ "MLDP", "SAHD" ], "deck": "The Patient", "rank": "10", "physical_safety": false, "mitigation_prompts": [ "Where are imported images parsed before they reach clinical workstations?", "What happens to an image file that anti-malware flags?", "Which routes bring outside images in: CD, USB, share, network?" ], "seen_in": [ "DICOM files carrying malware, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--467c1e93-5207-5149-b3ba-8cea7103a59d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-10 mitigation: DICOM files carry malware", "description": "Imported images are parsed and checked in isolation before they reach clinical workstations.\n\n1. Import external media through an isolated gateway that validates DICOM structure and strips unexpected content.\n2. Disable autorun and execution of files from imaging import folders.\n3. Agree with the vendor how infected images are handled without losing the clinical record.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-10", "mitigation_principle": "Imported images are parsed and checked in isolation before they reach clinical workstations.", "design_measures": [ "Import external media through an isolated gateway that validates DICOM structure and strips unexpected content.", "Disable autorun and execution of files from imaging import folders.", "Agree with the vendor how infected images are handled without losing the clinical record." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9af7405-c673-5285-82fe-eab357515458", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--467c1e93-5207-5149-b3ba-8cea7103a59d", "target_ref": "attack-pattern--e3532cc2-33e8-5828-bde3-d58cc2e20a63" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--dffca878-ba29-5e28-9c33-e74c0d191ac3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Scanners stuck on unsupported systems", "description": "CT, MRI and X-ray consoles often run operating systems the vendor certified years ago and that can no longer be patched. Ransomware spreading across the network shuts scanners down, and emergency imaging stops.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-682", "url": "https://capec.mitre.org/data/definitions/682.html", "description": "Exploitation of Firmware or ROM Code with Unpatchable Vulnerabilities" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/", "description": "NAO: Investigation, WannaCry cyber attack and the NHS" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks", "description": "GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-9", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "D", "E" ], "mds2": [ "RDMP", "CSUP", "SAHD" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which imaging consoles run operating systems that can't be patched?", "What could reach those consoles if ransomware spread?", "How quickly could a scanner be rebuilt and back in service?" ], "seen_in": [ "WannaCry and the NHS, 2017" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c34addf4-0c2d-5a9b-b560-eaa107422329", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-9 mitigation: Scanners stuck on unsupported systems", "description": "Imaging consoles that cannot be patched are isolated and kept recoverable.\n\n1. Place modalities in their own network segment allowing only DICOM traffic to named systems.\n2. Require vendors to commit to supported operating system lifetimes and validated patches.\n3. Keep a tested restore image for each console and practise recovery.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-9", "mitigation_principle": "Imaging consoles that cannot be patched are isolated and kept recoverable.", "design_measures": [ "Place modalities in their own network segment allowing only DICOM traffic to named systems.", "Require vendors to commit to supported operating system lifetimes and validated patches.", "Keep a tested restore image for each console and practise recovery." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0bb90a40-995a-5df0-9309-c016f50f9d11", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c34addf4-0c2d-5a9b-b560-eaa107422329", "target_ref": "attack-pattern--dffca878-ba29-5e28-9c33-e74c0d191ac3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--94c9eb53-50dc-5569-a30d-0c64a8a1c4fd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Worklist mix-up assigns wrong patient", "description": "Scanners take patient details from the modality worklist. A spoofed worklist server or altered entry puts images under the wrong patient, so a scan is reported for one person and acted on for another.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" }, { "source_name": "mitre-attack", "external_id": "T1557", "url": "https://attack.mitre.org/techniques/T1557/", "description": "Adversary-in-the-Middle" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-8", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "S", "T" ], "linddun": [ "I" ], "mds2": [ "NAUT", "IGAU" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does the scanner know the worklist server is genuine?", "Where is patient identity confirmed before the scan starts?", "How would images filed under the wrong patient be spotted?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--99caa2c0-b4a8-5b83-82bf-d60f57e040ac", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-8 mitigation: Worklist mix-up assigns wrong patient", "description": "Patient identity on images comes from an authenticated worklist and is confirmed at the scanner.\n\n1. Authenticate the worklist server to the modality and restrict who can query it.\n2. Confirm patient identity at the scanner against the wristband before acquisition.\n3. Reconcile acquired studies with orders and flag mismatches before reporting.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-8", "mitigation_principle": "Patient identity on images comes from an authenticated worklist and is confirmed at the scanner.", "design_measures": [ "Authenticate the worklist server to the modality and restrict who can query it.", "Confirm patient identity at the scanner against the wristband before acquisition.", "Reconcile acquired studies with orders and flag mismatches before reporting." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d84abb22-621f-5808-a356-b352882f521e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--99caa2c0-b4a8-5b83-82bf-d60f57e040ac", "target_ref": "attack-pattern--94c9eb53-50dc-5569-a30d-0c64a8a1c4fd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1535060-b1e7-5f9c-8515-9db6d026cc06", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "MRI safety limits overridden", "description": "MRI scanners limit gradient switching and radiofrequency energy to prevent burns and nerve stimulation, and manage helium and quench systems. Altered limits, monitoring software or service settings can burn a patient or damage the magnet.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-121", "url": "https://capec.mitre.org/data/definitions/121.html", "description": "Exploit Non-Production Interfaces" }, { "source_name": "cwe", "external_id": "CWE-1244", "url": "https://cwe.mitre.org/data/definitions/1244.html", "description": "Internal Asset Exposed to Unsafe Debug Access Level or State" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "Loss of Protection" }, { "source_name": "mitre-emb3d", "external_id": "TID-224", "url": "https://emb3d.mitre.org/threats/TID-224.html", "description": "Excessive Access via Software Diagnostic Features" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-7", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T", "E" ], "mds2": [ "AUTH", "AUDT" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Are MRI safety limits enforced in hardware, firmware or settings?", "Who can change gradient, energy or quench settings?", "What alerts staff if a safety limit has been altered?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c0fa87cb-18e8-546a-8dc1-e9b99ded1501", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-7 mitigation: MRI safety limits overridden", "description": "Patient safety limits in MRI are enforced in hardware or protected firmware, not configurable software.\n\n1. Enforce specific absorption rate and gradient limits in a protected controller.\n2. Separate quench and cryogen monitoring from the networked console.\n3. Restrict service settings to authenticated engineers with logged sessions.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-7", "mitigation_principle": "Patient safety limits in MRI are enforced in hardware or protected firmware, not configurable software.", "design_measures": [ "Enforce specific absorption rate and gradient limits in a protected controller.", "Separate quench and cryogen monitoring from the networked console.", "Restrict service settings to authenticated engineers with logged sessions." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--62df605a-aaa5-5ecf-8e05-82d1f9183db1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c0fa87cb-18e8-546a-8dc1-e9b99ded1501", "target_ref": "attack-pattern--b1535060-b1e7-5f9c-8515-9db6d026cc06" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e82e2df0-599d-58b9-bfc9-d9c1b5e0c3c1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nuclear medicine activity misrecorded", "description": "Dose calibrators and radiopharmacy software record the activity drawn for each patient. Altered calibration factors or records give patients the wrong radiation dose or invalidate scans.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-165", "url": "https://capec.mitre.org/data/definitions/165.html", "description": "File Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-6", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T", "R" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How are dose calibrator calibration factors protected and checked?", "Who can edit the activity recorded for a patient?", "Would a wrong dose show up before administration?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3c7080ab-db9c-5b29-88a9-74eb3b7bc4f0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-6 mitigation: Nuclear medicine activity misrecorded", "description": "Radiopharmaceutical activity is measured and recorded with verified calibration.\n\n1. Protect calibration factors from change without physicist approval.\n2. Check calibrators daily against a reference source and record the result.\n3. Keep activity records append-only and linked to the order.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-6", "mitigation_principle": "Radiopharmaceutical activity is measured and recorded with verified calibration.", "design_measures": [ "Protect calibration factors from change without physicist approval.", "Check calibrators daily against a reference source and record the result.", "Keep activity records append-only and linked to the order." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cfeab0da-90bd-5fc7-8b52-939fbfd1136b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3c7080ab-db9c-5b29-88a9-74eb3b7bc4f0", "target_ref": "attack-pattern--e82e2df0-599d-58b9-bfc9-d9c1b5e0c3c1" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3274f5bb-5eb3-50dd-a538-787419bb8589", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Imaging archive exposed online", "description": "Image archives and DICOM nodes reachable from the internet, or from guest networks, answer queries without authentication. Millions of images and reports with names and dates of birth can be downloaded.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-1", "url": "https://capec.mitre.org/data/definitions/1.html", "description": "Accessing Functionality Not Properly Constrained by ACLs" }, { "source_name": "capec", "external_id": "CAPEC-158", "url": "https://capec.mitre.org/data/definitions/158.html", "description": "Sniffing Network Traffic" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/", "description": "Exploit Public-Facing Application" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "Open PACS servers, 2019", "url": "https://www.helpnetsecurity.com/2019/09/18/confidential-patient-data/", "description": "Help Net Security: Confidential data of 24.3 million patients discovered online" }, { "source_name": "Open PACS servers, 2019", "url": "https://www.hipaajournal.com/update-issued-on-unsecured-pacs-as-exposed-medical-image-total-rises-to-1-19-billion/", "description": "HIPAA Journal: Exposed medical image total rises to 1.19 billion" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-5", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "I" ], "linddun": [ "DD", "I" ], "mds2": [ "NAUT", "TXCF", "AUTH" ], "deck": "The Patient", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Can the image archive be queried from the internet or guest Wi-Fi?", "Which systems may query the archive, and how are they authenticated?", "When did anyone last check what the archive answers to?" ], "seen_in": [ "Open PACS servers, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--83704561-3b32-50a4-b051-c70e722d048f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-5 mitigation: Imaging archive exposed online", "description": "Image archives answer only authenticated, authorised systems on approved networks.\n\n1. Never expose DICOM services directly to the internet; use authenticated gateways for external sharing.\n2. Require node authentication and TLS for every DICOM association.\n3. Scan regularly for exposed imaging services.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-5", "mitigation_principle": "Image archives answer only authenticated, authorised systems on approved networks.", "design_measures": [ "Never expose DICOM services directly to the internet; use authenticated gateways for external sharing.", "Require node authentication and TLS for every DICOM association.", "Scan regularly for exposed imaging services." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a421d9c5-620e-548f-9286-52084840050b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--83704561-3b32-50a4-b051-c70e722d048f", "target_ref": "attack-pattern--3274f5bb-5eb3-50dd-a538-787419bb8589" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--83725696-0b60-57ab-9056-ada0bae619a9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Image metadata re-identifies patients", "description": "Images shared for research, teaching or AI training keep patient details in headers, burned-in text or the anatomy itself. Head CT and MRI can be rendered into recognisable faces, so de-identified data identifies people.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-497", "url": "https://capec.mitre.org/data/definitions/497.html", "description": "File Discovery" }, { "source_name": "cwe", "external_id": "CWE-1230", "url": "https://cwe.mitre.org/data/definitions/1230.html", "description": "Exposure of Sensitive Information Through Metadata" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-4", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "I" ], "linddun": [ "I", "L", "DD" ], "mds2": [ "DIDT" ], "deck": "The Patient", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "What patient details remain in images shared for research or AI?", "Is burned-in text removed from the pixels as well as headers?", "Could a head scan be rendered into a recognisable face?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--96e980aa-2331-50f8-92d9-8b72d149ef42", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-4 mitigation: Image metadata re-identifies patients", "description": "Images leaving clinical use are de-identified in headers, pixels and anatomy, and checked.\n\n1. Apply a de-identification profile that covers headers, private tags and burned-in annotations.\n2. Deface head and neck studies before release.\n3. Check a sample of every release for residual identifiers.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-4", "mitigation_principle": "Images leaving clinical use are de-identified in headers, pixels and anatomy, and checked.", "design_measures": [ "Apply a de-identification profile that covers headers, private tags and burned-in annotations.", "Deface head and neck studies before release.", "Check a sample of every release for residual identifiers." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--91d29cb7-30cc-5d3f-8dd2-94345c0e5f77", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--96e980aa-2331-50f8-92d9-8b72d149ef42", "target_ref": "attack-pattern--83725696-0b60-57ab-9056-ada0bae619a9" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--13a5fc0d-2ead-5bee-a79e-5f1d071eb6e7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Portable imaging stores images unprotected", "description": "Portable ultrasound and X-ray units and handheld probes paired to phones store images locally and upload to clouds. A lost device or an unencrypted upload discloses patient images.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-507", "url": "https://capec.mitre.org/data/definitions/507.html", "description": "Physical Theft" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-3", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "I" ], "linddun": [ "DD" ], "mds2": [ "STCF", "TXCF", "PLOK" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "What images stay stored on portable units and paired phones?", "Where do portable devices upload, and is that approved?", "What happens to images when a handheld probe is lost?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--58064c00-70d0-5ed6-9876-08fc75662b15", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-3 mitigation: Portable imaging stores images unprotected", "description": "Portable imaging keeps no more data than needed, encrypted, and uploads only to approved destinations.\n\n1. Encrypt local image storage and wipe images after confirmed transfer.\n2. Restrict uploads to the hospital archive or an approved, contracted service.\n3. Support remote wipe and inventory for portable units and their phones.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-3", "mitigation_principle": "Portable imaging keeps no more data than needed, encrypted, and uploads only to approved destinations.", "design_measures": [ "Encrypt local image storage and wipe images after confirmed transfer.", "Restrict uploads to the hospital archive or an approved, contracted service.", "Support remote wipe and inventory for portable units and their phones." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8ca79bc5-463e-5e7d-ab59-fdb7b5a7c07c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--58064c00-70d0-5ed6-9876-08fc75662b15", "target_ref": "attack-pattern--13a5fc0d-2ead-5bee-a79e-5f1d071eb6e7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c19bac7-3e38-5f1d-8ef3-db2deb047638", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Viewer presets that hide findings", "description": "Diagnostic viewers and displays rely on window settings, presets and calibration. Altered presets or display calibration can make a subtle finding invisible, and the radiologist reports a normal study.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/#cri-ir-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "mitre-attack", "external_id": "T1565.003", "url": "https://attack.mitre.org/techniques/T1565/003/", "description": "Runtime Data Manipulation" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-2", "group_code": "IR", "group_name": "Imaging and Radiation", "stride": [ "T" ], "mds2": [ "IGAU" ], "deck": "The Patient", "rank": "2", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can change viewer presets and window settings?", "How is display calibration checked, and how often?", "Would a changed preset be visible to the radiologist?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--19dc54f2-1528-5526-9b9f-3834097a7b92", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IR-2 mitigation: Viewer presets that hide findings", "description": "Viewer presets and display calibration are controlled and checked.\n\n1. Manage presets centrally with change control and version history.\n2. Run regular display calibration checks and log results.\n3. Show when a non-standard preset is in use.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IR-2", "mitigation_principle": "Viewer presets and display calibration are controlled and checked.", "design_measures": [ "Manage presets centrally with change control and version history.", "Run regular display calibration checks and log results.", "Show when a non-standard preset is in use." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbf555a0-0542-5acc-ab75-b3feaa9fabdf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--19dc54f2-1528-5526-9b9f-3834097a7b92", "target_ref": "attack-pattern--1c19bac7-3e38-5f1d-8ef3-db2deb047638" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--1d46f452-1a31-5cba-81f5-31078e58ac30", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "IR Imaging and Radiation", "description": "X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine and radiotherapy, with their worklists, workstations, images and dose.", "context": "unspecified", "object_refs": [ "attack-pattern--4a515025-ee2e-55e9-b212-7ed51c213cd7", "course-of-action--ddb545c2-024f-53b3-b0a6-ba1d720a2ac8", "attack-pattern--b1597674-a863-5bbb-bd20-7a86d7f9f84b", "course-of-action--62add64b-389e-5586-b2ad-7edfc56968c7", "attack-pattern--24e52c6d-f8cc-5c82-8edb-3639edc79931", "course-of-action--5f923b18-968a-5529-b3d7-c2ca00e6da1e", "attack-pattern--61cb5d39-05bd-55bb-ba63-e2f2074591c1", "course-of-action--1cdc9795-99f7-5ce2-bf7d-271d6e1544ac", "attack-pattern--e3532cc2-33e8-5828-bde3-d58cc2e20a63", "course-of-action--467c1e93-5207-5149-b3ba-8cea7103a59d", "attack-pattern--dffca878-ba29-5e28-9c33-e74c0d191ac3", "course-of-action--c34addf4-0c2d-5a9b-b560-eaa107422329", "attack-pattern--94c9eb53-50dc-5569-a30d-0c64a8a1c4fd", "course-of-action--99caa2c0-b4a8-5b83-82bf-d60f57e040ac", "attack-pattern--b1535060-b1e7-5f9c-8515-9db6d026cc06", "course-of-action--c0fa87cb-18e8-546a-8dc1-e9b99ded1501", "attack-pattern--e82e2df0-599d-58b9-bfc9-d9c1b5e0c3c1", "course-of-action--3c7080ab-db9c-5b29-88a9-74eb3b7bc4f0", "attack-pattern--3274f5bb-5eb3-50dd-a538-787419bb8589", "course-of-action--83704561-3b32-50a4-b051-c70e722d048f", "attack-pattern--83725696-0b60-57ab-9056-ada0bae619a9", "course-of-action--96e980aa-2331-50f8-92d9-8b72d149ef42", "attack-pattern--13a5fc0d-2ead-5bee-a79e-5f1d071eb6e7", "course-of-action--58064c00-70d0-5ed6-9876-08fc75662b15", "attack-pattern--1c19bac7-3e38-5f1d-8ef3-db2deb047638", "course-of-action--19dc54f2-1528-5526-9b9f-3834097a7b92" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-IR", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/imaging-and-radiation/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b3292474-7815-5ad8-9986-0c8169fc6b48", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Results altered before reaching the record", "description": "Analyser results pass through middleware and the laboratory information system to the record with no end-to-end integrity check. A changed potassium, troponin or glucose value is filed as genuine, and clinicians treat, discharge or withhold treatment on it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-385", "url": "https://capec.mitre.org/data/definitions/385.html", "description": "Transaction or Event Tampering via Application API Manipulation" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-A", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "T" ], "mds2": [ "IGAU", "TXIG", "AUDT" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How do you prove a result is the value the analyser measured?", "Which systems between analyser and record could change a value?", "Would anyone notice a plausible but altered potassium result?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c71dd8c3-04df-5e14-ae69-ffbdc5d8f409", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-A mitigation: Results altered before reaching the record", "description": "A result must be provably the value the analyser measured, from instrument to record.\n\n1. Sign or hash each result at the analyser or middleware and verify it before filing in the record.\n2. Reconcile result counts and values between analyser logs and the record on a schedule, and alert on mismatches.\n3. Restrict who and what can edit a validated result, and keep every amendment visible with its reason.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-A", "mitigation_principle": "A result must be provably the value the analyser measured, from instrument to record.", "design_measures": [ "Sign or hash each result at the analyser or middleware and verify it before filing in the record.", "Reconcile result counts and values between analyser logs and the record on a schedule, and alert on mismatches.", "Restrict who and what can edit a validated result, and keep every amendment visible with its reason." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ba37c2db-398e-566c-b3a4-fa477d410537", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c71dd8c3-04df-5e14-ae69-ffbdc5d8f409", "target_ref": "attack-pattern--b3292474-7815-5ad8-9986-0c8169fc6b48" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f0da743e-2284-5bcc-9180-f91434019b30", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Blood matched to the wrong patient", "description": "Blood bank systems trust the group, antibody results and sample labels they are given. A changed group, a swapped sample identity or a forged crossmatch release leads to an incompatible transfusion, which can kill within minutes.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1288", "url": "https://cwe.mitre.org/data/definitions/1288.html", "description": "Improper Validation of Consistency within Input" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-K", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "T", "S" ], "mds2": [ "IGAU", "AUTH", "AUDT" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which records must agree before blood is released for a patient?", "Could one person or system change a group or crossmatch alone?", "How is sample identity checked from bedside to blood bank?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9d44533a-e088-557d-91e7-bdf4ede712fc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-K mitigation: Blood matched to the wrong patient", "description": "Transfusion safety must never rest on a single record that one person or system can change.\n\n1. Require two independent identity checks at sampling and at the bedside, enforced by the system, not by policy alone.\n2. Keep historical blood group records read-only and flag any new group that differs from them.\n3. Log and alert on every manual override of electronic crossmatch or issue rules.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-K", "mitigation_principle": "Transfusion safety must never rest on a single record that one person or system can change.", "design_measures": [ "Require two independent identity checks at sampling and at the bedside, enforced by the system, not by policy alone.", "Keep historical blood group records read-only and flag any new group that differs from them.", "Log and alert on every manual override of electronic crossmatch or issue rules." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dcf159b5-827f-5540-9f9f-a0423bf634d5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9d44533a-e088-557d-91e7-bdf4ede712fc", "target_ref": "attack-pattern--f0da743e-2284-5bcc-9180-f91434019b30" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7ae5ec0e-ddd4-5fbe-b930-047754dbfc00", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Outsourced pathology fails every hospital", "description": "Many hospitals send their tests to one shared pathology provider. When its systems are encrypted or cut off, every hospital it serves loses blood tests, crossmatching and results at once, and operations, cancer care and emergency work stop across a region.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/", "description": "The Register: Qilin ransomware attack on NHS supplier contributed to patient fatality" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.digitalhealth.net/2025/06/patient-dies-as-a-result-of-cyber-attack-on-nhs-pathology-provider/", "description": "Digital Health: Patient death linked to cyber attack on NHS pathology provider" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-Q", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "D" ], "mds2": [ "DTBK", "CONN" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which hospitals stop testing if the shared provider goes down?", "What tests can run locally when the provider is unreachable?", "How would crossmatching continue during a regional outage?" ], "seen_in": [ "Synnovis pathology attack, London, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--07b3d741-a045-5330-8670-9a6085016c70", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-Q mitigation: Outsourced pathology fails every hospital", "description": "No single laboratory service should be able to stop testing for a whole region.\n\n1. Design and contract for a fallback laboratory route, with tested result and request paths, for each critical test.\n2. Keep isolated, offline-capable blood bank and urgent testing capacity on each acute site.\n3. Rehearse a regional pathology outage with the provider and the hospitals it serves.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-Q", "mitigation_principle": "No single laboratory service should be able to stop testing for a whole region.", "design_measures": [ "Design and contract for a fallback laboratory route, with tested result and request paths, for each critical test.", "Keep isolated, offline-capable blood bank and urgent testing capacity on each acute site.", "Rehearse a regional pathology outage with the provider and the hospitals it serves." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9fb5747-69f5-5cdc-b1a8-2845f1c9c36b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--07b3d741-a045-5330-8670-9a6085016c70", "target_ref": "attack-pattern--7ae5ec0e-ddd4-5fbe-b930-047754dbfc00" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e6b3322e-158e-5d7e-8298-80bb0173534a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Results stop flowing and nobody notices", "description": "Interfaces between analysers, middleware and the record fail quietly: a stalled queue, an expired certificate, a dropped feed. Critical results sit undelivered while the ward assumes nothing abnormal came back.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-J", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "D" ], "mds2": [ "AUDT", "CONN" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How would anyone know results had stopped flowing to the record?", "What happens to a critical result stuck in a queue?", "Which certificates or feeds could expire silently?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4ae331db-62e1-5adf-981b-a88033b94820", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-J mitigation: Results stop flowing and nobody notices", "description": "Silence from the laboratory must never look the same as a normal result.\n\n1. Send heartbeats on every result interface and alarm to the laboratory and IT when one stops.\n2. Show pending and overdue results to the requesting clinician, with the time each was expected.\n3. Phone critical results by a defined route that does not depend on the interface working.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-J", "mitigation_principle": "Silence from the laboratory must never look the same as a normal result.", "design_measures": [ "Send heartbeats on every result interface and alarm to the laboratory and IT when one stops.", "Show pending and overdue results to the requesting clinician, with the time each was expected.", "Phone critical results by a defined route that does not depend on the interface working." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--105185d1-ee87-5cf7-815a-703d08df09da", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4ae331db-62e1-5adf-981b-a88033b94820", "target_ref": "attack-pattern--e6b3322e-158e-5d7e-8298-80bb0173534a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--edf8c67e-d3e8-5fe7-9ec9-ae19a443f491", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Autoverification rules quietly loosened", "description": "Laboratory systems release normal results automatically using rules, reference ranges and critical limits held in configuration. Changing those rules lets abnormal results release as normal, or suppresses critical-value calls, across every patient tested.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-75", "url": "https://capec.mitre.org/data/definitions/75.html", "description": "Manipulating Writeable Configuration Files" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-15", "url": "https://cwe.mitre.org/data/definitions/15.html", "description": "External Control of System or Configuration Setting" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-10", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "T" ], "mds2": [ "AUTH", "AUDT", "IGAU" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can change autoverification rules and critical limits?", "How is a rule change reviewed before it goes live?", "Would loosened rules be noticed across thousands of results?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--09fd5b1a-2be5-5377-83a5-0ac39fb49fdf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-10 mitigation: Autoverification rules quietly loosened", "description": "The rules that decide what a clinician sees must be controlled like the analyser itself.\n\n1. Put autoverification rules, reference ranges and critical limits under change control with two-person approval.\n2. Compare the live rule set against an approved baseline every day and alert on any difference.\n3. Sample auto-released results for manual review so a loosened rule shows up quickly.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-10", "mitigation_principle": "The rules that decide what a clinician sees must be controlled like the analyser itself.", "design_measures": [ "Put autoverification rules, reference ranges and critical limits under change control with two-person approval.", "Compare the live rule set against an approved baseline every day and alert on any difference.", "Sample auto-released results for manual review so a loosened rule shows up quickly." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f47e9853-6a01-5414-8adb-9773af73be11", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--09fd5b1a-2be5-5377-83a5-0ac39fb49fdf", "target_ref": "attack-pattern--edf8c67e-d3e8-5fe7-9ec9-ae19a443f491" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--40513b4a-71fa-595a-b33f-d3fd0834d762", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Bedside tests filed to wrong patient", "description": "Glucose meters, blood gas analysers and other bedside tests rely on shared operator codes and patient barcodes that are easily bypassed. Results land on the wrong record, and the wrong patient is treated.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-1390", "url": "https://cwe.mitre.org/data/definitions/1390.html", "description": "Weak Authentication" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-9", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "S", "R" ], "mds2": [ "PAUT", "AUTH", "IGAU" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How is each bedside test tied to an operator and a patient?", "Can staff bypass the patient barcode on a bedside meter?", "Are operator codes on bedside devices individual or shared?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--56860475-4adf-5b04-b390-8e6898e4b56c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-9 mitigation: Bedside tests filed to wrong patient", "description": "Every bedside test must be tied to a verified operator and a verified patient.\n\n1. Require a patient wristband scan before testing, with no manual entry except a logged emergency route.\n2. Give each operator an individual credential and lock devices to trained users.\n3. Hold results that fail identity checks in a queue for review rather than filing them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-9", "mitigation_principle": "Every bedside test must be tied to a verified operator and a verified patient.", "design_measures": [ "Require a patient wristband scan before testing, with no manual entry except a logged emergency route.", "Give each operator an individual credential and lock devices to trained users.", "Hold results that fail identity checks in a queue for review rather than filing them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--530a4a77-2c25-594b-b999-90a7c68a36f2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--56860475-4adf-5b04-b390-8e6898e4b56c", "target_ref": "attack-pattern--40513b4a-71fa-595a-b33f-d3fd0834d762" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--348f9e23-087f-53b4-810d-d77aa6f6889d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pathology slides swapped or edited", "description": "Digital pathology stores whole-slide images that pathologists and AI read remotely. If images can be replaced, relabelled or edited, a cancer is missed or invented, and the error looks like a sound diagnosis.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-165", "url": "https://capec.mitre.org/data/definitions/165.html", "description": "File Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-1230", "url": "https://cwe.mitre.org/data/definitions/1230.html", "description": "Exposure of Sensitive Information Through Metadata" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-8", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "T", "S" ], "mds2": [ "IGAU", "AUTH" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How is a slide image bound to its specimen?", "Who can replace or relabel stored slide images?", "Would a pathologist see that an image had been edited?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c1648c56-d095-586a-8b84-5bbcbe30b8fe", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-8 mitigation: Pathology slides swapped or edited", "description": "A slide image must stay bound to its specimen and provably unchanged from scanner to report.\n\n1. Hash images at the scanner and check the hash whenever an image is opened for reporting.\n2. Bind each image to specimen and patient identifiers inside signed metadata, not filenames.\n3. Restrict write and delete rights on the image store to the scanning workflow.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-8", "mitigation_principle": "A slide image must stay bound to its specimen and provably unchanged from scanner to report.", "design_measures": [ "Hash images at the scanner and check the hash whenever an image is opened for reporting.", "Bind each image to specimen and patient identifiers inside signed metadata, not filenames.", "Restrict write and delete rights on the image store to the scanning workflow." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76ac4626-1b4b-583e-b6ae-7449115220e5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c1648c56-d095-586a-8b84-5bbcbe30b8fe", "target_ref": "attack-pattern--348f9e23-087f-53b4-810d-d77aa6f6889d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--67b12546-821a-5f87-9764-6fd90c5bc251", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Quality control records faked", "description": "Quality control and calibration results show whether an analyser can be trusted. If they can be edited or skipped without trace, a drifting analyser keeps reporting wrong values and the laboratory's records say all was well.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1070", "url": "https://attack.mitre.org/techniques/T1070/", "description": "Indicator Removal" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-7", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "T", "R" ], "mds2": [ "AUDT", "IGAU" ], "deck": "The Patient", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Is quality control captured automatically or typed in?", "Can a QC result be edited or skipped without trace?", "Who reviews QC trends for a drifting analyser?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a1907f21-2a24-536d-9c4b-7d1a79d03b4b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-7 mitigation: Quality control records faked", "description": "Quality control evidence must be captured automatically and be impossible to rewrite quietly.\n\n1. Capture QC and calibration results directly from the analyser, not by manual entry.\n2. Block patient result release when QC has failed or is overdue, with a logged override.\n3. Keep QC history in an append-only store that analyser and laboratory staff cannot edit.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-7", "mitigation_principle": "Quality control evidence must be captured automatically and be impossible to rewrite quietly.", "design_measures": [ "Capture QC and calibration results directly from the analyser, not by manual entry.", "Block patient result release when QC has failed or is overdue, with a logged override.", "Keep QC history in an append-only store that analyser and laboratory staff cannot edit." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b176daa7-38c3-5e2e-b691-a85d6f5e01db", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a1907f21-2a24-536d-9c4b-7d1a79d03b4b", "target_ref": "attack-pattern--67b12546-821a-5f87-9764-6fd90c5bc251" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0b54c3d9-80b9-5d52-9777-84cf8ae6febb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Analysers as a network foothold", "description": "Analysers often run an old embedded operating system that the hospital may not patch, on the same network as everything else. One compromised analyser becomes a foothold for ransomware or a route to other laboratory and clinical systems.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-310", "url": "https://capec.mitre.org/data/definitions/310.html", "description": "Scanning for Vulnerable Software" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "mitre-emb3d", "external_id": "TID-202", "url": "https://emb3d.mitre.org/threats/TID-202.html", "description": "Exploitable System Network Stack Component" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-6", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "E", "T" ], "mds2": [ "SAHD", "MLDP", "RDMP" ], "deck": "The Patient", "rank": "6", "physical_safety": false, "mitigation_prompts": [ "What can each analyser reach on the network?", "Who patches analysers, and how long does it take?", "What reaches the analyser that isn't its own system?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1897cba9-14af-5f15-a3f4-4a849b64ace5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-6 mitigation: Analysers as a network foothold", "description": "An analyser should reach only what it needs and nothing should reach it except its own systems.\n\n1. Place analysers in their own network zone with allow-lists limited to middleware and vendor service.\n2. Ask for an SBOM and a supported-until date before purchase, and plan replacement around it.\n3. Monitor analyser traffic for anything outside its normal pattern.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-6", "mitigation_principle": "An analyser should reach only what it needs and nothing should reach it except its own systems.", "design_measures": [ "Place analysers in their own network zone with allow-lists limited to middleware and vendor service.", "Ask for an SBOM and a supported-until date before purchase, and plan replacement around it.", "Monitor analyser traffic for anything outside its normal pattern." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7dffa9b6-9eba-5d8c-a153-21d6fb26d6c3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1897cba9-14af-5f15-a3f4-4a849b64ace5", "target_ref": "attack-pattern--0b54c3d9-80b9-5d52-9777-84cf8ae6febb" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--508dee40-53d7-5386-9335-ec702a5757a4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Analyser locked by reagent licensing", "description": "Some analysers check reagent tags or licences against the manufacturer's cloud before running. When that link fails, is blocked or the vendor is attacked, testing stops even though reagents and staff are ready.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-5", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "D" ], "mds2": [ "CONN", "RMOT" ], "deck": "The Patient", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Does testing stop if the vendor's licence service is unreachable?", "How long can analysers run without the manufacturer's cloud?", "Who is called when reagent checks block testing at night?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d36bafdf-3bbf-57ba-ac1d-0bb92d484964", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-5 mitigation: Analyser locked by reagent licensing", "description": "Clinical testing must not depend on a vendor service being reachable at the moment of the test.\n\n1. Require offline grace periods for licence and reagent checks, written into the purchase contract.\n2. Test what the analyser does when its vendor link is cut, before go-live.\n3. Keep an emergency unlock procedure the laboratory can use without the vendor.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-5", "mitigation_principle": "Clinical testing must not depend on a vendor service being reachable at the moment of the test.", "design_measures": [ "Require offline grace periods for licence and reagent checks, written into the purchase contract.", "Test what the analyser does when its vendor link is cut, before go-live.", "Keep an emergency unlock procedure the laboratory can use without the vendor." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d06192cb-b7e3-5632-946a-c849502204e1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d36bafdf-3bbf-57ba-ac1d-0bb92d484964", "target_ref": "attack-pattern--508dee40-53d7-5386-9335-ec702a5757a4" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--687205f0-846d-55e8-9db5-3010ec84d376", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Genomic data leaves the building", "description": "Sequencers and analysis pipelines send genomic data to cloud services. Genomes identify patients and their relatives, cannot be reissued after a breach, and are often stored with weaker controls than the clinical record.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1530", "url": "https://attack.mitre.org/techniques/T1530/", "description": "Data from Cloud Storage" }, { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002/", "description": "Exfiltration to Cloud Storage" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-4", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "I" ], "linddun": [ "I", "L", "DD" ], "mds2": [ "STCF", "TXCF", "DIDT" ], "deck": "The Patient", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "Where do sequencers and pipelines send genomic data?", "Are genomic data protected at least as well as the record?", "Who could link a stored genome back to a patient's relatives?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--029f097b-fcf2-5d8e-acae-c72df5918f51", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-4 mitigation: Genomic data leaves the building", "description": "Genomic data must be treated as the most sensitive data the hospital holds.\n\n1. Encrypt genomic data at rest and in transit and keep keys under the hospital's control.\n2. Separate identifiers from sequence data and link them only inside an authorised service.\n3. Record every export and limit which destinations a sequencer can send data to.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-4", "mitigation_principle": "Genomic data must be treated as the most sensitive data the hospital holds.", "design_measures": [ "Encrypt genomic data at rest and in transit and keep keys under the hospital's control.", "Separate identifiers from sequence data and link them only inside an authorised service.", "Record every export and limit which destinations a sequencer can send data to." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd432065-f9cb-5b1a-b79d-d072aacb0eea", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--029f097b-fcf2-5d8e-acae-c72df5918f51", "target_ref": "attack-pattern--687205f0-846d-55e8-9db5-3010ec84d376" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--49d86e56-fc9e-574d-bd09-555472340683", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Public health reports spoofed or suppressed", "description": "Laboratories report notifiable infections to public health automatically. If that feed can be forged or blocked, an outbreak goes unseen, or a false one triggers costly responses and alarm.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-3", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "S", "T", "D" ], "mds2": [ "NAUT", "TXIG" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "How does public health know a notifiable report is genuine?", "Would anyone notice the reporting feed had stopped?", "Who checks that every required report was sent?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e69c576b-2c2c-59a8-b69f-f9600aa40db8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-3 mitigation: Public health reports spoofed or suppressed", "description": "Reports that drive public health action must be authenticated and their absence noticed.\n\n1. Authenticate both ends of the reporting link and sign each report.\n2. Reconcile reported cases with laboratory positives daily and investigate gaps.\n3. Alert when a reporting feed goes quiet for longer than its normal interval.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-3", "mitigation_principle": "Reports that drive public health action must be authenticated and their absence noticed.", "design_measures": [ "Authenticate both ends of the reporting link and sign each report.", "Reconcile reported cases with laboratory positives daily and investigate gaps.", "Alert when a reporting feed goes quiet for longer than its normal interval." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--17253e6b-0d94-5bc9-a814-2361f92302e4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e69c576b-2c2c-59a8-b69f-f9600aa40db8", "target_ref": "attack-pattern--49d86e56-fc9e-574d-bd09-555472340683" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--710302cd-93e3-584e-a8c9-13ec532f774b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Laboratory exports leak in spreadsheets", "description": "Results are exported to spreadsheets for audit, research and service reviews. Identifiable data spreads into shared drives and email, and formula content in exported cells can run when the file is opened.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/#cri-ld-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1236", "url": "https://cwe.mitre.org/data/definitions/1236.html", "description": "Improper Neutralization of Formula Elements in a CSV File" }, { "source_name": "cwe", "external_id": "CWE-212", "url": "https://cwe.mitre.org/data/definitions/212.html", "description": "Improper Removal of Sensitive Information Before Storage or Transfer" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-2", "group_code": "LD", "group_name": "Laboratory and Diagnostics", "stride": [ "I" ], "linddun": [ "DD", "L" ], "mds2": [ "DIDT", "MPII", "AUDT" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "What identifiable data goes into exported spreadsheets?", "Where do exported files end up, and who can open them?", "Are exported cells checked for formula content?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9f30176a-2b12-52cf-b5a2-00c328bfb4a3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-LD-2 mitigation: Laboratory exports leak in spreadsheets", "description": "Data leaving the laboratory system should carry no more than the task needs.\n\n1. Pseudonymise exports by default and require approval for identifiable extracts.\n2. Neutralise formula characters in exported fields.\n3. Log every export with its requester, purpose and destination.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-LD-2", "mitigation_principle": "Data leaving the laboratory system should carry no more than the task needs.", "design_measures": [ "Pseudonymise exports by default and require approval for identifiable extracts.", "Neutralise formula characters in exported fields.", "Log every export with its requester, purpose and destination." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e7f3d00e-a098-5a85-a938-c049bc9a285a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9f30176a-2b12-52cf-b5a2-00c328bfb4a3", "target_ref": "attack-pattern--710302cd-93e3-584e-a8c9-13ec532f774b" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--a9ad94da-ef5f-55c7-ba26-7dc8f2b1fa7b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "LD Laboratory and Diagnostics", "description": "Analysers, LIS and middleware, point-of-care tests, blood bank, pathology and digital pathology, sequencers and outsourced lab services.", "context": "unspecified", "object_refs": [ "attack-pattern--b3292474-7815-5ad8-9986-0c8169fc6b48", "course-of-action--c71dd8c3-04df-5e14-ae69-ffbdc5d8f409", "attack-pattern--f0da743e-2284-5bcc-9180-f91434019b30", "course-of-action--9d44533a-e088-557d-91e7-bdf4ede712fc", "attack-pattern--7ae5ec0e-ddd4-5fbe-b930-047754dbfc00", "course-of-action--07b3d741-a045-5330-8670-9a6085016c70", "attack-pattern--e6b3322e-158e-5d7e-8298-80bb0173534a", "course-of-action--4ae331db-62e1-5adf-981b-a88033b94820", "attack-pattern--edf8c67e-d3e8-5fe7-9ec9-ae19a443f491", "course-of-action--09fd5b1a-2be5-5377-83a5-0ac39fb49fdf", "attack-pattern--40513b4a-71fa-595a-b33f-d3fd0834d762", "course-of-action--56860475-4adf-5b04-b390-8e6898e4b56c", "attack-pattern--348f9e23-087f-53b4-810d-d77aa6f6889d", "course-of-action--c1648c56-d095-586a-8b84-5bbcbe30b8fe", "attack-pattern--67b12546-821a-5f87-9764-6fd90c5bc251", "course-of-action--a1907f21-2a24-536d-9c4b-7d1a79d03b4b", "attack-pattern--0b54c3d9-80b9-5d52-9777-84cf8ae6febb", "course-of-action--1897cba9-14af-5f15-a3f4-4a849b64ace5", "attack-pattern--508dee40-53d7-5386-9335-ec702a5757a4", "course-of-action--d36bafdf-3bbf-57ba-ac1d-0bb92d484964", "attack-pattern--687205f0-846d-55e8-9db5-3010ec84d376", "course-of-action--029f097b-fcf2-5d8e-acae-c72df5918f51", "attack-pattern--49d86e56-fc9e-574d-bd09-555472340683", "course-of-action--e69c576b-2c2c-59a8-b69f-f9600aa40db8", "attack-pattern--710302cd-93e3-584e-a8c9-13ec532f774b", "course-of-action--9f30176a-2b12-52cf-b5a2-00c328bfb4a3" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-LD", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/laboratory-and-diagnostics/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4693fe60-cbe4-5a5a-98a0-b65bda8cf56d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared clinical knowledge base corrupted", "description": "Decision support, drug interaction checks and order sets draw on a central rule base or a third-party drug database. One corrupted rule or update gives wrong advice to every prescriber at once, and the advice looks authoritative.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-184", "url": "https://capec.mitre.org/data/definitions/184.html", "description": "Software Integrity Attack" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-684", "url": "https://cwe.mitre.org/data/definitions/684.html", "description": "Incorrect Provision of Specified Functionality" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1195.002", "url": "https://attack.mitre.org/techniques/T1195/002/", "description": "Compromise Software Supply Chain" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-A", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T" ], "mds2": [ "IGAU", "CSUP", "AUDT" ], "deck": "The Patient", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who verifies changes to the clinical rule base before release?", "How many prescribers would one corrupted rule reach?", "How are third-party drug database updates checked?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f36235b7-7d3a-5f77-a277-b13c09a74f70", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-A mitigation: Shared clinical knowledge base corrupted", "description": "Clinical rules must be changed and updated like a medical device, with independent verification.\n\n1. Verify the signature and provenance of every knowledge base update before loading it.\n2. Test each update against a fixed set of clinical cases and block it if any result changes unexpectedly.\n3. Keep the previous version ready to restore and record who approved each change.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-A", "mitigation_principle": "Clinical rules must be changed and updated like a medical device, with independent verification.", "design_measures": [ "Verify the signature and provenance of every knowledge base update before loading it.", "Test each update against a fixed set of clinical cases and block it if any result changes unexpectedly.", "Keep the previous version ready to restore and record who approved each change." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dfb1fc4f-bcd7-51b9-afae-8e40f9c8fa64", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f36235b7-7d3a-5f77-a277-b13c09a74f70", "target_ref": "attack-pattern--4693fe60-cbe4-5a5a-98a0-b65bda8cf56d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7a7631e7-441d-5d36-8da1-578e2cc6d4c3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Dose calculators trusted blindly", "description": "Weight-based and infusion dose calculators accept whatever inputs they are given. A weight in the wrong unit, a moved decimal or a changed concentration produces a tenfold dose that looks correct on screen.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1287", "url": "https://cwe.mitre.org/data/definitions/1287.html", "description": "Improper Validation of Specified Type of Input" }, { "source_name": "cwe", "external_id": "CWE-1288", "url": "https://cwe.mitre.org/data/definitions/1288.html", "description": "Improper Validation of Consistency within Input" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-K", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T" ], "mds2": [ "IGAU" ], "deck": "The Patient", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What plausibility checks does the calculator apply to its inputs?", "Which units does each input expect, and is that shown?", "Would a tenfold dose look any different on screen?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--17b04876-b88a-5418-8756-4a14ded33f1a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-K mitigation: Dose calculators trusted blindly", "description": "A calculator that sets a dose must check its inputs against what is plausible for the patient.\n\n1. Take weight and concentration from verified sources, not free text, and show their origin.\n2. Apply hard and soft limits by age, weight and drug, and require a reason to exceed them.\n3. Show units explicitly at every step and in the final result.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-K", "mitigation_principle": "A calculator that sets a dose must check its inputs against what is plausible for the patient.", "design_measures": [ "Take weight and concentration from verified sources, not free text, and show their origin.", "Apply hard and soft limits by age, weight and drug, and require a reason to exceed them.", "Show units explicitly at every step and in the final result." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8623f63e-9318-5ce9-857b-7391e1c28b71", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--17b04876-b88a-5418-8756-4a14ded33f1a", "target_ref": "attack-pattern--7a7631e7-441d-5d36-8da1-578e2cc6d4c3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--69f98195-5375-563a-a6df-9550cba16bd3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Early-warning scores fed bad inputs", "description": "Deterioration and sepsis algorithms score whatever vital signs and results reach them. Missing, delayed or altered inputs, or a raised threshold, mean a deteriorating patient is never flagged.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-1288", "url": "https://cwe.mitre.org/data/definitions/1288.html", "description": "Improper Validation of Consistency within Input" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-Q", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T", "D" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Patient", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does the algorithm show that inputs are stale or missing?", "Who can change scoring thresholds, and is it reviewed?", "What alerts staff when an expected input never arrives?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f339bb3f-f441-5bdb-a118-2c35ddd48795", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-Q mitigation: Early-warning scores fed bad inputs", "description": "An algorithm must know when its inputs are stale, missing or implausible and say so.\n\n1. Show the age and source of every input beside the score.\n2. Flag a score as incomplete when inputs are missing or late instead of treating them as normal.\n3. Control and audit threshold changes, with clinical sign-off.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-Q", "mitigation_principle": "An algorithm must know when its inputs are stale, missing or implausible and say so.", "design_measures": [ "Show the age and source of every input beside the score.", "Flag a score as incomplete when inputs are missing or late instead of treating them as normal.", "Control and audit threshold changes, with clinical sign-off." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea152953-1783-5479-8dc7-fc4d0fdb64b4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f339bb3f-f441-5bdb-a118-2c35ddd48795", "target_ref": "attack-pattern--69f98195-5375-563a-a6df-9550cba16bd3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2e859239-caa8-56da-b9dc-8e5aac7b010d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Imaging AI fooled by crafted images", "description": "Triage and detection models read images that pass through many systems. Small, deliberate changes to an image can make a model miss a bleed or a tumour, or invent one, with no visible sign to a human reader.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1039", "url": "https://cwe.mitre.org/data/definitions/1039.html", "description": "Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-J", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T" ], "mds2": [ "IGAU" ], "deck": "The Patient", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Has the imaging model been tested against manipulated images?", "Is the model ever the only reader of an image?", "How would a missed finding by the model be caught?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--44693241-f6f8-5b32-8012-d6789b1469ec", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-J mitigation: Imaging AI fooled by crafted images", "description": "An imaging model must be tested against manipulated inputs and never be the only reader.\n\n1. Check image integrity from modality to model before inference.\n2. Test models with adversarial and corrupted inputs during validation and after every update.\n3. Keep a clinician read on every study the model triages as normal for the highest-risk findings.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-J", "mitigation_principle": "An imaging model must be tested against manipulated inputs and never be the only reader.", "design_measures": [ "Check image integrity from modality to model before inference.", "Test models with adversarial and corrupted inputs during validation and after every update.", "Keep a clinician read on every study the model triages as normal for the highest-risk findings." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19ea7ee4-e985-50a8-b346-d98eaf323724", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--44693241-f6f8-5b32-8012-d6789b1469ec", "target_ref": "attack-pattern--2e859239-caa8-56da-b9dc-8e5aac7b010d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5c2472aa-e546-5c52-98bb-eb3854476a01", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Model updates change care unannounced", "description": "Cloud-hosted software as a medical device can receive a new model version without the hospital knowing. Its performance on local patients shifts, and nobody compares outputs before and after.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "cwe", "external_id": "CWE-684", "url": "https://cwe.mitre.org/data/definitions/684.html", "description": "Incorrect Provision of Specified Functionality" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-10", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T", "R" ], "mds2": [ "CSUP", "SGUD" ], "deck": "The Patient", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does the hospital learn that a model version has changed?", "Are outputs compared on local patients before and after updates?", "Who can pause a model whose performance has shifted?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a3774244-db05-5acb-af4c-470b297a1119", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-10 mitigation: Model updates change care unannounced", "description": "A change to a clinical model must be visible to the hospital and checked on local data.\n\n1. Require notice and release notes for every model change in the supply contract.\n2. Display the model version with every output and record it in the patient record.\n3. Monitor agreement and alert rates locally, and alarm on a sudden shift.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-10", "mitigation_principle": "A change to a clinical model must be visible to the hospital and checked on local data.", "design_measures": [ "Require notice and release notes for every model change in the supply contract.", "Display the model version with every output and record it in the patient record.", "Monitor agreement and alert rates locally, and alarm on a sudden shift." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--754507d6-8398-5878-8db1-2d7b3d62bb51", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a3774244-db05-5acb-af4c-470b297a1119", "target_ref": "attack-pattern--5c2472aa-e546-5c52-98bb-eb3854476a01" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--af874ca8-4c86-58b6-b7f1-b46068c6aded", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Automation bias hides the failure", "description": "Interfaces present algorithm outputs as certain, without confidence or evidence. Clinicians stop checking, so any error, drift or compromise in the software flows straight into treatment.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-9", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T" ], "mds2": [ "IGAU", "SGUD" ], "deck": "The Patient", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Does the interface show how confident the algorithm is?", "What prompts the clinician to check an output before acting?", "How would drift or compromise in the software become visible?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9b5bc4bd-f270-52d7-99f9-6812c984291e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-9 mitigation: Automation bias hides the failure", "description": "Clinical software should show how sure it is and invite the clinician to check.\n\n1. Show confidence, the main inputs and known limits beside every recommendation.\n2. Design workflows so the clinician records a decision, not just an acceptance.\n3. Audit acceptance rates and investigate units where nearly every suggestion is accepted.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-9", "mitigation_principle": "Clinical software should show how sure it is and invite the clinician to check.", "design_measures": [ "Show confidence, the main inputs and known limits beside every recommendation.", "Design workflows so the clinician records a decision, not just an acceptance.", "Audit acceptance rates and investigate units where nearly every suggestion is accepted." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ea4f37dc-ed22-56ea-838e-784ab69510be", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9b5bc4bd-f270-52d7-99f9-6812c984291e", "target_ref": "attack-pattern--af874ca8-4c86-58b6-b7f1-b46068c6aded" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--51c0e7bd-381d-5f4c-8326-d71e7f6a230c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "AI scribes write errors into records", "description": "Ambient and speech scribes, including agent-driven tools, turn conversations into notes, allergies and medication lists. Mishearing, prompt injection from spoken or pasted text, or invented details enter the record and drive later orders.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1427", "url": "https://cwe.mitre.org/data/definitions/1427.html", "description": "Improper Neutralization of Input Used for LLM Prompting" }, { "source_name": "cwe", "external_id": "CWE-1434", "url": "https://cwe.mitre.org/data/definitions/1434.html", "description": "Insecure Setting of Generative AI/ML Model Inference Parameters" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-8", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T", "R" ], "linddun": [ "U", "DD" ], "mds2": [ "IGAU", "AUDT", "MPII" ], "deck": "The Patient", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who checks a generated note before it enters the record?", "Could spoken or pasted text steer what the scribe writes?", "Which orders could be driven by an unreviewed generated entry?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3ef98771-7979-53ce-b5a2-33f8f1db8107", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-8 mitigation: AI scribes write errors into records", "description": "Nothing generated should enter the record until a clinician has checked and accepted it.\n\n1. Hold generated text as a draft that a named clinician must review and sign.\n2. Highlight generated content that changes allergies, medications or diagnoses for explicit confirmation.\n3. Tell patients when recording and generation are used and let them decline.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-8", "mitigation_principle": "Nothing generated should enter the record until a clinician has checked and accepted it.", "design_measures": [ "Hold generated text as a draft that a named clinician must review and sign.", "Highlight generated content that changes allergies, medications or diagnoses for explicit confirmation.", "Tell patients when recording and generation are used and let them decline." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0defbcba-ea7b-5227-b883-58b47dc2dab5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3ef98771-7979-53ce-b5a2-33f8f1db8107", "target_ref": "attack-pattern--51c0e7bd-381d-5f4c-8326-d71e7f6a230c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b663c41d-bd00-57b4-aa02-ad8ae7076f55", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Models leak the patients they learned", "description": "Models trained or fine-tuned on hospital data can reveal whether a person was in the training set, or reproduce fragments of their records, to anyone who can query them.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-7", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "I" ], "linddun": [ "I", "L", "DD", "Nc" ], "mds2": [ "DIDT", "MPII" ], "deck": "The Patient", "rank": "7", "physical_safety": false, "mitigation_prompts": [ "Could someone tell from the model whether a patient was in training?", "Who can query the model, and how often?", "Was the training data reduced or protected before use?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--090bdba6-aa3a-503b-808a-b73e19d94a7f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-7 mitigation: Models leak the patients they learned", "description": "Patient data used to build a model must not be recoverable from the model.\n\n1. Train on de-identified data wherever possible and test models for memorisation before release.\n2. Limit who can query models and how often.\n3. Record which datasets trained each model and the legal basis for using them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-7", "mitigation_principle": "Patient data used to build a model must not be recoverable from the model.", "design_measures": [ "Train on de-identified data wherever possible and test models for memorisation before release.", "Limit who can query models and how often.", "Record which datasets trained each model and the legal basis for using them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a4991dbd-6f72-5d76-bc6a-bdf4ebceb1cc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--090bdba6-aa3a-503b-808a-b73e19d94a7f", "target_ref": "attack-pattern--b663c41d-bd00-57b4-aa02-ad8ae7076f55" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3e3e0ba7-8cc1-5228-a0f8-ddbec027d001", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unvalidated spreadsheets run clinical decisions", "description": "Wards and pharmacies build their own calculators, macros and trackers. They have no version control or testing, a changed cell alters every result, and macro-enabled files are an easy way to deliver malware.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-17", "url": "https://capec.mitre.org/data/definitions/17.html", "description": "Using Malicious Files" }, { "source_name": "cwe", "external_id": "CWE-1236", "url": "https://cwe.mitre.org/data/definitions/1236.html", "description": "Improper Neutralization of Formula Elements in a CSV File" }, { "source_name": "cwe", "external_id": "CWE-15", "url": "https://cwe.mitre.org/data/definitions/15.html", "description": "External Control of System or Configuration Setting" }, { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/", "description": "Malicious File" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-6", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "T", "E" ], "mds2": [ "IGAU", "MLDP" ], "deck": "The Patient", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which local spreadsheets or macros inform clinical decisions?", "Does each one have an owner, a version and a test?", "Who could change a formula without anyone noticing?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8c6bba12-e6bc-52e7-9802-184c67eacc87", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-6 mitigation: Unvalidated spreadsheets run clinical decisions", "description": "Any tool that informs a clinical decision needs an owner, a version and a test.\n\n1. Register local clinical tools, name an owner and validate them before use.\n2. Lock formulas and store approved versions in a controlled location.\n3. Block macros from untrusted locations on clinical workstations.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-6", "mitigation_principle": "Any tool that informs a clinical decision needs an owner, a version and a test.", "design_measures": [ "Register local clinical tools, name an owner and validate them before use.", "Lock formulas and store approved versions in a controlled location.", "Block macros from untrusted locations on clinical workstations." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f17f9d1c-7763-59e5-b442-7caa1ba588a9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8c6bba12-e6bc-52e7-9802-184c67eacc87", "target_ref": "attack-pattern--3e3e0ba7-8cc1-5228-a0f8-ddbec027d001" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--24f1e39a-eb31-53ac-82b7-343ab26a0b83", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Consumer apps used for clinical work", "description": "Staff use unregulated apps for doses, wound photos and messaging because they are quick. Patient images and details sync to personal clouds, and app results carry no validation.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-922", "url": "https://cwe.mitre.org/data/definitions/922.html", "description": "Insecure Storage of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002/", "description": "Exfiltration to Cloud Storage" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-5", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "I" ], "linddun": [ "DD", "Nc", "U" ], "mds2": [ "STCF", "MPII" ], "deck": "The Patient", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Which consumer apps do staff use for clinical work, and why?", "Where do photos and details from those apps sync?", "Is the approved tool as quick as the app staff prefer?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e20745c1-f368-551a-b046-c5e222a0cc71", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-5 mitigation: Consumer apps used for clinical work", "description": "Make the approved tool the easiest one to use for the task.\n\n1. Provide approved apps for photos, calculations and messaging on managed devices.\n2. Keep clinical photos in a managed container that never syncs to personal storage.\n3. Publish which apps are approved for which clinical tasks.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-5", "mitigation_principle": "Make the approved tool the easiest one to use for the task.", "design_measures": [ "Provide approved apps for photos, calculations and messaging on managed devices.", "Keep clinical photos in a managed container that never syncs to personal storage.", "Publish which apps are approved for which clinical tasks." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--30032008-df66-5146-9951-b16a5b36bc47", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e20745c1-f368-551a-b046-c5e222a0cc71", "target_ref": "attack-pattern--24f1e39a-eb31-53ac-82b7-343ab26a0b83" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1946cf02-5003-5f20-ad34-0f8da32f076c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cloud clinical software unreachable", "description": "Reporting, triage and decision software increasingly runs in a vendor's cloud. When the link, the vendor or its cloud is down, the pathway has no fallback and clinical work waits.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1498", "url": "https://attack.mitre.org/techniques/T1498/", "description": "Network Denial of Service" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-4", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "D" ], "mds2": [ "CONN", "DTBK" ], "deck": "The Patient", "rank": "4", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What happens to the pathway when the vendor's cloud is down?", "What reduced level of service is agreed, and rehearsed?", "How long can clinical work wait for the software to return?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e210c9be-5d1e-5b8a-8d3e-9d1184a7cd02", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-4 mitigation: Cloud clinical software unreachable", "description": "A clinical pathway must keep working, at a known reduced level, when its cloud software is gone.\n\n1. Define and rehearse a manual fallback for each cloud-dependent pathway.\n2. Require service levels and outage notice from the vendor, and monitor availability yourself.\n3. Keep essential reference data available offline.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-4", "mitigation_principle": "A clinical pathway must keep working, at a known reduced level, when its cloud software is gone.", "design_measures": [ "Define and rehearse a manual fallback for each cloud-dependent pathway.", "Require service levels and outage notice from the vendor, and monitor availability yourself.", "Keep essential reference data available offline." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b808c14d-b260-59fe-b376-526b31e87f5e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e210c9be-5d1e-5b8a-8d3e-9d1184a7cd02", "target_ref": "attack-pattern--1946cf02-5003-5f20-ad34-0f8da32f076c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4a302609-cffd-5878-a5a0-e75506f10ce3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alert overrides leave no trail", "description": "Clinicians override drug interaction and allergy alerts many times a day. Without a recorded reason, nobody can tell a justified override from a dangerous one, or prove later what was shown.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "IEC 62304", "description": "IEC 62304 Medical device software: software life cycle processes" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-3", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "R" ], "mds2": [ "AUDT" ], "deck": "The Patient", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Is a reason recorded each time a safety alert is overridden?", "Could you later prove what alert a clinician saw?", "Who reviews override patterns for dangerous habits?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e501ef42-9f05-59e4-b4c4-7c7873e7c21a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-3 mitigation: Alert overrides leave no trail", "description": "Every override of a safety alert should record who, what and why.\n\n1. Require a short coded reason for overriding high-severity alerts.\n2. Record the alert text shown, with its version, alongside the override.\n3. Review override patterns and retire alerts that are always overridden.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-3", "mitigation_principle": "Every override of a safety alert should record who, what and why.", "design_measures": [ "Require a short coded reason for overriding high-severity alerts.", "Record the alert text shown, with its version, alongside the override.", "Review override patterns and retire alerts that are always overridden." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fb6aac80-b429-5fe1-bbab-5bed326b52ce", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e501ef42-9f05-59e4-b4c4-7c7873e7c21a", "target_ref": "attack-pattern--4a302609-cffd-5878-a5a0-e75506f10ce3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5d0b6abd-77af-595e-9fdb-2e70dd512af5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Algorithms expose sensitive inferences", "description": "Models infer pregnancy, HIV status, mental illness or addiction from routine data and show the inference to anyone viewing the patient. The patient never disclosed it and cannot see or contest it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/#cri-ca-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-2", "group_code": "CA", "group_name": "Clinical Software and AI", "stride": [ "I" ], "linddun": [ "I", "DD", "U" ], "mds2": [ "AUTH", "MPII" ], "deck": "The Patient", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "Which sensitive conditions can the models infer from routine data?", "Who can see an inference the patient never disclosed?", "Can patients see or contest what was inferred about them?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--7a724b29-b6c1-50b9-848a-1b32bb6005cd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CA-2 mitigation: Algorithms expose sensitive inferences", "description": "Inferred sensitive information deserves the same protection as information the patient disclosed.\n\n1. Classify inferred conditions with the same sensitivity as recorded ones and restrict their display.\n2. Label inferences as such and let clinicians suppress them.\n3. Tell patients which inference tools are in use.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CA-2", "mitigation_principle": "Inferred sensitive information deserves the same protection as information the patient disclosed.", "design_measures": [ "Classify inferred conditions with the same sensitivity as recorded ones and restrict their display.", "Label inferences as such and let clinicians suppress them.", "Tell patients which inference tools are in use." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9c96cacc-44ae-5330-9e73-76c8ec479e49", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7a724b29-b6c1-50b9-848a-1b32bb6005cd", "target_ref": "attack-pattern--5d0b6abd-77af-595e-9fdb-2e70dd512af5" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--b3731c5f-fd59-5011-a58c-b47f346613c2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CA Clinical Software and AI", "description": "Software as a medical device, decision support, dose calculators, early-warning and sepsis scores, imaging AI, AI scribes and the apps clinicians reach for.", "context": "unspecified", "object_refs": [ "attack-pattern--4693fe60-cbe4-5a5a-98a0-b65bda8cf56d", "course-of-action--f36235b7-7d3a-5f77-a277-b13c09a74f70", "attack-pattern--7a7631e7-441d-5d36-8da1-578e2cc6d4c3", "course-of-action--17b04876-b88a-5418-8756-4a14ded33f1a", "attack-pattern--69f98195-5375-563a-a6df-9550cba16bd3", "course-of-action--f339bb3f-f441-5bdb-a118-2c35ddd48795", "attack-pattern--2e859239-caa8-56da-b9dc-8e5aac7b010d", "course-of-action--44693241-f6f8-5b32-8012-d6789b1469ec", "attack-pattern--5c2472aa-e546-5c52-98bb-eb3854476a01", "course-of-action--a3774244-db05-5acb-af4c-470b297a1119", "attack-pattern--af874ca8-4c86-58b6-b7f1-b46068c6aded", "course-of-action--9b5bc4bd-f270-52d7-99f9-6812c984291e", "attack-pattern--51c0e7bd-381d-5f4c-8326-d71e7f6a230c", "course-of-action--3ef98771-7979-53ce-b5a2-33f8f1db8107", "attack-pattern--b663c41d-bd00-57b4-aa02-ad8ae7076f55", "course-of-action--090bdba6-aa3a-503b-808a-b73e19d94a7f", "attack-pattern--3e3e0ba7-8cc1-5228-a0f8-ddbec027d001", "course-of-action--8c6bba12-e6bc-52e7-9802-184c67eacc87", "attack-pattern--24f1e39a-eb31-53ac-82b7-343ab26a0b83", "course-of-action--e20745c1-f368-551a-b046-c5e222a0cc71", "attack-pattern--1946cf02-5003-5f20-ad34-0f8da32f076c", "course-of-action--e210c9be-5d1e-5b8a-8d3e-9d1184a7cd02", "attack-pattern--4a302609-cffd-5878-a5a0-e75506f10ce3", "course-of-action--e501ef42-9f05-59e4-b4c4-7c7873e7c21a", "attack-pattern--5d0b6abd-77af-595e-9fdb-2e70dd512af5", "course-of-action--7a724b29-b6c1-50b9-848a-1b32bb6005cd" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-CA", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-software-and-ai/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8d310241-3055-53cc-9e8e-f65856506769", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Allergies and medications rewritten", "description": "Clinicians act on the allergy list, medication history, blood group and resuscitation status in the record. If these can be changed without strong control and visible history, a patient is given a drug they react to, or not resuscitated.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-1", "url": "https://capec.mitre.org/data/definitions/1.html", "description": "Accessing Functionality Not Properly Constrained by ACLs" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-A", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "T" ], "linddun": [ "Nc" ], "mds2": [ "IGAU", "AUDT", "AUTH" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can change allergies, blood group or resuscitation status?", "How obvious is a recent change to a clinician opening the record?", "What review follows a change to a safety-critical fact?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f303484b-11b4-51d6-b668-e0ddb4cb1cc6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-A mitigation: Allergies and medications rewritten", "description": "Safety-critical facts in the record must be hard to change and every change must be obvious.\n\n1. Require re-authentication and a reason to change allergies, resuscitation status or blood group.\n2. Show recent changes to safety-critical fields prominently to the next clinician.\n3. Alert on bulk or unusual edits to these fields across many patients.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-A", "mitigation_principle": "Safety-critical facts in the record must be hard to change and every change must be obvious.", "design_measures": [ "Require re-authentication and a reason to change allergies, resuscitation status or blood group.", "Show recent changes to safety-critical fields prominently to the next clinician.", "Alert on bulk or unusual edits to these fields across many patients." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f793f424-4b23-5ed6-89ad-53276913cd36", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f303484b-11b4-51d6-b668-e0ddb4cb1cc6", "target_ref": "attack-pattern--8d310241-3055-53cc-9e8e-f65856506769" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e24a3930-d2c4-5ad1-90cb-6342c9da2df8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Whole record stolen for extortion", "description": "The record holds every patient's history in a few databases and reporting replicas. Attackers copy it in bulk, then extort the hospital and threaten to publish, and the data can never be taken back.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-116", "url": "https://capec.mitre.org/data/definitions/116.html", "description": "Excavation" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T1213.006", "url": "https://attack.mitre.org/techniques/T1213/006/", "description": "Databases" }, { "source_name": "mitre-attack", "external_id": "T1567.002", "url": "https://attack.mitre.org/techniques/T1567/002/", "description": "Exfiltration to Cloud Storage" }, { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657/", "description": "Financial Theft" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "Change Healthcare, 2024", "url": "https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/change-healthcare-data-breach-toll-reaches-192-7-million", "description": "Becker's: Change Healthcare data breach toll reaches 192.7 million" }, { "source_name": "Change Healthcare, 2024", "url": "https://www.fiercehealthcare.com/payers/unitedhealth-estimates-190m-people-impacted-change-healthcare-cyberattack", "description": "Fierce Healthcare: UnitedHealth estimates 190M people impacted" }, { "source_name": "NHS Dumfries and Galloway, 2024", "url": "https://www.helpnetsecurity.com/2024/03/28/nhs-scotland-ransomware/", "description": "Help Net Security: NHS Scotland confirms ransomware attackers leaked patients' data" }, { "source_name": "NHS Dumfries and Galloway, 2024", "url": "https://www.digitalhealth.net/2024/05/nhs-dumfries-and-galloway-working-with-ncsc-after-3tb-data-leak", "description": "Digital Health: NHS Dumfries and Galloway working with NCSC after 3TB data leak" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-K", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I" ], "linddun": [ "DD", "I" ], "mds2": [ "STCF", "AUDT", "MPII" ], "deck": "The Hospital", "rank": "K", "physical_safety": false, "mitigation_prompts": [ "Which accounts or systems could copy the whole record?", "Would a bulk export from a reporting replica raise an alarm?", "How are backups and replicas protected from the same theft?" ], "seen_in": [ "Change Healthcare, 2024", "NHS Dumfries and Galloway, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4eef9b97-dde0-510a-80e7-48a0b427fb8b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-K mitigation: Whole record stolen for extortion", "description": "No single account or system should be able to copy the whole patient record unnoticed.\n\n1. Limit bulk query and export rights to a few monitored service accounts.\n2. Detect and alarm on unusual volumes leaving reporting databases and backups.\n3. Encrypt replicas and backups with keys held separately from the systems that read them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-K", "mitigation_principle": "No single account or system should be able to copy the whole patient record unnoticed.", "design_measures": [ "Limit bulk query and export rights to a few monitored service accounts.", "Detect and alarm on unusual volumes leaving reporting databases and backups.", "Encrypt replicas and backups with keys held separately from the systems that read them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1caeac2a-a37e-5328-b3bb-7d83ae18f637", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4eef9b97-dde0-510a-80e7-48a0b427fb8b", "target_ref": "attack-pattern--e24a3930-d2c4-5ad1-90cb-6342c9da2df8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--23717df7-3ad7-574d-b86f-0746703d2887", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patients extorted one by one", "description": "Therapy notes, sexual health and other sensitive records are stored as readable text. Once stolen, attackers contact patients individually and demand payment to keep their notes private.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-312", "url": "https://cwe.mitre.org/data/definitions/312.html", "description": "Cleartext Storage of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657/", "description": "Financial Theft" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "Vastaamo psychotherapy records, Finland, 2020", "url": "https://en.wikipedia.org/wiki/Vastaamo_data_breach", "description": "Wikipedia: Vastaamo data breach" }, { "source_name": "Vastaamo psychotherapy records, Finland, 2020", "url": "https://ny1.com/nyc/all-boroughs/ap-top-news/2024/04/30/finnish-hacker-gets-prison-for-accessing-thousands-of-psychotherapy-records-and-demanding-ransoms", "description": "AP via NY1: Finnish hacker gets prison for accessing psychotherapy records" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-Q", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I" ], "linddun": [ "DD", "I", "L" ], "mds2": [ "STCF", "MPII" ], "deck": "The Hospital", "rank": "Q", "physical_safety": false, "mitigation_prompts": [ "Which notes would hurt a patient most if published?", "Are those notes stored as readable text?", "What support would patients get if their notes were stolen?" ], "seen_in": [ "Vastaamo psychotherapy records, Finland, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b39b9344-db10-5eda-b382-19d56d7da56b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-Q mitigation: Patients extorted one by one", "description": "The most sensitive notes must be useless to anyone who steals them.\n\n1. Encrypt sensitive note categories at field level with separately held keys.\n2. Prepare a plan to warn and support patients quickly if notes are taken.\n3. Keep sensitive notes out of bulk extracts and reporting copies.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-Q", "mitigation_principle": "The most sensitive notes must be useless to anyone who steals them.", "design_measures": [ "Encrypt sensitive note categories at field level with separately held keys.", "Prepare a plan to warn and support patients quickly if notes are taken.", "Keep sensitive notes out of bulk extracts and reporting copies." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cc582296-ff9c-585e-a9ce-21886108f944", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b39b9344-db10-5eda-b382-19d56d7da56b", "target_ref": "attack-pattern--23717df7-3ad7-574d-b86f-0746703d2887" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--99ed82d7-23ac-5a35-b1c6-60a32e10c584", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Two patients become one record", "description": "Patient matching merges records on name, date of birth and partial identifiers. A wrong merge or a stolen identity mixes another person's allergies, results and diagnoses into a patient's record, and both are treated on the wrong history.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-1288", "url": "https://cwe.mitre.org/data/definitions/1288.html", "description": "Improper Validation of Consistency within Input" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-J", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "S", "T" ], "linddun": [ "L", "I" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which identifiers does patient matching rely on?", "Who reviews a merge before it takes effect?", "How is a wrong merge undone, and who is told?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--634adf48-71fa-54e2-9eb4-56cf782ccb6c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-J mitigation: Two patients become one record", "description": "Merging identities must be deliberate, reviewed and reversible.\n\n1. Require review of merges below a high matching confidence, by trained staff.\n2. Keep merges reversible with full history of which data came from which identity.\n3. Flag records where new data conflicts with established facts, such as blood group or sex at birth.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-J", "mitigation_principle": "Merging identities must be deliberate, reviewed and reversible.", "design_measures": [ "Require review of merges below a high matching confidence, by trained staff.", "Keep merges reversible with full history of which data came from which identity.", "Flag records where new data conflicts with established facts, such as blood group or sex at birth." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--146a5493-806f-5c9a-843a-721a40fecea8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--634adf48-71fa-54e2-9eb4-56cf782ccb6c", "target_ref": "attack-pattern--99ed82d7-23ac-5a35-b1c6-60a32e10c584" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cee6cadf-82b6-52cb-90bd-3039e66d192e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sensitive categories open to every user", "description": "Mental health, sexual health, HIV, abortion, gender identity and genetic records are visible to anyone who can open the patient. Where the law, family or employer is hostile, disclosure puts the patient at real risk.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-10", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I" ], "linddun": [ "DD", "I", "Nc" ], "mds2": [ "AUTH", "MPII" ], "deck": "The Hospital", "rank": "10", "physical_safety": false, "mitigation_prompts": [ "Who can open mental health, sexual health or genetic records?", "Does access follow the care relationship or just the login?", "What extra step guards the most sensitive categories?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--90fa8fff-c688-510f-b730-98f0d77c4fe7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-10 mitigation: Sensitive categories open to every user", "description": "Access to sensitive categories should follow the care relationship, not the login.\n\n1. Tag sensitive categories and restrict them to the treating team, with logged break-glass.\n2. Let patients choose additional restrictions where the law allows.\n3. Keep sensitive categories out of default printouts, summaries and shared feeds.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-10", "mitigation_principle": "Access to sensitive categories should follow the care relationship, not the login.", "design_measures": [ "Tag sensitive categories and restrict them to the treating team, with logged break-glass.", "Let patients choose additional restrictions where the law allows.", "Keep sensitive categories out of default printouts, summaries and shared feeds." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f4a099ae-3b1a-55b2-8376-7dbb43214f0a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--90fa8fff-c688-510f-b730-98f0d77c4fe7", "target_ref": "attack-pattern--cee6cadf-82b6-52cb-90bd-3039e66d192e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8c598a64-e35e-5ea0-a080-eab692b9945e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Staff browse records without reason", "description": "Insiders look up celebrities, colleagues, neighbours and former partners. Access is logged, but nobody reviews the logs, so curiosity and stalking go unnoticed and unpunished.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T1213", "url": "https://attack.mitre.org/techniques/T1213/", "description": "Data from Information Repositories" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-9", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I", "R" ], "linddun": [ "DD", "D", "I" ], "mds2": [ "AUDT", "AUTH" ], "deck": "The Hospital", "rank": "9", "physical_safety": false, "mitigation_prompts": [ "Who reviews access logs, and how often?", "How would a colleague browsing a neighbour's record be detected?", "What happens to staff found looking without reason?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--7ef3f63c-9cbe-51cd-9ec1-95553e519ef7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-9 mitigation: Staff browse records without reason", "description": "Every look at a record should be attributable and reviewed against a care relationship.\n\n1. Analyse access logs automatically for patients with no care link to the viewer.\n2. Flag high-interest records and alert on access to them.\n3. Tell staff the logs are reviewed and act visibly on findings.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-9", "mitigation_principle": "Every look at a record should be attributable and reviewed against a care relationship.", "design_measures": [ "Analyse access logs automatically for patients with no care link to the viewer.", "Flag high-interest records and alert on access to them.", "Tell staff the logs are reviewed and act visibly on findings." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--981d9ea6-a176-5867-83bc-3533babf6082", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7ef3f63c-9cbe-51cd-9ec1-95553e519ef7", "target_ref": "attack-pattern--8c598a64-e35e-5ea0-a080-eab692b9945e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--33ee01a8-8b86-5a73-a19d-04ff13d57ffb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patient portal accounts taken over", "description": "Portals let patients and their proxies read records and message clinicians. Reused passwords, weak recovery and loose proxy access let attackers, or a coercive partner or relative, read and change what the patient sees.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-600", "url": "https://capec.mitre.org/data/definitions/600.html", "description": "Credential Stuffing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-640", "url": "https://cwe.mitre.org/data/definitions/640.html", "description": "Weak Password Recovery Mechanism for Forgotten Password" }, { "source_name": "mitre-attack", "external_id": "T1110.004", "url": "https://attack.mitre.org/techniques/T1110/004/", "description": "Credential Stuffing" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-8", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "S", "I" ], "linddun": [ "DD", "I", "L" ], "mds2": [ "PAUT", "AUDT" ], "deck": "The Hospital", "rank": "8", "physical_safety": false, "mitigation_prompts": [ "How strong are portal logins and account recovery?", "Who can be granted proxy access, and can the patient revoke it?", "How would a coercive relative's access be noticed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5a7937e5-6899-5670-8783-8d85a052dd1d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-8 mitigation: Patient portal accounts taken over", "description": "Portal access must be as strong as the data it shows, and proxies must be revocable by the patient.\n\n1. Offer phishing-resistant authentication and detect credential stuffing.\n2. Let patients see and revoke proxies, and alert them to new devices and proxy access.\n3. Make account recovery require more than details found in the record.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-8", "mitigation_principle": "Portal access must be as strong as the data it shows, and proxies must be revocable by the patient.", "design_measures": [ "Offer phishing-resistant authentication and detect credential stuffing.", "Let patients see and revoke proxies, and alert them to new devices and proxy access.", "Make account recovery require more than details found in the record." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b93759b1-5f5b-5335-8b4a-ebd82c09651b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5a7937e5-6899-5670-8783-8d85a052dd1d", "target_ref": "attack-pattern--33ee01a8-8b86-5a73-a19d-04ff13d57ffb" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ff406aa8-3e68-5393-a7f1-5eca12ea74f8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Health data shared beyond its purpose", "description": "Tracking scripts on appointment and portal pages, research extracts and contracts with insurers or authorities move health data to parties the patient never expected. Once shared, it is linked with other data and cannot be recalled.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-201", "url": "https://cwe.mitre.org/data/definitions/201.html", "description": "Insertion of Sensitive Information Into Sent Data" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-7", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I" ], "linddun": [ "DD", "U", "Nc", "L" ], "mds2": [ "MPII", "DIDT" ], "deck": "The Hospital", "rank": "7", "physical_safety": false, "mitigation_prompts": [ "Which third parties receive data from portal and appointment pages?", "Does every data flow have a stated purpose?", "What does each extract contain beyond what its purpose needs?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--46900a27-7fa0-524c-83fb-96826d2ed22b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-7 mitigation: Health data shared beyond its purpose", "description": "Each flow of patient data must have a stated purpose and the least data it needs.\n\n1. Remove third-party tracking from any page that shows or collects health data.\n2. Keep a register of data flows with purpose, legal basis and owner, reviewed yearly.\n3. Send only the fields each recipient needs.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-7", "mitigation_principle": "Each flow of patient data must have a stated purpose and the least data it needs.", "design_measures": [ "Remove third-party tracking from any page that shows or collects health data.", "Keep a register of data flows with purpose, legal basis and owner, reviewed yearly.", "Send only the fields each recipient needs." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--92342363-09f3-5012-9dfd-358cbfad0389", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--46900a27-7fa0-524c-83fb-96826d2ed22b", "target_ref": "attack-pattern--ff406aa8-3e68-5393-a7f1-5eca12ea74f8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--664ef0db-dbfe-5ffc-958e-b93b400ee362", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "De-identified data re-identified", "description": "Research and analytics datasets have names removed but keep dates, postcodes, rare conditions and free text. Linking them with other data identifies patients, sometimes in seconds.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-212", "url": "https://cwe.mitre.org/data/definitions/212.html", "description": "Improper Removal of Sensitive Information Before Storage or Transfer" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-6", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I" ], "linddun": [ "L", "I", "DD" ], "mds2": [ "DIDT" ], "deck": "The Hospital", "rank": "6", "physical_safety": false, "mitigation_prompts": [ "Which quasi-identifiers remain in research datasets?", "Has anyone measured the re-identification risk?", "Who decides whether free text can leave the record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e0347f68-6b27-5c37-8676-1de234e8fd7c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-6 mitigation: De-identified data re-identified", "description": "Treat de-identification as a risk to measure, not a step that is done.\n\n1. Assess re-identification risk for each release and generalise rare values.\n2. Remove or scrub free text before release.\n3. Release data inside a controlled research environment instead of handing out copies.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-6", "mitigation_principle": "Treat de-identification as a risk to measure, not a step that is done.", "design_measures": [ "Assess re-identification risk for each release and generalise rare values.", "Remove or scrub free text before release.", "Release data inside a controlled research environment instead of handing out copies." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5c325f75-8958-5ba1-aa83-d4eb46d938ac", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e0347f68-6b27-5c37-8676-1de234e8fd7c", "target_ref": "attack-pattern--664ef0db-dbfe-5ffc-958e-b93b400ee362" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1a69f301-66fd-585f-be32-47d2de109d25", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Audit trail can be edited", "description": "System administrators and vendor support can change or delete audit records. Then nobody can prove who changed a record or viewed it, which matters in incidents, complaints and court.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "mitre-attack", "external_id": "T1070", "url": "https://attack.mitre.org/techniques/T1070/", "description": "Indicator Removal" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-5", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "R" ], "linddun": [ "Nr" ], "mds2": [ "AUDT" ], "deck": "The Hospital", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Who can alter or delete audit records, including vendor support?", "Where is the audit trail kept, out of administrators' reach?", "Could you prove in court who viewed a record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--497d74fa-d18d-58b3-b9e7-3fd7576d503f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-5 mitigation: Audit trail can be edited", "description": "The audit trail must be beyond the reach of the people and systems it records.\n\n1. Ship audit records to a separate, append-only store as they are written.\n2. Separate audit administration from system administration.\n3. Check the audit stream for gaps and alarm when it stops.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-5", "mitigation_principle": "The audit trail must be beyond the reach of the people and systems it records.", "design_measures": [ "Ship audit records to a separate, append-only store as they are written.", "Separate audit administration from system administration.", "Check the audit stream for gaps and alarm when it stops." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4ea63c94-952c-57c2-858e-a57fb5338643", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--497d74fa-d18d-58b3-b9e7-3fd7576d503f", "target_ref": "attack-pattern--1a69f301-66fd-585f-be32-47d2de109d25" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--413af9ca-f1e6-5ff9-9f20-585c05badcf4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Records released to impostors", "description": "Records teams answer requests from patients, police, insurers and solicitors by phone, email and post. Someone posing as the patient or an official obtains a full record.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-407", "url": "https://capec.mitre.org/data/definitions/407.html", "description": "Pretexting" }, { "source_name": "capec", "external_id": "CAPEC-412", "url": "https://capec.mitre.org/data/definitions/412.html", "description": "Pretexting via Customer Service" }, { "source_name": "cwe", "external_id": "CWE-1390", "url": "https://cwe.mitre.org/data/definitions/1390.html", "description": "Weak Authentication" }, { "source_name": "mitre-attack", "external_id": "T1598.004", "url": "https://attack.mitre.org/techniques/T1598/004/", "description": "Spearphishing Voice" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-4", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "S", "I" ], "linddun": [ "DD", "I" ], "mds2": [ "PAUT", "MPII" ], "deck": "The Hospital", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "How do records staff verify who is asking for a record?", "Which requests arrive by phone or email, and how are they checked?", "What would an impostor need to obtain a full record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--eec6d867-36d3-584d-952f-4fbed5b29dc9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-4 mitigation: Records released to impostors", "description": "Release of records must verify who is asking and whether they are entitled.\n\n1. Verify identity through a channel already on file, not one given in the request.\n2. Send records through an authenticated portal rather than email or post.\n3. Review third-party requests for entitlement and release the minimum needed.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-4", "mitigation_principle": "Release of records must verify who is asking and whether they are entitled.", "design_measures": [ "Verify identity through a channel already on file, not one given in the request.", "Send records through an authenticated portal rather than email or post.", "Review third-party requests for entitlement and release the minimum needed." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3bfd3819-5867-5b89-a58d-a66737a363f8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--eec6d867-36d3-584d-952f-4fbed5b29dc9", "target_ref": "attack-pattern--413af9ca-f1e6-5ff9-9f20-585c05badcf4" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--12e2fd1e-88a8-527c-9a7d-b403f9bba8d8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Printouts and caches left behind", "description": "Shared workstations, browser caches, downloaded letters and downtime printouts hold patient data long after the task. Anyone using the next session, bin or printer tray can read them.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-204", "url": "https://capec.mitre.org/data/definitions/204.html", "description": "Lifting Sensitive Data Embedded in Cache" }, { "source_name": "cwe", "external_id": "CWE-524", "url": "https://cwe.mitre.org/data/definitions/524.html", "description": "Use of Cache Containing Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-525", "url": "https://cwe.mitre.org/data/definitions/525.html", "description": "Use of Web Browser Cache Containing Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-3", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "I" ], "linddun": [ "DD" ], "mds2": [ "ALOF", "STCF" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "What patient data stays on shared workstations after a session?", "Where do downtime printouts end up?", "Who clears browser caches and downloaded letters, and when?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--23b22502-dcf7-546e-92fd-c9244333060e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-3 mitigation: Printouts and caches left behind", "description": "Patient data should not outlive the task on shared equipment.\n\n1. Clear local caches and downloads when a clinical session ends.\n2. Use secure print release and confidential waste on wards.\n3. Lock or log off unattended sessions quickly, using tap-to-switch to keep it practical.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-3", "mitigation_principle": "Patient data should not outlive the task on shared equipment.", "design_measures": [ "Clear local caches and downloads when a clinical session ends.", "Use secure print release and confidential waste on wards.", "Lock or log off unattended sessions quickly, using tap-to-switch to keep it practical." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b15b0b31-c1e0-58c2-aebf-0fc4ad1b809f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--23b22502-dcf7-546e-92fd-c9244333060e", "target_ref": "attack-pattern--12e2fd1e-88a8-527c-9a7d-b403f9bba8d8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--41a6bfdb-a30c-53f9-8c88-57aa34a1b799", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patients cannot see who looked", "description": "Patients have no view of who accessed their record or where it was shared. They cannot notice misuse, object to a disclosure or correct what was sent.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/#cri-rc-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-223", "url": "https://cwe.mitre.org/data/definitions/223.html", "description": "Omission of Security-relevant Information" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-2", "group_code": "RC", "group_name": "Records and Patient Data", "stride": [ "R" ], "linddun": [ "U", "Nc" ], "mds2": [ "AUDT", "MPII" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "Can patients see who accessed their record?", "How would a patient object to a disclosure?", "Where can patients see where their record was shared?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ab089b3f-7df8-5c06-bf87-9e2ade10a163", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-RC-2 mitigation: Patients cannot see who looked", "description": "Patients should be able to see how their record has been used.\n\n1. Show patients an access and sharing history in the portal.\n2. Let patients report access they do not recognise and track the response.\n3. Explain in plain language who routinely sees their record and why.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-RC-2", "mitigation_principle": "Patients should be able to see how their record has been used.", "design_measures": [ "Show patients an access and sharing history in the portal.", "Let patients report access they do not recognise and track the response.", "Explain in plain language who routinely sees their record and why." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--69e50546-e501-50b2-9f44-5fda158a6aa5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ab089b3f-7df8-5c06-bf87-9e2ade10a163", "target_ref": "attack-pattern--41a6bfdb-a30c-53f9-8c88-57aa34a1b799" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--c8e1f4e9-7d0c-5834-a012-0f9f52abd785", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "RC Records and Patient Data", "description": "The EHR and patient administration, orders and results, identity matching, sensitive categories, portals, research use and the audit trail.", "context": "unspecified", "object_refs": [ "attack-pattern--8d310241-3055-53cc-9e8e-f65856506769", "course-of-action--f303484b-11b4-51d6-b668-e0ddb4cb1cc6", "attack-pattern--e24a3930-d2c4-5ad1-90cb-6342c9da2df8", "course-of-action--4eef9b97-dde0-510a-80e7-48a0b427fb8b", "attack-pattern--23717df7-3ad7-574d-b86f-0746703d2887", "course-of-action--b39b9344-db10-5eda-b382-19d56d7da56b", "attack-pattern--99ed82d7-23ac-5a35-b1c6-60a32e10c584", "course-of-action--634adf48-71fa-54e2-9eb4-56cf782ccb6c", "attack-pattern--cee6cadf-82b6-52cb-90bd-3039e66d192e", "course-of-action--90fa8fff-c688-510f-b730-98f0d77c4fe7", "attack-pattern--8c598a64-e35e-5ea0-a080-eab692b9945e", "course-of-action--7ef3f63c-9cbe-51cd-9ec1-95553e519ef7", "attack-pattern--33ee01a8-8b86-5a73-a19d-04ff13d57ffb", "course-of-action--5a7937e5-6899-5670-8783-8d85a052dd1d", "attack-pattern--ff406aa8-3e68-5393-a7f1-5eca12ea74f8", "course-of-action--46900a27-7fa0-524c-83fb-96826d2ed22b", "attack-pattern--664ef0db-dbfe-5ffc-958e-b93b400ee362", "course-of-action--e0347f68-6b27-5c37-8676-1de234e8fd7c", "attack-pattern--1a69f301-66fd-585f-be32-47d2de109d25", "course-of-action--497d74fa-d18d-58b3-b9e7-3fd7576d503f", "attack-pattern--413af9ca-f1e6-5ff9-9f20-585c05badcf4", "course-of-action--eec6d867-36d3-584d-952f-4fbed5b29dc9", "attack-pattern--12e2fd1e-88a8-527c-9a7d-b403f9bba8d8", "course-of-action--23b22502-dcf7-546e-92fd-c9244333060e", "attack-pattern--41a6bfdb-a30c-53f9-8c88-57aa34a1b799", "course-of-action--ab089b3f-7df8-5c06-bf87-9e2ade10a163" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-RC", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/records-and-patient-data/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cc005d9e-4fc6-5b94-8301-2e4c4c5deed8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unauthenticated orders and results feeds", "description": "Interfaces accept HL7 orders, results and admissions from any sender that can reach the port, with no check of who sent them. A forged potassium result or a cancelled allergy lands in the record looking genuine, and clinicians treat the patient on it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-594", "url": "https://capec.mitre.org/data/definitions/594.html", "description": "Traffic Injection" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1557", "url": "https://attack.mitre.org/techniques/T1557/", "description": "Adversary-in-the-Middle" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-A", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "S", "T" ], "mds2": [ "NAUT", "TXIG", "IGAU" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which senders can reach each interface port?", "How does an interface check who sent a message?", "What would a forged result look like when it reached the record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8d14030d-a1c5-54f5-ae11-f9acf7e54867", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-A mitigation: Unauthenticated orders and results feeds", "description": "Every interface accepts clinical messages only from authenticated senders over protected channels, and rejects everything else.\n\n1. Wrap HL7 v2 MLLP feeds in mutually authenticated TLS, or carry them over an authenticated tunnel between named endpoints.\n2. Allowlist sending applications and facilities per interface, and reject messages whose sender fields do not match the authenticated peer.\n3. Alert on messages from unexpected sources, and route clinically significant result changes for human review.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-A", "mitigation_principle": "Every interface accepts clinical messages only from authenticated senders over protected channels, and rejects everything else.", "design_measures": [ "Wrap HL7 v2 MLLP feeds in mutually authenticated TLS, or carry them over an authenticated tunnel between named endpoints.", "Allowlist sending applications and facilities per interface, and reject messages whose sender fields do not match the authenticated peer.", "Alert on messages from unexpected sources, and route clinically significant result changes for human review." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f13fc9a0-357c-5388-b735-ec43ca9cba2f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8d14030d-a1c5-54f5-ae11-f9acf7e54867", "target_ref": "attack-pattern--cc005d9e-4fc6-5b94-8301-2e4c4c5deed8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--acf6715c-0691-5d66-8248-6459aff67176", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Integration engine as master key", "description": "The integration engine sees, transforms and routes every clinical message, and its routes can be edited by a handful of accounts. Whoever controls it can rewrite results, redirect orders or copy every message out, across every connected system at once.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-385", "url": "https://capec.mitre.org/data/definitions/385.html", "description": "Transaction or Event Tampering via Application API Manipulation" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1119", "url": "https://attack.mitre.org/techniques/T1119/", "description": "Automated Collection" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-K", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "T", "I", "D", "E" ], "linddun": [ "DD" ], "mds2": [ "AUTH", "AUDT", "IGAU" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can edit routes and transforms in the integration engine?", "How are engine changes reviewed and detected?", "What could someone controlling the engine change across systems?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f1ec9e11-7807-516b-bb76-da08d31b2ef9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-K mitigation: Integration engine as master key", "description": "The integration engine is treated as a safety-critical system: changes to routes and transforms are controlled, reviewed and detectable.\n\n1. Put route and transform changes through change control with two-person approval and versioned, signed configuration.\n2. Separate engine administration from ordinary IT accounts, with phishing-resistant MFA and a dedicated management network.\n3. Reconcile message counts and checksums between sending and receiving systems so silent rewrites show up.\n4. Keep a tested standby engine and a documented manual workaround for each critical feed.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-K", "mitigation_principle": "The integration engine is treated as a safety-critical system: changes to routes and transforms are controlled, reviewed and detectable.", "design_measures": [ "Put route and transform changes through change control with two-person approval and versioned, signed configuration.", "Separate engine administration from ordinary IT accounts, with phishing-resistant MFA and a dedicated management network.", "Reconcile message counts and checksums between sending and receiving systems so silent rewrites show up.", "Keep a tested standby engine and a documented manual workaround for each critical feed." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ebafd032-1aa1-52e4-bfcd-bf13105a90de", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f1ec9e11-7807-516b-bb76-da08d31b2ef9", "target_ref": "attack-pattern--acf6715c-0691-5d66-8248-6459aff67176" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--10d1cdd2-c9f0-514b-9d6e-c98a6f8f17c3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Device data charted without integrity", "description": "Device integration middleware writes vital signs, pump rates and ventilator settings into the record without proving which device produced them or that values were not changed in transit. Wrong values become the charted truth that drives early-warning scores and treatment decisions.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-384", "url": "https://capec.mitre.org/data/definitions/384.html", "description": "Application API Message Manipulation via Man-in-the-Middle" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "mitre-emb3d", "external_id": "TID-407", "url": "https://emb3d.mitre.org/threats/TID-407.html", "description": "Missing Message Replay Protection" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-Q", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "S", "T", "R" ], "mds2": [ "IGAU", "NAUT", "TXIG" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does middleware prove which device produced a value?", "What validation happens before device data is charted?", "Which scores and decisions consume charted device data?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--643b3521-1120-5420-9851-6bf8fefb6239", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-Q mitigation: Device data charted without integrity", "description": "Device data entering the record carries proof of its source and integrity, and is validated before it is charted.\n\n1. Authenticate each device to the middleware and sign or MAC observations end to end, not only per network hop.\n2. Require clinician validation of device data before charting, with the device identifier shown alongside each value.\n3. Range-check and rate-check incoming values against physiology and the device's own reported limits.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-Q", "mitigation_principle": "Device data entering the record carries proof of its source and integrity, and is validated before it is charted.", "design_measures": [ "Authenticate each device to the middleware and sign or MAC observations end to end, not only per network hop.", "Require clinician validation of device data before charting, with the device identifier shown alongside each value.", "Range-check and rate-check incoming values against physiology and the device's own reported limits." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dcd265a8-3363-5e2c-8881-f261d5bf8422", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--643b3521-1120-5420-9851-6bf8fefb6239", "target_ref": "attack-pattern--10d1cdd2-c9f0-514b-9d6e-c98a6f8f17c3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--45a4a627-670c-5a4f-98a5-ba4aceef1092", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Open DICOM nodes", "description": "Imaging systems accept DICOM store, query and retrieve requests from any node that knows an application title, which is usually guessable. Images can be pulled out in bulk, or new images inserted into a patient's study, including files that also carry executable code.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-636", "url": "https://capec.mitre.org/data/definitions/636.html", "description": "Hiding Malicious Data or Code within Files" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "cwe", "external_id": "CWE-434", "url": "https://cwe.mitre.org/data/definitions/434.html", "description": "Unrestricted Upload of File with Dangerous Type" }, { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/", "description": "Exploit Public-Facing Application" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Open PACS servers, 2019", "url": "https://www.helpnetsecurity.com/2019/09/18/confidential-patient-data/", "description": "Help Net Security: Confidential data of 24.3 million patients discovered online" }, { "source_name": "Open PACS servers, 2019", "url": "https://www.hipaajournal.com/update-issued-on-unsecured-pacs-as-exposed-medical-image-total-rises-to-1-19-billion/", "description": "HIPAA Journal: Exposed medical image total rises to 1.19 billion" }, { "source_name": "DICOM files carrying malware, 2019", "url": "https://web.nvd.nist.gov/vuln/detail/CVE-2019-11687", "description": "NVD: CVE-2019-11687" }, { "source_name": "DICOM files carrying malware, 2019", "url": "https://www.govinfosecurity.com/researchers-malware-be-hidden-in-medical-images-a-12388", "description": "GovInfoSecurity: Researchers, malware can be hidden in medical images" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-J", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "S", "T", "I" ], "linddun": [ "DD", "I" ], "mds2": [ "NAUT", "TXCF", "MLDP" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which nodes can query or store to the imaging systems?", "Is any DICOM peer authenticated beyond its application title?", "How are received objects checked before joining a study?" ], "seen_in": [ "Open PACS servers, 2019", "DICOM files carrying malware, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9a85fb19-ad8f-5f4a-806c-fad7d162e8af", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-J mitigation: Open DICOM nodes", "description": "DICOM associations are authenticated and limited to known peers, and every received object is checked before it reaches a study.\n\n1. Use DICOM TLS with certificates per node, and restrict associations to an allowlist of application titles and addresses.\n2. Never expose PACS or modality DICOM ports to the internet; reach remote sites through authenticated gateways.\n3. Scan received DICOM files for embedded executable content and quarantine objects arriving from unexpected sources.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-J", "mitigation_principle": "DICOM associations are authenticated and limited to known peers, and every received object is checked before it reaches a study.", "design_measures": [ "Use DICOM TLS with certificates per node, and restrict associations to an allowlist of application titles and addresses.", "Never expose PACS or modality DICOM ports to the internet; reach remote sites through authenticated gateways.", "Scan received DICOM files for embedded executable content and quarantine objects arriving from unexpected sources." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c85af3ae-998e-5912-9390-b563b68c8daa", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9a85fb19-ad8f-5f4a-806c-fad7d162e8af", "target_ref": "attack-pattern--45a4a627-670c-5a4f-98a5-ba4aceef1092" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d914b986-5b98-5956-9b97-de138e22c906", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Identity mismatched across interfaces", "description": "Each system keys patients differently and interfaces map identifiers with brittle rules. A mapping error, or a deliberate edit to a demographic message, merges two people or files results under the wrong patient, so treatment follows someone else's data.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-694", "url": "https://cwe.mitre.org/data/definitions/694.html", "description": "Use of Multiple Resources with Duplicate Identifier" }, { "source_name": "cwe", "external_id": "CWE-706", "url": "https://cwe.mitre.org/data/definitions/706.html", "description": "Use of Incorrectly-Resolved Name or Reference" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-10", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "T", "R" ], "linddun": [ "L", "I" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Hospital", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which identifiers do interfaces use to match a patient?", "Who reviews mismatches flagged between systems?", "How would results filed to the wrong patient be noticed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--7253b0bb-e6fd-541b-ab24-caef1378d98a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-10 mitigation: Identity mismatched across interfaces", "description": "Patient identity is matched on multiple strong identifiers end to end, and every merge or mismatch is detected and reviewed.\n\n1. Use an enterprise master patient index and match on at least two independent identifiers in every interface.\n2. Hold and queue messages whose identifiers fail to match rather than guessing, and alert the owning team.\n3. Log and review every patient merge and unmerge, with the ability to trace and reverse filed results.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-10", "mitigation_principle": "Patient identity is matched on multiple strong identifiers end to end, and every merge or mismatch is detected and reviewed.", "design_measures": [ "Use an enterprise master patient index and match on at least two independent identifiers in every interface.", "Hold and queue messages whose identifiers fail to match rather than guessing, and alert the owning team.", "Log and review every patient merge and unmerge, with the ability to trace and reverse filed results." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1cb06880-6ae1-53dd-9060-2ea5b5f8e8f4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7253b0bb-e6fd-541b-ab24-caef1378d98a", "target_ref": "attack-pattern--d914b986-5b98-5956-9b97-de138e22c906" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f83b7528-710f-59f3-b58d-36f26add4ba2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Over-broad scopes for FHIR apps", "description": "Third-party and patient-facing apps get FHIR access through broad scopes or long-lived tokens granted once. A compromised or careless app can read whole populations' records through a legitimate API, and nobody notices because the calls look normal.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-1", "url": "https://capec.mitre.org/data/definitions/1.html", "description": "Accessing Functionality Not Properly Constrained by ACLs" }, { "source_name": "capec", "external_id": "CAPEC-57", "url": "https://capec.mitre.org/data/definitions/57.html", "description": "Utilizing REST's Trust in the System Resource to Obtain Sensitive Data" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "mitre-attack", "external_id": "T1213", "url": "https://attack.mitre.org/techniques/T1213/", "description": "Data from Information Repositories" }, { "source_name": "mitre-attack", "external_id": "T1567", "url": "https://attack.mitre.org/techniques/T1567/", "description": "Exfiltration Over Web Service" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-9", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "I", "E" ], "linddun": [ "DD", "U", "Nc" ], "mds2": [ "AUTH", "MPII", "AUDT" ], "deck": "The Hospital", "rank": "9", "physical_safety": false, "mitigation_prompts": [ "What scopes and token lifetimes do FHIR apps receive?", "Who approves a new app's access, and for what purpose?", "Would bulk reads through a legitimate API raise an alert?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8bcccc4d-af68-5239-b375-7bd6d79828a9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-9 mitigation: Over-broad scopes for FHIR apps", "description": "API access is granted per purpose, minimal in scope and time, and monitored for unusual volume.\n\n1. Grant the narrowest SMART scopes needed, prefer patient-level over system-level access, and expire refresh tokens.\n2. Rate-limit and alert on bulk queries and access patterns outside an app's declared purpose.\n3. Review registered apps regularly and revoke those without an owner or current agreement.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-9", "mitigation_principle": "API access is granted per purpose, minimal in scope and time, and monitored for unusual volume.", "design_measures": [ "Grant the narrowest SMART scopes needed, prefer patient-level over system-level access, and expire refresh tokens.", "Rate-limit and alert on bulk queries and access patterns outside an app's declared purpose.", "Review registered apps regularly and revoke those without an owner or current agreement." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--346d769b-267f-5b21-b1bc-cb591ed30c6a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8bcccc4d-af68-5239-b375-7bd6d79828a9", "target_ref": "attack-pattern--f83b7528-710f-59f3-b58d-36f26add4ba2" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7d646693-1efc-5340-8a81-d513ccc7c451", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Replayed and duplicated messages", "description": "Interfaces cannot tell a new message from a resent one. A replayed medication order, admission or transfer is acted on twice: a second dose dispensed, a bed reassigned, a discharge triggered.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-60", "url": "https://capec.mitre.org/data/definitions/60.html", "description": "Reusing Session IDs (aka Session Replay)" }, { "source_name": "capec", "external_id": "CAPEC-594", "url": "https://capec.mitre.org/data/definitions/594.html", "description": "Traffic Injection" }, { "source_name": "cwe", "external_id": "CWE-294", "url": "https://cwe.mitre.org/data/definitions/294.html", "description": "Authentication Bypass by Capture-replay" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-221", "url": "https://emb3d.mitre.org/threats/TID-221.html", "description": "Authentication Bypass By Message Replay" }, { "source_name": "mitre-emb3d", "external_id": "TID-407", "url": "https://emb3d.mitre.org/threats/TID-407.html", "description": "Missing Message Replay Protection" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-8", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "T", "R" ], "mds2": [ "TXIG", "IGAU" ], "deck": "The Hospital", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does each interface recognise a duplicated message?", "Which repeated messages could cause harm if acted on twice?", "Where are message order and uniqueness enforced?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--fe142ff3-78ab-54fd-94f2-a8804ac7fc49", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-8 mitigation: Replayed and duplicated messages", "description": "Every clinical message is unique, ordered and processed once, and duplicates are caught before they act.\n\n1. Enforce unique message control IDs with sequence checking and reject duplicates within a defined window.\n2. Make order processing idempotent so a resent order updates rather than duplicates.\n3. Timestamp and sign messages so stale replays outside their validity window are refused.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-8", "mitigation_principle": "Every clinical message is unique, ordered and processed once, and duplicates are caught before they act.", "design_measures": [ "Enforce unique message control IDs with sequence checking and reject duplicates within a defined window.", "Make order processing idempotent so a resent order updates rather than duplicates.", "Timestamp and sign messages so stale replays outside their validity window are refused." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5523c57d-4308-5b06-a982-ea0949d768fb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fe142ff3-78ab-54fd-94f2-a8804ac7fc49", "target_ref": "attack-pattern--7d646693-1efc-5340-8a81-d513ccc7c451" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--24012cc2-bd8b-57ae-8cd5-bcf91bd2f695", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Feeds that fail silently", "description": "When an interface stops, queues fill quietly and the receiving system simply shows nothing new. Critical results, allergy updates or admissions stop arriving, and clinicians take the silence for normal.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-603", "url": "https://capec.mitre.org/data/definitions/603.html", "description": "Blockage" }, { "source_name": "cwe", "external_id": "CWE-392", "url": "https://cwe.mitre.org/data/definitions/392.html", "description": "Missing Report of Error Condition" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-7", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "D" ], "mds2": [ "DTBK", "AUDT" ], "deck": "The Hospital", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How would anyone know a critical feed had stopped?", "Who is told when interface queues back up?", "What do clinicians see when no new data arrives?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--fceaa329-7d84-5957-ae98-af49829f522c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-7 mitigation: Feeds that fail silently", "description": "Every critical feed is monitored end to end, and staff are told when data stops flowing.\n\n1. Monitor queue depth and message age per critical feed, with alerts to an owner who is on duty around the clock.\n2. Send heartbeat messages and show a visible stale-data warning in receiving systems when they stop.\n3. Define and rehearse what wards do when a feed is down, including phoning critical results.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-7", "mitigation_principle": "Every critical feed is monitored end to end, and staff are told when data stops flowing.", "design_measures": [ "Monitor queue depth and message age per critical feed, with alerts to an owner who is on duty around the clock.", "Send heartbeat messages and show a visible stale-data warning in receiving systems when they stop.", "Define and rehearse what wards do when a feed is down, including phoning critical results." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--43d32996-d669-543f-a63e-c309947b3f47", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--fceaa329-7d84-5957-ae98-af49829f522c", "target_ref": "attack-pattern--24012cc2-bd8b-57ae-8cd5-bcf91bd2f695" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fd87ac62-b993-5063-9807-4592ff935021", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Exchange trusts every participant equally", "description": "Regional and national record exchanges give every connected organisation the same reach. One compromised clinic, vendor or pharmacy can query or push records about patients it has never treated.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "mitre-attack", "external_id": "T1213", "url": "https://attack.mitre.org/techniques/T1213/", "description": "Data from Information Repositories" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-6", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "S", "I", "E" ], "linddun": [ "DD", "L", "Nc" ], "mds2": [ "AUTH", "AUDT", "NAUT" ], "deck": "The Hospital", "rank": "6", "physical_safety": false, "mitigation_prompts": [ "What can one participant query through the exchange?", "Is access tied to a care relationship with the patient?", "Who monitors each organisation's use of the exchange?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c45bd504-b654-590b-b108-d817f4ba2a52", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-6 mitigation: Exchange trusts every participant equally", "description": "Access through exchanges is tied to a demonstrated care relationship, and each participant's use is monitored.\n\n1. Require a care-relationship or consent assertion per query and audit it against later activity.\n2. Apply per-participant quotas and anomaly detection, and suspend participants quickly when misuse shows.\n3. Sign pushed documents at source so receivers can check provenance before filing them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-6", "mitigation_principle": "Access through exchanges is tied to a demonstrated care relationship, and each participant's use is monitored.", "design_measures": [ "Require a care-relationship or consent assertion per query and audit it against later activity.", "Apply per-participant quotas and anomaly detection, and suspend participants quickly when misuse shows.", "Sign pushed documents at source so receivers can check provenance before filing them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a34b7065-64bc-5fb9-9e18-f2db8725ec87", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c45bd504-b654-590b-b108-d817f4ba2a52", "target_ref": "attack-pattern--fd87ac62-b993-5063-9807-4592ff935021" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--681d7c17-8ac9-58b7-8cb7-5125bf62412f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Malformed messages break the engine", "description": "Parsers in engines and receiving systems trust message structure. Oversized fields, unexpected segments or crafted XML and JSON crash interfaces, inject content downstream, or exhaust resources, stopping clinical data flows hospital-wide.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-28", "url": "https://capec.mitre.org/data/definitions/28.html", "description": "Fuzzing" }, { "source_name": "capec", "external_id": "CAPEC-221", "url": "https://capec.mitre.org/data/definitions/221.html", "description": "Data Serialization External Entities Blowup" }, { "source_name": "capec", "external_id": "CAPEC-153", "url": "https://capec.mitre.org/data/definitions/153.html", "description": "Input Data Manipulation" }, { "source_name": "cwe", "external_id": "CWE-611", "url": "https://cwe.mitre.org/data/definitions/611.html", "description": "Improper Restriction of XML External Entity Reference" }, { "source_name": "cwe", "external_id": "CWE-776", "url": "https://cwe.mitre.org/data/definitions/776.html", "description": "Improper Restriction of Recursive Entity References in DTDs" }, { "source_name": "cwe", "external_id": "CWE-1284", "url": "https://cwe.mitre.org/data/definitions/1284.html", "description": "Improper Validation of Specified Quantity in Input" }, { "source_name": "mitre-attack", "external_id": "T1499", "url": "https://attack.mitre.org/techniques/T1499/", "description": "Endpoint Denial of Service" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-5", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "T", "D" ], "mds2": [ "SAHD", "IGAU" ], "deck": "The Hospital", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Does every interface validate messages against a strict profile?", "What happens to a malformed or oversized message?", "Could one bad message stop data flows hospital-wide?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f1271914-16d3-5185-99bc-df1e75b4abc5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-5 mitigation: Malformed messages break the engine", "description": "Every interface validates structure and content against a strict profile before processing.\n\n1. Validate messages against conformance profiles and reject or quarantine anything outside them.\n2. Disable external entity resolution and limit message size, nesting and field length in all parsers.\n3. Fuzz test interfaces before go-live and after upgrades.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-5", "mitigation_principle": "Every interface validates structure and content against a strict profile before processing.", "design_measures": [ "Validate messages against conformance profiles and reject or quarantine anything outside them.", "Disable external entity resolution and limit message size, nesting and field length in all parsers.", "Fuzz test interfaces before go-live and after upgrades." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5ac6c174-52c7-5fd9-96ec-deba2e122d8a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f1271914-16d3-5185-99bc-df1e75b4abc5", "target_ref": "attack-pattern--681d7c17-8ac9-58b7-8cb7-5125bf62412f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8548555c-4e2c-5f33-ac65-e2a5767399b0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared interface credentials and certificates", "description": "Interface accounts, keys and certificates are hard-coded, shared across feeds and vendors, and tracked nowhere. One leaked secret opens many interfaces, and an expiring certificate stops several feeds at once without warning.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "cwe", "external_id": "CWE-298", "url": "https://cwe.mitre.org/data/definitions/298.html", "description": "Improper Validation of Certificate Expiration" }, { "source_name": "cwe", "external_id": "CWE-522", "url": "https://cwe.mitre.org/data/definitions/522.html", "description": "Insufficiently Protected Credentials" }, { "source_name": "mitre-attack", "external_id": "T1552.001", "url": "https://attack.mitre.org/techniques/T1552/001/", "description": "Credentials In Files" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-4", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "S", "D" ], "mds2": [ "NAUT", "SGUD" ], "deck": "The Hospital", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "Which interface credentials are shared across feeds or vendors?", "Who owns each certificate, and who watches its expiry?", "How many interfaces would one leaked secret open?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4cc35c6c-2b1c-5f3f-8639-6c41657a916e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-4 mitigation: Shared interface credentials and certificates", "description": "Each interface has its own managed credentials, with known owners, rotation and expiry monitoring.\n\n1. Issue a distinct credential or certificate per interface and peer, stored in a secrets manager rather than config files.\n2. Track expiry dates centrally and alert well before any certificate lapses.\n3. Rotate interface secrets on schedule and whenever a vendor engineer or integrator leaves.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-4", "mitigation_principle": "Each interface has its own managed credentials, with known owners, rotation and expiry monitoring.", "design_measures": [ "Issue a distinct credential or certificate per interface and peer, stored in a secrets manager rather than config files.", "Track expiry dates centrally and alert well before any certificate lapses.", "Rotate interface secrets on schedule and whenever a vendor engineer or integrator leaves." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e71f1b7f-51cc-596d-a3eb-688e424991c3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4cc35c6c-2b1c-5f3f-8639-6c41657a916e", "target_ref": "attack-pattern--8548555c-4e2c-5f33-ac65-e2a5767399b0" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6729ec3b-0c65-5a99-bf42-52dca0721fcc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Test interfaces wired to production", "description": "Test and training systems are connected to live feeds for convenience. Test orders and dummy results flow into real records, or copies of real patient data sit in test systems with weaker controls.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1269", "url": "https://cwe.mitre.org/data/definitions/1269.html", "description": "Product Released in Non-Release Configuration" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-3", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "T", "I" ], "linddun": [ "DD", "Nc" ], "mds2": [ "DIDT", "SAHD" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Are any test or training systems connected to live feeds?", "Where could test orders reach a real patient's record?", "What real patient data sits in test environments?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c956a2fa-710c-5891-b307-ecb9ac5fc41a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-3 mitigation: Test interfaces wired to production", "description": "Test and live environments are separated, and only synthetic or de-identified data crosses into test.\n\n1. Block network routes between test and production interfaces, and use distinct identifiers that live systems reject.\n2. Use synthetic or de-identified data in test, and approve any exception formally with an expiry date.\n3. Mark test messages clearly and alert if one ever arrives in production.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-3", "mitigation_principle": "Test and live environments are separated, and only synthetic or de-identified data crosses into test.", "design_measures": [ "Block network routes between test and production interfaces, and use distinct identifiers that live systems reject.", "Use synthetic or de-identified data in test, and approve any exception formally with an expiry date.", "Mark test messages clearly and alert if one ever arrives in production." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4425f69e-bb8f-573a-9ea9-42b3cdb9dad7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c956a2fa-710c-5891-b307-ecb9ac5fc41a", "target_ref": "attack-pattern--6729ec3b-0c65-5a99-bf42-52dca0721fcc" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5b550c8c-1e8e-5719-9b3a-25e2c105de13", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patient data in interface logs", "description": "Engines keep full messages in logs, error queues and debug traces for troubleshooting, often for years. Support staff, vendors and anyone with log access can read complete patient records outside the controls of the clinical system.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/#cri-in-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-497", "url": "https://capec.mitre.org/data/definitions/497.html", "description": "File Discovery" }, { "source_name": "cwe", "external_id": "CWE-532", "url": "https://cwe.mitre.org/data/definitions/532.html", "description": "Insertion of Sensitive Information into Log File" }, { "source_name": "cwe", "external_id": "CWE-312", "url": "https://cwe.mitre.org/data/definitions/312.html", "description": "Cleartext Storage of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-2", "group_code": "IN", "group_name": "Integration and Interoperability", "stride": [ "I" ], "linddun": [ "DD", "U", "Nc" ], "mds2": [ "MPII", "STCF", "AUDT" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "How much patient data do engine logs and error queues keep?", "Who can read interface logs, including vendors?", "How long are full messages retained for troubleshooting?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8729a4c5-bc36-5006-9b33-5970f70fd6f3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-IN-2 mitigation: Patient data in interface logs", "description": "Interface logs keep only what troubleshooting needs, for as short a time as possible, under the same protection as the record.\n\n1. Mask or truncate patient identifiers and clinical content in logs by default.\n2. Encrypt error queues and set retention limits that purge resolved messages.\n3. Restrict and audit access to logs, including vendor support access.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-IN-2", "mitigation_principle": "Interface logs keep only what troubleshooting needs, for as short a time as possible, under the same protection as the record.", "design_measures": [ "Mask or truncate patient identifiers and clinical content in logs by default.", "Encrypt error queues and set retention limits that purge resolved messages.", "Restrict and audit access to logs, including vendor support access." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e575ad15-e00d-5c36-bcaa-992fbce17502", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8729a4c5-bc36-5006-9b33-5970f70fd6f3", "target_ref": "attack-pattern--5b550c8c-1e8e-5719-9b3a-25e2c105de13" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--16f9399f-1f52-5fe7-9ac8-12beda6dfc53", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "IN Integration and Interoperability", "description": "HL7 v2, FHIR, DICOM, integration engines, device integration middleware and regional exchange.", "context": "unspecified", "object_refs": [ "attack-pattern--cc005d9e-4fc6-5b94-8301-2e4c4c5deed8", "course-of-action--8d14030d-a1c5-54f5-ae11-f9acf7e54867", "attack-pattern--acf6715c-0691-5d66-8248-6459aff67176", "course-of-action--f1ec9e11-7807-516b-bb76-da08d31b2ef9", "attack-pattern--10d1cdd2-c9f0-514b-9d6e-c98a6f8f17c3", "course-of-action--643b3521-1120-5420-9851-6bf8fefb6239", "attack-pattern--45a4a627-670c-5a4f-98a5-ba4aceef1092", "course-of-action--9a85fb19-ad8f-5f4a-806c-fad7d162e8af", "attack-pattern--d914b986-5b98-5956-9b97-de138e22c906", "course-of-action--7253b0bb-e6fd-541b-ab24-caef1378d98a", "attack-pattern--f83b7528-710f-59f3-b58d-36f26add4ba2", "course-of-action--8bcccc4d-af68-5239-b375-7bd6d79828a9", "attack-pattern--7d646693-1efc-5340-8a81-d513ccc7c451", "course-of-action--fe142ff3-78ab-54fd-94f2-a8804ac7fc49", "attack-pattern--24012cc2-bd8b-57ae-8cd5-bcf91bd2f695", "course-of-action--fceaa329-7d84-5957-ae98-af49829f522c", "attack-pattern--fd87ac62-b993-5063-9807-4592ff935021", "course-of-action--c45bd504-b654-590b-b108-d817f4ba2a52", "attack-pattern--681d7c17-8ac9-58b7-8cb7-5125bf62412f", "course-of-action--f1271914-16d3-5185-99bc-df1e75b4abc5", "attack-pattern--8548555c-4e2c-5f33-ac65-e2a5767399b0", "course-of-action--4cc35c6c-2b1c-5f3f-8639-6c41657a916e", "attack-pattern--6729ec3b-0c65-5a99-bf42-52dca0721fcc", "course-of-action--c956a2fa-710c-5891-b307-ecb9ac5fc41a", "attack-pattern--5b550c8c-1e8e-5719-9b3a-25e2c105de13", "course-of-action--8729a4c5-bc36-5006-9b33-5970f70fd6f3" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-IN", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/integration-and-interoperability/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--52d3c5a6-e0ca-5abe-97d5-2bfb7e3e17de", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Life support on the office network", "description": "Monitors, pumps, ventilators and imaging share flat network segments with office PCs and email. Ransomware or a worm landing on one desktop spreads to clinical devices, which stop or must be pulled off the network mid-care.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "Exploitation of Remote Services" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/", "description": "NAO: Investigation, WannaCry cyber attack and the NHS" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks", "description": "GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-A", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "T", "D", "E" ], "mds2": [ "CONN", "SAHD" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which clinical devices share a segment with office PCs?", "What flows does each clinical segment actually need?", "How would ransomware on one desktop reach a ventilator?" ], "seen_in": [ "WannaCry and the NHS, 2017" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e67393fb-9fae-5038-b6ab-4b7a0365f747", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-A mitigation: Life support on the office network", "description": "Clinical devices sit in segments sized to their safety role, with only the flows they need allowed.\n\n1. Segment medical devices by function and criticality, and permit only documented flows to named systems.\n2. Block office-to-device traffic by default, including file sharing and remote desktop protocols.\n3. Design devices to keep delivering therapy and local alarms when network segments are isolated in an incident.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-A", "mitigation_principle": "Clinical devices sit in segments sized to their safety role, with only the flows they need allowed.", "design_measures": [ "Segment medical devices by function and criticality, and permit only documented flows to named systems.", "Block office-to-device traffic by default, including file sharing and remote desktop protocols.", "Design devices to keep delivering therapy and local alarms when network segments are isolated in an incident." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e85d5dd2-edde-5c86-8d90-9bd9e5a76ad8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e67393fb-9fae-5038-b6ab-4b7a0365f747", "target_ref": "attack-pattern--52d3c5a6-e0ca-5abe-97d5-2bfb7e3e17de" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--85e57f40-d8bd-5ec0-a82b-72adc78581b9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Unpatchable systems inside devices", "description": "Imaging, lab and monitoring devices run frozen, certified builds of old operating systems that cannot be patched or run endpoint protection without the manufacturer. Known, public exploits reach them as soon as anything else on their network is compromised.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-310", "url": "https://capec.mitre.org/data/definitions/310.html", "description": "Scanning for Vulnerable Software" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/", "description": "NAO: Investigation, WannaCry cyber attack and the NHS" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks", "description": "GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-K", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "T", "D", "E" ], "mds2": [ "CSUP", "RDMP", "MLDP" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which devices run operating systems that cannot be patched?", "What network controls compensate for each unpatchable device?", "When is each one due to be replaced?" ], "seen_in": [ "WannaCry and the NHS, 2017" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--91298292-6019-5d26-93a0-7b5ac2d5945a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-K mitigation: Unpatchable systems inside devices", "description": "Devices that cannot be patched are compensated for by the network around them, and replaced on a planned date.\n\n1. Place unpatchable devices behind dedicated enforcement points that allow only their documented protocols.\n2. Require manufacturers to state patch support periods and validated update timelines at procurement.\n3. Monitor these segments for exploit traffic and keep a replacement date on every device record.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-K", "mitigation_principle": "Devices that cannot be patched are compensated for by the network around them, and replaced on a planned date.", "design_measures": [ "Place unpatchable devices behind dedicated enforcement points that allow only their documented protocols.", "Require manufacturers to state patch support periods and validated update timelines at procurement.", "Monitor these segments for exploit traffic and keep a replacement date on every device record." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d6622bd-2eff-5d26-995a-bd28cc9d1248", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--91298292-6019-5d26-93a0-7b5ac2d5945a", "target_ref": "attack-pattern--85e57f40-d8bd-5ec0-a82b-72adc78581b9" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b0a1b58e-4042-5f1f-9cbd-9426e5dfaf6e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telemetry lost without an alarm", "description": "Wireless telemetry and Wi-Fi monitors drop out when the spectrum is jammed, crowded or misconfigured. Ambulatory and cardiac patients go unmonitored while the central station shows stale or missing traces that nobody treats as an alarm.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-601", "url": "https://capec.mitre.org/data/definitions/601.html", "description": "Jamming" }, { "source_name": "capec", "external_id": "CAPEC-604", "url": "https://capec.mitre.org/data/definitions/604.html", "description": "Wi-Fi Jamming" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "Denial of View" }, { "source_name": "mitre-attack", "external_id": "T0829", "url": "https://attack.mitre.org/techniques/T0829/", "description": "Loss of View" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-Q", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "D" ], "mds2": [ "CONN" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Where on site is wireless monitoring coverage weak?", "What raises an alarm when a wireless link drops?", "Who watches the spectrum used by telemetry?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6c2a8044-9e03-54c4-99c3-f5ed712a91d7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-Q mitigation: Telemetry lost without an alarm", "description": "Loss of a wireless monitoring link is itself an alarm, raised locally and centrally.\n\n1. Raise a technical alarm at the bedside and central station whenever a wireless link drops beyond a short threshold.\n2. Survey and manage the spectrum for telemetry bands and clinical Wi-Fi, with interference monitoring in ward areas.\n3. Define which patients cannot be on wireless-only monitoring and plan fallback to wired or observation.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-Q", "mitigation_principle": "Loss of a wireless monitoring link is itself an alarm, raised locally and centrally.", "design_measures": [ "Raise a technical alarm at the bedside and central station whenever a wireless link drops beyond a short threshold.", "Survey and manage the spectrum for telemetry bands and clinical Wi-Fi, with interference monitoring in ward areas.", "Define which patients cannot be on wireless-only monitoring and plan fallback to wired or observation." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--96441c56-d1d1-5893-a269-dad6c77de7f0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6c2a8044-9e03-54c4-99c3-f5ed712a91d7", "target_ref": "attack-pattern--b0a1b58e-4042-5f1f-9cbd-9426e5dfaf6e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fa88a5de-a013-5b1a-850e-41496bcfa8ae", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Clinical systems reachable from the internet", "description": "PACS, device consoles and vendor service ports end up reachable from the internet through misconfigured firewalls, NAT rules or vendor cellular modems. Search engines index them, and anyone can find patient images or a way in.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-292", "url": "https://capec.mitre.org/data/definitions/292.html", "description": "Host Discovery" }, { "source_name": "capec", "external_id": "CAPEC-300", "url": "https://capec.mitre.org/data/definitions/300.html", "description": "Port Scanning" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/", "description": "Exploit Public-Facing Application" }, { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/", "description": "External Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Open PACS servers, 2019", "url": "https://www.helpnetsecurity.com/2019/09/18/confidential-patient-data/", "description": "Help Net Security: Confidential data of 24.3 million patients discovered online" }, { "source_name": "Open PACS servers, 2019", "url": "https://www.hipaajournal.com/update-issued-on-unsecured-pacs-as-exposed-medical-image-total-rises-to-1-19-billion/", "description": "HIPAA Journal: Exposed medical image total rises to 1.19 billion" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-J", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "I", "E" ], "linddun": [ "DD" ], "mds2": [ "CONN", "RMOT" ], "deck": "The Hospital", "rank": "J", "physical_safety": false, "mitigation_prompts": [ "Which clinical systems could be found from the internet today?", "Which vendor modems bypass the hospital firewall?", "When was external exposure last checked, and by whom?" ], "seen_in": [ "Open PACS servers, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3a10163e-9bcb-519e-b292-bec95fb5c676", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-J mitigation: Clinical systems reachable from the internet", "description": "No clinical system is reachable from the internet except through an authenticated, monitored gateway.\n\n1. Scan the hospital's own address ranges from outside regularly and act on any clinical service found.\n2. Ban direct internet exposure of devices and route vendor access through a managed remote-access gateway.\n3. Inventory cellular modems and out-of-band links built into devices and close or monitor them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-J", "mitigation_principle": "No clinical system is reachable from the internet except through an authenticated, monitored gateway.", "design_measures": [ "Scan the hospital's own address ranges from outside regularly and act on any clinical service found.", "Ban direct internet exposure of devices and route vendor access through a managed remote-access gateway.", "Inventory cellular modems and out-of-band links built into devices and close or monitor them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32cc23ff-fe14-536e-90a8-e133bda6d79e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3a10163e-9bcb-519e-b292-bec95fb5c676", "target_ref": "attack-pattern--fa88a5de-a013-5b1a-850e-41496bcfa8ae" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f9e78eac-ec77-50cf-92a2-5794217b6fb3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared network stack flaws", "description": "Many device types embed the same third-party network stack. One flaw in it lets a single malformed packet crash or take over pumps, monitors and imaging from many makers, and nobody knows which devices carry it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-28", "url": "https://capec.mitre.org/data/definitions/28.html", "description": "Fuzzing" }, { "source_name": "cwe", "external_id": "CWE-1395", "url": "https://cwe.mitre.org/data/definitions/1395.html", "description": "Dependency on Vulnerable Third-Party Component" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "Denial of Service" }, { "source_name": "mitre-emb3d", "external_id": "TID-202", "url": "https://emb3d.mitre.org/threats/TID-202.html", "description": "Exploitable System Network Stack Component" }, { "source_name": "mitre-emb3d", "external_id": "TID-405", "url": "https://emb3d.mitre.org/threats/TID-405.html", "description": "Network Stack Resource Exhaustion" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "URGENT/11, 2019", "url": "https://healthcareitnews.com/node/544606", "description": "Healthcare IT News: URGENT/11, FDA issues alert" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-10", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "D", "E" ], "mds2": [ "SBOM", "CSUP", "RDMP" ], "deck": "The Hospital", "rank": "10", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which devices embed the same third-party network stack?", "How quickly could affected devices be shielded on the network?", "Where would you learn about a flaw in that stack?" ], "seen_in": [ "URGENT/11, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f1eae015-c1a0-57e6-a2dd-eca91fb64a84", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-10 mitigation: Shared network stack flaws", "description": "The hospital knows which components each device contains and can shield affected devices quickly.\n\n1. Require SBOMs at procurement and map them against the device inventory so stack flaws resolve to device lists.\n2. Keep network signatures and filtering ready to shield vulnerable device segments within hours.\n3. Require manufacturers to fuzz their network stacks and disclose affected models promptly.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-10", "mitigation_principle": "The hospital knows which components each device contains and can shield affected devices quickly.", "design_measures": [ "Require SBOMs at procurement and map them against the device inventory so stack flaws resolve to device lists.", "Keep network signatures and filtering ready to shield vulnerable device segments within hours.", "Require manufacturers to fuzz their network stacks and disclose affected models promptly." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28ebf60c-62ef-586b-8d2c-677e846de05d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f1eae015-c1a0-57e6-a2dd-eca91fb64a84", "target_ref": "attack-pattern--f9e78eac-ec77-50cf-92a2-5794217b6fb3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--73c5b210-c06e-5896-8a12-60805fdfc122", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Spoofed and shared Wi-Fi", "description": "Medical devices join clinical Wi-Fi with one pre-shared key that never changes and is printed in service manuals. Anyone with the key can join, impersonate the network with an evil twin, or read and alter device traffic.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-616", "url": "https://capec.mitre.org/data/definitions/616.html", "description": "Establish Rogue Location" }, { "source_name": "cwe", "external_id": "CWE-1391", "url": "https://cwe.mitre.org/data/definitions/1391.html", "description": "Use of Weak Credentials" }, { "source_name": "cwe", "external_id": "CWE-322", "url": "https://cwe.mitre.org/data/definitions/322.html", "description": "Key Exchange without Entity Authentication" }, { "source_name": "mitre-attack", "external_id": "T1557.004", "url": "https://attack.mitre.org/techniques/T1557/004/", "description": "Evil Twin" }, { "source_name": "mitre-attack", "external_id": "T0860", "url": "https://attack.mitre.org/techniques/T0860/", "description": "Wireless Compromise" }, { "source_name": "mitre-emb3d", "external_id": "TID-411", "url": "https://emb3d.mitre.org/threats/TID-411.html", "description": "Weak/Insecure Cryptographic Protocol" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-9", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "S", "I", "T" ], "linddun": [ "DD" ], "mds2": [ "NAUT", "TXCF" ], "deck": "The Hospital", "rank": "9", "physical_safety": false, "mitigation_prompts": [ "How do devices authenticate to clinical Wi-Fi?", "When did the pre-shared key last change, and who knows it?", "How would devices detect an evil twin network?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5cd35c4c-5265-5f32-8d70-31ac27f8d9b7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-9 mitigation: Spoofed and shared Wi-Fi", "description": "Devices authenticate to the network individually, and the network authenticates itself to devices.\n\n1. Use certificate-based 802.1X for devices that support it, and per-device keys for those that do not.\n2. Detect rogue and evil-twin access points in clinical areas and contain them.\n3. Rotate any shared keys on staff and vendor departures and remove them from documentation.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-9", "mitigation_principle": "Devices authenticate to the network individually, and the network authenticates itself to devices.", "design_measures": [ "Use certificate-based 802.1X for devices that support it, and per-device keys for those that do not.", "Detect rogue and evil-twin access points in clinical areas and contain them.", "Rotate any shared keys on staff and vendor departures and remove them from documentation." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6357c259-387b-5aaa-a2ac-d9d522efaed8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5cd35c4c-5265-5f32-8d70-31ac27f8d9b7", "target_ref": "attack-pattern--73c5b210-c06e-5896-8a12-60805fdfc122" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--63fbc16f-d619-5208-8305-f3f4dad847b9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No list of connected devices", "description": "Nobody can say which medical devices are on the network, where they are, what software they run or who owns them. Segmentation, patching, incident response and recalls all start by guessing.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-8", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "R" ], "mds2": [ "CONN", "SBOM" ], "deck": "The Hospital", "rank": "8", "physical_safety": false, "mitigation_prompts": [ "Can you list every connected device, its location and owner?", "How is the inventory kept current as devices move?", "How long would a recall search take today?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8e5ee45b-56f2-5820-aaa5-15b3b09fa424", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-8 mitigation: No list of connected devices", "description": "Every connected device is known, with its location, software, owner and risk recorded and kept current.\n\n1. Combine passive network discovery with the clinical engineering asset register and reconcile them continuously.\n2. Record software versions, SBOM, network flows and clinical criticality for every connected device.\n3. Make network connection depend on the device being registered.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-8", "mitigation_principle": "Every connected device is known, with its location, software, owner and risk recorded and kept current.", "design_measures": [ "Combine passive network discovery with the clinical engineering asset register and reconcile them continuously.", "Record software versions, SBOM, network flows and clinical criticality for every connected device.", "Make network connection depend on the device being registered." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9344f98f-8f6a-51cd-b62f-01cf0c5305c1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8e5ee45b-56f2-5820-aaa5-15b3b09fa424", "target_ref": "attack-pattern--63fbc16f-d619-5208-8305-f3f4dad847b9" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e8385de1-bc56-51eb-9e0d-18ccc7d2fb85", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Bluetooth from the corridor", "description": "Bedside and wearable devices accept Bluetooth connections with weak or no pairing. Someone in the corridor or next bed can crash them, read readings or send commands, and flaws in common Bluetooth chips affect many devices at once.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-667", "url": "https://capec.mitre.org/data/definitions/667.html", "description": "Bluetooth Impersonation AttackS (BIAS)" }, { "source_name": "capec", "external_id": "CAPEC-668", "url": "https://capec.mitre.org/data/definitions/668.html", "description": "Key Negotiation of Bluetooth Attack (KNOB)" }, { "source_name": "capec", "external_id": "CAPEC-666", "url": "https://capec.mitre.org/data/definitions/666.html", "description": "BlueSmacking" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-322", "url": "https://cwe.mitre.org/data/definitions/322.html", "description": "Key Exchange without Entity Authentication" }, { "source_name": "mitre-attack", "external_id": "T1011.001", "url": "https://attack.mitre.org/techniques/T1011/001/", "description": "Exfiltration Over Bluetooth" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "mitre-emb3d", "external_id": "TID-408", "url": "https://emb3d.mitre.org/threats/TID-408.html", "description": "Unencrypted Sensitive Data Communication" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.raps.org/resource/fda-warns-of-cybersecurity-vulnerabilities-in-pace.html", "description": "RAPS: FDA warns of cybersecurity vulnerabilities in pacemakers and other BLE devices" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.hpnonline.com/healthcare-it/article/21128449/fda-informs-about-potential-cybersecurity-vulnerabilities-in-certain-medical-devices-with-bluetooth-low-energy", "description": "HPN: FDA informs about potential vulnerabilities in medical devices with Bluetooth Low Energy" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-7", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "S", "T", "D" ], "linddun": [ "DD" ], "mds2": [ "NAUT", "TXCF" ], "deck": "The Hospital", "rank": "7", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which bedside devices accept Bluetooth connections, and how?", "Could someone in the corridor connect to them?", "Which common Bluetooth chips do your devices share?" ], "seen_in": [ "SweynTooth Bluetooth flaws, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--2cbe143c-f4a6-5e75-a600-51fab8a58455", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-7 mitigation: Bluetooth from the corridor", "description": "Bluetooth links to clinical devices are authenticated, encrypted and limited to the intended peer.\n\n1. Require authenticated pairing with numeric comparison or out-of-band exchange, never just-works for therapy devices.\n2. Accept connections only from bonded peers and disable advertising once paired where possible.\n3. Track chipset vulnerabilities through the SBOM and patch or shield affected models.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-7", "mitigation_principle": "Bluetooth links to clinical devices are authenticated, encrypted and limited to the intended peer.", "design_measures": [ "Require authenticated pairing with numeric comparison or out-of-band exchange, never just-works for therapy devices.", "Accept connections only from bonded peers and disable advertising once paired where possible.", "Track chipset vulnerabilities through the SBOM and patch or shield affected models." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e2f6b21-e356-573b-8d87-1e50d997ecff", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2cbe143c-f4a6-5e75-a600-51fab8a58455", "target_ref": "attack-pattern--e8385de1-bc56-51eb-9e0d-18ccc7d2fb85" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a21d315f-b0d3-5659-aabc-b69e1e1f70b8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Clocks and names shared with devices", "description": "Monitors, pumps and the record depend on hospital DNS, DHCP and time servers built for office IT. A failure or spoof misdirects device data or skews timestamps, so trends, alarms and drug timings are recorded out of order.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-142", "url": "https://capec.mitre.org/data/definitions/142.html", "description": "DNS Cache Poisoning" }, { "source_name": "capec", "external_id": "CAPEC-697", "url": "https://capec.mitre.org/data/definitions/697.html", "description": "DHCP Spoofing" }, { "source_name": "cwe", "external_id": "CWE-350", "url": "https://cwe.mitre.org/data/definitions/350.html", "description": "Reliance on Reverse DNS Resolution for a Security-Critical Action" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" }, { "source_name": "mitre-attack", "external_id": "T1557.003", "url": "https://attack.mitre.org/techniques/T1557/003/", "description": "DHCP Spoofing" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-6", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "S", "T", "D" ], "mds2": [ "IGAU", "CONN" ], "deck": "The Hospital", "rank": "6", "physical_safety": false, "mitigation_prompts": [ "Which DNS, DHCP and time servers do devices depend on?", "Are those services redundant and protected from spoofing?", "How would skewed timestamps show up in the record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--59a91597-8d45-5f35-8e14-5220a1060f7d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-6 mitigation: Clocks and names shared with devices", "description": "Clinical devices rely on core network services that are hardened, redundant and authenticated.\n\n1. Provide dedicated, redundant DNS, DHCP and time sources for clinical segments.\n2. Use authenticated time and pinned server addresses for devices that support them.\n3. Alert on clock drift between devices and the record beyond a clinical tolerance.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-6", "mitigation_principle": "Clinical devices rely on core network services that are hardened, redundant and authenticated.", "design_measures": [ "Provide dedicated, redundant DNS, DHCP and time sources for clinical segments.", "Use authenticated time and pinned server addresses for devices that support them.", "Alert on clock drift between devices and the record beyond a clinical tolerance." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6664673c-c9c0-57c1-93ce-3e35debd81f4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--59a91597-8d45-5f35-8e14-5220a1060f7d", "target_ref": "attack-pattern--a21d315f-b0d3-5659-aabc-b69e1e1f70b8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9533fac3-12b2-5c3e-9b3b-42d782f5f86f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Live ports in public areas", "description": "Network ports in patient rooms, waiting areas and corridors are live and give full access to clinical networks. A visitor or patient plugs in a laptop or small device and reaches monitors and records.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-390", "url": "https://capec.mitre.org/data/definitions/390.html", "description": "Bypassing Physical Security" }, { "source_name": "cwe", "external_id": "CWE-1263", "url": "https://cwe.mitre.org/data/definitions/1263.html", "description": "Improper Physical Access Control" }, { "source_name": "mitre-attack", "external_id": "T1200", "url": "https://attack.mitre.org/techniques/T1200/", "description": "Hardware Additions" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-5", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "S", "E" ], "mds2": [ "CONN", "PLOK" ], "deck": "The Hospital", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Which network ports in public areas are live?", "What happens when an unknown device plugs in?", "Could a visitor's laptop reach a monitor or the record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3bea79b9-9427-5cc5-be15-7ea45c32ad6c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-5 mitigation: Live ports in public areas", "description": "Only known, authorised devices can use a network port, and public areas have none that reach clinical networks.\n\n1. Enforce network access control on every port, placing unknown devices in an isolated segment.\n2. Disable unused ports and patch only what each room needs.\n3. Alert on new devices appearing on clinical segments.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-5", "mitigation_principle": "Only known, authorised devices can use a network port, and public areas have none that reach clinical networks.", "design_measures": [ "Enforce network access control on every port, placing unknown devices in an isolated segment.", "Disable unused ports and patch only what each room needs.", "Alert on new devices appearing on clinical segments." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da0aff69-ba7e-554c-b054-88f30c15c64d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3bea79b9-9427-5cc5-be15-7ea45c32ad6c", "target_ref": "attack-pattern--9533fac3-12b2-5c3e-9b3b-42d782f5f86f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e4fe63d4-f0c1-5775-8c62-ca72e7bc3dd6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Location tags leak movements", "description": "Real-time location tags on patients, staff and equipment broadcast identifiers and feed location history to dashboards open to many users. Movements of vulnerable or high-profile patients can be tracked, and spoofed tags send staff looking in the wrong place.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-619", "url": "https://capec.mitre.org/data/definitions/619.html", "description": "Signal Strength Tracking" }, { "source_name": "capec", "external_id": "CAPEC-612", "url": "https://capec.mitre.org/data/definitions/612.html", "description": "WiFi MAC Address Tracking" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-4", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "S", "I" ], "linddun": [ "L", "I", "D", "U" ], "mds2": [ "MPII", "TXCF" ], "deck": "The Hospital", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "Who can see location history from RTLS dashboards?", "What purpose justifies tracking each patient or staff tag?", "How would spoofed tags be detected?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6b4c0b8c-f76f-5197-b146-fb37bddc7d62", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-4 mitigation: Location tags leak movements", "description": "Location data is collected for a stated purpose, protected like clinical data and limited to those who need it.\n\n1. Rotate tag identifiers and encrypt tag transmissions where the technology allows.\n2. Restrict location views by role and keep history only as long as its purpose needs.\n3. Tell patients and staff what is tracked and why.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-4", "mitigation_principle": "Location data is collected for a stated purpose, protected like clinical data and limited to those who need it.", "design_measures": [ "Rotate tag identifiers and encrypt tag transmissions where the technology allows.", "Restrict location views by role and keep history only as long as its purpose needs.", "Tell patients and staff what is tracked and why." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ec9384ba-ce9c-596b-9916-ba369d86acfd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6b4c0b8c-f76f-5197-b146-fb37bddc7d62", "target_ref": "attack-pattern--e4fe63d4-f0c1-5775-8c62-ca72e7bc3dd6" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ce64dce6-e064-55a5-9c9b-8b58cab30ffb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patient and guest Wi-Fi not isolated", "description": "Guest and patient Wi-Fi share infrastructure and routing with clinical networks. A patient's infected laptop, or a device bridging two networks, becomes a path into clinical systems.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T1599", "url": "https://attack.mitre.org/techniques/T1599/", "description": "Network Boundary Bridging" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-3", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "E" ], "mds2": [ "CONN" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "How is guest Wi-Fi separated from clinical networks?", "Could a device bridge guest and clinical networks?", "What shared infrastructure do both networks use?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5c3eb850-3f07-51c3-80e3-dbbb7a81f655", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-3 mitigation: Patient and guest Wi-Fi not isolated", "description": "Guest networks are isolated from clinical networks in design, not only by configuration.\n\n1. Route guest traffic straight to the internet on separate infrastructure or tunnelled VLANs with no internal routes.\n2. Enable client isolation on guest Wi-Fi.\n3. Test isolation after every network change.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-3", "mitigation_principle": "Guest networks are isolated from clinical networks in design, not only by configuration.", "design_measures": [ "Route guest traffic straight to the internet on separate infrastructure or tunnelled VLANs with no internal routes.", "Enable client isolation on guest Wi-Fi.", "Test isolation after every network change." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--868a67bc-0e57-52b8-9e5c-cfed2297f473", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5c3eb850-3f07-51c3-80e3-dbbb7a81f655", "target_ref": "attack-pattern--ce64dce6-e064-55a5-9c9b-8b58cab30ffb" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8c3a37f2-4957-558a-b942-d61813073d1c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Satellite sites trusted completely", "description": "Clinics, community sites and partner buildings connect over links with weaker controls, yet the main network trusts them fully. A compromise at the smallest site reaches the main hospital's devices.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/#cri-nw-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-653", "url": "https://cwe.mitre.org/data/definitions/653.html", "description": "Improper Isolation or Compartmentalization" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-2", "group_code": "NW", "group_name": "Networks and Wireless", "stride": [ "E" ], "mds2": [ "CONN" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "What can a small clinic site reach in the main hospital?", "Which flows from satellite sites are actually required?", "How are controls at the smallest site checked?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--bc3b7634-232a-58f3-9991-d6148b5fcfc4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-NW-2 mitigation: Satellite sites trusted completely", "description": "Every site is treated as its own trust zone, with only required flows allowed into the main hospital.\n\n1. Terminate site links at enforcement points that filter to documented services.\n2. Apply the same device and identity standards at small sites, or limit what they can reach.\n3. Monitor inter-site traffic for unexpected protocols.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-NW-2", "mitigation_principle": "Every site is treated as its own trust zone, with only required flows allowed into the main hospital.", "design_measures": [ "Terminate site links at enforcement points that filter to documented services.", "Apply the same device and identity standards at small sites, or limit what they can reach.", "Monitor inter-site traffic for unexpected protocols." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d238dcac-1b42-549f-b09d-d23c4126b4c0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bc3b7634-232a-58f3-9991-d6148b5fcfc4", "target_ref": "attack-pattern--8c3a37f2-4957-558a-b942-d61813073d1c" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--20802fce-b858-5bbc-8c9f-25eb6222770f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "NW Networks and Wireless", "description": "Segmentation, legacy systems inside devices, Wi-Fi, WMTS telemetry, Bluetooth, RTLS, device inventory and satellite sites.", "context": "unspecified", "object_refs": [ "attack-pattern--52d3c5a6-e0ca-5abe-97d5-2bfb7e3e17de", "course-of-action--e67393fb-9fae-5038-b6ab-4b7a0365f747", "attack-pattern--85e57f40-d8bd-5ec0-a82b-72adc78581b9", "course-of-action--91298292-6019-5d26-93a0-7b5ac2d5945a", "attack-pattern--b0a1b58e-4042-5f1f-9cbd-9426e5dfaf6e", "course-of-action--6c2a8044-9e03-54c4-99c3-f5ed712a91d7", "attack-pattern--fa88a5de-a013-5b1a-850e-41496bcfa8ae", "course-of-action--3a10163e-9bcb-519e-b292-bec95fb5c676", "attack-pattern--f9e78eac-ec77-50cf-92a2-5794217b6fb3", "course-of-action--f1eae015-c1a0-57e6-a2dd-eca91fb64a84", "attack-pattern--73c5b210-c06e-5896-8a12-60805fdfc122", "course-of-action--5cd35c4c-5265-5f32-8d70-31ac27f8d9b7", "attack-pattern--63fbc16f-d619-5208-8305-f3f4dad847b9", "course-of-action--8e5ee45b-56f2-5820-aaa5-15b3b09fa424", "attack-pattern--e8385de1-bc56-51eb-9e0d-18ccc7d2fb85", "course-of-action--2cbe143c-f4a6-5e75-a600-51fab8a58455", "attack-pattern--a21d315f-b0d3-5659-aabc-b69e1e1f70b8", "course-of-action--59a91597-8d45-5f35-8e14-5220a1060f7d", "attack-pattern--9533fac3-12b2-5c3e-9b3b-42d782f5f86f", "course-of-action--3bea79b9-9427-5cc5-be15-7ea45c32ad6c", "attack-pattern--e4fe63d4-f0c1-5775-8c62-ca72e7bc3dd6", "course-of-action--6b4c0b8c-f76f-5197-b146-fb37bddc7d62", "attack-pattern--ce64dce6-e064-55a5-9c9b-8b58cab30ffb", "course-of-action--5c3eb850-3f07-51c3-80e3-dbbb7a81f655", "attack-pattern--8c3a37f2-4957-558a-b942-d61813073d1c", "course-of-action--bc3b7634-232a-58f3-9991-d6148b5fcfc4" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-NW", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/networks-and-wireless/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--38a8a1b5-4e78-5ff5-8435-ecdd696c9c80", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarms that never reach the nurse", "description": "Monitor and pump alarms travel through middleware to nurses' handsets, with no end-to-end confirmation of delivery. When the middleware fails, is misconfigured or is tampered with, alarms vanish while every system shows normal.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-603", "url": "https://capec.mitre.org/data/definitions/603.html", "description": "Blockage" }, { "source_name": "cwe", "external_id": "CWE-392", "url": "https://cwe.mitre.org/data/definitions/392.html", "description": "Missing Report of Error Condition" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "Alarm Suppression" }, { "source_name": "mitre-attack", "external_id": "T0815", "url": "https://attack.mitre.org/techniques/T0815/", "description": "Denial of View" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-A", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "T", "D", "R" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How is delivery of an alarm to a handset confirmed?", "What happens when an alarm is not acknowledged in time?", "Would anyone notice the middleware had stopped forwarding alarms?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--cdae9c91-d091-54ab-bed4-97faf0975614", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-A mitigation: Alarms that never reach the nurse", "description": "Every clinical alarm is confirmed as delivered and acknowledged, and escalates when it is not.\n\n1. Require acknowledgement within a set time and escalate unacknowledged alarms to another clinician and the central station.\n2. Monitor the middleware with end-to-end test alarms and alert on any failure to deliver.\n3. Keep audible bedside and central alarms active as a backstop whatever the middleware does.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-A", "mitigation_principle": "Every clinical alarm is confirmed as delivered and acknowledged, and escalates when it is not.", "design_measures": [ "Require acknowledgement within a set time and escalate unacknowledged alarms to another clinician and the central station.", "Monitor the middleware with end-to-end test alarms and alert on any failure to deliver.", "Keep audible bedside and central alarms active as a backstop whatever the middleware does." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23168f46-baa1-517c-96ba-6d6e49c3513e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cdae9c91-d091-54ab-bed4-97faf0975614", "target_ref": "attack-pattern--38a8a1b5-4e78-5ff5-8435-ecdd696c9c80" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--96800aef-b864-50a4-8b55-7499899822dc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Crash calls on one platform", "description": "The cardiac arrest and rapid response call path runs on the same IP telephony and network as everything else. When ransomware or an outage takes it down, staff cannot summon the resuscitation team.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-603", "url": "https://capec.mitre.org/data/definitions/603.html", "description": "Blockage" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "mitre-attack", "external_id": "T1498", "url": "https://attack.mitre.org/techniques/T1498/", "description": "Network Denial of Service" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-K", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "D" ], "mds2": [ "DTBK", "CONN" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What carries a crash call from the handset to every team bleep?", "How does the caller know the team was reached?", "What is the fallback, and when was it last tested?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--94ffd421-b0d1-5c81-bf6d-d6f1c45a39f2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-K mitigation: Crash calls on one platform", "description": "Emergency call paths have an independent fallback that works when the main network and telephony are down.\n\n1. Provide an independent backup for crash and emergency calls, such as dedicated lines, radios or hard-wired alarms.\n2. Test the emergency call path daily, end to end, and log the result.\n3. Train staff on the downtime method and display it at every call point.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-K", "mitigation_principle": "Emergency call paths have an independent fallback that works when the main network and telephony are down.", "design_measures": [ "Provide an independent backup for crash and emergency calls, such as dedicated lines, radios or hard-wired alarms.", "Test the emergency call path daily, end to end, and log the result.", "Train staff on the downtime method and display it at every call point." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2c481c4a-cb5b-5192-91fb-f37503f91781", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--94ffd421-b0d1-5c81-bf6d-d6f1c45a39f2", "target_ref": "attack-pattern--96800aef-b864-50a4-8b55-7499899822dc" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1341f338-c435-5088-bdc6-9682b381519c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nurse call failing silently", "description": "IP nurse call systems sit on shared networks with default settings. A fault or attack stops patient calls from reaching staff, or marks them answered, and patients who cannot leave their bed have no other way to get help.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-176", "url": "https://capec.mitre.org/data/definitions/176.html", "description": "Configuration/Environment Manipulation" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "Denial of Service" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-Q", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "T", "D" ], "mds2": [ "SAHD", "CONN" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How would staff know nurse call had stopped working?", "What does a patient who can't leave the bed do if it fails?", "Who monitors nurse call as a safety system?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--cdd2fa31-34b4-50cf-86b0-91c42554d891", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-Q mitigation: Nurse call failing silently", "description": "Nurse call is designed and monitored as a patient-safety system with a known fallback.\n\n1. Supervise every call point and alert on lost connections or stuck states.\n2. Isolate nurse call on its own segment and harden its servers and default accounts.\n3. Define ward procedures, such as increased rounding, for when nurse call is degraded.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-Q", "mitigation_principle": "Nurse call is designed and monitored as a patient-safety system with a known fallback.", "design_measures": [ "Supervise every call point and alert on lost connections or stuck states.", "Isolate nurse call on its own segment and harden its servers and default accounts.", "Define ward procedures, such as increased rounding, for when nurse call is degraded." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e4dc0b8c-d377-5e3f-b6e0-f4b404768722", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cdd2fa31-34b4-50cf-86b0-91c42554d891", "target_ref": "attack-pattern--1341f338-c435-5088-bdc6-9682b381519c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a25a7eb7-97ec-55d5-8552-8d0ddd2c1e42", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "False alarms and fake calls", "description": "Handsets and paging accept alarms and messages from anything that can reach the messaging gateway. Injected false alarms or fake emergency calls send staff to the wrong bed, mask real alarms and wear down trust in the system.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-J", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "S", "T" ], "mds2": [ "NAUT", "TXIG" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which systems can send alarms or calls to handsets?", "Can staff see where an alarm or emergency call came from?", "How would injected false alarms be spotted and stopped?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4f54f759-8e62-5d09-85f1-992295193ca9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-J mitigation: False alarms and fake calls", "description": "Only authenticated systems can raise alarms and emergency calls, and staff can see where each came from.\n\n1. Authenticate every system that can send to the alarm and messaging gateway, and reject the rest.\n2. Show the source device, location and patient on every alarm so staff can judge it quickly.\n3. Alert on unusual alarm volumes or sources.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-J", "mitigation_principle": "Only authenticated systems can raise alarms and emergency calls, and staff can see where each came from.", "design_measures": [ "Authenticate every system that can send to the alarm and messaging gateway, and reject the rest.", "Show the source device, location and patient on every alarm so staff can judge it quickly.", "Alert on unusual alarm volumes or sources." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb07c15d-38d5-51be-823b-77a3b398e9a4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4f54f759-8e62-5d09-85f1-992295193ca9", "target_ref": "attack-pattern--a25a7eb7-97ec-55d5-8552-8d0ddd2c1e42" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--50744542-137c-577a-84c3-963dfd1fa522", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pages read and spoofed by radio", "description": "Pagers and bleeps carry patient names, conditions and locations unencrypted over radio. Anyone with a cheap receiver can read them, and anyone with a transmitter can send pages that look genuine.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-157", "url": "https://capec.mitre.org/data/definitions/157.html", "description": "Sniffing Attacks" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "mitre-attack", "external_id": "T1040", "url": "https://attack.mitre.org/techniques/T1040/", "description": "Network Sniffing" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "Leaking Beeps, 2016", "url": "https://documents.trendmicro.com/assets/threat-reports/wp-leaking-beeps-healthcare.pdf", "description": "Trend Micro: Leaking Beeps, unencrypted pager messages in the healthcare industry" }, { "source_name": "Leaking Beeps, 2016", "url": "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/are-pagers-leaking-your-patients-phi", "description": "Trend Micro: Are pagers leaking your patients' PHI?" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-10", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "S", "I" ], "linddun": [ "DD", "I" ], "mds2": [ "TXCF", "TXIG" ], "deck": "The Hospital", "rank": "10", "physical_safety": false, "mitigation_prompts": [ "What patient details appear in pager messages?", "Could a cheap receiver read your hospital's pages?", "How would a spoofed page be told from a genuine one?" ], "seen_in": [ "Leaking Beeps, 2016" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--228c59a6-44b6-5749-8c1d-aa30204e5291", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-10 mitigation: Pages read and spoofed by radio", "description": "Paging carries no patient-identifiable data in the clear, and pages that start clinical action are authenticated.\n\n1. Move clinical paging to encrypted, authenticated messaging, or strip patient details from pages.\n2. Use pages only as a call-back prompt, with clinical detail given on a verified channel.\n3. Plan retirement of unencrypted paging, keeping a resilient alert method in its place.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-10", "mitigation_principle": "Paging carries no patient-identifiable data in the clear, and pages that start clinical action are authenticated.", "design_measures": [ "Move clinical paging to encrypted, authenticated messaging, or strip patient details from pages.", "Use pages only as a call-back prompt, with clinical detail given on a verified channel.", "Plan retirement of unencrypted paging, keeping a resilient alert method in its place." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--76e89473-56d2-51af-9ace-8a083b31f477", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--228c59a6-44b6-5749-8c1d-aa30204e5291", "target_ref": "attack-pattern--50744542-137c-577a-84c3-963dfd1fa522" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f492e5d8-7620-5cac-886e-048ccc3d1498", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Clinical care on consumer messaging", "description": "When official tools are slow, clinicians share patient photos, results and decisions in consumer messaging groups on personal phones. Data sits outside the record and the hospital, with no audit, retention or way to remove it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-545", "url": "https://capec.mitre.org/data/definitions/545.html", "description": "Pull Data from System Resources" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-213", "url": "https://cwe.mitre.org/data/definitions/213.html", "description": "Exposure of Sensitive Information Due to Incompatible Policies" }, { "source_name": "mitre-attack", "external_id": "T1213.005", "url": "https://attack.mitre.org/techniques/T1213/005/", "description": "Messaging Applications" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-9", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "I", "R" ], "linddun": [ "DD", "U", "Nc" ], "mds2": [ "MPII", "STCF" ], "deck": "The Hospital", "rank": "9", "physical_safety": false, "mitigation_prompts": [ "Why do clinicians reach for consumer messaging instead?", "How do decisions made in messages reach the record?", "What happens to patient photos on personal phones?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--100159eb-3738-532a-a428-bd4740c3536f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-9 mitigation: Clinical care on consumer messaging", "description": "Official clinical messaging is quicker than the shadow alternative, and decisions made in it reach the record.\n\n1. Provide an approved secure messaging app that handles photos and groups as easily as consumer apps.\n2. Write messaging decisions back to the record automatically or prompt for it.\n3. Set clear guidance, and remove clinical content from personal devices when staff leave.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-9", "mitigation_principle": "Official clinical messaging is quicker than the shadow alternative, and decisions made in it reach the record.", "design_measures": [ "Provide an approved secure messaging app that handles photos and groups as easily as consumer apps.", "Write messaging decisions back to the record automatically or prompt for it.", "Set clear guidance, and remove clinical content from personal devices when staff leave." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1e0c0aaf-be0b-5727-bd2a-00ddc784d525", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--100159eb-3738-532a-a428-bd4740c3536f", "target_ref": "attack-pattern--f492e5d8-7620-5cac-886e-048ccc3d1498" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3e761c1a-4ca5-5475-95d1-f1795e0e2cc3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Impersonating a clinician by message", "description": "Secure messaging trusts the display name. Anyone with a hijacked account, or a lookalike profile, can send orders, ask for results or request a change in treatment, and the recipient acts on it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-98", "url": "https://capec.mitre.org/data/definitions/98.html", "description": "Phishing" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "mitre-attack", "external_id": "T1566.003", "url": "https://attack.mitre.org/techniques/T1566/003/", "description": "Spearphishing via Service" }, { "source_name": "mitre-attack", "external_id": "T1534", "url": "https://attack.mitre.org/techniques/T1534/", "description": "Internal Spearphishing" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-8", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "S", "R" ], "mds2": [ "PAUT", "AUTH" ], "deck": "The Hospital", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does a recipient verify who sent a clinical message?", "Which requests need confirming on a second channel?", "What could a hijacked messaging account ask for?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b15e53b4-fa00-5513-b5ff-00dd07bcd783", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-8 mitigation: Impersonating a clinician by message", "description": "Clinical instructions sent by message come from verified identities, and high-risk requests are confirmed on a second channel.\n\n1. Tie messaging accounts to verified staff identity, with phishing-resistant authentication.\n2. Show role and verification status clearly, and flag external or newly created accounts.\n3. Require a call-back or order entry for high-risk instructions such as drug or dose changes.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-8", "mitigation_principle": "Clinical instructions sent by message come from verified identities, and high-risk requests are confirmed on a second channel.", "design_measures": [ "Tie messaging accounts to verified staff identity, with phishing-resistant authentication.", "Show role and verification status clearly, and flag external or newly created accounts.", "Require a call-back or order entry for high-risk instructions such as drug or dose changes." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e84fe4fd-f6ff-5d4f-b981-8bbf87814afc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b15e53b4-fa00-5513-b5ff-00dd07bcd783", "target_ref": "attack-pattern--3e761c1a-4ca5-5475-95d1-f1795e0e2cc3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ad6cdfa9-faf3-5add-8c85-5e5001f4f2a5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Switchboard and rota as weak link", "description": "Switchboard, on-call rotas and contact directories decide who gets called. A tampered rota or a convincing caller sends emergency calls to the wrong person, or obtains direct numbers and patient whereabouts.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-415", "url": "https://capec.mitre.org/data/definitions/415.html", "description": "Pretexting via Phone" }, { "source_name": "capec", "external_id": "CAPEC-407", "url": "https://capec.mitre.org/data/definitions/407.html", "description": "Pretexting" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" }, { "source_name": "mitre-attack", "external_id": "T1566.004", "url": "https://attack.mitre.org/techniques/T1566/004/", "description": "Spearphishing Voice" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-7", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "S", "T" ], "linddun": [ "DD" ], "mds2": [ "AUTH", "AUDT" ], "deck": "The Hospital", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can edit on-call rotas and the staff directory?", "What verification does switchboard apply to unusual callers?", "How would a tampered rota be noticed during the night?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--da437092-d425-5d52-80ab-daf63bf15eaf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-7 mitigation: Switchboard and rota as weak link", "description": "Rotas and directories are controlled data, and switchboard follows verification scripts.\n\n1. Restrict and log edits to on-call rotas and contact directories, with change alerts to the owning team.\n2. Give switchboard staff verification scripts for requests about patients or staff.\n3. Check critical rotas automatically against expected coverage before each shift.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-7", "mitigation_principle": "Rotas and directories are controlled data, and switchboard follows verification scripts.", "design_measures": [ "Restrict and log edits to on-call rotas and contact directories, with change alerts to the owning team.", "Give switchboard staff verification scripts for requests about patients or staff.", "Check critical rotas automatically against expected coverage before each shift." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--800dbcec-1761-5ca0-a68c-58ad06f9a8fc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--da437092-d425-5d52-80ab-daf63bf15eaf", "target_ref": "attack-pattern--ad6cdfa9-faf3-5add-8c85-5e5001f4f2a5" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1b3c83b7-b7eb-5329-abc9-863ffccfe0f1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Shared handsets with no owner", "description": "Ward handsets are passed between staff without login. Whoever holds one sees patient alarms and messages and can acknowledge them, and there is no record of who did.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-1463", "url": "https://cwe.mitre.org/data/definitions/1463.html", "description": "Insufficient Session Timeout Value" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-6", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "S", "R", "I" ], "linddun": [ "DD", "Nr" ], "mds2": [ "PAUT", "ALOF", "AUDT" ], "deck": "The Hospital", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How do you know who held a handset when an alarm was acknowledged?", "Do staff sign in to ward handsets at handover?", "What can someone holding a spare handset see and do?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--570d8a12-08d6-598e-ab55-5f9688589f8e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-6 mitigation: Shared handsets with no owner", "description": "Each alarm acknowledgement is tied to the person holding the handset at the time.\n\n1. Require quick sign-in to handsets at shift start, by badge or code, and sign out on dock.\n2. Record who acknowledged every alarm and message.\n3. Hide message content on the lock screen and wipe handsets on return.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-6", "mitigation_principle": "Each alarm acknowledgement is tied to the person holding the handset at the time.", "design_measures": [ "Require quick sign-in to handsets at shift start, by badge or code, and sign out on dock.", "Record who acknowledged every alarm and message.", "Hide message content on the lock screen and wipe handsets on return." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--deb09b37-40b5-58e5-827f-3c50d197560b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--570d8a12-08d6-598e-ab55-5f9688589f8e", "target_ref": "attack-pattern--1b3c83b7-b7eb-5329-abc9-863ffccfe0f1" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--94be8d05-0829-5b49-aaa4-d84079d4895a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Overhead paging hijacked", "description": "Overhead paging and public address systems are now IP-based and reachable from the wider network. A false emergency code or evacuation announcement can cause panic or disrupt care across a site.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-5", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "S", "D" ], "mds2": [ "AUTH", "CONN" ], "deck": "The Hospital", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Which consoles and systems can trigger overhead announcements?", "How is an emergency announcement authenticated?", "What would a false evacuation code cost the site?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--409060df-2219-5782-98a5-624ea48ac399", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-5 mitigation: Overhead paging hijacked", "description": "Public address is reachable only from authorised consoles, and emergency announcements need authenticated sources.\n\n1. Isolate the PA system and permit only named consoles to broadcast.\n2. Require authentication for emergency and evacuation announcements.\n3. Log every broadcast and alert on unexpected sources.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-5", "mitigation_principle": "Public address is reachable only from authorised consoles, and emergency announcements need authenticated sources.", "design_measures": [ "Isolate the PA system and permit only named consoles to broadcast.", "Require authentication for emergency and evacuation announcements.", "Log every broadcast and alert on unexpected sources." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4df4c981-296e-5f8f-a08a-501e05b5fac8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--409060df-2219-5782-98a5-624ea48ac399", "target_ref": "attack-pattern--94be8d05-0829-5b49-aaa4-d84079d4895a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8376007e-c5fb-511a-8a38-327a8ee2d3aa", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Clinical apps on personal phones", "description": "Staff run clinical messaging and record apps on their own phones without device management. Lost or shared phones expose patient data on lock screens, in backups and in notifications.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-507", "url": "https://capec.mitre.org/data/definitions/507.html", "description": "Physical Theft" }, { "source_name": "cwe", "external_id": "CWE-312", "url": "https://cwe.mitre.org/data/definitions/312.html", "description": "Cleartext Storage of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-4", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "I" ], "linddun": [ "DD" ], "mds2": [ "STCF", "ALOF" ], "deck": "The Hospital", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "What patient data shows on lock screens and notifications?", "Do clinical apps protect their data on unmanaged phones?", "What happens to app data when a phone is lost?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--09bfff0a-b2a9-5cde-8153-627837fe497d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-4 mitigation: Clinical apps on personal phones", "description": "Clinical apps protect their own data, whatever device they run on.\n\n1. Use app-level protection: separate PIN, encrypted storage and remote wipe of app data.\n2. Hide clinical content from notifications and exclude it from personal backups.\n3. Require a minimum operating system version and screen lock to run clinical apps.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-4", "mitigation_principle": "Clinical apps protect their own data, whatever device they run on.", "design_measures": [ "Use app-level protection: separate PIN, encrypted storage and remote wipe of app data.", "Hide clinical content from notifications and exclude it from personal backups.", "Require a minimum operating system version and screen lock to run clinical apps." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--818d8a15-2b69-5568-b98e-40bb63b3c359", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--09bfff0a-b2a9-5cde-8153-627837fe497d", "target_ref": "attack-pattern--8376007e-c5fb-511a-8a38-327a8ee2d3aa" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--998cc892-6d50-5ed6-9250-ed5b1ba18edc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Status boards in public view", "description": "Electronic whiteboards and patient status screens show names, diagnoses and risks where visitors can see them, and some can be edited from any ward PC without login.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-699", "url": "https://capec.mitre.org/data/definitions/699.html", "description": "Eavesdropping on a Monitor" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-3", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "I", "T" ], "linddun": [ "DD", "I" ], "mds2": [ "MPII", "AUTH" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "What do status boards show that visitors can read?", "Who can edit a status board, and is a login required?", "Which details could be removed without hurting care?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--84085ea1-bdb4-5420-8e34-117dc8d21745", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-3 mitigation: Status boards in public view", "description": "Status displays show only what the audience needs, and edits are authenticated.\n\n1. Use initials or bed numbers on displays visible to the public.\n2. Require authenticated edits and log changes to patient status.\n3. Position screens and set privacy modes by location.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-3", "mitigation_principle": "Status displays show only what the audience needs, and edits are authenticated.", "design_measures": [ "Use initials or bed numbers on displays visible to the public.", "Require authenticated edits and log changes to patient status.", "Position screens and set privacy modes by location." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2817d342-cb3d-554b-849f-56debf94d3fd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--84085ea1-bdb4-5420-8e34-117dc8d21745", "target_ref": "attack-pattern--998cc892-6d50-5ed6-9250-ed5b1ba18edc" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--abd3a90c-c2a7-52a7-8fdd-0b51b7eb99f0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Recordings with clinical detail", "description": "Call recordings, voicemail and message archives hold clinical conversations, kept indefinitely and readable by telephony administrators and suppliers.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/#cri-cc-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-545", "url": "https://capec.mitre.org/data/definitions/545.html", "description": "Pull Data from System Resources" }, { "source_name": "cwe", "external_id": "CWE-312", "url": "https://cwe.mitre.org/data/definitions/312.html", "description": "Cleartext Storage of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1123", "url": "https://attack.mitre.org/techniques/T1123/", "description": "Audio Capture" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-2", "group_code": "CC", "group_name": "Clinical Communications", "stride": [ "I" ], "linddun": [ "DD", "Nc" ], "mds2": [ "STCF", "MPII" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "How long are call recordings and voicemail kept?", "Who can listen to archived clinical conversations?", "Do suppliers have access to communication archives?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--78154757-a8b3-53ac-92de-b8dd66afd56c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CC-2 mitigation: Recordings with clinical detail", "description": "Communications records are kept for a defined purpose and period, under clinical data protection.\n\n1. Set retention limits for recordings and archives and purge on schedule.\n2. Encrypt recordings and limit access by role, with audit.\n3. Include telephony suppliers in data protection agreements.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CC-2", "mitigation_principle": "Communications records are kept for a defined purpose and period, under clinical data protection.", "design_measures": [ "Set retention limits for recordings and archives and purge on schedule.", "Encrypt recordings and limit access by role, with audit.", "Include telephony suppliers in data protection agreements." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--519b6477-f7e5-5fc9-8049-7625d816afcf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--78154757-a8b3-53ac-92de-b8dd66afd56c", "target_ref": "attack-pattern--abd3a90c-c2a7-52a7-8fdd-0b51b7eb99f0" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--fbbcff55-b901-5de7-967b-209073f6053c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CC Clinical Communications", "description": "Nurse call, alarm routing to handsets, pagers and bleeps, DECT and Wi-Fi phones, secure and shadow messaging, crash calls, switchboard and overhead paging.", "context": "unspecified", "object_refs": [ "attack-pattern--38a8a1b5-4e78-5ff5-8435-ecdd696c9c80", "course-of-action--cdae9c91-d091-54ab-bed4-97faf0975614", "attack-pattern--96800aef-b864-50a4-8b55-7499899822dc", "course-of-action--94ffd421-b0d1-5c81-bf6d-d6f1c45a39f2", "attack-pattern--1341f338-c435-5088-bdc6-9682b381519c", "course-of-action--cdd2fa31-34b4-50cf-86b0-91c42554d891", "attack-pattern--a25a7eb7-97ec-55d5-8552-8d0ddd2c1e42", "course-of-action--4f54f759-8e62-5d09-85f1-992295193ca9", "attack-pattern--50744542-137c-577a-84c3-963dfd1fa522", "course-of-action--228c59a6-44b6-5749-8c1d-aa30204e5291", "attack-pattern--f492e5d8-7620-5cac-886e-048ccc3d1498", "course-of-action--100159eb-3738-532a-a428-bd4740c3536f", "attack-pattern--3e761c1a-4ca5-5475-95d1-f1795e0e2cc3", "course-of-action--b15e53b4-fa00-5513-b5ff-00dd07bcd783", "attack-pattern--ad6cdfa9-faf3-5add-8c85-5e5001f4f2a5", "course-of-action--da437092-d425-5d52-80ab-daf63bf15eaf", "attack-pattern--1b3c83b7-b7eb-5329-abc9-863ffccfe0f1", "course-of-action--570d8a12-08d6-598e-ab55-5f9688589f8e", "attack-pattern--94be8d05-0829-5b49-aaa4-d84079d4895a", "course-of-action--409060df-2219-5782-98a5-624ea48ac399", "attack-pattern--8376007e-c5fb-511a-8a38-327a8ee2d3aa", "course-of-action--09bfff0a-b2a9-5cde-8153-627837fe497d", "attack-pattern--998cc892-6d50-5ed6-9250-ed5b1ba18edc", "course-of-action--84085ea1-bdb4-5420-8e34-117dc8d21745", "attack-pattern--abd3a90c-c2a7-52a7-8fdd-0b51b7eb99f0", "course-of-action--78154757-a8b3-53ac-92de-b8dd66afd56c" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-CC", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/clinical-communications/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--36d944fd-cc37-5f2a-83da-d693fdc3d687", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Dispatch links fail without warning", "description": "Ambulance dispatch, hospital status and handover links run over one integration path that nobody monitors end to end. When it fails or is taken down, crews and emergency departments keep working from stale information, ambulances queue or go to the wrong place, and no one notices until patients are harmed.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-582", "url": "https://capec.mitre.org/data/definitions/582.html", "description": "Route Disabling" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-1320", "url": "https://cwe.mitre.org/data/definitions/1320.html", "description": "Improper Protection for Outbound Error Messages and Alert Signals" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "mitre-attack", "external_id": "T1498", "url": "https://attack.mitre.org/techniques/T1498/", "description": "Network Denial of Service" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Advanced and NHS 111, 2022", "url": "https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/", "description": "ICO: Software provider fined £3m following 2022 ransomware attack" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-A", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "D" ], "mds2": [ "DTBK", "CONN" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who monitors the dispatch link to the hospital end to end?", "How would both control rooms know the link had gone quiet?", "What fallback for status and pre-alerts shares none of its failure?" ], "seen_in": [ "Advanced and NHS 111, 2022" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b7a27ab5-9361-535e-9a95-47581f03484e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-A mitigation: Dispatch links fail without warning", "description": "Every link between dispatch and the hospital is monitored end to end and has a rehearsed fallback that does not share its failure.\n\n1. Send heartbeat messages across each dispatch and handover link and alarm in both control rooms when one goes quiet.\n2. Keep a voice and radio fallback for status and pre-alerts on separate infrastructure, with numbers held offline.\n3. Rehearse loss of the dispatch link jointly with the ambulance service at least yearly, including the switch back.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-A", "mitigation_principle": "Every link between dispatch and the hospital is monitored end to end and has a rehearsed fallback that does not share its failure.", "design_measures": [ "Send heartbeat messages across each dispatch and handover link and alarm in both control rooms when one goes quiet.", "Keep a voice and radio fallback for status and pre-alerts on separate infrastructure, with numbers held offline.", "Rehearse loss of the dispatch link jointly with the ambulance service at least yearly, including the switch back." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--49f2f620-d021-5d15-9b4e-031d855f9c78", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b7a27ab5-9361-535e-9a95-47581f03484e", "target_ref": "attack-pattern--36d944fd-cc37-5f2a-83da-d693fdc3d687" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--60b8e427-8bd9-5479-8acc-08e94d32f21c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Diversion status falsified or stale", "description": "Regional capacity and diversion boards accept status changes from any logged-in user or unauthenticated feed. A false closed sends ambulances past the nearest capable hospital; a false open sends a stroke or trauma patient to a hospital whose scanner or theatre is down.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "University Hospital Düsseldorf, 2020", "url": "https://www.technologyreview.com/2020/09/18/1008582/a-patient-has-died-after-ransomware-hackers-hit-a-german-hospital", "description": "MIT Technology Review: A patient has died after ransomware hackers hit a German hospital" }, { "source_name": "University Hospital Düsseldorf, 2020", "url": "https://borncity.com/win/2020/11/18/ransomware-befall-in-uniklinik-dsseldorf-nicht-fr-todesfall-verantwortlich/", "description": "Born's Tech and Windows World: ransomware at Uniklinik Düsseldorf not responsible for death" }, { "source_name": "Ascension, 2024", "url": "https://www.bleepingcomputer.com/news/security/ascension-health-data-of-56-million-stolen-in-ransomware-attack/", "description": "BleepingComputer: Ascension health data of 5.6 million stolen in ransomware attack" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-K", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "T", "R" ], "mds2": [ "AUTH", "AUDT", "IGAU" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who can change a hospital's diversion status, and how is it confirmed?", "Does the board show how old each status is?", "What happens when a status feed is unauthenticated or stale?" ], "seen_in": [ "University Hospital Düsseldorf, 2020", "Ascension, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--87770f57-61f3-5d9f-8d63-1106d855d812", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-K mitigation: Diversion status falsified or stale", "description": "Diversion status is changed only by named, authorised people, is confirmed out of band, and shows its age.\n\n1. Require named authentication and a second confirmation by phone before a hospital's diversion status changes.\n2. Show the time and author of every status change on the board, and mark status older than a set period as stale.\n3. Publish service-level status (CT, cath lab, theatres) separately from whole-site diversion so crews route by capability.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-K", "mitigation_principle": "Diversion status is changed only by named, authorised people, is confirmed out of band, and shows its age.", "design_measures": [ "Require named authentication and a second confirmation by phone before a hospital's diversion status changes.", "Show the time and author of every status change on the board, and mark status older than a set period as stale.", "Publish service-level status (CT, cath lab, theatres) separately from whole-site diversion so crews route by capability." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0f6b73f-b6f8-5d61-afb5-a5616c2d2070", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--87770f57-61f3-5d9f-8d63-1106d855d812", "target_ref": "attack-pattern--60b8e427-8bd9-5479-8acc-08e94d32f21c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--16a25aea-9b9a-5207-91cb-9d624747eede", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Prehospital ECG and pre-alert tampered", "description": "Twelve-lead ECGs and stroke or trauma pre-alerts travel from the ambulance to the hospital by fax, email, messaging or a vendor cloud without integrity or patient binding. An altered, delayed or misattributed tracing means the cath lab or stroke team is not activated, or is activated for the wrong patient.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-94", "url": "https://capec.mitre.org/data/definitions/94.html", "description": "Adversary in the Middle (AiTM)" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "cwe", "external_id": "CWE-319", "url": "https://cwe.mitre.org/data/definitions/319.html", "description": "Cleartext Transmission of Sensitive Information" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1557", "url": "https://attack.mitre.org/techniques/T1557/", "description": "Adversary-in-the-Middle" }, { "source_name": "mitre-emb3d", "external_id": "TID-408", "url": "https://emb3d.mitre.org/threats/TID-408.html", "description": "Unencrypted Sensitive Data Communication" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-Q", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "T", "I" ], "linddun": [ "L", "DD" ], "mds2": [ "TXIG", "TXCF", "NAUT" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How is a prehospital ECG bound to the right patient and incident?", "Who confirms that a pre-alert has actually arrived?", "Which routes carry tracings: fax, email, messaging or vendor cloud?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5f9acdad-1705-50f5-b875-00172b6cc28d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-Q mitigation: Prehospital ECG and pre-alert tampered", "description": "Prehospital clinical data is signed at source, bound to the patient and incident, and its delivery is confirmed by a person.\n\n1. Sign ECGs on the monitor or gateway and verify the signature before display in the hospital.\n2. Bind each transmission to an incident number and patient identifiers, and show both prominently to the receiving clinician.\n3. Require a spoken acknowledgement of time-critical pre-alerts and alarm the crew when none arrives in time.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-Q", "mitigation_principle": "Prehospital clinical data is signed at source, bound to the patient and incident, and its delivery is confirmed by a person.", "design_measures": [ "Sign ECGs on the monitor or gateway and verify the signature before display in the hospital.", "Bind each transmission to an incident number and patient identifiers, and show both prominently to the receiving clinician.", "Require a spoken acknowledgement of time-critical pre-alerts and alarm the crew when none arrives in time." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--720fcb72-cac9-54df-8a9e-468ad10aef4b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5f9acdad-1705-50f5-b875-00172b6cc28d", "target_ref": "attack-pattern--16a25aea-9b9a-5207-91cb-9d624747eede" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bab17ff4-0271-52b1-872f-26d076a0299f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Emergency services radio jammed or spoofed", "description": "Ambulance crews rely on one radio system for clinical advice, backup and handover, with no tested alternative. Jamming, a rogue transmitter or loss of the radio core leaves crews unable to call for help or receive changed instructions, and spoofed traffic can send them to false incidents.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-601", "url": "https://capec.mitre.org/data/definitions/601.html", "description": "Jamming" }, { "source_name": "capec", "external_id": "CAPEC-599", "url": "https://capec.mitre.org/data/definitions/599.html", "description": "Terrestrial Jamming" }, { "source_name": "capec", "external_id": "CAPEC-605", "url": "https://capec.mitre.org/data/definitions/605.html", "description": "Cellular Jamming" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-J", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "D" ], "mds2": [ "CONN" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What second way do crews have to reach control?", "How is a radio instruction that changes destination verified?", "What would crews do if the radio core went down?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b781804d-0bd2-5210-b109-a159a9a3d598", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-J mitigation: Emergency services radio jammed or spoofed", "description": "Crews keep at least two independent ways to reach control, and voice instructions that change a destination are verified.\n\n1. Provide a second bearer, such as cellular with priority access or satellite, that does not share the radio core or sites.\n2. Detect and report interference by monitoring receiver noise at base sites and from vehicles.\n3. Verify destination changes received by voice through the vehicle's data terminal or a call-back procedure.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-J", "mitigation_principle": "Crews keep at least two independent ways to reach control, and voice instructions that change a destination are verified.", "design_measures": [ "Provide a second bearer, such as cellular with priority access or satellite, that does not share the radio core or sites.", "Detect and report interference by monitoring receiver noise at base sites and from vehicles.", "Verify destination changes received by voice through the vehicle's data terminal or a call-back procedure." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--def8afa1-adb2-57d2-ba13-ec413c46e42a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b781804d-0bd2-5210-b109-a159a9a3d598", "target_ref": "attack-pattern--bab17ff4-0271-52b1-872f-26d076a0299f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2a455cd0-c70d-51bb-b71a-b713b19003a8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Emergency call handoff flooded or faked", "description": "The interface that passes calls and incident data from the emergency call centre to ambulance dispatch trusts every record it receives and has no limit on volume. A flood of fake calls or injected incidents exhausts call-takers and ambulances, and real emergencies wait.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-125", "url": "https://capec.mitre.org/data/definitions/125.html", "description": "Flooding" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-770", "url": "https://cwe.mitre.org/data/definitions/770.html", "description": "Allocation of Resources Without Limits or Throttling" }, { "source_name": "cwe", "external_id": "CWE-940", "url": "https://cwe.mitre.org/data/definitions/940.html", "description": "Improper Verification of Source of a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1498", "url": "https://attack.mitre.org/techniques/T1498/", "description": "Network Denial of Service" }, { "source_name": "mitre-attack", "external_id": "T1499.003", "url": "https://attack.mitre.org/techniques/T1499/003/", "description": "Application Exhaustion Flood" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-10", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "D" ], "mds2": [ "NAUT", "AUDT" ], "deck": "The Hospital", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does dispatch know an incident record came from the call centre?", "What limits the volume of incidents the handoff accepts?", "Could operators spot a coordinated flood of fake calls?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b7c8184e-9ba9-50d6-93b2-f083d6d0f688", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-10 mitigation: Emergency call handoff flooded or faked", "description": "Incident handoff between call centres and dispatch authenticates its source, limits volume and lets operators spot coordinated floods.\n\n1. Authenticate each system that can create incidents in dispatch and reject records from anything else.\n2. Rate-limit and alarm on surges of calls or incidents from one number range, route or interface.\n3. Keep a surge procedure that lets clinicians triage queued calls by risk when volume is abnormal.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-10", "mitigation_principle": "Incident handoff between call centres and dispatch authenticates its source, limits volume and lets operators spot coordinated floods.", "design_measures": [ "Authenticate each system that can create incidents in dispatch and reject records from anything else.", "Rate-limit and alarm on surges of calls or incidents from one number range, route or interface.", "Keep a surge procedure that lets clinicians triage queued calls by risk when volume is abnormal." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--78158846-c99c-5bba-9c83-5b81491e9f10", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b7c8184e-9ba9-50d6-93b2-f083d6d0f688", "target_ref": "attack-pattern--2a455cd0-c70d-51bb-b71a-b713b19003a8" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1d1e21d3-46a5-5577-ad3a-92a2f6aba145", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Image transfer between hospitals unverified", "description": "Image-sharing links between hospitals accept studies from any connected peer and import them straight into the local archive. A wrong-patient study, an altered image or a DICOM file carrying malware arrives with the trust of a referral, and when the link is down a time-critical neurosurgical or trauma referral stalls.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-636", "url": "https://capec.mitre.org/data/definitions/636.html", "description": "Hiding Malicious Data or Code within Files" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-349", "url": "https://cwe.mitre.org/data/definitions/349.html", "description": "Acceptance of Extraneous Untrusted Data With Trusted Data" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1204.002", "url": "https://attack.mitre.org/techniques/T1204/002/", "description": "Malicious File" }, { "source_name": "DICOM PS3.15", "description": "DICOM PS3.15 Security and System Management Profiles" }, { "source_name": "DICOM files carrying malware, 2019", "url": "https://web.nvd.nist.gov/vuln/detail/CVE-2019-11687", "description": "NVD: CVE-2019-11687" }, { "source_name": "DICOM files carrying malware, 2019", "url": "https://www.govinfosecurity.com/researchers-malware-be-hidden-in-medical-images-a-12388", "description": "GovInfoSecurity: Researchers, malware can be hidden in medical images" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-9", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "T", "D" ], "linddun": [ "L", "DD" ], "mds2": [ "NAUT", "IGAU", "MLDP" ], "deck": "The Hospital", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which hospitals can push images straight into your archive?", "Who matches an incoming study to the right patient?", "What happens to a time-critical referral when the link is down?" ], "seen_in": [ "DICOM files carrying malware, 2019" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b3579610-347e-5529-b695-7e8062e3ebd9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-9 mitigation: Image transfer between hospitals unverified", "description": "Images from other organisations are authenticated, matched to the patient by a person, and checked before they enter the local archive.\n\n1. Authenticate each sending organisation and node, and keep a list of peers allowed to send.\n2. Quarantine imported studies until patient identity is reconciled and files are scanned for embedded executable content.\n3. Keep a tested secondary route for urgent referrals, such as a separate image-sharing service, with known contacts.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-9", "mitigation_principle": "Images from other organisations are authenticated, matched to the patient by a person, and checked before they enter the local archive.", "design_measures": [ "Authenticate each sending organisation and node, and keep a list of peers allowed to send.", "Quarantine imported studies until patient identity is reconciled and files are scanned for embedded executable content.", "Keep a tested secondary route for urgent referrals, such as a separate image-sharing service, with known contacts." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3277bc00-2c48-54b7-8c6a-fca5d263ecd4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b3579610-347e-5529-b695-7e8062e3ebd9", "target_ref": "attack-pattern--1d1e21d3-46a5-5577-ad3a-92a2f6aba145" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--15c1b0b2-f775-55ff-8586-a5776339586a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Hospital-at-home hub goes blind", "description": "Virtual wards depend on one monitoring hub that gathers observations from patients' homes through a vendor platform and mobile networks. If the hub, platform or feed fails or is tampered with, deteriorating patients look stable and nobody is called, because silence reads as normal.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-1320", "url": "https://cwe.mitre.org/data/definitions/1320.html", "description": "Improper Protection for Outbound Error Messages and Alert Signals" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-8", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "T", "D", "R" ], "linddun": [ "DD" ], "mds2": [ "DTBK", "AUDT", "AUTH" ], "deck": "The Hospital", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Does the virtual ward treat missing observations as an alarm?", "How would staff reach every patient if the platform failed?", "Which links between home and hub could fail silently?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e90e6d31-006f-5a9b-a6d4-7210b5911c94", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-8 mitigation: Hospital-at-home hub goes blind", "description": "A virtual ward treats missing data as an alarm and keeps a way to reach every patient when the platform fails.\n\n1. Alarm on each patient whose readings stop arriving within the expected interval, not only on abnormal readings.\n2. Keep an offline list of virtual-ward patients with phone numbers and escalation plans, refreshed every shift.\n3. Restrict who can change alert thresholds and log every change with the reason and clinician.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-8", "mitigation_principle": "A virtual ward treats missing data as an alarm and keeps a way to reach every patient when the platform fails.", "design_measures": [ "Alarm on each patient whose readings stop arriving within the expected interval, not only on abnormal readings.", "Keep an offline list of virtual-ward patients with phone numbers and escalation plans, refreshed every shift.", "Restrict who can change alert thresholds and log every change with the reason and clinician." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--556f3c4a-b386-584d-a2fa-56681374c85b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e90e6d31-006f-5a9b-a6d4-7210b5911c94", "target_ref": "attack-pattern--15c1b0b2-f775-55ff-8586-a5776339586a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3fe8a025-6348-5bdf-b9a8-c838ccae48cf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Staff call-in cascade abused", "description": "Major-incident and staff call-in messages go out by SMS or automated calls that anyone can imitate, and the cascade platform has weak login. A false major incident pulls staff in and drains the next shift; a blocked or hijacked cascade leaves the hospital short when a real one starts.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-416", "url": "https://capec.mitre.org/data/definitions/416.html", "description": "Manipulate Human Behavior" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-290", "url": "https://cwe.mitre.org/data/definitions/290.html", "description": "Authentication Bypass by Spoofing" }, { "source_name": "mitre-attack", "external_id": "T1684.001", "url": "https://attack.mitre.org/techniques/T1684/001/", "description": "Impersonation" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-7", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "D" ], "mds2": [ "PAUT", "AUTH" ], "deck": "The Hospital", "rank": "7", "physical_safety": false, "mitigation_prompts": [ "How can staff tell a genuine call-in message from a fake?", "Who can log in to the cascade platform, and how?", "What is the manual fallback if the cascade is blocked?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--bbc39d07-aa76-5a40-848a-1041f8eb443b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-7 mitigation: Staff call-in cascade abused", "description": "Call-in messages are verifiable by staff, the cascade is protected like a clinical system, and a manual fallback exists.\n\n1. Tell staff how genuine call-ins look and give them a number or app to confirm one before travelling.\n2. Protect the cascade platform with multi-factor login and two-person activation for a major incident.\n3. Hold printed call-in trees and a switchboard procedure for when the platform is down.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-7", "mitigation_principle": "Call-in messages are verifiable by staff, the cascade is protected like a clinical system, and a manual fallback exists.", "design_measures": [ "Tell staff how genuine call-ins look and give them a number or app to confirm one before travelling.", "Protect the cascade platform with multi-factor login and two-person activation for a major incident.", "Hold printed call-in trees and a switchboard procedure for when the platform is down." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0899ac56-4644-57cd-b052-97db24e2c8af", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bbc39d07-aa76-5a40-848a-1041f8eb443b", "target_ref": "attack-pattern--3fe8a025-6348-5bdf-b9a8-c838ccae48cf" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2daa1d0b-ad52-5f9d-a3cf-f81545f4edd1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Telehealth consult hijacked or impersonated", "description": "Video and phone consultations use reusable links and no identity check on either side. Someone can join or take over a consult, impersonate the clinician to give harmful advice or extract details, or impersonate the patient to obtain prescriptions and records.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-593", "url": "https://capec.mitre.org/data/definitions/593.html", "description": "Session Hijacking" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "cwe", "external_id": "CWE-1467", "url": "https://cwe.mitre.org/data/definitions/1467.html", "description": "Use of Singular Authentication Artifact for Multiple User Sessions" }, { "source_name": "mitre-attack", "external_id": "T1684.001", "url": "https://attack.mitre.org/techniques/T1684/001/", "description": "Impersonation" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-6", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "I", "E" ], "linddun": [ "I", "DD", "D" ], "mds2": [ "PAUT", "TXCF" ], "deck": "The Hospital", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How are the clinician and the patient each identified on a remote consult?", "Are session links single-use and tied to the appointment?", "Could someone join a consult without anyone noticing?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--7464150e-8167-5f4e-b849-f42a304656a2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-6 mitigation: Telehealth consult hijacked or impersonated", "description": "Both parties in a remote consultation are identified, and session links are single-use and bound to the appointment.\n\n1. Issue single-use, time-limited links bound to the appointment, and lock the room once both parties join.\n2. Verify the patient's identity at the start of each consult and record that it was done.\n3. Show the clinician's verified name and organisation in the client, and give patients a way to confirm it.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-6", "mitigation_principle": "Both parties in a remote consultation are identified, and session links are single-use and bound to the appointment.", "design_measures": [ "Issue single-use, time-limited links bound to the appointment, and lock the room once both parties join.", "Verify the patient's identity at the start of each consult and record that it was done.", "Show the clinician's verified name and organisation in the client, and give patients a way to confirm it." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d9786528-63c5-5988-bd95-56b1707b4de1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--7464150e-8167-5f4e-b849-f42a304656a2", "target_ref": "attack-pattern--2daa1d0b-ad52-5f9d-a3cf-f81545f4edd1" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--34129ee1-404f-51b2-ac04-3442789f7c8a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ambulance location depends on GNSS", "description": "Ambulance location, nearest-vehicle allocation and timestamps on care records depend on GNSS. Jamming or spoofing near a station or along a route misplaces vehicles, sends a distant crew to a cardiac arrest, and leaves records with wrong times.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-627", "url": "https://capec.mitre.org/data/definitions/627.html", "description": "Counterfeit GPS Signals" }, { "source_name": "capec", "external_id": "CAPEC-628", "url": "https://capec.mitre.org/data/definitions/628.html", "description": "Carry-Off GPS Attack" }, { "source_name": "capec", "external_id": "CAPEC-599", "url": "https://capec.mitre.org/data/definitions/599.html", "description": "Terrestrial Jamming" }, { "source_name": "cwe", "external_id": "CWE-348", "url": "https://cwe.mitre.org/data/definitions/348.html", "description": "Use of Less Trusted Source" }, { "source_name": "cwe", "external_id": "CWE-346", "url": "https://cwe.mitre.org/data/definitions/346.html", "description": "Origin Validation Error" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-5", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "T", "D" ], "mds2": [ "IGAU" ], "deck": "The Hospital", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What other source confirms ambulance position besides GNSS?", "How are implausible vehicle positions flagged before allocation?", "Which records take their timestamps from GNSS?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1d3d5ba0-740f-5567-b86e-c1883383e709", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-5 mitigation: Ambulance location depends on GNSS", "description": "Vehicle location and time come from more than one source, and implausible positions are flagged before allocation.\n\n1. Combine GNSS with cellular location and vehicle odometry, and flag positions that jump or freeze.\n2. Let dispatchers override automated allocation when location quality is flagged as poor.\n3. Take care-record timestamps from a trusted network time source, with GNSS only as a fallback.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-5", "mitigation_principle": "Vehicle location and time come from more than one source, and implausible positions are flagged before allocation.", "design_measures": [ "Combine GNSS with cellular location and vehicle odometry, and flag positions that jump or freeze.", "Let dispatchers override automated allocation when location quality is flagged as poor.", "Take care-record timestamps from a trusted network time source, with GNSS only as a fallback." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6bf8dde8-1ed2-5f95-9e73-6c2a250fb61d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1d3d5ba0-740f-5567-b86e-c1883383e709", "target_ref": "attack-pattern--34129ee1-404f-51b2-ac04-3442789f7c8a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--74833b90-64b2-5eed-978b-605b11c7f659", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patients trained to click hospital links", "description": "Hospitals send appointment reminders, results notices and payment requests by SMS and email with links, from senders anyone can imitate. Patients learn to trust them, so fake messages, fake portals and fake public notices harvest credentials, take payments or tell people the emergency department is closed.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-98", "url": "https://capec.mitre.org/data/definitions/98.html", "description": "Phishing" }, { "source_name": "capec", "external_id": "CAPEC-543", "url": "https://capec.mitre.org/data/definitions/543.html", "description": "Counterfeit Websites" }, { "source_name": "capec", "external_id": "CAPEC-630", "url": "https://capec.mitre.org/data/definitions/630.html", "description": "TypoSquatting" }, { "source_name": "cwe", "external_id": "CWE-451", "url": "https://cwe.mitre.org/data/definitions/451.html", "description": "User Interface (UI) Misrepresentation of Critical Information" }, { "source_name": "mitre-attack", "external_id": "T1566.002", "url": "https://attack.mitre.org/techniques/T1566/002/", "description": "Spearphishing Link" }, { "source_name": "mitre-attack", "external_id": "T1583.001", "url": "https://attack.mitre.org/techniques/T1583/001/", "description": "Domains" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-4", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "S", "I" ], "linddun": [ "DD", "U" ], "deck": "The Hospital", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "How can patients tell a genuine hospital message from a fake?", "Do any hospital messages ask patients to log in or pay by link?", "How would you warn the public about fake hospital notices?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--70ac6bfb-9875-599e-b23d-db5b7a98c411", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-4 mitigation: Patients trained to click hospital links", "description": "Patients can tell genuine hospital messages from fakes, and messages never ask them to log in or pay through a link.\n\n1. Register sender IDs and domains, and publish how genuine messages look and what they will never ask for.\n2. Point patients to the portal or app by name instead of sending login links in messages.\n3. Monitor for look-alike domains, sender IDs and social accounts, and publish service status only on known channels.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-4", "mitigation_principle": "Patients can tell genuine hospital messages from fakes, and messages never ask them to log in or pay through a link.", "design_measures": [ "Register sender IDs and domains, and publish how genuine messages look and what they will never ask for.", "Point patients to the portal or app by name instead of sending login links in messages.", "Monitor for look-alike domains, sender IDs and social accounts, and publish service status only on known channels." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a51e4f28-6cd6-53df-b84e-7032ff6e8ffb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--70ac6bfb-9875-599e-b23d-db5b7a98c411", "target_ref": "attack-pattern--74833b90-64b2-5eed-978b-605b11c7f659" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8bd3a7eb-745e-5feb-9662-461051648c5e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ambulance care records leak or lag", "description": "Electronic patient care records live on crew tablets and sync through a vendor cloud. When the sync fails at handover the emergency department works from a verbal summary, and a lost or poorly managed tablet exposes records of everyone the crew treated.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-507", "url": "https://capec.mitre.org/data/definitions/507.html", "description": "Physical Theft" }, { "source_name": "cwe", "external_id": "CWE-312", "url": "https://cwe.mitre.org/data/definitions/312.html", "description": "Cleartext Storage of Sensitive Information" }, { "source_name": "mitre-attack", "external_id": "T1005", "url": "https://attack.mitre.org/techniques/T1005/", "description": "Data from Local System" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-3", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "I", "D" ], "linddun": [ "DD", "I" ], "mds2": [ "STCF", "TXCF", "DTBK" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "What happens at handover when the care record fails to sync?", "How are crew tablets protected if one is lost?", "How long do records stay on the tablet after handover?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6bc3b7bd-01ff-56c2-ac22-b8abd46c00ae", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-3 mitigation: Ambulance care records leak or lag", "description": "Prehospital records reach the receiving hospital reliably and are protected on the device for as long as they are held.\n\n1. Encrypt records on the tablet, enrol tablets in device management, and remote-wipe on loss.\n2. Hand over a printable or local copy of the record when the cloud sync has not completed.\n3. Purge records from the tablet once the hospital has acknowledged receipt.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-3", "mitigation_principle": "Prehospital records reach the receiving hospital reliably and are protected on the device for as long as they are held.", "design_measures": [ "Encrypt records on the tablet, enrol tablets in device management, and remote-wipe on loss.", "Hand over a printable or local copy of the record when the cloud sync has not completed.", "Purge records from the tablet once the hospital has acknowledged receipt." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8feb837d-8667-561c-8f99-65ec034de3c4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6bc3b7bd-01ff-56c2-ac22-b8abd46c00ae", "target_ref": "attack-pattern--8bd3a7eb-745e-5feb-9662-461051648c5e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c74fb9a2-9143-546d-a03a-c4ec11db2f66", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Backup radio and satellite never tested", "description": "Satellite phones, backup radio and spare lines sit in a cupboard with flat batteries, expired subscriptions and outdated numbers. On the day every other channel fails, the hospital cannot reach the ambulance service, neighbouring hospitals or its own staff.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/#cri-ec-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-2", "group_code": "EC", "group_name": "Emergency and External Communications", "stride": [ "D" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "When were backup radio and satellite phones last used in anger or drill?", "Who keeps fallback directories current and offline?", "Are subscriptions, batteries and numbers checked on a schedule?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--61b74a00-bb79-52b2-9a95-630603b75f8d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-EC-2 mitigation: Backup radio and satellite never tested", "description": "Fallback communications are part of routine operations, tested on a schedule, and their directories are kept current offline.\n\n1. Test every fallback channel monthly with a real call to the ambulance service and a neighbouring hospital.\n2. Keep batteries charged, subscriptions in force, and a printed directory beside each device.\n3. Name who owns each fallback device and include its use in major-incident exercises.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-EC-2", "mitigation_principle": "Fallback communications are part of routine operations, tested on a schedule, and their directories are kept current offline.", "design_measures": [ "Test every fallback channel monthly with a real call to the ambulance service and a neighbouring hospital.", "Keep batteries charged, subscriptions in force, and a printed directory beside each device.", "Name who owns each fallback device and include its use in major-incident exercises." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--541437b9-ac28-5c0e-b3e3-3a0a5e272443", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--61b74a00-bb79-52b2-9a95-630603b75f8d", "target_ref": "attack-pattern--c74fb9a2-9143-546d-a03a-c4ec11db2f66" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--1a4445bc-bc5a-56db-a4e7-af90bbb75f0e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "EC Emergency and External Communications", "description": "Ambulance dispatch, prehospital ECG and pre-alerts, emergency services radio, diversion, image transfer, telehealth, hospital-at-home hubs, staff call-in, patient SMS and backup links.", "context": "unspecified", "object_refs": [ "attack-pattern--36d944fd-cc37-5f2a-83da-d693fdc3d687", "course-of-action--b7a27ab5-9361-535e-9a95-47581f03484e", "attack-pattern--60b8e427-8bd9-5479-8acc-08e94d32f21c", "course-of-action--87770f57-61f3-5d9f-8d63-1106d855d812", "attack-pattern--16a25aea-9b9a-5207-91cb-9d624747eede", "course-of-action--5f9acdad-1705-50f5-b875-00172b6cc28d", "attack-pattern--bab17ff4-0271-52b1-872f-26d076a0299f", "course-of-action--b781804d-0bd2-5210-b109-a159a9a3d598", "attack-pattern--2a455cd0-c70d-51bb-b71a-b713b19003a8", "course-of-action--b7c8184e-9ba9-50d6-93b2-f083d6d0f688", "attack-pattern--1d1e21d3-46a5-5577-ad3a-92a2f6aba145", "course-of-action--b3579610-347e-5529-b695-7e8062e3ebd9", "attack-pattern--15c1b0b2-f775-55ff-8586-a5776339586a", "course-of-action--e90e6d31-006f-5a9b-a6d4-7210b5911c94", "attack-pattern--3fe8a025-6348-5bdf-b9a8-c838ccae48cf", "course-of-action--bbc39d07-aa76-5a40-848a-1041f8eb443b", "attack-pattern--2daa1d0b-ad52-5f9d-a3cf-f81545f4edd1", "course-of-action--7464150e-8167-5f4e-b849-f42a304656a2", "attack-pattern--34129ee1-404f-51b2-ac04-3442789f7c8a", "course-of-action--1d3d5ba0-740f-5567-b86e-c1883383e709", "attack-pattern--74833b90-64b2-5eed-978b-605b11c7f659", "course-of-action--70ac6bfb-9875-599e-b23d-db5b7a98c411", "attack-pattern--8bd3a7eb-745e-5feb-9662-461051648c5e", "course-of-action--6bc3b7bd-01ff-56c2-ac22-b8abd46c00ae", "attack-pattern--c74fb9a2-9143-546d-a03a-c4ec11db2f66", "course-of-action--61b74a00-bb79-52b2-9a95-630603b75f8d" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-EC", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/emergency-and-external-communications/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f760ea6b-a8b0-5eba-9530-af7889a2da1b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Medical gas alarms suppressed or altered", "description": "Oxygen and other medical gas plant, pressure monitoring and area alarm panels are networked for remote monitoring with weak or no authentication. Changing pressures or suppressing alarms can starve a ward of oxygen or vacuum without anyone at the panel or on the ward being told.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-636", "url": "https://cwe.mitre.org/data/definitions/636.html", "description": "Not Failing Securely" }, { "source_name": "mitre-attack", "external_id": "T0838", "url": "https://attack.mitre.org/techniques/T0838/", "description": "Modify Alarm Settings" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "Alarm Suppression" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-emb3d", "external_id": "TID-310", "url": "https://emb3d.mitre.org/threats/TID-310.html", "description": "Remotely Accessible Unauthenticated Services" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-A", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "T", "D" ], "mds2": [ "AUTH", "AUDT" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which medical gas alarms and pressures can be changed over the network?", "What local protection works whatever the network says?", "Would ward staff learn of a gas fault if the panel were silenced?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3308282b-d9d0-55de-99ea-92fd88dce472", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-A mitigation: Medical gas alarms suppressed or altered", "description": "Medical gas safety depends on local engineered protections and alarms that no network command can disable.\n\n1. Keep pressure relief, low-pressure alarms and manifold changeover hardwired, independent of the monitoring network.\n2. Make remote monitoring read-only, and route any remote control through an authenticated, logged path that operators approve.\n3. Alarm on loss of the monitoring link itself, and test area alarms against the plant on a schedule.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-A", "mitigation_principle": "Medical gas safety depends on local engineered protections and alarms that no network command can disable.", "design_measures": [ "Keep pressure relief, low-pressure alarms and manifold changeover hardwired, independent of the monitoring network.", "Make remote monitoring read-only, and route any remote control through an authenticated, logged path that operators approve.", "Alarm on loss of the monitoring link itself, and test area alarms against the plant on a schedule." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--002cecf6-e372-5b0c-b011-8420c8993c76", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3308282b-d9d0-55de-99ea-92fd88dce472", "target_ref": "attack-pattern--f760ea6b-a8b0-5eba-9530-af7889a2da1b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ca9e44d8-38a2-5ff7-8216-25a39cc3eb97", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Theatre and isolation pressure reversed", "description": "Building management controls the air changes and pressure regimes of theatres and isolation rooms. A changed setpoint or schedule turns a negative-pressure room positive or cuts theatre air changes, spreading airborne infection or raising surgical site infection, with displays still showing normal.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-862", "url": "https://cwe.mitre.org/data/definitions/862.html", "description": "Missing Authorization" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0831", "url": "https://attack.mitre.org/techniques/T0831/", "description": "Manipulation of Control" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-K", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "T", "R" ], "mds2": [ "AUTH", "AUDT" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What measures room pressure independently of building management?", "Who can change setpoints or schedules for theatres and isolation rooms?", "Where would staff see that a negative-pressure room had reversed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6f64c22c-cf78-5f73-acbd-6696c6833db6", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-K mitigation: Theatre and isolation pressure reversed", "description": "Critical-room pressure and air changes are monitored independently of the system that controls them, at the room.\n\n1. Fit independent pressure monitors with local alarms at each isolation room and theatre.\n2. Lock critical-room setpoints and schedules, requiring authenticated, logged changes with an engineering approval.\n3. Compare commanded and measured air changes daily and investigate any divergence.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-K", "mitigation_principle": "Critical-room pressure and air changes are monitored independently of the system that controls them, at the room.", "design_measures": [ "Fit independent pressure monitors with local alarms at each isolation room and theatre.", "Lock critical-room setpoints and schedules, requiring authenticated, logged changes with an engineering approval.", "Compare commanded and measured air changes daily and investigate any divergence." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b20e7414-cec8-59eb-9567-45c73ba92248", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6f64c22c-cf78-5f73-acbd-6696c6833db6", "target_ref": "attack-pattern--ca9e44d8-38a2-5ff7-8216-25a39cc3eb97" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0c8d0ce4-0998-54cd-a164-46c33f5ac61a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Backup power controls disabled", "description": "Generator, automatic transfer switch and UPS controllers are reachable from the building network or the internet, often with default credentials. Disabling the transfer or setting generators to manual means the next mains failure, accidental or engineered, takes theatres, ICU and life support down.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-70", "url": "https://capec.mitre.org/data/definitions/70.html", "description": "Try Common or Default Usernames and Passwords" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-1392", "url": "https://cwe.mitre.org/data/definitions/1392.html", "description": "Use of Default Credentials" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0816", "url": "https://attack.mitre.org/techniques/T0816/", "description": "Device Restart/Shutdown" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "Loss of Protection" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "Change Operating Mode" }, { "source_name": "mitre-emb3d", "external_id": "TID-311", "url": "https://emb3d.mitre.org/threats/TID-311.html", "description": "Default Credentials" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-Q", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "D", "T" ], "mds2": [ "SAHD", "AUTH" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Can generator or transfer switch controls be reached from the network?", "Who would notice if backup power had been set to manual?", "When was a real changeover to backup power last tested?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5cb9cd28-663e-55dc-81d9-1019884e407c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-Q mitigation: Backup power controls disabled", "description": "Changeover to backup power is protected locally and cannot be disabled from the network.\n\n1. Keep transfer and generator start logic local and hardwired, with network access read-only by default.\n2. Change default credentials, remove internet exposure and put power controllers in their own segment.\n3. Run load tests on a schedule and alarm when any controller leaves automatic mode.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-Q", "mitigation_principle": "Changeover to backup power is protected locally and cannot be disabled from the network.", "design_measures": [ "Keep transfer and generator start logic local and hardwired, with network access read-only by default.", "Change default credentials, remove internet exposure and put power controllers in their own segment.", "Run load tests on a schedule and alarm when any controller leaves automatic mode." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a6684328-2647-5b87-b611-caf3cf4ed8ec", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5cb9cd28-663e-55dc-81d9-1019884e407c", "target_ref": "attack-pattern--0c8d0ce4-0998-54cd-a164-46c33f5ac61a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--05747b23-9f52-5fe3-a3dd-5af949019469", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Cold storage excursions hidden", "description": "Blood, vaccine, tissue and pharmacy fridges report to a central temperature monitoring system that can be edited or fed false readings. A heated or failed fridge looks normal, and patients receive spoiled blood products, vaccines or drugs.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-268", "url": "https://capec.mitre.org/data/definitions/268.html", "description": "Audit Log Manipulation" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "mitre-attack", "external_id": "T0838", "url": "https://attack.mitre.org/techniques/T0838/", "description": "Modify Alarm Settings" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-J", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "T", "R" ], "mds2": [ "IGAU", "AUDT" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How is fridge temperature evidence protected from editing?", "What independent check confirms blood and vaccines stayed in range?", "Would a failed fridge still look normal on the central system?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--864c53bc-b772-52c0-9eb3-dc7591d4f723", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-J mitigation: Cold storage excursions hidden", "description": "Temperature evidence for stored blood, vaccines and drugs is tamper-evident and checked independently of the monitoring system.\n\n1. Use loggers that sign their readings, and keep an independent local display and alarm on each critical unit.\n2. Make recorded temperatures read-only after capture and log every acknowledgement and edit.\n3. Quarantine stock automatically when readings stop or gaps appear, until a person reviews them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-J", "mitigation_principle": "Temperature evidence for stored blood, vaccines and drugs is tamper-evident and checked independently of the monitoring system.", "design_measures": [ "Use loggers that sign their readings, and keep an independent local display and alarm on each critical unit.", "Make recorded temperatures read-only after capture and log every acknowledgement and edit.", "Quarantine stock automatically when readings stop or gaps appear, until a person reviews them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7e92afee-8821-5f1a-aa6c-faa210931a04", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--864c53bc-b772-52c0-9eb3-dc7591d4f723", "target_ref": "attack-pattern--05747b23-9f52-5fe3-a3dd-5af949019469" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7d846318-16c0-55cd-8e60-1952fe0d0cbb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Water treatment controls changed", "description": "Controllers for dialysis water treatment and hot water temperature are networked and maintained remotely. A changed setpoint or silenced quality alarm exposes dialysis patients to contaminated water, or lets Legionella grow in wards where patients are immunocompromised.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0838", "url": "https://attack.mitre.org/techniques/T0838/", "description": "Modify Alarm Settings" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "Loss of Safety" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-10", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "T", "D" ], "mds2": [ "AUTH", "AUDT" ], "deck": "The Hospital", "rank": "10", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What local interlocks protect dialysis water quality?", "Who can change hot water setpoints remotely?", "How often does independent testing confirm water quality?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e5fb58b4-9684-534c-8c29-2932a1ebe738", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-10 mitigation: Water treatment controls changed", "description": "Water quality for dialysis and for vulnerable patients is protected by local interlocks and checked by independent testing.\n\n1. Interlock dialysis water production locally so out-of-specification water cannot reach the loop, whatever the network says.\n2. Restrict and log setpoint changes on water controllers, and alarm on any change outside a maintenance window.\n3. Keep independent sampling and temperature checks on a schedule that does not rely on the control system.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-10", "mitigation_principle": "Water quality for dialysis and for vulnerable patients is protected by local interlocks and checked by independent testing.", "design_measures": [ "Interlock dialysis water production locally so out-of-specification water cannot reach the loop, whatever the network says.", "Restrict and log setpoint changes on water controllers, and alarm on any change outside a maintenance window.", "Keep independent sampling and temperature checks on a schedule that does not rely on the control system." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4d28ddc8-711c-59f6-a7e5-cf86956a38c3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e5fb58b4-9684-534c-8c29-2932a1ebe738", "target_ref": "attack-pattern--7d846318-16c0-55cd-8e60-1952fe0d0cbb" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7c51029f-3730-5c07-a8e0-f8b94911e2c7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Sterilisation cycle records falsified", "description": "Washer-disinfectors and autoclaves record cycle parameters to a tracking system that releases instruments. Altered parameters or forged records release unsterile instruments to theatres, or force a recall of every set processed while records cannot be trusted.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-148", "url": "https://capec.mitre.org/data/definitions/148.html", "description": "Content Spoofing" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-9", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "T", "R" ], "mds2": [ "IGAU", "AUTH" ], "deck": "The Hospital", "rank": "9", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "What releases instruments: the record, or physical evidence too?", "Who can change cycle parameters or tracking records?", "How would you recall sets if cycle records could not be trusted?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--510434fd-a770-5311-b17b-fe61ca75eb3f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-9 mitigation: Sterilisation cycle records falsified", "description": "Instrument release depends on cycle evidence that cannot be forged and on physical indicators the network cannot change.\n\n1. Have sterilisers sign their cycle records and have the tracking system verify them before release.\n2. Keep chemical and biological indicators as an independent check on every load.\n3. Restrict cycle parameter changes to authenticated engineers, logged and reviewed by sterile services.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-9", "mitigation_principle": "Instrument release depends on cycle evidence that cannot be forged and on physical indicators the network cannot change.", "design_measures": [ "Have sterilisers sign their cycle records and have the tracking system verify them before release.", "Keep chemical and biological indicators as an independent check on every load.", "Restrict cycle parameter changes to authenticated engineers, logged and reviewed by sterile services." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--80a19487-7587-5e96-92e6-fed634a6ae4d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--510434fd-a770-5311-b17b-fe61ca75eb3f", "target_ref": "attack-pattern--7c51029f-3730-5c07-a8e0-f8b94911e2c7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a54e0488-3c4b-5fb0-919a-dfbfd62d5a06", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Pneumatic tube system stops or misroutes", "description": "The pneumatic tube system carries samples, blood and drugs between wards, labs and pharmacy, under one networked controller with embedded stations. Stopping or misrouting it delays results across the hospital, and a compromised station is a foothold on the network.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0814", "url": "https://attack.mitre.org/techniques/T0814/", "description": "Denial of Service" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-211", "url": "https://emb3d.mitre.org/threats/TID-211.html", "description": "Device Allows Unauthenticated Firmware Installation" }, { "source_name": "PwnedPiper pneumatic tubes, 2021", "url": "https://www.theregister.com/2021/08/02/pwnedpiper_swisslog_pts/", "description": "The Register: PwnedPiper flaws in Swisslog pneumatic tube systems" }, { "source_name": "PwnedPiper pneumatic tubes, 2021", "url": "https://health-isac.org/armis-discovers-9-vulnerabilities-in-infrastructure-used-by-80-of-major-hospitals-in-north-america/", "description": "Health-ISAC: Armis discovers 9 vulnerabilities in hospital infrastructure" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-8", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "D", "T" ], "mds2": [ "IGAU", "SAHD" ], "deck": "The Hospital", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How would the hospital move samples and drugs without the tube system?", "What can a tube station reach on the network?", "Who patches the tube controller and its stations?" ], "seen_in": [ "PwnedPiper pneumatic tubes, 2021" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c3bcc471-e4a9-5988-ac71-8e42cec5c1ed", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-8 mitigation: Pneumatic tube system stops or misroutes", "description": "The tube system's controller and stations are hardened, updated and isolated, and the hospital can run without it.\n\n1. Put tube controllers and stations in their own segment with only the connections they need.\n2. Require signed firmware for stations and keep them on supported versions.\n3. Keep a porter-run courier procedure for urgent samples and blood, and rehearse it.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-8", "mitigation_principle": "The tube system's controller and stations are hardened, updated and isolated, and the hospital can run without it.", "design_measures": [ "Put tube controllers and stations in their own segment with only the connections they need.", "Require signed firmware for stations and keep them on supported versions.", "Keep a porter-run courier procedure for urgent samples and blood, and rehearse it." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--099f14ef-a6db-5e68-9970-38ae81cbf883", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c3bcc471-e4a9-5988-ac71-8e42cec5c1ed", "target_ref": "attack-pattern--a54e0488-3c4b-5fb0-919a-dfbfd62d5a06" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--12f7e531-1e67-58a9-9316-d18cb645e044", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Building management as a pivot", "description": "Building management servers and controllers are maintained by contractors, often exposed to the internet, and sit on networks that reach clinical systems. Once inside the building network an attacker moves to device and clinical networks the hospital thought were separate.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-700", "url": "https://capec.mitre.org/data/definitions/700.html", "description": "Network Boundary Bridging" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T0883", "url": "https://attack.mitre.org/techniques/T0883/", "description": "Internet Accessible Device" }, { "source_name": "mitre-attack", "external_id": "T0866", "url": "https://attack.mitre.org/techniques/T0866/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-attack", "external_id": "T0822", "url": "https://attack.mitre.org/techniques/T0822/", "description": "External Remote Services" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-7", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "E", "I" ], "mds2": [ "CONN", "RMOT" ], "deck": "The Hospital", "rank": "7", "physical_safety": false, "mitigation_prompts": [ "What can the building management network reach in the clinical estate?", "How do contractors connect to building systems remotely?", "Is any building controller reachable from the internet?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--32314493-43fb-50e3-bb8e-6ee46ae1987f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-7 mitigation: Building management as a pivot", "description": "Building systems are a separate zone with controlled conduits, and their remote access is treated like any other privileged access.\n\n1. Separate building systems from clinical and corporate networks, allowing only defined, monitored flows between them.\n2. Remove internet exposure and route contractor access through the hospital's managed remote access with multi-factor login.\n3. Include building controllers in the asset inventory and vulnerability management.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-7", "mitigation_principle": "Building systems are a separate zone with controlled conduits, and their remote access is treated like any other privileged access.", "design_measures": [ "Separate building systems from clinical and corporate networks, allowing only defined, monitored flows between them.", "Remove internet exposure and route contractor access through the hospital's managed remote access with multi-factor login.", "Include building controllers in the asset inventory and vulnerability management." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e3bdce1d-9809-5dfb-96fb-9573c63fb8e9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--32314493-43fb-50e3-bb8e-6ee46ae1987f", "target_ref": "attack-pattern--12f7e531-1e67-58a9-9316-d18cb645e044" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bed22d20-4040-54c6-9c79-2693b436926f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Infant security and door access defeated", "description": "Infant tagging, maternity door locks and access control share controllers and credentials that can be cloned, overridden or disabled. Defeating them enables abduction, and a mass lock or unlock traps people in or opens secure areas during a fire or incident.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-395", "url": "https://capec.mitre.org/data/definitions/395.html", "description": "Bypassing Electronic Locks and Access Controls" }, { "source_name": "capec", "external_id": "CAPEC-390", "url": "https://capec.mitre.org/data/definitions/390.html", "description": "Bypassing Physical Security" }, { "source_name": "cwe", "external_id": "CWE-1263", "url": "https://cwe.mitre.org/data/definitions/1263.html", "description": "Improper Physical Access Control" }, { "source_name": "cwe", "external_id": "CWE-294", "url": "https://cwe.mitre.org/data/definitions/294.html", "description": "Authentication Bypass by Capture-replay" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-6", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "S", "E", "D" ], "linddun": [ "I" ], "mds2": [ "PLOK", "AUTH", "AUDT" ], "deck": "The Hospital", "rank": "6", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Can infant tags or door credentials be cloned or overridden remotely?", "What do secure doors do in a fire, and in an abduction alert?", "Who could trigger a mass lock or unlock?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c77d9b41-a332-5ca3-9201-42faa6cee40e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-6 mitigation: Infant security and door access defeated", "description": "Secure doors fail safe for fire and fail secure for abduction, and their controllers resist cloning and remote override.\n\n1. Use access cards that cannot be cloned, and alarm on doors held or forced in maternity and paediatric areas.\n2. Make fire release hardwired and local, and log any remote lock or unlock command with who issued it.\n3. Test infant tag alarms and door interlocks on a schedule, including when the network is down.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-6", "mitigation_principle": "Secure doors fail safe for fire and fail secure for abduction, and their controllers resist cloning and remote override.", "design_measures": [ "Use access cards that cannot be cloned, and alarm on doors held or forced in maternity and paediatric areas.", "Make fire release hardwired and local, and log any remote lock or unlock command with who issued it.", "Test infant tag alarms and door interlocks on a schedule, including when the network is down." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--72d5c558-c9f5-5b21-9580-1df3235fe147", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c77d9b41-a332-5ca3-9201-42faa6cee40e", "target_ref": "attack-pattern--bed22d20-4040-54c6-9c79-2693b436926f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5e7c185d-b11f-53a8-b86c-6ebbd781326d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Lift priority for patient transfers lost", "description": "Lifts that move patients between emergency, theatre and intensive care are run from networked controllers with remote service. Stopping them or removing priority modes delays critical transfers and can trap a patient and team between floors.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "mitre-attack", "external_id": "T0816", "url": "https://attack.mitre.org/techniques/T0816/", "description": "Device Restart/Shutdown" }, { "source_name": "mitre-attack", "external_id": "T0858", "url": "https://attack.mitre.org/techniques/T0858/", "description": "Change Operating Mode" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-5", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "D" ], "mds2": [ "RMOT", "AUTH" ], "deck": "The Hospital", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Can remote service take patient-transfer lifts out of priority mode?", "What happens to a patient and team if a lift stops between floors?", "Who is told before a lift is taken out of service?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e54a6e46-815d-5770-ae5b-c070ad0620c1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-5 mitigation: Lift priority for patient transfers lost", "description": "Patient-transfer lifts keep their priority and safety functions locally, and remote service cannot take them out of service unannounced.\n\n1. Keep firefighter and bed-priority modes under local key control, independent of the network.\n2. Restrict remote service to read-only by default and log any command that changes lift mode.\n3. Plan alternative transfer routes and staffing for when priority lifts are out of service.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-5", "mitigation_principle": "Patient-transfer lifts keep their priority and safety functions locally, and remote service cannot take them out of service unannounced.", "design_measures": [ "Keep firefighter and bed-priority modes under local key control, independent of the network.", "Restrict remote service to read-only by default and log any command that changes lift mode.", "Plan alternative transfer routes and staffing for when priority lifts are out of service." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e6a6bf1f-4b32-578e-8658-f9a3ac7266b3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e54a6e46-815d-5770-ae5b-c070ad0620c1", "target_ref": "attack-pattern--5e7c185d-b11f-53a8-b86c-6ebbd781326d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1f07b14b-6a5f-5a80-a5b1-e0f7f6d394fb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Facilities alarms reach nobody", "description": "Plant alarms for gases, power, fridges and ventilation are relayed to estates staff by email, SMS or a pager gateway that is unmonitored. When the relay fails, or is overwhelmed by nuisance alarms, a critical alarm sits unread while the plant fails.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "cwe", "external_id": "CWE-1320", "url": "https://cwe.mitre.org/data/definitions/1320.html", "description": "Improper Protection for Outbound Error Messages and Alert Signals" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "mitre-attack", "external_id": "T0878", "url": "https://attack.mitre.org/techniques/T0878/", "description": "Alarm Suppression" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-4", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "D" ], "mds2": [ "CONN" ], "deck": "The Hospital", "rank": "4", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who receives critical plant alarms, and must they acknowledge them?", "What tells estates staff that the alarm relay has failed?", "How many nuisance alarms bury the critical ones?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--42b6c246-d8ed-538b-8966-1a89a98a866f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-4 mitigation: Facilities alarms reach nobody", "description": "Critical facilities alarms reach a person who acknowledges them, and failure of the relay is itself an alarm.\n\n1. Require acknowledgement of critical alarms and escalate automatically when none arrives in time.\n2. Send a heartbeat through the alarm relay and alarm locally when it stops.\n3. Review alarm volumes monthly and remove nuisance alarms so critical ones stand out.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-4", "mitigation_principle": "Critical facilities alarms reach a person who acknowledges them, and failure of the relay is itself an alarm.", "design_measures": [ "Require acknowledgement of critical alarms and escalate automatically when none arrives in time.", "Send a heartbeat through the alarm relay and alarm locally when it stops.", "Review alarm volumes monthly and remove nuisance alarms so critical ones stand out." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1c7447aa-ec06-52e6-8f81-4d1a09b53a4c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--42b6c246-d8ed-538b-8966-1a89a98a866f", "target_ref": "attack-pattern--1f07b14b-6a5f-5a80-a5b1-e0f7f6d394fb" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a16637d2-2bb2-59fd-b91d-ff46cd3d9e8b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Engineering drawings and asset data exposed", "description": "Drawings of gas, power and ventilation systems, asset registers and controller addresses are shared in tenders, contractor portals and project files. They tell an attacker exactly which controller feeds which theatre or ward.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-169", "url": "https://capec.mitre.org/data/definitions/169.html", "description": "Footprinting" }, { "source_name": "capec", "external_id": "CAPEC-406", "url": "https://capec.mitre.org/data/definitions/406.html", "description": "Dumpster Diving" }, { "source_name": "cwe", "external_id": "CWE-552", "url": "https://cwe.mitre.org/data/definitions/552.html", "description": "Files or Directories Accessible to External Parties" }, { "source_name": "mitre-attack", "external_id": "T0882", "url": "https://attack.mitre.org/techniques/T0882/", "description": "Theft of Operational Information" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-3", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "I" ], "mds2": [ "MPII" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Where are drawings of gas, power and ventilation shared?", "Who can see which controller feeds which theatre?", "Is access to engineering information tracked and limited?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b31a3cdf-c540-570b-a49f-6937f37fb5fe", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-3 mitigation: Engineering drawings and asset data exposed", "description": "Engineering information about critical building systems is shared on a need-to-know basis and tracked.\n\n1. Classify engineering drawings and asset data, and share them only through controlled portals with named access.\n2. Remove controller addresses and credentials from tender and handover documents.\n3. Require contractors to return or destroy engineering information at the end of a project.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-3", "mitigation_principle": "Engineering information about critical building systems is shared on a need-to-know basis and tracked.", "design_measures": [ "Classify engineering drawings and asset data, and share them only through controlled portals with named access.", "Remove controller addresses and credentials from tender and handover documents.", "Require contractors to return or destroy engineering information at the end of a project." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3fe4b788-3e30-5c60-b670-17107809aa30", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b31a3cdf-c540-570b-a49f-6937f37fb5fe", "target_ref": "attack-pattern--a16637d2-2bb2-59fd-b91d-ff46cd3d9e8b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f182b6dd-10cd-54fd-9329-a857f7a9ae92", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Energy optimisation darkens clinical areas", "description": "Energy and lighting optimisation schedules, set centrally or by a vendor platform, apply office logic to clinical areas. A changed schedule switches off lighting, ventilation or heating in a ward, theatre or recovery area overnight.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/#cri-fb-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-212", "url": "https://capec.mitre.org/data/definitions/212.html", "description": "Functionality Misuse" }, { "source_name": "cwe", "external_id": "CWE-1188", "url": "https://cwe.mitre.org/data/definitions/1188.html", "description": "Initialization of a Resource with an Insecure Default" }, { "source_name": "mitre-attack", "external_id": "T0836", "url": "https://attack.mitre.org/techniques/T0836/", "description": "Modify Parameter" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-2", "group_code": "FB", "group_name": "Facilities and Building Systems", "stride": [ "T", "D" ], "mds2": [ "AUTH" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "Which clinical areas do automated energy schedules touch?", "Who approves an energy rule that affects a ward or theatre?", "Could a vendor platform change lighting or ventilation overnight?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--2b0d47a6-efd2-5e1d-b898-a3fdfbf5ee31", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-FB-2 mitigation: Energy optimisation darkens clinical areas", "description": "Clinical areas are excluded from automated energy schedules unless clinicians have approved the rule.\n\n1. Tag clinical zones in the building system and block energy rules from applying to them by default.\n2. Log and review every schedule change, including those pushed by the vendor platform.\n3. Give each clinical area a local override that restores lighting and ventilation immediately.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-FB-2", "mitigation_principle": "Clinical areas are excluded from automated energy schedules unless clinicians have approved the rule.", "design_measures": [ "Tag clinical zones in the building system and block energy rules from applying to them by default.", "Log and review every schedule change, including those pushed by the vendor platform.", "Give each clinical area a local override that restores lighting and ventilation immediately." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e9008105-cb96-5e2f-87cf-b34d08474f7a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--2b0d47a6-efd2-5e1d-b898-a3fdfbf5ee31", "target_ref": "attack-pattern--f182b6dd-10cd-54fd-9329-a857f7a9ae92" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--a2a1a539-a018-5f5c-b1d4-05d943ef0e99", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "FB Facilities and Building Systems", "description": "Medical gases, theatre and isolation ventilation, backup power, cold storage, water, sterile services, pneumatic tubes, lifts, infant security and building management.", "context": "unspecified", "object_refs": [ "attack-pattern--f760ea6b-a8b0-5eba-9530-af7889a2da1b", "course-of-action--3308282b-d9d0-55de-99ea-92fd88dce472", "attack-pattern--ca9e44d8-38a2-5ff7-8216-25a39cc3eb97", "course-of-action--6f64c22c-cf78-5f73-acbd-6696c6833db6", "attack-pattern--0c8d0ce4-0998-54cd-a164-46c33f5ac61a", "course-of-action--5cb9cd28-663e-55dc-81d9-1019884e407c", "attack-pattern--05747b23-9f52-5fe3-a3dd-5af949019469", "course-of-action--864c53bc-b772-52c0-9eb3-dc7591d4f723", "attack-pattern--7d846318-16c0-55cd-8e60-1952fe0d0cbb", "course-of-action--e5fb58b4-9684-534c-8c29-2932a1ebe738", "attack-pattern--7c51029f-3730-5c07-a8e0-f8b94911e2c7", "course-of-action--510434fd-a770-5311-b17b-fe61ca75eb3f", "attack-pattern--a54e0488-3c4b-5fb0-919a-dfbfd62d5a06", "course-of-action--c3bcc471-e4a9-5988-ac71-8e42cec5c1ed", "attack-pattern--12f7e531-1e67-58a9-9316-d18cb645e044", "course-of-action--32314493-43fb-50e3-bb8e-6ee46ae1987f", "attack-pattern--bed22d20-4040-54c6-9c79-2693b436926f", "course-of-action--c77d9b41-a332-5ca3-9201-42faa6cee40e", "attack-pattern--5e7c185d-b11f-53a8-b86c-6ebbd781326d", "course-of-action--e54a6e46-815d-5770-ae5b-c070ad0620c1", "attack-pattern--1f07b14b-6a5f-5a80-a5b1-e0f7f6d394fb", "course-of-action--42b6c246-d8ed-538b-8966-1a89a98a866f", "attack-pattern--a16637d2-2bb2-59fd-b91d-ff46cd3d9e8b", "course-of-action--b31a3cdf-c540-570b-a49f-6937f37fb5fe", "attack-pattern--f182b6dd-10cd-54fd-9329-a857f7a9ae92", "course-of-action--2b0d47a6-efd2-5e1d-b898-a3fdfbf5ee31" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-FB", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/facilities-and-building-systems/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c66f7b34-ee26-579e-a940-04ff9f30e3a3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One service password, every hospital", "description": "A manufacturer uses the same service password, key or certificate on every unit it ships, and its engineers know it. Once it leaks, anyone can reach service functions on that model in every hospital at once, and the hospitals cannot change it.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-70", "url": "https://capec.mitre.org/data/definitions/70.html", "description": "Try Common or Default Usernames and Passwords" }, { "source_name": "capec", "external_id": "CAPEC-191", "url": "https://capec.mitre.org/data/definitions/191.html", "description": "Read Sensitive Constants Within an Executable" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "cwe", "external_id": "CWE-1273", "url": "https://cwe.mitre.org/data/definitions/1273.html", "description": "Device Unlock Credential Sharing" }, { "source_name": "mitre-attack", "external_id": "T1078.001", "url": "https://attack.mitre.org/techniques/T1078/001/", "description": "Default Accounts" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "mitre-emb3d", "external_id": "TID-328", "url": "https://emb3d.mitre.org/threats/TID-328.html", "description": "Hardcoded Credentials" }, { "source_name": "mitre-emb3d", "external_id": "TID-311", "url": "https://emb3d.mitre.org/threats/TID-311.html", "description": "Default Credentials" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-A", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "S", "E" ], "mds2": [ "PAUT", "RMOT", "AUTH" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Is any service credential shared across every unit of this model?", "Can the hospital change service credentials without the vendor?", "What would one leaked service password open across your sites?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e57942f6-6cb0-53d2-a386-9ea997a72e73", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-A mitigation: One service password, every hospital", "description": "Service credentials are unique per device, owned by the hospital, and changeable without the vendor.\n\n1. Require unique per-device service credentials at procurement, and refuse devices with shared or hard-coded ones.\n2. Let the hospital rotate service credentials and issue them to engineers for a visit, logged.\n3. Ask vendors to confirm in writing how service credentials are generated, stored and revoked.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-A", "mitigation_principle": "Service credentials are unique per device, owned by the hospital, and changeable without the vendor.", "design_measures": [ "Require unique per-device service credentials at procurement, and refuse devices with shared or hard-coded ones.", "Let the hospital rotate service credentials and issue them to engineers for a visit, logged.", "Ask vendors to confirm in writing how service credentials are generated, stored and revoked." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b7092e1d-2ef1-5234-844b-27a03efacd00", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e57942f6-6cb0-53d2-a386-9ea997a72e73", "target_ref": "attack-pattern--c66f7b34-ee26-579e-a940-04ff9f30e3a3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--99962bf0-d720-568f-9e49-bb53249f8dad", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Always-on vendor remote service", "description": "Vendors keep permanent tunnels, modems or remote-access tools into their devices for service, outside the hospital's control. Compromise of the vendor, or of one technician, opens a path into many hospitals' device networks at once.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-555", "url": "https://capec.mitre.org/data/definitions/555.html", "description": "Remote Services with Stolen Credentials" }, { "source_name": "cwe", "external_id": "CWE-923", "url": "https://cwe.mitre.org/data/definitions/923.html", "description": "Improper Restriction of Communication Channel to Intended Endpoints" }, { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/", "description": "External Remote Services" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "mitre-attack", "external_id": "T1219", "url": "https://attack.mitre.org/techniques/T1219/", "description": "Remote Access Tools" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-K", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "S", "E" ], "mds2": [ "RMOT", "AUDT" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which vendors hold permanent remote access into devices?", "Who approves each remote service session, and is it recorded?", "How would you know a vendor tunnel had been misused?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--4917fe0f-0a07-5835-98ff-2b70dab55331", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-K mitigation: Always-on vendor remote service", "description": "Vendor remote access is brokered, approved per session, recorded, and closed when the work ends.\n\n1. Route all vendor access through the hospital's managed access service with multi-factor login and per-session approval.\n2. Remove cellular modems and vendor-installed remote tools that bypass the hospital's controls.\n3. Record sessions and review them against the service ticket.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-K", "mitigation_principle": "Vendor remote access is brokered, approved per session, recorded, and closed when the work ends.", "design_measures": [ "Route all vendor access through the hospital's managed access service with multi-factor login and per-session approval.", "Remove cellular modems and vendor-installed remote tools that bypass the hospital's controls.", "Record sessions and review them against the service ticket." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5db3aa94-e746-529e-9088-45d3a2f3658b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--4917fe0f-0a07-5835-98ff-2b70dab55331", "target_ref": "attack-pattern--99962bf0-d720-568f-9e49-bb53249f8dad" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4589a202-0479-586b-a07c-8ae628799ec2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Care depends on the vendor's cloud", "description": "Treatment planning, device configuration, remote follow-up or reporting run in the manufacturer's cloud. A ransomware attack or outage there stops care at every customer at once, and hospitals have no local fallback.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Elekta cloud outage, 2021", "url": "https://compliancy-group.com/healthcare-vendor-ransomware-attack-170-health-systems-hit/", "description": "Compliancy Group: Healthcare vendor ransomware attack, 170 health systems hit" }, { "source_name": "Elekta cloud outage, 2021", "url": "https://yaledailynews.com/blog/2021/04/27/ynhhs-pauses-radiotherapy-treatment-for-six-days-after-software-breach", "description": "Yale Daily News: YNHHS pauses radiotherapy treatment for six days" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-Q", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "D" ], "mds2": [ "DTBK", "RDMP" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which clinical functions stop if the vendor's cloud is down?", "What degraded mode keeps care running locally?", "When was a vendor cloud outage last rehearsed?" ], "seen_in": [ "Elekta cloud outage, 2021" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8e2da3f7-02ec-5686-9ed4-3ab305b20bd9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-Q mitigation: Care depends on the vendor's cloud", "description": "Clinically essential functions keep working, at least in a degraded mode, when the vendor's cloud is unavailable.\n\n1. Identify which clinical functions need the vendor cloud and require a documented local fallback for each.\n2. Keep local copies of plans, configurations and data needed to treat current patients.\n3. Include the vendor's incident notification and recovery commitments in the contract and exercise them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-Q", "mitigation_principle": "Clinically essential functions keep working, at least in a degraded mode, when the vendor's cloud is unavailable.", "design_measures": [ "Identify which clinical functions need the vendor cloud and require a documented local fallback for each.", "Keep local copies of plans, configurations and data needed to treat current patients.", "Include the vendor's incident notification and recovery commitments in the contract and exercise them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--544a314c-7890-58ad-b176-406f973b9acf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8e2da3f7-02ec-5686-9ed4-3ab305b20bd9", "target_ref": "attack-pattern--4589a202-0479-586b-a07c-8ae628799ec2" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--028900f7-1aca-5f21-b389-61e3cb2dcac3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "End of support with no exit", "description": "Devices run operating systems and components the manufacturer no longer supports, and replacement is unaffordable or years away. Known vulnerabilities stay open in clinical use, and one worm can take out imaging, lab and monitoring together.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-310", "url": "https://capec.mitre.org/data/definitions/310.html", "description": "Scanning for Vulnerable Software" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/", "description": "NAO: Investigation, WannaCry cyber attack and the NHS" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks", "description": "GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-J", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "T", "D" ], "mds2": [ "RDMP", "SAHD" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which devices are past their manufacturer's end of support?", "How are unsupported devices isolated until replacement?", "When is each unsupported device due to be replaced?" ], "seen_in": [ "WannaCry and the NHS, 2017" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--093d41f7-91be-5274-8e06-5c53e91834bc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-J mitigation: End of support with no exit", "description": "Every device has a planned end of support, and devices past it are isolated and scheduled for replacement.\n\n1. Record end-of-support dates for each device and its third-party components at purchase.\n2. Isolate unsupported devices in restricted segments with only the flows they need.\n3. Budget replacement cycles from end-of-support dates, and report the unsupported estate to the board.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-J", "mitigation_principle": "Every device has a planned end of support, and devices past it are isolated and scheduled for replacement.", "design_measures": [ "Record end-of-support dates for each device and its third-party components at purchase.", "Isolate unsupported devices in restricted segments with only the flows they need.", "Budget replacement cycles from end-of-support dates, and report the unsupported estate to the board." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--37dbfc9d-da14-5fd3-a66d-63a096b96f16", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--093d41f7-91be-5274-8e06-5c53e91834bc", "target_ref": "attack-pattern--028900f7-1aca-5f21-b389-61e3cb2dcac3" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--06689fcd-c7f0-5a14-bd88-e4919d7f7b3a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Only the vendor may patch", "description": "Hospitals are not allowed to patch validated devices, and manufacturers take months to validate updates, often without saying what to do meanwhile. Known exploited vulnerabilities stay open, and staff patch anyway and break the device's validated state.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "cwe", "external_id": "CWE-671", "url": "https://cwe.mitre.org/data/definitions/671.html", "description": "Lack of Administrator Control over Security" }, { "source_name": "mitre-attack", "external_id": "T1210", "url": "https://attack.mitre.org/techniques/T1210/", "description": "Exploitation of Remote Services" }, { "source_name": "mitre-emb3d", "external_id": "TID-210", "url": "https://emb3d.mitre.org/threats/TID-210.html", "description": "Device Vulnerabilities Unpatchable" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-10", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "T", "D" ], "mds2": [ "CSUP", "SGUD" ], "deck": "The Hospital", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What timeline has the vendor committed to for validated updates?", "Which interim mitigations can the hospital apply safely?", "What happens when staff patch a validated device themselves?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--0aa4abb0-d53f-5132-9cde-15ff4d74dd0e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-10 mitigation: Only the vendor may patch", "description": "Manufacturers commit to timelines for validated updates and give interim mitigations the hospital can apply safely.\n\n1. Contract for maximum times to validated security updates and for interim compensating controls.\n2. Ask for a list of operating system patches the hospital may apply without revalidation.\n3. Track each open vulnerability on clinical devices with its mitigation and review date.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-10", "mitigation_principle": "Manufacturers commit to timelines for validated updates and give interim mitigations the hospital can apply safely.", "design_measures": [ "Contract for maximum times to validated security updates and for interim compensating controls.", "Ask for a list of operating system patches the hospital may apply without revalidation.", "Track each open vulnerability on clinical devices with its mitigation and review date." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dd571311-36d2-5c03-8ab8-5db7d9886434", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0aa4abb0-d53f-5132-9cde-15ff4d74dd0e", "target_ref": "attack-pattern--06689fcd-c7f0-5a14-bd88-e4919d7f7b3a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e3f08b5d-cf8d-507e-93ca-a31fe4f8eedd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Service laptops carry infection between hospitals", "description": "Field engineers plug their laptops and USB drives into devices at hospital after hospital, using service software with full control. Malware or a tampered tool spreads from one site to the next and onto devices the hospital's protections never see.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-457", "url": "https://capec.mitre.org/data/definitions/457.html", "description": "USB Memory Attacks" }, { "source_name": "cwe", "external_id": "CWE-829", "url": "https://cwe.mitre.org/data/definitions/829.html", "description": "Inclusion of Functionality from Untrusted Control Sphere" }, { "source_name": "mitre-attack", "external_id": "T1091", "url": "https://attack.mitre.org/techniques/T1091/", "description": "Replication Through Removable Media" }, { "source_name": "mitre-attack", "external_id": "T0864", "url": "https://attack.mitre.org/techniques/T0864/", "description": "Transient Cyber Asset" }, { "source_name": "mitre-emb3d", "external_id": "TID-303", "url": "https://emb3d.mitre.org/threats/TID-303.html", "description": "Excessive Trust in Offboard Management/IDE Software" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-9", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "T", "E" ], "mds2": [ "MLDP", "RMOT" ], "deck": "The Hospital", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How are service laptops and USB drives checked before touching a device?", "Who records which tools were used on which device?", "Could malware travel on an engineer's kit from another hospital?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--bdbfbcb3-00f1-5a91-95e8-85fae88423a3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-9 mitigation: Service laptops carry infection between hospitals", "description": "Service tools and media are treated as transient assets: checked, controlled and recorded before they touch a device.\n\n1. Scan engineers' laptops and media at a kiosk before connection, and record the asset used.\n2. Offer hospital-owned service workstations for vendors where devices allow it.\n3. Require vendors to describe how service laptops are managed, patched and protected.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-9", "mitigation_principle": "Service tools and media are treated as transient assets: checked, controlled and recorded before they touch a device.", "design_measures": [ "Scan engineers' laptops and media at a kiosk before connection, and record the asset used.", "Offer hospital-owned service workstations for vendors where devices allow it.", "Require vendors to describe how service laptops are managed, patched and protected." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--914f3c08-8619-5895-8e8a-4de2efc84fb8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--bdbfbcb3-00f1-5a91-95e8-85fae88423a3", "target_ref": "attack-pattern--e3f08b5d-cf8d-507e-93ca-a31fe4f8eedd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3bc9c84d-8b5f-5e2b-8d02-fd38bf966923", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Update channel delivers malicious updates", "description": "Device and software updates arrive from the vendor's portal, a service engineer or a distribution server, and devices accept what they are given. A compromised vendor or update server pushes tampered firmware or software across the installed base.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "capec", "external_id": "CAPEC-669", "url": "https://capec.mitre.org/data/definitions/669.html", "description": "Alteration of a Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "cwe", "external_id": "CWE-347", "url": "https://cwe.mitre.org/data/definitions/347.html", "description": "Improper Verification of Cryptographic Signature" }, { "source_name": "mitre-attack", "external_id": "T1195.002", "url": "https://attack.mitre.org/techniques/T1195/002/", "description": "Compromise Software Supply Chain" }, { "source_name": "mitre-emb3d", "external_id": "TID-211", "url": "https://emb3d.mitre.org/threats/TID-211.html", "description": "Device Allows Unauthenticated Firmware Installation" }, { "source_name": "mitre-emb3d", "external_id": "TID-213", "url": "https://emb3d.mitre.org/threats/TID-213.html", "description": "Faulty FW/SW Update Integrity Verification" }, { "source_name": "mitre-emb3d", "external_id": "TID-216", "url": "https://emb3d.mitre.org/threats/TID-216.html", "description": "Firmware Update Rollbacks Allowed" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-8", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "T", "E" ], "mds2": [ "IGAU", "CSUP" ], "deck": "The Hospital", "rank": "8", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Does each device verify updates itself, whatever the delivery route?", "Which servers and people can deliver updates to devices?", "How many devices would one tampered update reach?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--8ae905f8-6138-520e-8fc6-0c5b298f3407", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-8 mitigation: Update channel delivers malicious updates", "description": "Devices accept only updates signed by the manufacturer and verify them themselves, whatever the delivery route.\n\n1. Require signed updates verified on the device, with rollback protection.\n2. Verify update packages against published hashes before staging them in the hospital.\n3. Stage updates on a sample of devices and watch for unexpected behaviour before wider rollout.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-8", "mitigation_principle": "Devices accept only updates signed by the manufacturer and verify them themselves, whatever the delivery route.", "design_measures": [ "Require signed updates verified on the device, with rollback protection.", "Verify update packages against published hashes before staging them in the hospital.", "Stage updates on a sample of devices and watch for unexpected behaviour before wider rollout." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a7531c5-0d53-5902-9c09-fa7f897569f9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--8ae905f8-6138-520e-8fc6-0c5b298f3407", "target_ref": "attack-pattern--3bc9c84d-8b5f-5e2b-8d02-fd38bf966923" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fc7f9695-bda3-5ecc-9e8a-791af0757a65", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Bought without security evidence", "description": "Devices and clinical systems are bought on clinical and price criteria alone, without a security disclosure, SBOM, support period or vulnerability handling commitment. Once installed, the weaknesses cannot be bought back.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-7", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "T", "I", "D" ], "mds2": [ "SBOM", "RDMP", "SGUD" ], "deck": "The Hospital", "rank": "7", "physical_safety": false, "mitigation_prompts": [ "Is security evidence scored alongside clinical criteria at purchase?", "Did the supplier commit to a support period and vulnerability handling?", "Which installed systems were bought without an SBOM?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--10274ef0-56ce-587d-b009-4f11f65df48b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-7 mitigation: Bought without security evidence", "description": "Security evidence and lifecycle commitments are procurement criteria with the same weight as clinical ones.\n\n1. Require an MDS2, an SBOM, a support end date and a disclosure process in every tender.\n2. Include clinical engineering and security in evaluation, with the power to fail a bid.\n3. Write security update and notification obligations into the contract.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-7", "mitigation_principle": "Security evidence and lifecycle commitments are procurement criteria with the same weight as clinical ones.", "design_measures": [ "Require an MDS2, an SBOM, a support end date and a disclosure process in every tender.", "Include clinical engineering and security in evaluation, with the power to fail a bid.", "Write security update and notification obligations into the contract." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d40c2284-57bf-5ef1-a4f5-fcab3b892168", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--10274ef0-56ce-587d-b009-4f11f65df48b", "target_ref": "attack-pattern--fc7f9695-bda3-5ecc-9e8a-791af0757a65" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3ec759be-1f24-5110-8f56-911c14af115c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Refurbished and grey-market devices", "description": "Refurbished, loaned and grey-market devices arrive with unknown firmware, counterfeit parts, another hospital's configuration and sometimes its patients' data. They can behave unpredictably and carry weaknesses or implants nobody checked for.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-535", "url": "https://capec.mitre.org/data/definitions/535.html", "description": "Malicious Gray Market Hardware" }, { "source_name": "capec", "external_id": "CAPEC-530", "url": "https://capec.mitre.org/data/definitions/530.html", "description": "Provide Counterfeit Component" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "cwe", "external_id": "CWE-226", "url": "https://cwe.mitre.org/data/definitions/226.html", "description": "Sensitive Information in Resource Not Removed Before Reuse" }, { "source_name": "mitre-attack", "external_id": "T1195.003", "url": "https://attack.mitre.org/techniques/T1195/003/", "description": "Compromise Hardware Supply Chain" }, { "source_name": "mitre-emb3d", "external_id": "TID-113", "url": "https://emb3d.mitre.org/threats/TID-113.html", "description": "Unverified Peripheral Firmware Loaded" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-6", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "T", "I" ], "linddun": [ "DD" ], "mds2": [ "IGAU", "MPII" ], "deck": "The Hospital", "rank": "6", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "How is a refurbished or loaned device restored to a known state?", "Who verifies a second-hand device's origin and firmware?", "Could a device arrive holding another hospital's patients or settings?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b3c066ca-2a7d-5a5b-be0a-121ae3217d51", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-6 mitigation: Refurbished and grey-market devices", "description": "Every device entering service is restored to a known configuration and its origin and firmware are verified.\n\n1. Buy refurbished devices only through manufacturer-authorised channels with documented provenance.\n2. Reset devices to factory configuration and verify firmware versions and hashes before clinical use.\n3. Check incoming devices for previous owners' data and network credentials, and remove them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-6", "mitigation_principle": "Every device entering service is restored to a known configuration and its origin and firmware are verified.", "design_measures": [ "Buy refurbished devices only through manufacturer-authorised channels with documented provenance.", "Reset devices to factory configuration and verify firmware versions and hashes before clinical use.", "Check incoming devices for previous owners' data and network credentials, and remove them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb365557-51fd-557a-93c4-2a6cc72d0a0a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b3c066ca-2a7d-5a5b-be0a-121ae3217d51", "target_ref": "attack-pattern--3ec759be-1f24-5110-8f56-911c14af115c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5d07a89c-4d56-556c-a844-62a32adbffe5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Disposed devices leak patients and passwords", "description": "Devices returned to the vendor, sold or scrapped still hold patient data, network keys and service credentials. Anyone who buys them on the second-hand market can read the data and use the keys to get onto the hospital's network.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-675", "url": "https://capec.mitre.org/data/definitions/675.html", "description": "Retrieve Data from Decommissioned Devices" }, { "source_name": "cwe", "external_id": "CWE-1266", "url": "https://cwe.mitre.org/data/definitions/1266.html", "description": "Improper Scrubbing of Sensitive Data from Decommissioned Device" }, { "source_name": "cwe", "external_id": "CWE-226", "url": "https://cwe.mitre.org/data/definitions/226.html", "description": "Sensitive Information in Resource Not Removed Before Reuse" }, { "source_name": "mitre-attack", "external_id": "T1052", "url": "https://attack.mitre.org/techniques/T1052/", "description": "Exfiltration Over Physical Medium" }, { "source_name": "mitre-emb3d", "external_id": "TID-108", "url": "https://emb3d.mitre.org/threats/TID-108.html", "description": "ROM/NVRAM Data Extraction or Modification" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-5", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "I" ], "linddun": [ "DD", "I" ], "mds2": [ "MPII", "STCF", "DIDT" ], "deck": "The Hospital", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "What standard is used to sanitise devices before they leave?", "Which credentials does a disposed device hold that need rotating?", "Who records that sanitisation actually happened?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--30480838-5a9c-5e87-8d39-8b6c7b0e4dc5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-5 mitigation: Disposed devices leak patients and passwords", "description": "Every device leaving the hospital is sanitised to a recorded standard, and credentials it held are rotated.\n\n1. Wipe or destroy storage in every departing device using a method the manufacturer confirms, and keep a certificate.\n2. Rotate Wi-Fi keys, certificates and accounts the device held when it leaves service.\n3. Require vendors taking devices back to sanitise them and confirm it in writing.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-5", "mitigation_principle": "Every device leaving the hospital is sanitised to a recorded standard, and credentials it held are rotated.", "design_measures": [ "Wipe or destroy storage in every departing device using a method the manufacturer confirms, and keep a certificate.", "Rotate Wi-Fi keys, certificates and accounts the device held when it leaves service.", "Require vendors taking devices back to sanitise them and confirm it in writing." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--38c251a6-7f94-5435-9741-a21bda54b9a1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--30480838-5a9c-5e87-8d39-8b6c7b0e4dc5", "target_ref": "attack-pattern--5d07a89c-4d56-556c-a844-62a32adbffe5" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a054897b-7d9f-55c0-8f76-4bea0cca729e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Vendor collapses or changes hands", "description": "A manufacturer goes bust, withdraws a product or is acquired, and support, cloud services, signing keys and spare parts go with it. Hospitals and patients are left with devices nobody can update, service or safely replace.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "Argus II retinal implant, 2020", "url": "https://spectrum.ieee.org/bionic-eye-obsolete", "description": "IEEE Spectrum: Their bionic eyes are now obsolete and unsupported" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-4", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "D" ], "mds2": [ "RDMP" ], "deck": "The Hospital", "rank": "4", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What happens to support, keys and spares if the vendor fails?", "Does the contract cover a change of ownership?", "Which devices depend on one vendor's continued existence?" ], "seen_in": [ "Argus II retinal implant, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1257d34d-8a63-55b8-be22-a23adc91754a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-4 mitigation: Vendor collapses or changes hands", "description": "Hospitals plan for losing a supplier and contract for what happens to support, keys and data if they do.\n\n1. Contract for escrow of documentation, service tools and update capability if the vendor exits the market.\n2. Identify single-supplier devices and plan alternatives before they are needed.\n3. Require notice of product withdrawal and a support period after it.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-4", "mitigation_principle": "Hospitals plan for losing a supplier and contract for what happens to support, keys and data if they do.", "design_measures": [ "Contract for escrow of documentation, service tools and update capability if the vendor exits the market.", "Identify single-supplier devices and plan alternatives before they are needed.", "Require notice of product withdrawal and a support period after it." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--83caa16d-3334-5761-a22e-083c8a93dcf3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1257d34d-8a63-55b8-be22-a23adc91754a", "target_ref": "attack-pattern--a054897b-7d9f-55c0-8f76-4bea0cca729e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--42471240-7d24-5e7a-9c50-613449cda004", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No SBOM, no answer", "description": "When a vulnerability is announced in a common component, the hospital cannot tell which of its devices contain it, and the vendor takes weeks to say. Exposure is unknown while attackers already know where to look.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1395", "url": "https://cwe.mitre.org/data/definitions/1395.html", "description": "Dependency on Vulnerable Third-Party Component" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "mitre-emb3d", "external_id": "TID-202", "url": "https://emb3d.mitre.org/threats/TID-202.html", "description": "Exploitable System Network Stack Component" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "URGENT/11, 2019", "url": "https://healthcareitnews.com/node/544606", "description": "Healthcare IT News: URGENT/11, FDA issues alert" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.raps.org/resource/fda-warns-of-cybersecurity-vulnerabilities-in-pace.html", "description": "RAPS: FDA warns of cybersecurity vulnerabilities in pacemakers and other BLE devices" }, { "source_name": "SweynTooth Bluetooth flaws, 2020", "url": "https://www.hpnonline.com/healthcare-it/article/21128449/fda-informs-about-potential-cybersecurity-vulnerabilities-in-certain-medical-devices-with-bluetooth-low-energy", "description": "HPN: FDA informs about potential vulnerabilities in medical devices with Bluetooth Low Energy" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-3", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "I" ], "mds2": [ "SBOM", "RDMP" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Can you match a new component vulnerability to your devices in hours?", "Which devices have no current component list?", "How quickly do vendors answer exposure questions?" ], "seen_in": [ "URGENT/11, 2019", "SweynTooth Bluetooth flaws, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6f55e50d-252e-5c99-8c3f-03466750c374", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-3 mitigation: No SBOM, no answer", "description": "Hospitals hold current component lists for their devices and can match a new vulnerability to devices in hours.\n\n1. Require machine-readable SBOMs at purchase and with every update.\n2. Load SBOMs into the asset inventory and match them automatically against new vulnerability notices.\n3. Ask vendors for exploitability statements so effort goes where it matters.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-3", "mitigation_principle": "Hospitals hold current component lists for their devices and can match a new vulnerability to devices in hours.", "design_measures": [ "Require machine-readable SBOMs at purchase and with every update.", "Load SBOMs into the asset inventory and match them automatically against new vulnerability notices.", "Ask vendors for exploitability statements so effort goes where it matters." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a2e235b4-43d5-5d5f-bac7-46d173097a47", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6f55e50d-252e-5c99-8c3f-03466750c374", "target_ref": "attack-pattern--42471240-7d24-5e7a-9c50-613449cda004" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--878153a5-66d9-5a15-84a4-147801d54fe5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Advisories never reach the ward", "description": "Manufacturers' security notices go to a sales or procurement contact, not to clinical engineering, and hospitals have no published way to report problems. Fixes and warnings sit in an inbox while vulnerable devices stay in use.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/#cri-sv-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-2", "group_code": "SV", "group_name": "Suppliers, Service and Lifecycle", "stride": [ "I" ], "mds2": [ "SGUD", "CSUP" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "Who at the hospital receives manufacturers' security advisories?", "How does the hospital report a problem to a vendor?", "How long does an advisory take to reach clinical engineering?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9192b8ea-3886-5d64-b826-e718b9ec6513", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-SV-2 mitigation: Advisories never reach the ward", "description": "Security advisories have a named destination on both sides, and the hospital can report problems to the vendor.\n\n1. Register a monitored security contact with every device vendor and keep it current.\n2. Require vendors to run a coordinated vulnerability disclosure process and say how they notify customers.\n3. Route advisories to clinical engineering and track each to closure.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-SV-2", "mitigation_principle": "Security advisories have a named destination on both sides, and the hospital can report problems to the vendor.", "design_measures": [ "Register a monitored security contact with every device vendor and keep it current.", "Require vendors to run a coordinated vulnerability disclosure process and say how they notify customers.", "Route advisories to clinical engineering and track each to closure." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73e87179-005b-55db-a1cd-bbc72246fa49", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9192b8ea-3886-5d64-b826-e718b9ec6513", "target_ref": "attack-pattern--878153a5-66d9-5a15-84a4-147801d54fe5" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--3480ed67-fd24-584c-8e0c-6e80772a4e4d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "SV Suppliers, Service and Lifecycle", "description": "Vendor remote service, service laptops, manufacturer clouds, patching rights, end of support, procurement evidence, refurbished devices, disposal and vendor failure.", "context": "unspecified", "object_refs": [ "attack-pattern--c66f7b34-ee26-579e-a940-04ff9f30e3a3", "course-of-action--e57942f6-6cb0-53d2-a386-9ea997a72e73", "attack-pattern--99962bf0-d720-568f-9e49-bb53249f8dad", "course-of-action--4917fe0f-0a07-5835-98ff-2b70dab55331", "attack-pattern--4589a202-0479-586b-a07c-8ae628799ec2", "course-of-action--8e2da3f7-02ec-5686-9ed4-3ab305b20bd9", "attack-pattern--028900f7-1aca-5f21-b389-61e3cb2dcac3", "course-of-action--093d41f7-91be-5274-8e06-5c53e91834bc", "attack-pattern--06689fcd-c7f0-5a14-bd88-e4919d7f7b3a", "course-of-action--0aa4abb0-d53f-5132-9cde-15ff4d74dd0e", "attack-pattern--e3f08b5d-cf8d-507e-93ca-a31fe4f8eedd", "course-of-action--bdbfbcb3-00f1-5a91-95e8-85fae88423a3", "attack-pattern--3bc9c84d-8b5f-5e2b-8d02-fd38bf966923", "course-of-action--8ae905f8-6138-520e-8fc6-0c5b298f3407", "attack-pattern--fc7f9695-bda3-5ecc-9e8a-791af0757a65", "course-of-action--10274ef0-56ce-587d-b009-4f11f65df48b", "attack-pattern--3ec759be-1f24-5110-8f56-911c14af115c", "course-of-action--b3c066ca-2a7d-5a5b-be0a-121ae3217d51", "attack-pattern--5d07a89c-4d56-556c-a844-62a32adbffe5", "course-of-action--30480838-5a9c-5e87-8d39-8b6c7b0e4dc5", "attack-pattern--a054897b-7d9f-55c0-8f76-4bea0cca729e", "course-of-action--1257d34d-8a63-55b8-be22-a23adc91754a", "attack-pattern--42471240-7d24-5e7a-9c50-613449cda004", "course-of-action--6f55e50d-252e-5c99-8c3f-03466750c374", "attack-pattern--878153a5-66d9-5a15-84a4-147801d54fe5", "course-of-action--9192b8ea-3886-5d64-b826-e718b9ec6513" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-SV", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/suppliers-service-and-lifecycle/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--dbd94d38-4365-5d1a-a4a4-026592fee097", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Stolen clinician identity prescribes and signs", "description": "A clinician's account can prescribe, sign results, discharge patients and change care plans from any workstation or remote session, with no stronger check for high-risk actions. A phished or reused password lets an attacker order, cancel or approve care under a trusted name.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "capec", "external_id": "CAPEC-98", "url": "https://capec.mitre.org/data/definitions/98.html", "description": "Phishing" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1566", "url": "https://attack.mitre.org/techniques/T1566/", "description": "Phishing" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-A", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "E", "R" ], "mds2": [ "PAUT", "AUTH", "AUDT" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which clinical actions need stronger proof than reading a record?", "How are remote clinical sessions authenticated?", "Who is told when orders appear under a clinician's name unusually?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--f0a65b6e-88c5-5e42-961f-ed9ac66285fa", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-A mitigation: Stolen clinician identity prescribes and signs", "description": "High-risk clinical actions need stronger proof of who is acting than reading a record does.\n\n1. Require step-up authentication, such as a smartcard tap or a second factor, for prescribing, signing results and changing allergies.\n2. Bind remote and off-site clinical sessions to managed devices and phishing-resistant authentication.\n3. Alert the clinician and their lead when orders are placed under their name from an unusual place or time.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-A", "mitigation_principle": "High-risk clinical actions need stronger proof of who is acting than reading a record does.", "design_measures": [ "Require step-up authentication, such as a smartcard tap or a second factor, for prescribing, signing results and changing allergies.", "Bind remote and off-site clinical sessions to managed devices and phishing-resistant authentication.", "Alert the clinician and their lead when orders are placed under their name from an unusual place or time." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2f88ff9c-20d5-5d82-99f0-fbd986200053", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--f0a65b6e-88c5-5e42-961f-ed9ac66285fa", "target_ref": "attack-pattern--dbd94d38-4365-5d1a-a4a4-026592fee097" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--876f3ff6-f3a0-5950-a021-e16dbeb59c28", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Default and hard-coded device credentials", "description": "Devices ship with default administrator passwords that nobody changes, or with credentials compiled into the firmware that cannot be changed. Anyone on the clinical network can log in and change settings, alarm limits or therapy, and the hospital has no way to close the door short of replacing the device.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-70", "url": "https://capec.mitre.org/data/definitions/70.html", "description": "Try Common or Default Usernames and Passwords" }, { "source_name": "capec", "external_id": "CAPEC-115", "url": "https://capec.mitre.org/data/definitions/115.html", "description": "Authentication Bypass" }, { "source_name": "cwe", "external_id": "CWE-1393", "url": "https://cwe.mitre.org/data/definitions/1393.html", "description": "Use of Default Password" }, { "source_name": "cwe", "external_id": "CWE-259", "url": "https://cwe.mitre.org/data/definitions/259.html", "description": "Use of Hard-coded Password" }, { "source_name": "cwe", "external_id": "CWE-798", "url": "https://cwe.mitre.org/data/definitions/798.html", "description": "Use of Hard-coded Credentials" }, { "source_name": "mitre-attack", "external_id": "T1078.001", "url": "https://attack.mitre.org/techniques/T1078/001/", "description": "Default Accounts" }, { "source_name": "mitre-attack", "external_id": "T0859", "url": "https://attack.mitre.org/techniques/T0859/", "description": "Valid Accounts" }, { "source_name": "mitre-emb3d", "external_id": "TID-311", "url": "https://emb3d.mitre.org/threats/TID-311.html", "description": "Default Credentials" }, { "source_name": "mitre-emb3d", "external_id": "TID-328", "url": "https://emb3d.mitre.org/threats/TID-328.html", "description": "Hardcoded Credentials" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-K", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "T", "E" ], "mds2": [ "PAUT", "SAHD", "AUTH" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which devices still use default or hard-coded credentials?", "Can the hospital set and change every device credential?", "What could someone on the clinical network change with a default password?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ff96a3ef-78c8-5269-817f-f7f897ba0972", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-K mitigation: Default and hard-coded device credentials", "description": "No device should be reachable with a credential the hospital did not set and cannot change.\n\n1. Force a unique credential to be set at installation before the device will run clinically.\n2. Remove hard-coded accounts; where an account must exist, make it changeable and disable it by default.\n3. Ask for default and hard-coded credentials in procurement (MDS2) and reject devices that cannot answer.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-K", "mitigation_principle": "No device should be reachable with a credential the hospital did not set and cannot change.", "design_measures": [ "Force a unique credential to be set at installation before the device will run clinically.", "Remove hard-coded accounts; where an account must exist, make it changeable and disable it by default.", "Ask for default and hard-coded credentials in procurement (MDS2) and reject devices that cannot answer." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bd14e246-1929-5cc4-95e8-4667b4f2e96b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ff96a3ef-78c8-5269-817f-f7f897ba0972", "target_ref": "attack-pattern--876f3ff6-f3a0-5950-a021-e16dbeb59c28" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2e9d8e3a-d5f9-5c83-96ac-a77fab63e158", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One directory for IT and devices", "description": "Modality workstations, monitoring servers, lab middleware and pharmacy systems all join the same directory as office PCs. One stolen administrator account or one domain compromise reaches every clinical system at once, and ransomware spreads to the devices along with the desktops.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "capec", "external_id": "CAPEC-652", "url": "https://capec.mitre.org/data/definitions/652.html", "description": "Use of Known Kerberos Credentials" }, { "source_name": "capec", "external_id": "CAPEC-509", "url": "https://capec.mitre.org/data/definitions/509.html", "description": "Kerberoasting" }, { "source_name": "cwe", "external_id": "CWE-266", "url": "https://cwe.mitre.org/data/definitions/266.html", "description": "Incorrect Privilege Assignment" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T1078.002", "url": "https://attack.mitre.org/techniques/T1078/002/", "description": "Domain Accounts" }, { "source_name": "mitre-attack", "external_id": "T1021.002", "url": "https://attack.mitre.org/techniques/T1021/002/", "description": "SMB/Windows Admin Shares" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/", "description": "NAO: Investigation, WannaCry cyber attack and the NHS" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks", "description": "GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks" }, { "source_name": "Conti attack on Ireland's HSE, 2021", "url": "https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf", "description": "HSE: Conti cyber attack on the HSE, full report (PwC)" }, { "source_name": "Conti attack on Ireland's HSE, 2021", "url": "https://www.hhs.gov/sites/default/files/lessons-learned-hse-attack.pdf", "description": "HHS HC3: Lessons learned from the HSE cyber attack" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-Q", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "E", "D" ], "mds2": [ "AUTH", "SAHD" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which clinical systems join the same directory as office PCs?", "What would one stolen domain administrator account reach?", "Could clinical devices keep running if the directory were lost?" ], "seen_in": [ "WannaCry and the NHS, 2017", "Conti attack on Ireland's HSE, 2021" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b6cabce8-afb7-5000-a2b5-356562f97e7d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-Q mitigation: One directory for IT and devices", "description": "A compromise of the corporate identity system must not hand over the clinical device estate.\n\n1. Run clinical device systems in a separate identity domain with no trust from the corporate directory.\n2. Use separate administrator accounts and workstations for the device estate, never reused for email or browsing.\n3. Test that a fully compromised corporate domain cannot log in to any device or clinical server.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-Q", "mitigation_principle": "A compromise of the corporate identity system must not hand over the clinical device estate.", "design_measures": [ "Run clinical device systems in a separate identity domain with no trust from the corporate directory.", "Use separate administrator accounts and workstations for the device estate, never reused for email or browsing.", "Test that a fully compromised corporate domain cannot log in to any device or clinical server." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cc77e207-b1c7-56e7-9af9-acd3ef9276e3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b6cabce8-afb7-5000-a2b5-356562f97e7d", "target_ref": "attack-pattern--2e9d8e3a-d5f9-5c83-96ac-a77fab63e158" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--404f2117-5b96-5154-aa1b-d5bdf695a26b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Devices without their own identity", "description": "Systems accept vital signs, results or images from anything on the network that speaks the right protocol. A rogue or spoofed node can pose as a monitor, analyser or modality and write false values into the record, which clinicians then act on.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-151", "url": "https://capec.mitre.org/data/definitions/151.html", "description": "Identity Spoofing" }, { "source_name": "capec", "external_id": "CAPEC-194", "url": "https://capec.mitre.org/data/definitions/194.html", "description": "Fake the Source of Data" }, { "source_name": "cwe", "external_id": "CWE-306", "url": "https://cwe.mitre.org/data/definitions/306.html", "description": "Missing Authentication for Critical Functionality" }, { "source_name": "cwe", "external_id": "CWE-924", "url": "https://cwe.mitre.org/data/definitions/924.html", "description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel" }, { "source_name": "mitre-attack", "external_id": "T1565.002", "url": "https://attack.mitre.org/techniques/T1565/002/", "description": "Transmitted Data Manipulation" }, { "source_name": "mitre-emb3d", "external_id": "TID-406", "url": "https://emb3d.mitre.org/threats/TID-406.html", "description": "Unauthorized Messages or Connections" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-J", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "T" ], "mds2": [ "NAUT", "IGAU" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How does a receiving system know which device sent the data?", "What happens to data from an unknown or spoofed node?", "Could a rogue device pose as a monitor or analyser?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--ba63ea2c-ed90-587a-8e35-d3f537d5c8c9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-J mitigation: Devices without their own identity", "description": "Every device that writes clinical data proves which device it is, and the receiver refuses data from unknown sources.\n\n1. Give each device a certificate or key at installation and require mutual authentication to gateways and interfaces.\n2. Keep a register of devices allowed to send to each interface and reject the rest.\n3. Alert clinical engineering when a new or unexpected source appears on a clinical feed.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-J", "mitigation_principle": "Every device that writes clinical data proves which device it is, and the receiver refuses data from unknown sources.", "design_measures": [ "Give each device a certificate or key at installation and require mutual authentication to gateways and interfaces.", "Keep a register of devices allowed to send to each interface and reject the rest.", "Alert clinical engineering when a new or unexpected source appears on a clinical feed." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fd46556a-e2ba-5372-ad45-162496c79712", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--ba63ea2c-ed90-587a-8e35-d3f537d5c8c9", "target_ref": "attack-pattern--404f2117-5b96-5154-aa1b-d5bdf695a26b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b1747ab7-2895-5bef-a9fc-39d5931fa24b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Help-desk resets for urgent callers", "description": "The service desk resets passwords and multi-factor enrolment for anyone who sounds like a busy consultant with a patient waiting. An attacker who knows names and rotas from public pages gets a clinician's or administrator's access in one phone call.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-407", "url": "https://capec.mitre.org/data/definitions/407.html", "description": "Pretexting" }, { "source_name": "capec", "external_id": "CAPEC-416", "url": "https://capec.mitre.org/data/definitions/416.html", "description": "Manipulate Human Behavior" }, { "source_name": "cwe", "external_id": "CWE-640", "url": "https://cwe.mitre.org/data/definitions/640.html", "description": "Weak Password Recovery Mechanism for Forgotten Password" }, { "source_name": "mitre-attack", "external_id": "T1566.004", "url": "https://attack.mitre.org/techniques/T1566/004/", "description": "Spearphishing Voice" }, { "source_name": "mitre-attack", "external_id": "T1098.005", "url": "https://attack.mitre.org/techniques/T1098/005/", "description": "Device Registration" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-10", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "E" ], "mds2": [ "PAUT", "AUTH" ], "deck": "The Hospital", "rank": "10", "physical_safety": false, "mitigation_prompts": [ "How does the service desk prove a caller's identity?", "Are privileged resets harder than ordinary ones?", "What public information would help an attacker sound convincing?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d71e1918-5d05-5921-b238-221ac99fd4db", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-10 mitigation: Help-desk resets for urgent callers", "description": "Urgency must never replace identity proofing for credential resets, and resets must be harder for privileged accounts.\n\n1. Verify callers through a second channel or in person before any reset, with a fast route for genuine emergencies.\n2. Require a manager or second approver for resets of privileged and remote-access accounts.\n3. Notify the account owner on every reset and enrolment change, through a channel the caller does not control.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-10", "mitigation_principle": "Urgency must never replace identity proofing for credential resets, and resets must be harder for privileged accounts.", "design_measures": [ "Verify callers through a second channel or in person before any reset, with a fast route for genuine emergencies.", "Require a manager or second approver for resets of privileged and remote-access accounts.", "Notify the account owner on every reset and enrolment change, through a channel the caller does not control." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--be7fea50-3630-5fc6-aefd-a97072bb69dc", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d71e1918-5d05-5921-b238-221ac99fd4db", "target_ref": "attack-pattern--b1747ab7-2895-5bef-a9fc-39d5931fa24b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b5f81c0c-5872-55e3-ad66-91838a941f9e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Break-glass becomes the normal route", "description": "Emergency access to records and devices is so easy, or normal access so slow, that staff use break-glass every shift. Nobody reviews it, so snooping on records and unattributed changes hide in the noise, and the control meant for emergencies stops meaning anything.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "cwe", "external_id": "CWE-863", "url": "https://cwe.mitre.org/data/definitions/863.html", "description": "Incorrect Authorization" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-9", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "R", "I", "E" ], "linddun": [ "Nr", "DD", "Nc" ], "mds2": [ "EMRG", "AUDT" ], "deck": "The Hospital", "rank": "9", "physical_safety": false, "mitigation_prompts": [ "How often is break-glass used, and why so often?", "Who reviews each break-glass use, and how quickly?", "Is normal access slow enough to push staff to emergency access?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--98528531-9b17-5724-b06e-83aa51a3991c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-9 mitigation: Break-glass becomes the normal route", "description": "Emergency access is quick in an emergency, rare in practice and reviewed every time it is used.\n\n1. Fix the routine access problems that drive break-glass use before adding more controls.\n2. Ask for a reason at break-glass and send every use to a reviewer within a day.\n3. Report break-glass rates by ward and role so routine use is visible and challenged.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-9", "mitigation_principle": "Emergency access is quick in an emergency, rare in practice and reviewed every time it is used.", "design_measures": [ "Fix the routine access problems that drive break-glass use before adding more controls.", "Ask for a reason at break-glass and send every use to a reviewer within a day.", "Report break-glass rates by ward and role so routine use is visible and challenged." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3177daa5-1ee2-5c66-a7a7-304e85896a22", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--98528531-9b17-5724-b06e-83aa51a3991c", "target_ref": "attack-pattern--b5f81c0c-5872-55e3-ad66-91838a941f9e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2509f242-7efc-5d6f-af28-2572964ba4fd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Generic and shared clinical logins", "description": "Wards share generic accounts on workstations, devices and departmental systems because individual logins are too slow. Orders, results, settings and record views cannot be tied to a person, so mistakes and misuse go uninvestigated and leavers keep access through the shared password.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-21", "url": "https://capec.mitre.org/data/definitions/21.html", "description": "Exploitation of Trusted Identifiers" }, { "source_name": "cwe", "external_id": "CWE-286", "url": "https://cwe.mitre.org/data/definitions/286.html", "description": "Incorrect User Management" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T1078.003", "url": "https://attack.mitre.org/techniques/T1078/003/", "description": "Local Accounts" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-8", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "R" ], "linddun": [ "Nr" ], "mds2": [ "PAUT", "AUDT" ], "deck": "The Hospital", "rank": "8", "physical_safety": false, "mitigation_prompts": [ "Which wards or devices still rely on generic accounts?", "Can every order and setting change be tied to a person?", "What would make individual login as fast as the shared one?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c8e5a265-8e9a-555b-9a84-8ffd80d43688", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-8 mitigation: Generic and shared clinical logins", "description": "Every clinical action is attributable to a person, without making shared devices slower to use.\n\n1. Replace generic accounts with fast individual sign-on, such as badge tap with a short PIN.\n2. Where a device must run under a shared account, record who is signed in to the session alongside it.\n3. Change shared passwords whenever a holder leaves and audit for generic account use on clinical systems.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-8", "mitigation_principle": "Every clinical action is attributable to a person, without making shared devices slower to use.", "design_measures": [ "Replace generic accounts with fast individual sign-on, such as badge tap with a short PIN.", "Where a device must run under a shared account, record who is signed in to the session alongside it.", "Change shared passwords whenever a holder leaves and audit for generic account use on clinical systems." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e29537a0-2940-5a1e-b5eb-bf68c405f9ef", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c8e5a265-8e9a-555b-9a84-8ffd80d43688", "target_ref": "attack-pattern--2509f242-7efc-5d6f-af28-2572964ba4fd" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fcf47c5c-6125-5822-8178-96e152e0911b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Session handed to the next user", "description": "Shared workstations on wheels and bedside terminals stay signed in as the last person. The next clinician prescribes, records or views under someone else's name, sometimes on the wrong patient's open record, and the record shows the wrong author for clinical decisions.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-593", "url": "https://capec.mitre.org/data/definitions/593.html", "description": "Session Hijacking" }, { "source_name": "capec", "external_id": "CAPEC-60", "url": "https://capec.mitre.org/data/definitions/60.html", "description": "Reusing Session IDs (aka Session Replay)" }, { "source_name": "cwe", "external_id": "CWE-1463", "url": "https://cwe.mitre.org/data/definitions/1463.html", "description": "Insufficient Session Timeout Value" }, { "source_name": "cwe", "external_id": "CWE-1464", "url": "https://cwe.mitre.org/data/definitions/1464.html", "description": "Improper Session Invalidation" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-7", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "R" ], "linddun": [ "Nr" ], "mds2": [ "ALOF", "PAUT" ], "deck": "The Hospital", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Does the shared screen always show who is signed in?", "How quickly can the next clinician switch user?", "Could someone prescribe on the wrong patient's open record?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--b2b31302-96ce-5f1f-bacd-8217d72c601c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-7 mitigation: Session handed to the next user", "description": "A shared screen always shows who is signed in and which patient is open, and switches user quickly and safely.\n\n1. Use fast user switching that closes the previous user's patient context.\n2. Show the signed-in user and patient prominently on every clinical screen.\n3. Lock idle sessions on a timeout suited to the area, shorter in public areas than in theatres.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-7", "mitigation_principle": "A shared screen always shows who is signed in and which patient is open, and switches user quickly and safely.", "design_measures": [ "Use fast user switching that closes the previous user's patient context.", "Show the signed-in user and patient prominently on every clinical screen.", "Lock idle sessions on a timeout suited to the area, shorter in public areas than in theatres." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--301625e0-e476-5ac3-a948-a5e6a784b44c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--b2b31302-96ce-5f1f-bacd-8217d72c601c", "target_ref": "attack-pattern--fcf47c5c-6125-5822-8178-96e152e0911b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--739b61ee-b5f0-5b56-a6c4-9c17c09a0d2d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Standing privilege for biomed and IT", "description": "Clinical engineering and IT staff hold permanent administrator rights to every device console, monitoring server and integration engine. One phished or reused account gives an attacker the power to change any device or interface in the hospital, with nothing to approve or notice.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-122", "url": "https://capec.mitre.org/data/definitions/122.html", "description": "Privilege Abuse" }, { "source_name": "capec", "external_id": "CAPEC-233", "url": "https://capec.mitre.org/data/definitions/233.html", "description": "Privilege Escalation" }, { "source_name": "cwe", "external_id": "CWE-250", "url": "https://cwe.mitre.org/data/definitions/250.html", "description": "Execution with Unnecessary Privileges" }, { "source_name": "cwe", "external_id": "CWE-266", "url": "https://cwe.mitre.org/data/definitions/266.html", "description": "Incorrect Privilege Assignment" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1098.007", "url": "https://attack.mitre.org/techniques/T1098/007/", "description": "Additional Local or Domain Groups" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-6", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "E", "R" ], "mds2": [ "AUTH", "AUDT", "PAUT" ], "deck": "The Hospital", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which biomed and IT accounts hold standing administrator rights?", "Is privilege granted for a task and seen by someone else?", "What could one phished engineer account change?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--df2e8d7b-9f04-5033-8672-bbc7f91a91fe", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-6 mitigation: Standing privilege for biomed and IT", "description": "Privilege over clinical systems is granted for a task, for a time, and is seen by someone else.\n\n1. Grant device and integration admin rights just in time, with approval and expiry.\n2. Use phishing-resistant authentication for every privileged clinical account.\n3. Alert on privileged changes to device settings, alarm limits and interface routes outside change windows.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-6", "mitigation_principle": "Privilege over clinical systems is granted for a task, for a time, and is seen by someone else.", "design_measures": [ "Grant device and integration admin rights just in time, with approval and expiry.", "Use phishing-resistant authentication for every privileged clinical account.", "Alert on privileged changes to device settings, alarm limits and interface routes outside change windows." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cf88f4e1-5d6c-59be-90f7-5fac0255356a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--df2e8d7b-9f04-5033-8672-bbc7f91a91fe", "target_ref": "attack-pattern--739b61ee-b5f0-5b56-a6c4-9c17c09a0d2d" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c2b199c-ef74-5c9c-82ec-4f5fe684e02f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Agency, locum and leaver accounts", "description": "Agency nurses, locum doctors, students and contractors get accounts in a hurry and nobody removes them. Accounts outlive the people, are shared between shifts or reach remote access, giving former staff and anyone who buys their password a way into records and systems.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-560", "url": "https://capec.mitre.org/data/definitions/560.html", "description": "Use of Known Domain Credentials" }, { "source_name": "cwe", "external_id": "CWE-286", "url": "https://cwe.mitre.org/data/definitions/286.html", "description": "Incorrect User Management" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/", "description": "External Remote Services" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-5", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "E" ], "linddun": [ "I" ], "mds2": [ "AUTH", "PAUT" ], "deck": "The Hospital", "rank": "5", "physical_safety": false, "mitigation_prompts": [ "Who sponsors each agency, locum and contractor account?", "Does every temporary account have an end date?", "How quickly is access removed when someone leaves?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d8b6ba8a-25b7-569c-8582-d837d26e6bb2", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-5 mitigation: Agency, locum and leaver accounts", "description": "Every account has an owner, an end date and a sponsor who answers for it.\n\n1. Give temporary staff accounts an end date at creation and require a sponsor to extend them.\n2. Feed starters and leavers from rostering and HR into account removal automatically.\n3. Review dormant and remote-capable accounts monthly and disable those unused for a set period.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-5", "mitigation_principle": "Every account has an owner, an end date and a sponsor who answers for it.", "design_measures": [ "Give temporary staff accounts an end date at creation and require a sponsor to extend them.", "Feed starters and leavers from rostering and HR into account removal automatically.", "Review dormant and remote-capable accounts monthly and disable those unused for a set period." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--06fca3dc-49e8-587e-a33f-d7c829ccf708", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d8b6ba8a-25b7-569c-8582-d837d26e6bb2", "target_ref": "attack-pattern--1c2b199c-ef74-5c9c-82ec-4f5fe684e02f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--14a0946c-71aa-5105-bd47-88ccf871627e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Authentication friction drives workarounds", "description": "Logins and multi-factor prompts that take too long in a resuscitation or theatre push staff to write passwords on monitors, share tokens, prop sessions open or disable locks. The workaround becomes the real control, and both security and care suffer.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-416", "url": "https://capec.mitre.org/data/definitions/416.html", "description": "Manipulate Human Behavior" }, { "source_name": "cwe", "external_id": "CWE-655", "url": "https://cwe.mitre.org/data/definitions/655.html", "description": "Insufficient Psychological Acceptability" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-4", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S", "E" ], "mds2": [ "PAUT", "EMRG" ], "deck": "The Hospital", "rank": "4", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How many seconds does login take in resuscitation or theatre?", "Which workarounds do staff use when authentication is slow?", "Were clinicians involved in testing the authentication design?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--0548d5f8-c361-5d70-b59a-cb41bd7bbfae", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-4 mitigation: Authentication friction drives workarounds", "description": "Authentication is designed around clinical workflow, measured in seconds, and tested with clinicians.\n\n1. Time sign-in and switch-user on real wards and set a target in seconds.\n2. Use proximity or badge tap with risk-based step-up rather than repeated full logins.\n3. Watch for workarounds such as written passwords and fix the cause, not the person.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-4", "mitigation_principle": "Authentication is designed around clinical workflow, measured in seconds, and tested with clinicians.", "design_measures": [ "Time sign-in and switch-user on real wards and set a target in seconds.", "Use proximity or badge tap with risk-based step-up rather than repeated full logins.", "Watch for workarounds such as written passwords and fix the cause, not the person." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2dba3e7e-64ae-5657-85ff-756ba74f662f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--0548d5f8-c361-5d70-b59a-cb41bd7bbfae", "target_ref": "attack-pattern--14a0946c-71aa-5105-bd47-88ccf871627e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d5275b53-47b2-5ffb-ab51-438f2771899f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Credentials in service files", "description": "Passwords, keys and interface credentials sit in plain text in device configuration backups, export files, service reports and installation notes. Whoever gets a copy, from a shared drive, an old laptop or a disposed device, gets the keys to the clinical systems they describe.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-406", "url": "https://capec.mitre.org/data/definitions/406.html", "description": "Dumpster Diving" }, { "source_name": "cwe", "external_id": "CWE-256", "url": "https://cwe.mitre.org/data/definitions/256.html", "description": "Plaintext Storage of a Password" }, { "source_name": "cwe", "external_id": "CWE-522", "url": "https://cwe.mitre.org/data/definitions/522.html", "description": "Insufficiently Protected Credentials" }, { "source_name": "mitre-attack", "external_id": "T1552.001", "url": "https://attack.mitre.org/techniques/T1552/001/", "description": "Credentials In Files" }, { "source_name": "mitre-emb3d", "external_id": "TID-329", "url": "https://emb3d.mitre.org/threats/TID-329.html", "description": "Improper Password Storage" }, { "source_name": "mitre-emb3d", "external_id": "TID-226", "url": "https://emb3d.mitre.org/threats/TID-226.html", "description": "Device leaks security information in logs" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-3", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "I", "E" ], "mds2": [ "STCF", "SAHD" ], "deck": "The Hospital", "rank": "3", "physical_safety": false, "mitigation_prompts": [ "Where do configuration backups and service reports keep credentials?", "Who can read exported device files on shared drives?", "Are secrets removed before files leave the device?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--dac0d56f-1da0-515c-be86-06e24e40d866", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-3 mitigation: Credentials in service files", "description": "Secrets never appear in configuration exports, logs or documents that leave the device.\n\n1. Store device and interface secrets in a protected store and redact them from exports and service reports.\n2. Scan shared drives and ticket systems for clinical system credentials and rotate any found.\n3. Wipe credentials when devices are decommissioned, returned or sent for repair.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-3", "mitigation_principle": "Secrets never appear in configuration exports, logs or documents that leave the device.", "design_measures": [ "Store device and interface secrets in a protected store and redact them from exports and service reports.", "Scan shared drives and ticket systems for clinical system credentials and rotate any found.", "Wipe credentials when devices are decommissioned, returned or sent for repair." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--109f0593-7f3c-57f6-bbe3-4cd517db0aed", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--dac0d56f-1da0-515c-be86-06e24e40d866", "target_ref": "attack-pattern--d5275b53-47b2-5ffb-ab51-438f2771899f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6efc0df8-a0a3-58cc-9144-98a89c6e9c64", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Badges cloned, shared and left in", "description": "Proximity badges and smartcards give access to doors, drug rooms and clinical systems. Cards that are easy to clone, left in readers or lent to colleagues let someone else walk into restricted areas or act as the card holder on clinical systems.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/#cri-ac-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-390", "url": "https://capec.mitre.org/data/definitions/390.html", "description": "Bypassing Physical Security" }, { "source_name": "cwe", "external_id": "CWE-654", "url": "https://cwe.mitre.org/data/definitions/654.html", "description": "Reliance on a Single Factor in a Security Decision" }, { "source_name": "cwe", "external_id": "CWE-308", "url": "https://cwe.mitre.org/data/definitions/308.html", "description": "Use of Single-factor Authentication" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-2", "group_code": "AC", "group_name": "Identity and Access", "stride": [ "S" ], "linddun": [ "I" ], "mds2": [ "PAUT", "PLOK" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "How easily can your badges be cloned?", "Where is a second factor needed beyond the badge?", "What happens when a badge is left in a reader?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--36e36aab-4f90-57f3-9dd7-baf68977b8fd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-AC-2 mitigation: Badges cloned, shared and left in", "description": "A badge proves who is present only when it is hard to copy and backed by a second factor where it matters.\n\n1. Use badges with cryptographic authentication rather than readable serial numbers.\n2. Require a PIN or biometric with the badge for controlled drugs, prescribing and restricted areas.\n3. Remove the session automatically when the card leaves the reader.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-AC-2", "mitigation_principle": "A badge proves who is present only when it is hard to copy and backed by a second factor where it matters.", "design_measures": [ "Use badges with cryptographic authentication rather than readable serial numbers.", "Require a PIN or biometric with the badge for controlled drugs, prescribing and restricted areas.", "Remove the session automatically when the card leaves the reader." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4321ccfb-fa4a-5594-ae03-d9deefdfdcaf", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--36e36aab-4f90-57f3-9dd7-baf68977b8fd", "target_ref": "attack-pattern--6efc0df8-a0a3-58cc-9144-98a89c6e9c64" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--39afa25f-8ea2-54ad-98fa-cde9a36ecb89", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "AC Identity and Access", "description": "Clinician identities, default and hard-coded credentials, shared directories, shared logins, break-glass, session handover, privileged and temporary accounts, badges.", "context": "unspecified", "object_refs": [ "attack-pattern--dbd94d38-4365-5d1a-a4a4-026592fee097", "course-of-action--f0a65b6e-88c5-5e42-961f-ed9ac66285fa", "attack-pattern--876f3ff6-f3a0-5950-a021-e16dbeb59c28", "course-of-action--ff96a3ef-78c8-5269-817f-f7f897ba0972", "attack-pattern--2e9d8e3a-d5f9-5c83-96ac-a77fab63e158", "course-of-action--b6cabce8-afb7-5000-a2b5-356562f97e7d", "attack-pattern--404f2117-5b96-5154-aa1b-d5bdf695a26b", "course-of-action--ba63ea2c-ed90-587a-8e35-d3f537d5c8c9", "attack-pattern--b1747ab7-2895-5bef-a9fc-39d5931fa24b", "course-of-action--d71e1918-5d05-5921-b238-221ac99fd4db", "attack-pattern--b5f81c0c-5872-55e3-ad66-91838a941f9e", "course-of-action--98528531-9b17-5724-b06e-83aa51a3991c", "attack-pattern--2509f242-7efc-5d6f-af28-2572964ba4fd", "course-of-action--c8e5a265-8e9a-555b-9a84-8ffd80d43688", "attack-pattern--fcf47c5c-6125-5822-8178-96e152e0911b", "course-of-action--b2b31302-96ce-5f1f-bacd-8217d72c601c", "attack-pattern--739b61ee-b5f0-5b56-a6c4-9c17c09a0d2d", "course-of-action--df2e8d7b-9f04-5033-8672-bbc7f91a91fe", "attack-pattern--1c2b199c-ef74-5c9c-82ec-4f5fe684e02f", "course-of-action--d8b6ba8a-25b7-569c-8582-d837d26e6bb2", "attack-pattern--14a0946c-71aa-5105-bd47-88ccf871627e", "course-of-action--0548d5f8-c361-5d70-b59a-cb41bd7bbfae", "attack-pattern--d5275b53-47b2-5ffb-ab51-438f2771899f", "course-of-action--dac0d56f-1da0-515c-be86-06e24e40d866", "attack-pattern--6efc0df8-a0a3-58cc-9144-98a89c6e9c64", "course-of-action--36e36aab-4f90-57f3-9dd7-baf68977b8fd" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-AC", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/identity-and-access/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--879dcaf5-06d2-5c7f-bd3a-3a11d1d74de7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Ransomware takes the whole estate", "description": "Clinical and corporate systems share networks, accounts and management tools, so ransomware reaches records, imaging, labs, pharmacy and device servers at once. The hospital loses sight of its patients, diverts ambulances and cancels care for weeks while everything is rebuilt.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-A", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-a", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-441", "url": "https://capec.mitre.org/data/definitions/441.html", "description": "Malicious Logic Insertion" }, { "source_name": "cwe", "external_id": "CWE-1220", "url": "https://cwe.mitre.org/data/definitions/1220.html", "description": "Insufficient Granularity of Access Control" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490/", "description": "Inhibit System Recovery" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/", "description": "NAO: Investigation, WannaCry cyber attack and the NHS" }, { "source_name": "WannaCry and the NHS, 2017", "url": "https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks", "description": "GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks" }, { "source_name": "Conti attack on Ireland's HSE, 2021", "url": "https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf", "description": "HSE: Conti cyber attack on the HSE, full report (PwC)" }, { "source_name": "Conti attack on Ireland's HSE, 2021", "url": "https://www.hhs.gov/sites/default/files/lessons-learned-hse-attack.pdf", "description": "HHS HC3: Lessons learned from the HSE cyber attack" }, { "source_name": "Ascension, 2024", "url": "https://www.bleepingcomputer.com/news/security/ascension-health-data-of-56-million-stolen-in-ransomware-attack/", "description": "BleepingComputer: Ascension health data of 5.6 million stolen in ransomware attack" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-A", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D", "T" ], "mds2": [ "MLDP", "DTBK" ], "deck": "The Hospital", "rank": "A", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which clinical services would keep running if the corporate estate fell?", "What do clinical and corporate systems share: accounts, tools, networks?", "How long would rebuilding the core clinical services take?" ], "seen_in": [ "WannaCry and the NHS, 2017", "Conti attack on Ireland's HSE, 2021", "Ascension, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c5a0289d-e4fb-5d74-afaf-4a881b747ea0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-A mitigation: Ransomware takes the whole estate", "description": "Design so that losing the corporate estate leaves a core of clinical care running.\n\n1. Segment clinical systems and devices so that a compromise of office IT cannot encrypt them.\n2. Define the minimum clinical service that must survive and engineer its systems to run in isolation.\n3. Rehearse an estate-wide outage with clinicians, not only IT, at least yearly.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-A", "mitigation_principle": "Design so that losing the corporate estate leaves a core of clinical care running.", "design_measures": [ "Segment clinical systems and devices so that a compromise of office IT cannot encrypt them.", "Define the minimum clinical service that must survive and engineer its systems to run in isolation.", "Rehearse an estate-wide outage with clinicians, not only IT, at least yearly." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d490697d-4d71-5cf3-a273-fee20c92c05a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c5a0289d-e4fb-5d74-afaf-4a881b747ea0", "target_ref": "attack-pattern--879dcaf5-06d2-5c7f-bd3a-3a11d1d74de7" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9c71057e-15be-51f0-ad65-79c3eeef4449", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "A shared service stops many hospitals", "description": "Pathology, imaging, radiotherapy planning or IT is provided by one company or one hub for many hospitals. When it is attacked, every hospital it serves loses that service together, with no local fallback, and operations, transfusions and cancer treatment stop across a region.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-K", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-k", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/", "description": "The Register: Qilin ransomware attack on NHS supplier contributed to patient fatality" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.digitalhealth.net/2025/06/patient-dies-as-a-result-of-cyber-attack-on-nhs-pathology-provider/", "description": "Digital Health: Patient death linked to cyber attack on NHS pathology provider" }, { "source_name": "Elekta cloud outage, 2021", "url": "https://compliancy-group.com/healthcare-vendor-ransomware-attack-170-health-systems-hit/", "description": "Compliancy Group: Healthcare vendor ransomware attack, 170 health systems hit" }, { "source_name": "Elekta cloud outage, 2021", "url": "https://yaledailynews.com/blog/2021/04/27/ynhhs-pauses-radiotherapy-treatment-for-six-days-after-software-breach", "description": "Yale Daily News: YNHHS pauses radiotherapy treatment for six days" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-K", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "mds2": [ "DTBK" ], "deck": "The Hospital", "rank": "K", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which clinical services come from one supplier shared by many hospitals?", "What local fallback exists if that supplier is attacked?", "Who coordinates across the region when a shared service fails?" ], "seen_in": [ "Synnovis pathology attack, London, 2024", "Elekta cloud outage, 2021" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--88449f9a-18a2-5aa8-95ee-89bd2284b62f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-K mitigation: A shared service stops many hospitals", "description": "No single supplier or hub should be able to stop a clinical service across a region without a tested fallback.\n\n1. Map which clinical services depend on a shared provider and what each hospital does without it.\n2. Contract for and test fallback capacity, such as mutual aid between laboratories or a second planning system.\n3. Require shared providers to show segregation between customers so one attack does not stop all of them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-K", "mitigation_principle": "No single supplier or hub should be able to stop a clinical service across a region without a tested fallback.", "design_measures": [ "Map which clinical services depend on a shared provider and what each hospital does without it.", "Contract for and test fallback capacity, such as mutual aid between laboratories or a second planning system.", "Require shared providers to show segregation between customers so one attack does not stop all of them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6c37f989-6e44-5dc3-bf04-b7447fcea2d9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--88449f9a-18a2-5aa8-95ee-89bd2284b62f", "target_ref": "attack-pattern--9c71057e-15be-51f0-ad65-79c3eeef4449" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f71796fc-ad6c-53c7-8ab6-70cc38b07a9c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Backups reachable from what they protect", "description": "Backups of records, images and device configurations are online, writable and run by the same accounts as production. Attackers find and destroy them before encrypting, so restoring takes weeks of rebuilding rather than days of recovery.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-Q", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-q", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-607", "url": "https://capec.mitre.org/data/definitions/607.html", "description": "Obstruction" }, { "source_name": "cwe", "external_id": "CWE-732", "url": "https://cwe.mitre.org/data/definitions/732.html", "description": "Incorrect Permission Assignment for Critical Resource" }, { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490/", "description": "Inhibit System Recovery" }, { "source_name": "mitre-attack", "external_id": "T1485", "url": "https://attack.mitre.org/techniques/T1485/", "description": "Data Destruction" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-Q", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D", "T" ], "mds2": [ "DTBK" ], "deck": "The Hospital", "rank": "Q", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which backups would survive a full compromise of the estate?", "Do backups use the same accounts as production?", "How long would a restore from the offline copy take?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--644cdac4-8d49-5f23-b0e7-7e487dc7200d", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-Q mitigation: Backups reachable from what they protect", "description": "At least one copy of every clinical system's data and configuration survives a full compromise of the estate.\n\n1. Keep immutable or offline copies managed by separate credentials that the main directory cannot reach.\n2. Back up device configurations, drug libraries and interface definitions, not only databases.\n3. Test full restores of clinical systems on a schedule and time them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-Q", "mitigation_principle": "At least one copy of every clinical system's data and configuration survives a full compromise of the estate.", "design_measures": [ "Keep immutable or offline copies managed by separate credentials that the main directory cannot reach.", "Back up device configurations, drug libraries and interface definitions, not only databases.", "Test full restores of clinical systems on a schedule and time them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--e342c9f6-5546-5620-9e87-024c7fc4d416", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--644cdac4-8d49-5f23-b0e7-7e487dc7200d", "target_ref": "attack-pattern--f71796fc-ad6c-53c7-8ab6-70cc38b07a9c" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--44ec7aaf-d455-5b66-9d29-c62c4c47b993", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Restored data nobody has checked", "description": "After an outage, systems are restored from backups and paper records are typed back in, but nobody checks that results, orders, allergies and medication histories are complete and unaltered. Missing or tampered clinical data flows back into care looking trustworthy.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-J", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-j", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-184", "url": "https://capec.mitre.org/data/definitions/184.html", "description": "Software Integrity Attack" }, { "source_name": "cwe", "external_id": "CWE-354", "url": "https://cwe.mitre.org/data/definitions/354.html", "description": "Improper Validation of Integrity Check Value" }, { "source_name": "cwe", "external_id": "CWE-353", "url": "https://cwe.mitre.org/data/definitions/353.html", "description": "Missing Support for Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1565.001", "url": "https://attack.mitre.org/techniques/T1565/001/", "description": "Stored Data Manipulation" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-J", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "T", "R" ], "mds2": [ "IGAU", "DTBK" ], "deck": "The Hospital", "rank": "J", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How do you check that restored clinical data is complete?", "Who verifies records typed back in from paper?", "Could tampered data return with the restore unnoticed?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--c3d77478-3431-5ac9-82a7-4db0092d95d5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-J mitigation: Restored data nobody has checked", "description": "Recovered clinical data is verified as complete and unaltered before clinicians rely on it.\n\n1. Hash and sign clinical data at backup so restored records can be checked for tampering.\n2. Reconcile results, orders and medication given during downtime against the restored record, with clinical sign-off.\n3. Flag records touched during the outage window so clinicians know to double-check them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-J", "mitigation_principle": "Recovered clinical data is verified as complete and unaltered before clinicians rely on it.", "design_measures": [ "Hash and sign clinical data at backup so restored records can be checked for tampering.", "Reconcile results, orders and medication given during downtime against the restored record, with clinical sign-off.", "Flag records touched during the outage window so clinicians know to double-check them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eff468b0-277e-58e7-bb41-9939a796430c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--c3d77478-3431-5ac9-82a7-4db0092d95d5", "target_ref": "attack-pattern--44ec7aaf-d455-5b66-9d29-c62c4c47b993" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--91b43522-bda9-5901-8c95-1fd76262dfb0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Downtime procedures nobody has practised", "description": "Paper forms, manual ordering, handwritten labels and runners exist on paper but have never been tried at scale. When systems go down for weeks, staff improvise, errors multiply in prescribing, identification and results, and staff exhaust themselves keeping it running.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "Loss of Availability" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/", "description": "The Register: Qilin ransomware attack on NHS supplier contributed to patient fatality" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.digitalhealth.net/2025/06/patient-dies-as-a-result-of-cyber-attack-on-nhs-pathology-provider/", "description": "Digital Health: Patient death linked to cyber attack on NHS pathology provider" }, { "source_name": "Ascension, 2024", "url": "https://www.bleepingcomputer.com/news/security/ascension-health-data-of-56-million-stolen-in-ransomware-attack/", "description": "BleepingComputer: Ascension health data of 5.6 million stolen in ransomware attack" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-10", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "mds2": [ "DTBK" ], "deck": "The Hospital", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "When were downtime procedures last practised at scale?", "Who staffs runners, manual ordering and paper reconciliation?", "How long could manual working last before errors climb?" ], "seen_in": [ "Synnovis pathology attack, London, 2024", "Ascension, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d236dba7-e8f5-51d2-a04b-cbd221dd076b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-10 mitigation: Downtime procedures nobody has practised", "description": "Manual working is a planned, practised and staffed mode of the hospital, not an improvisation.\n\n1. Keep downtime packs on every ward with forms, label stock and contact lists, checked monthly.\n2. Run downtime drills that include pharmacy, labs, imaging and portering, and record what failed.\n3. Plan rotas and extra staff for long outages so manual working is sustainable for weeks.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-10", "mitigation_principle": "Manual working is a planned, practised and staffed mode of the hospital, not an improvisation.", "design_measures": [ "Keep downtime packs on every ward with forms, label stock and contact lists, checked monthly.", "Run downtime drills that include pharmacy, labs, imaging and portering, and record what failed.", "Plan rotas and extra staff for long outages so manual working is sustainable for weeks." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--abfad0f0-aff4-568b-94ff-f23b2dba0f02", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d236dba7-e8f5-51d2-a04b-cbd221dd076b", "target_ref": "attack-pattern--91b43522-bda9-5901-8c95-1fd76262dfb0" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--82d2ff4b-4e60-5d1a-8fee-c3c76180da99", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Devices that stop without their server", "description": "Devices need a licence server, drug library server, worklist or vendor cloud to start or keep working. When the back end is encrypted or cut off, pumps, modalities and analysers refuse to run or lock into unsafe defaults, though they could work alone.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-754", "url": "https://cwe.mitre.org/data/definitions/754.html", "description": "Improper Check for Unusual or Exceptional Conditions" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "Loss of Availability" }, { "source_name": "mitre-attack", "external_id": "T0816", "url": "https://attack.mitre.org/techniques/T0816/", "description": "Device Restart/Shutdown" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-9", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "mds2": [ "DTBK", "CONN" ], "deck": "The Hospital", "rank": "9", "physical_safety": true, "harm": "direct", "mitigation_prompts": [ "Which devices refuse to start without their server or licence?", "What defaults do devices fall back to when the back end is gone?", "Could these devices treat or diagnose safely on their own?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--86386589-9876-53e2-94fa-e368e59e2372", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-9 mitigation: Devices that stop without their server", "description": "A device that can treat or diagnose safely on its own keeps doing so when its back end is gone.\n\n1. Require devices to keep working in a safe local mode, with their last good configuration, when servers are lost.\n2. Ask suppliers about back-end dependencies and grace periods in procurement and test them before go-live.\n3. Document how to run each critical device without its network, and practise it.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-9", "mitigation_principle": "A device that can treat or diagnose safely on its own keeps doing so when its back end is gone.", "design_measures": [ "Require devices to keep working in a safe local mode, with their last good configuration, when servers are lost.", "Ask suppliers about back-end dependencies and grace periods in procurement and test them before go-live.", "Document how to run each critical device without its network, and practise it." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--144a5e56-dc25-5969-9fcc-5f5f55ac33a3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--86386589-9876-53e2-94fa-e368e59e2372", "target_ref": "attack-pattern--82d2ff4b-4e60-5d1a-8fee-c3c76180da99" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--910b8fee-ba15-5bed-a5cc-beb7a505048b", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Diversion overloads the neighbours", "description": "A hospital that loses its systems diverts ambulances and transfers to nearby hospitals, which are already busy. Travel times rise for critically ill patients and the neighbours run short of beds and staff, so one attack degrades emergency care across a region.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "Loss of Availability" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "University Hospital Düsseldorf, 2020", "url": "https://www.technologyreview.com/2020/09/18/1008582/a-patient-has-died-after-ransomware-hackers-hit-a-german-hospital", "description": "MIT Technology Review: A patient has died after ransomware hackers hit a German hospital" }, { "source_name": "University Hospital Düsseldorf, 2020", "url": "https://borncity.com/win/2020/11/18/ransomware-befall-in-uniklinik-dsseldorf-nicht-fr-todesfall-verantwortlich/", "description": "Born's Tech and Windows World: ransomware at Uniklinik Düsseldorf not responsible for death" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-8", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "deck": "The Hospital", "rank": "8", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which neighbouring hospitals absorb your patients if you divert?", "Do regional plans assume a hospital lost to a cyberattack?", "How is the extra load shared before it lands?" ], "seen_in": [ "University Hospital Düsseldorf, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a59840aa-53c8-5021-a859-473369e66fcb", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-8 mitigation: Diversion overloads the neighbours", "description": "Regional plans assume a hospital can be lost to a cyberattack and share the load before it lands.\n\n1. Agree cyber diversion triggers and capacity with neighbouring hospitals and ambulance services in advance.\n2. Keep a way to update diversion status that does not depend on the affected hospital's systems.\n3. Plan which time-critical services, such as stroke and cardiac care, must stay open and how.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-8", "mitigation_principle": "Regional plans assume a hospital can be lost to a cyberattack and share the load before it lands.", "design_measures": [ "Agree cyber diversion triggers and capacity with neighbouring hospitals and ambulance services in advance.", "Keep a way to update diversion status that does not depend on the affected hospital's systems.", "Plan which time-critical services, such as stroke and cardiac care, must stay open and how." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d823014b-ee84-5989-a475-c95aa9006c2e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a59840aa-53c8-5021-a859-473369e66fcb", "target_ref": "attack-pattern--910b8fee-ba15-5bed-a5cc-beb7a505048b" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a3027ee5-bc19-504e-9278-d341b3960b42", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One update takes the estate down", "description": "A trusted security agent, operating system or management tool pushes a faulty or malicious update to every machine at once. Clinical workstations, servers and device consoles fail together, and the hospital cannot recover them faster than it can visit each one.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-186", "url": "https://capec.mitre.org/data/definitions/186.html", "description": "Malicious Software Update" }, { "source_name": "cwe", "external_id": "CWE-494", "url": "https://cwe.mitre.org/data/definitions/494.html", "description": "Download of Code Without Integrity Check" }, { "source_name": "mitre-attack", "external_id": "T1195.002", "url": "https://attack.mitre.org/techniques/T1195/002/", "description": "Compromise Software Supply Chain" }, { "source_name": "mitre-emb3d", "external_id": "TID-217", "url": "https://emb3d.mitre.org/threats/TID-217.html", "description": "Remotely Initiated Updates Can Cause DoS" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "CrowdStrike update outage, 2024", "url": "https://www.statnews.com/2024/07/19/microsoft-crowdstrike-outage-hospitals-cancellations/", "description": "STAT: Hospitals cancel appointments in global tech outage" }, { "source_name": "CrowdStrike update outage, 2024", "url": "https://www.wbur.org/news/2024/07/19/boston-tech-outage-logan-mbg-microsoft", "description": "WBUR: Mass General Brigham cancels non-urgent surgeries" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-7", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D", "T" ], "mds2": [ "CSUP", "DTBK" ], "deck": "The Hospital", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which tools can push an update to every machine at once?", "Are updates staged so critical systems can be held back?", "How quickly could you stop and roll back a bad update?" ], "seen_in": [ "CrowdStrike update outage, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--36dcff33-6e9e-51c7-9008-5f19386ade72", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-7 mitigation: One update takes the estate down", "description": "Updates reach critical clinical systems in stages, with a way to stop and roll back before all are affected.\n\n1. Stage updates to clinical systems in rings, holding critical areas back until earlier rings are healthy.\n2. Keep a tested way to recover machines in bulk without the failed tool, such as rebuild images on local media.\n3. Hold a minimum set of devices on a different platform or update channel for continuity.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-7", "mitigation_principle": "Updates reach critical clinical systems in stages, with a way to stop and roll back before all are affected.", "design_measures": [ "Stage updates to clinical systems in rings, holding critical areas back until earlier rings are healthy.", "Keep a tested way to recover machines in bulk without the failed tool, such as rebuild images on local media.", "Hold a minimum set of devices on a different platform or update channel for continuity." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd379664-4f7f-5786-8f1d-db408f7ea9f3", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--36dcff33-6e9e-51c7-9008-5f19386ade72", "target_ref": "attack-pattern--a3027ee5-bc19-504e-9278-d341b3960b42" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3467dcba-81e8-5dc5-963c-ea243f9b3994", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Downtime copies that go down too", "description": "Read-only downtime viewers, medication lists and printed reports depend on the same network, directory or storage as the main record. When the outage comes they are encrypted or stale, and clinicians lose allergies, drug charts and care plans exactly when they need them.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-6", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "linddun": [ "DD" ], "mds2": [ "DTBK", "STCF" ], "deck": "The Hospital", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "What do downtime viewers and printed reports depend on?", "Would downtime copies survive the same outage as the record?", "How current are the downtime copies at any moment?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--aeacd577-537e-5f58-bdfa-85fe8aafbe2e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-6 mitigation: Downtime copies that go down too", "description": "Downtime copies are independent of the systems whose failure they cover.\n\n1. Keep downtime copies on standalone devices per ward, refreshed often and not joined to the main directory.\n2. Print or cache critical summaries such as medication charts and allergies on a schedule.\n3. Test that downtime copies open with the network, directory and main storage all unavailable.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-6", "mitigation_principle": "Downtime copies are independent of the systems whose failure they cover.", "design_measures": [ "Keep downtime copies on standalone devices per ward, refreshed often and not joined to the main directory.", "Print or cache critical summaries such as medication charts and allergies on a schedule.", "Test that downtime copies open with the network, directory and main storage all unavailable." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db6821ee-84f3-5267-b80b-8dd65ac96920", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--aeacd577-537e-5f58-bdfa-85fe8aafbe2e", "target_ref": "attack-pattern--3467dcba-81e8-5dc5-963c-ea243f9b3994" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8c98cd4d-8a9e-5c22-bcd3-d61d9f995f4f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Incident communications on compromised systems", "description": "The incident plan relies on email, VoIP phones, paging and the intranet to call staff in and coordinate. Those same systems are down or untrusted, so command cannot reach staff, the ambulance service or the public, and attackers may read the response.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T1489", "url": "https://attack.mitre.org/techniques/T1489/", "description": "Service Stop" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-5", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D", "I" ], "deck": "The Hospital", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How would incident command reach staff with email and phones down?", "Which communication channels share fate with the systems under attack?", "Could attackers be reading the response?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--3268f62d-7463-57b4-82bb-914c093273a1", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-5 mitigation: Incident communications on compromised systems", "description": "The hospital can command its response with systems that do not share the fate of the ones under attack.\n\n1. Provide out-of-band communications for incident command, such as separate phones, radios or a hosted service.\n2. Keep printed contact lists and call-in cascades that work without the directory.\n3. Assume email and chat are being read during an incident and move sensitive decisions off them.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-5", "mitigation_principle": "The hospital can command its response with systems that do not share the fate of the ones under attack.", "design_measures": [ "Provide out-of-band communications for incident command, such as separate phones, radios or a hosted service.", "Keep printed contact lists and call-in cascades that work without the directory.", "Assume email and chat are being read during an incident and move sensitive decisions off them." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8660a53b-2551-57ca-8646-e0bbcb017f87", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--3268f62d-7463-57b4-82bb-914c093273a1", "target_ref": "attack-pattern--8c98cd4d-8a9e-5c22-bcd3-d61d9f995f4f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--31d22056-5629-5ec9-9206-6eb21d31010a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "No planned restore order", "description": "Nobody has worked out which systems must come back first and what they depend on. Teams restore systems that cannot run without the directory, DNS, integration engine or certificates, and clinical priorities wait behind whatever IT reaches first.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T1490", "url": "https://attack.mitre.org/techniques/T1490/", "description": "Inhibit System Recovery" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-4", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "mds2": [ "DTBK" ], "deck": "The Hospital", "rank": "4", "physical_safety": false, "mitigation_prompts": [ "Which systems must be restored first for clinical care?", "What technical dependencies does each priority system have?", "When was the restore order last tested?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--970b7181-64fe-5cff-8172-2ba5be7d34c0", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-4 mitigation: No planned restore order", "description": "The restore order follows clinical priority and real technical dependencies, both written down and tested.\n\n1. Map dependencies of each clinical system, including identity, DNS, time, integration and licences.\n2. Agree a restore order with clinical leads and keep it with the backups, offline.\n3. Rehearse restoring the top tier of clinical services from bare infrastructure.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-4", "mitigation_principle": "The restore order follows clinical priority and real technical dependencies, both written down and tested.", "design_measures": [ "Map dependencies of each clinical system, including identity, DNS, time, integration and licences.", "Agree a restore order with clinical leads and keep it with the backups, offline.", "Rehearse restoring the top tier of clinical services from bare infrastructure." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--fc2b0131-2b6c-59fa-93c5-03ac1e2a6281", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--970b7181-64fe-5cff-8172-2ba5be7d34c0", "target_ref": "attack-pattern--31d22056-5629-5ec9-9206-6eb21d31010a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d012bd75-3476-5e51-b0e7-3f75d0444068", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Extortion deadlines rush the recovery", "description": "Attackers set publication deadlines and contact staff, patients and the press while the hospital is still restoring. Under that pressure leaders skip validation, restore from unchecked backups or reconnect early, and the attackers' access or damaged data comes back with the services.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T1657", "url": "https://attack.mitre.org/techniques/T1657/", "description": "Financial Theft" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Conti attack on Ireland's HSE, 2021", "url": "https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf", "description": "HSE: Conti cyber attack on the HSE, full report (PwC)" }, { "source_name": "Conti attack on Ireland's HSE, 2021", "url": "https://www.hhs.gov/sites/default/files/lessons-learned-hse-attack.pdf", "description": "HHS HC3: Lessons learned from the HSE cyber attack" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-3", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "T", "D" ], "mds2": [ "DTBK" ], "deck": "The Hospital", "rank": "3", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who decides on reconnection, and on what evidence?", "How will publication threats be handled without driving technical choices?", "Will you rebuild from known-good images even if it is slower?" ], "seen_in": [ "Conti attack on Ireland's HSE, 2021" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--61d20e5d-37c0-53af-9b0e-42f86de84b02", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-3 mitigation: Extortion deadlines rush the recovery", "description": "Recovery steps are decided on clinical and technical evidence, not on the extortion clock.\n\n1. Agree in advance who decides on reconnection and what evidence they need, independent of any ransom deadline.\n2. Prepare holding statements and patient lines so publication threats do not drive technical decisions.\n3. Rebuild from known-good images and verified backups even when that is slower than restoring in place.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-3", "mitigation_principle": "Recovery steps are decided on clinical and technical evidence, not on the extortion clock.", "design_measures": [ "Agree in advance who decides on reconnection and what evidence they need, independent of any ransom deadline.", "Prepare holding statements and patient lines so publication threats do not drive technical decisions.", "Rebuild from known-good images and verified backups even when that is slower than restoring in place." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d918e481-7aca-5b12-ac06-f6f3976052c8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--61d20e5d-37c0-53af-9b0e-42f86de84b02", "target_ref": "attack-pattern--d012bd75-3476-5e51-b0e7-3f75d0444068" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cff02807-13d7-5e6a-b01a-c4833aef66d9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Payments and claims stop flowing", "description": "Claims, eligibility checks and pharmacy payments run through a single clearing service or payer platform. When it is attacked, providers cannot verify cover or get paid, pharmacies cannot dispense on account, and smaller practices run out of cash within weeks.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/#cri-cd-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1486", "url": "https://attack.mitre.org/techniques/T1486/", "description": "Data Encrypted for Impact" }, { "source_name": "Change Healthcare, 2024", "url": "https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/change-healthcare-data-breach-toll-reaches-192-7-million", "description": "Becker's: Change Healthcare data breach toll reaches 192.7 million" }, { "source_name": "Change Healthcare, 2024", "url": "https://www.fiercehealthcare.com/payers/unitedhealth-estimates-190m-people-impacted-change-healthcare-cyberattack", "description": "Fierce Healthcare: UnitedHealth estimates 190M people impacted" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-2", "group_code": "CD", "group_name": "Continuity and Downtime", "stride": [ "D" ], "deck": "The Hospital", "rank": "2", "physical_safety": false, "mitigation_prompts": [ "Which payment or eligibility service would stop dispensing or billing?", "How long could smaller providers survive without payments?", "Can care continue when cover cannot be checked?" ], "seen_in": [ "Change Healthcare, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--d441a04b-5d4a-560a-969b-9a1be828e018", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-CD-2 mitigation: Payments and claims stop flowing", "description": "Clinical care continues when payment and eligibility services do not, and providers can survive a long payment outage.\n\n1. Agree with payers how care is authorised and paid when eligibility services are down.\n2. Keep a second route to submit claims and check cover, tested at least yearly.\n3. Plan financial reserves or emergency funding for a payment outage of several weeks.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-CD-2", "mitigation_principle": "Clinical care continues when payment and eligibility services do not, and providers can survive a long payment outage.", "design_measures": [ "Agree with payers how care is authorised and paid when eligibility services are down.", "Keep a second route to submit claims and check cover, tested at least yearly.", "Plan financial reserves or emergency funding for a payment outage of several weeks." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19eb7cb2-f206-5804-aeae-aa1103769cec", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--d441a04b-5d4a-560a-969b-9a1be828e018", "target_ref": "attack-pattern--cff02807-13d7-5e6a-b01a-c4833aef66d9" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--29d03310-5236-5467-80ab-94675d53f856", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CD Continuity and Downtime", "description": "Estate-wide ransomware, shared services, backups, restore validation, downtime procedures and copies, diversion, incident communications and extortion.", "context": "unspecified", "object_refs": [ "attack-pattern--879dcaf5-06d2-5c7f-bd3a-3a11d1d74de7", "course-of-action--c5a0289d-e4fb-5d74-afaf-4a881b747ea0", "attack-pattern--9c71057e-15be-51f0-ad65-79c3eeef4449", "course-of-action--88449f9a-18a2-5aa8-95ee-89bd2284b62f", "attack-pattern--f71796fc-ad6c-53c7-8ab6-70cc38b07a9c", "course-of-action--644cdac4-8d49-5f23-b0e7-7e487dc7200d", "attack-pattern--44ec7aaf-d455-5b66-9d29-c62c4c47b993", "course-of-action--c3d77478-3431-5ac9-82a7-4db0092d95d5", "attack-pattern--91b43522-bda9-5901-8c95-1fd76262dfb0", "course-of-action--d236dba7-e8f5-51d2-a04b-cbd221dd076b", "attack-pattern--82d2ff4b-4e60-5d1a-8fee-c3c76180da99", "course-of-action--86386589-9876-53e2-94fa-e368e59e2372", "attack-pattern--910b8fee-ba15-5bed-a5cc-beb7a505048b", "course-of-action--a59840aa-53c8-5021-a859-473369e66fcb", "attack-pattern--a3027ee5-bc19-504e-9278-d341b3960b42", "course-of-action--36dcff33-6e9e-51c7-9008-5f19386ade72", "attack-pattern--3467dcba-81e8-5dc5-963c-ea243f9b3994", "course-of-action--aeacd577-537e-5f58-bdfa-85fe8aafbe2e", "attack-pattern--8c98cd4d-8a9e-5c22-bcd3-d61d9f995f4f", "course-of-action--3268f62d-7463-57b4-82bb-914c093273a1", "attack-pattern--31d22056-5629-5ec9-9206-6eb21d31010a", "course-of-action--970b7181-64fe-5cff-8172-2ba5be7d34c0", "attack-pattern--d012bd75-3476-5e51-b0e7-3f75d0444068", "course-of-action--61d20e5d-37c0-53af-9b0e-42f86de84b02", "attack-pattern--cff02807-13d7-5e6a-b01a-c4833aef66d9", "course-of-action--d441a04b-5d4a-560a-969b-9a1be828e018" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-CD", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/continuity-and-downtime/" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--717d53e4-d528-56c4-a8c2-050c005ef854", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Life before login", "description": "Clinical urgency beats every control that slows care. Staff will bypass, share or switch off any security that delays treatment, so a design that only works when people comply fails on the busiest night, and a control that fails closed can harm a patient.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-1", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-1", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "capec", "external_id": "CAPEC-416", "url": "https://capec.mitre.org/data/definitions/416.html", "description": "Manipulate Human Behavior" }, { "source_name": "cwe", "external_id": "CWE-655", "url": "https://cwe.mitre.org/data/definitions/655.html", "description": "Insufficient Psychological Acceptability" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-1", "group_code": "TR", "group_name": "Trumps", "stride": [ "E" ], "mds2": [ "EMRG" ], "deck": "Both decks", "rank": "1", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which security steps slow care in an emergency, and by how long?", "Is the secure path also the fastest one on the busiest night?", "Which controls fail closed where failing closed could harm a patient?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--6b8489a8-df97-5a9b-8138-81b2c0c4b76c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-1 mitigation: Life before login", "description": "Design security so the safe and secure path is also the fastest path in an emergency.\n\n1. Time every security step in real clinical workflows and set targets in seconds.\n2. Provide accountable emergency access instead of hoping staff will not need it.\n3. Decide, per function, whether failure should be open or closed, and justify it in the safety case.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-1", "mitigation_principle": "Design security so the safe and secure path is also the fastest path in an emergency.", "design_measures": [ "Time every security step in real clinical workflows and set targets in seconds.", "Provide accountable emergency access instead of hoping staff will not need it.", "Decide, per function, whether failure should be open or closed, and justify it in the safety case." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5d146211-20a3-5eff-bcc2-70c01e51bbdd", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--6b8489a8-df97-5a9b-8138-81b2c0c4b76c", "target_ref": "attack-pattern--717d53e4-d528-56c4-a8c2-050c005ef854" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d59fe841-2a76-51a1-b74e-c21546db307a", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The device outlives its software", "description": "Medical devices stay in service for ten to twenty years, while their operating systems and components lose support in a few. Hospitals run certified builds that cannot change, so known weaknesses stay open for most of a device's life.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-2", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-2", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1104", "url": "https://cwe.mitre.org/data/definitions/1104.html", "description": "Use of Unmaintained Third Party Components" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" }, { "source_name": "Argus II retinal implant, 2020", "url": "https://spectrum.ieee.org/bionic-eye-obsolete", "description": "IEEE Spectrum: Their bionic eyes are now obsolete and unsupported" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-2", "group_code": "TR", "group_name": "Trumps", "mds2": [ "RDMP", "SBOM", "CSUP" ], "deck": "Both decks", "rank": "2", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How long will this device stay in service, and its software supported?", "What happens to it once its operating system loses support?", "Who plans the device's software life at purchase?" ], "seen_in": [ "Argus II retinal implant, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1d4729b3-0566-59db-b40f-ef743344621c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-2 mitigation: The device outlives its software", "description": "Plan the whole service life of a device's software at design and at purchase.\n\n1. Require a support roadmap for every third-party component and an end-of-support date in the contract.\n2. Design devices so components can be updated without replacing the clinical function.\n3. Budget and plan replacement or isolation before support ends, not after.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-2", "mitigation_principle": "Plan the whole service life of a device's software at design and at purchase.", "design_measures": [ "Require a support roadmap for every third-party component and an end-of-support date in the contract.", "Design devices so components can be updated without replacing the clinical function.", "Budget and plan replacement or isolation before support ends, not after." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9dfeef25-8139-55e7-a1e3-9abdd1ee7ca9", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1d4729b3-0566-59db-b40f-ef743344621c", "target_ref": "attack-pattern--d59fe841-2a76-51a1-b74e-c21546db307a" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c8e389d4-5d1f-5e57-bff9-70322ffdf389", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Nobody owns the bedside", "description": "Clinical engineering, IT, the supplier and the ward each assume another owns a connected device's security. Patching, monitoring, configuration and incident response fall between them, and attackers find the gaps first.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-3", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-3", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-671", "url": "https://cwe.mitre.org/data/definitions/671.html", "description": "Lack of Administrator Control over Security" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-3", "group_code": "TR", "group_name": "Trumps", "mds2": [ "SGUD" ], "deck": "Both decks", "rank": "3", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Who owns the security of each connected device in this design?", "Where do clinical engineering, IT, vendor and ward responsibilities meet?", "Who responds first when a bedside device is compromised?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--5b152825-95ad-51b2-889f-a2c58a7e76d8", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-3 mitigation: Nobody owns the bedside", "description": "Every connected device has a named owner for its security, across its whole life.\n\n1. Assign responsibilities for each device class in a written agreement between clinical engineering, IT and the supplier.\n2. Keep one inventory of connected devices, shared by all owners, with a named contact per device.\n3. Include connected devices in incident response playbooks with clear decision rights.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-3", "mitigation_principle": "Every connected device has a named owner for its security, across its whole life.", "design_measures": [ "Assign responsibilities for each device class in a written agreement between clinical engineering, IT and the supplier.", "Keep one inventory of connected devices, shared by all owners, with a named contact per device.", "Include connected devices in incident response playbooks with clear decision rights." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d65854de-8230-5f71-8c00-15f0e2c014c7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--5b152825-95ad-51b2-889f-a2c58a7e76d8", "target_ref": "attack-pattern--c8e389d4-5d1f-5e57-bff9-70322ffdf389" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b47e7211-2fb5-5ae5-b2d3-7634fe44f19f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Safety cases assume accidents", "description": "Risk files and safety cases model random failures and honest mistakes. An adversary chooses the worst moment, defeats several safeguards together and hides the evidence, so controls judged independent fail at once and residual risk is far higher than the file says.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-4", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-4", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T0880", "url": "https://attack.mitre.org/techniques/T0880/", "description": "Loss of Safety" }, { "source_name": "mitre-attack", "external_id": "T0837", "url": "https://attack.mitre.org/techniques/T0837/", "description": "Loss of Protection" }, { "source_name": "ISO 14971", "description": "ISO 14971:2019 Medical devices: application of risk management to medical devices" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "IEC TR 60601-4-5", "description": "IEC TR 60601-4-5:2021 Medical electrical equipment: safety-related technical security specifications" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-4", "group_code": "TR", "group_name": "Trumps", "mds2": [ "IGAU" ], "deck": "Both decks", "rank": "4", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Does the safety risk file treat an adversary as a cause of hazards?", "Which safeguards could one attacker defeat together?", "How would the residual risk change if failures were deliberate?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--e95b8fdf-777a-50da-a44f-4f959289902e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-4 mitigation: Safety cases assume accidents", "description": "Treat intentional misuse as a cause of hazards in the safety risk file, not a separate concern.\n\n1. Link security threats to hazards in the ISO 14971 risk file and score them together.\n2. Check that safeguards relied on as independent cannot be defeated by one compromise.\n3. Reassess the safety case whenever a new vulnerability or attack technique affects the device.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-4", "mitigation_principle": "Treat intentional misuse as a cause of hazards in the safety risk file, not a separate concern.", "design_measures": [ "Link security threats to hazards in the ISO 14971 risk file and score them together.", "Check that safeguards relied on as independent cannot be defeated by one compromise.", "Reassess the safety case whenever a new vulnerability or attack technique affects the device." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--909d39cf-66d1-5160-ad2f-513597ebbe86", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--e95b8fdf-777a-50da-a44f-4f959289902e", "target_ref": "attack-pattern--b47e7211-2fb5-5ae5-b2d3-7634fe44f19f" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1f0ef489-e541-51c0-b981-f7d0d345fb82", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Alarm fatigue hides the attack", "description": "Wards hear hundreds of alarms a shift, most of them false, so staff silence, widen or ignore them. Manipulated readings, suppressed alarms or a device behaving oddly blend into the noise and are noticed late, if at all.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-5", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-5", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-778", "url": "https://cwe.mitre.org/data/definitions/778.html", "description": "Insufficient Logging" }, { "source_name": "mitre-attack", "external_id": "T0832", "url": "https://attack.mitre.org/techniques/T0832/", "description": "Manipulation of View" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-5", "group_code": "TR", "group_name": "Trumps", "stride": [ "T", "R" ], "mds2": [ "AUDT", "IGAU" ], "deck": "Both decks", "rank": "5", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How many alarms does each ward hear in a shift?", "Would a manipulated alarm stand out from the noise?", "Who can change alarm settings, and is that protected?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--cb64638b-c1eb-5f3b-9081-27d3cb7ef433", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-5 mitigation: Alarm fatigue hides the attack", "description": "Alarms are few, meaningful and protected from change, so an abnormal one gets attention.\n\n1. Reduce non-actionable alarms through tuning and clinical review before adding new ones.\n2. Protect alarm limits and routing from unauthorised change and log every change.\n3. Report alarm silencing and limit changes per device so unusual patterns are seen.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-5", "mitigation_principle": "Alarms are few, meaningful and protected from change, so an abnormal one gets attention.", "design_measures": [ "Reduce non-actionable alarms through tuning and clinical review before adding new ones.", "Protect alarm limits and routing from unauthorised change and log every change.", "Report alarm silencing and limit changes per device so unusual patterns are seen." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6e994078-4e63-5f57-a2c0-a018e548e9c4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--cb64638b-c1eb-5f3b-9081-27d3cb7ef433", "target_ref": "attack-pattern--1f0ef489-e541-51c0-b981-f7d0d345fb82" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--dd20481e-1157-5262-a811-b8cee10aba10", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "One supplier, many hospitals", "description": "A handful of suppliers provide the record systems, laboratories, imaging platforms, remote service tools and clouds for most hospitals in a region or country. One compromise or one failure at a supplier becomes an incident at every customer together.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-6", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-6", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1357", "url": "https://cwe.mitre.org/data/definitions/1357.html", "description": "Reliance on Insufficiently Trustworthy Component" }, { "source_name": "mitre-attack", "external_id": "T1199", "url": "https://attack.mitre.org/techniques/T1199/", "description": "Trusted Relationship" }, { "source_name": "mitre-attack", "external_id": "T1195.002", "url": "https://attack.mitre.org/techniques/T1195/002/", "description": "Compromise Software Supply Chain" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.theregister.com/2025/06/26/qilin_ransomware_nhs_death/", "description": "The Register: Qilin ransomware attack on NHS supplier contributed to patient fatality" }, { "source_name": "Synnovis pathology attack, London, 2024", "url": "https://www.digitalhealth.net/2025/06/patient-dies-as-a-result-of-cyber-attack-on-nhs-pathology-provider/", "description": "Digital Health: Patient death linked to cyber attack on NHS pathology provider" }, { "source_name": "Change Healthcare, 2024", "url": "https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/change-healthcare-data-breach-toll-reaches-192-7-million", "description": "Becker's: Change Healthcare data breach toll reaches 192.7 million" }, { "source_name": "Change Healthcare, 2024", "url": "https://www.fiercehealthcare.com/payers/unitedhealth-estimates-190m-people-impacted-change-healthcare-cyberattack", "description": "Fierce Healthcare: UnitedHealth estimates 190M people impacted" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-6", "group_code": "TR", "group_name": "Trumps", "stride": [ "D" ], "mds2": [ "RMOT" ], "deck": "Both decks", "rank": "6", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Which suppliers in this design also serve most nearby hospitals?", "What would one supplier's compromise do to every customer at once?", "How would you keep working without that supplier?" ], "seen_in": [ "Synnovis pathology attack, London, 2024", "Change Healthcare, 2024" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--da9ef02f-5635-5677-a5c1-43ce25f55457", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-6 mitigation: One supplier, many hospitals", "description": "Know where many hospitals share one supplier and keep a way to work without it.\n\n1. Map shared suppliers across the region and treat concentration as a risk to manage.\n2. Require suppliers to separate customers so one breach does not reach all of them.\n3. Plan mutual aid and fallbacks that do not use the same supplier.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-6", "mitigation_principle": "Know where many hospitals share one supplier and keep a way to work without it.", "design_measures": [ "Map shared suppliers across the region and treat concentration as a risk to manage.", "Require suppliers to separate customers so one breach does not reach all of them.", "Plan mutual aid and fallbacks that do not use the same supplier." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dabc28b2-5ffd-5939-9061-d66873cc00c4", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--da9ef02f-5635-5677-a5c1-43ce25f55457", "target_ref": "attack-pattern--dd20481e-1157-5262-a811-b8cee10aba10" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--737911fb-980d-59f9-9a4d-c523dc31f203", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Patch means revalidate", "description": "Changing a certified device's software means verification by the maker and sometimes the regulator, and hospitals are told not to patch themselves. Fixes arrive months or years after the weakness is public, and the hospital must defend a device it is not allowed to change.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-7", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-7", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-1329", "url": "https://cwe.mitre.org/data/definitions/1329.html", "description": "Reliance on Component That is Not Updateable" }, { "source_name": "mitre-emb3d", "external_id": "TID-213", "url": "https://emb3d.mitre.org/threats/TID-213.html", "description": "Faulty FW/SW Update Integrity Verification" }, { "source_name": "FDA premarket", "description": "FDA, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026)" }, { "source_name": "AAMI SW96", "description": "ANSI/AAMI SW96:2023 Standard for medical device security: security risk management for device manufacturers" }, { "source_name": "IEC 81001-5-1", "description": "IEC 81001-5-1:2021 Health software and health IT systems safety, effectiveness and security: security activities in the product life cycle" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-7", "group_code": "TR", "group_name": "Trumps", "mds2": [ "CSUP", "RDMP" ], "deck": "Both decks", "rank": "7", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "How long does a validated fix take to reach this device?", "What may the hospital do while a fix is awaited?", "Does the contract commit the maker to timely validated updates?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--1e161ccf-fb29-511e-9376-f9f25c7e6abe", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-7 mitigation: Patch means revalidate", "description": "Design and contract for timely, validated updates as part of the device, not an exception.\n\n1. Design devices so security updates can be verified quickly without re-certifying clinical function.\n2. Agree update timelines and compensating controls in the purchase contract.\n3. Isolate and monitor devices awaiting validated updates, with the supplier's guidance.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-7", "mitigation_principle": "Design and contract for timely, validated updates as part of the device, not an exception.", "design_measures": [ "Design devices so security updates can be verified quickly without re-certifying clinical function.", "Agree update timelines and compensating controls in the purchase contract.", "Isolate and monitor devices awaiting validated updates, with the supplier's guidance." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--50ca8d24-cd3a-57c1-a4c2-562b2bb2203f", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--1e161ccf-fb29-511e-9376-f9f25c7e6abe", "target_ref": "attack-pattern--737911fb-980d-59f9-9a4d-c523dc31f203" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f025c68b-cd4e-598d-adb6-d97401e62905", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Every patient is a target", "description": "Health records are permanent, deeply personal and valuable for fraud, extortion, discrimination and intelligence. Every patient is a data subject whose information can be sold, published or used against them, long after the care has ended.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-8", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-8", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "cwe", "external_id": "CWE-359", "url": "https://cwe.mitre.org/data/definitions/359.html", "description": "Exposure of Private Personal Information to an Unauthorized Actor" }, { "source_name": "ISO 27799", "description": "ISO 27799 Health informatics: information security management in health using ISO/IEC 27002" }, { "source_name": "Vastaamo psychotherapy records, Finland, 2020", "url": "https://en.wikipedia.org/wiki/Vastaamo_data_breach", "description": "Wikipedia: Vastaamo data breach" }, { "source_name": "Vastaamo psychotherapy records, Finland, 2020", "url": "https://ny1.com/nyc/all-boroughs/ap-top-news/2024/04/30/finnish-hacker-gets-prison-for-accessing-thousands-of-psychotherapy-records-and-demanding-ransoms", "description": "AP via NY1: Finnish hacker gets prison for accessing psychotherapy records" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-8", "group_code": "TR", "group_name": "Trumps", "stride": [ "I" ], "linddun": [ "L", "I", "DD", "U", "Nc" ], "mds2": [ "MPII", "STCF", "DIDT" ], "deck": "Both decks", "rank": "8", "physical_safety": false, "mitigation_prompts": [ "What patient data does this design collect that care doesn't need?", "Which data would do most harm if sold or published?", "How long is patient data kept after care ends?" ], "seen_in": [ "Vastaamo psychotherapy records, Finland, 2020" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--53e5a5dc-e038-55af-b6b1-c3bcc5b90e3c", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-8 mitigation: Every patient is a target", "description": "Collect, keep and expose only what care needs, and protect the most sensitive data most strongly.\n\n1. Classify record categories by sensitivity and apply stronger controls to the most sensitive.\n2. Minimise copies of patient data in secondary systems, exports and test environments.\n3. Give patients a way to see who has accessed their record.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-8", "mitigation_principle": "Collect, keep and expose only what care needs, and protect the most sensitive data most strongly.", "design_measures": [ "Classify record categories by sensitivity and apply stronger controls to the most sensitive.", "Minimise copies of patient data in secondary systems, exports and test environments.", "Give patients a way to see who has accessed their record." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7e551ea6-4496-522d-b844-a3bca854f8e5", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--53e5a5dc-e038-55af-b6b1-c3bcc5b90e3c", "target_ref": "attack-pattern--f025c68b-cd4e-598d-adb6-d97401e62905" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--50fae21a-c84b-53dc-b4e4-c7e1ddb5c38e", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "The hospital never closes", "description": "Hospitals run every hour of every day with no maintenance window. Patching, testing and recovery all compete with care, and the only way to switch a hospital off safely is to divert patients elsewhere.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-9", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-9", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T0826", "url": "https://attack.mitre.org/techniques/T0826/", "description": "Loss of Availability" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-9", "group_code": "TR", "group_name": "Trumps", "stride": [ "D" ], "mds2": [ "DTBK", "CSUP" ], "deck": "Both decks", "rank": "9", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "When can this system be patched, tested or restored without stopping care?", "What does the design assume about maintenance windows?", "Is diversion the only way to take this service offline safely?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--a2a36639-e024-527b-83bc-06f6a0730052", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-9 mitigation: The hospital never closes", "description": "Build maintenance and recovery into the design so they do not require stopping care.\n\n1. Design redundant clinical systems so one side can be updated while the other runs.\n2. Plan maintenance with clinical leads around activity, not around IT convenience.\n3. Treat the ability to recover without closing as a design requirement.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-9", "mitigation_principle": "Build maintenance and recovery into the design so they do not require stopping care.", "design_measures": [ "Design redundant clinical systems so one side can be updated while the other runs.", "Plan maintenance with clinical leads around activity, not around IT convenience.", "Treat the ability to recover without closing as a design requirement." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23e686d4-5287-57dc-a09b-ab57cdd6b5e7", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--a2a36639-e024-527b-83bc-06f6a0730052", "target_ref": "attack-pattern--50fae21a-c84b-53dc-b4e4-c7e1ddb5c38e" }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--08b4f3e0-a555-588d-9e84-d47c18fa1049", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "Hospitals are strategic targets", "description": "Hospitals are critical infrastructure. Criminals target them because they pay, and states may pre-position in them or disrupt them in a crisis or conflict to cause fear and overwhelm emergency response. Plans built for accidents and petty crime do not survive a determined adversary.", "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR-10", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/#cri-tr-10", "description": "Hospital and Medical Device Threat Taxonomy v1.0, the reference for the Critical Condition card game" }, { "source_name": "mitre-attack", "external_id": "T1078", "url": "https://attack.mitre.org/techniques/T1078/", "description": "Valid Accounts" }, { "source_name": "mitre-attack", "external_id": "T1133", "url": "https://attack.mitre.org/techniques/T1133/", "description": "External Remote Services" }, { "source_name": "IEC 62443", "description": "IEC 62443 Security for industrial automation and control systems" }, { "source_name": "IEC 80001-1", "description": "IEC 80001-1:2021 Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software" } ], "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-10", "group_code": "TR", "group_name": "Trumps", "stride": [ "D", "E" ], "deck": "Both decks", "rank": "10", "physical_safety": true, "harm": "care", "mitigation_prompts": [ "Does the design assume a patient, capable adversary or just criminals?", "What would a state actor gain by disrupting this system in a crisis?", "Which plans would fail against a deliberate, coordinated attack?" ] } } }, { "type": "course-of-action", "spec_version": "2.1", "id": "course-of-action--9b9e4331-7e20-5647-aa09-6efe952ab551", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "CRI-TR-10 mitigation: Hospitals are strategic targets", "description": "Plan for a patient, capable adversary who wants disruption, not only for criminals who want money.\n\n1. Include state-level scenarios, such as simultaneous attacks on several hospitals, in continuity planning.\n2. Share threat intelligence with sector bodies and national authorities and act on it.\n3. Hunt for long-term access in clinical and device networks, not only for ransomware.", "extensions": { "extension-definition--299b5d5a-77c7-5142-846a-1a455069d1a3": { "extension_type": "property-extension", "taxonomy": "Hospital and Medical Device Threat Taxonomy", "reference": "CRI-TR-10", "mitigation_principle": "Plan for a patient, capable adversary who wants disruption, not only for criminals who want money.", "design_measures": [ "Include state-level scenarios, such as simultaneous attacks on several hospitals, in continuity planning.", "Share threat intelligence with sector bodies and national authorities and act on it.", "Hunt for long-term access in clinical and device networks, not only for ransomware." ] } } }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--85283ac3-d2d6-5f10-b437-3f728b085102", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "relationship_type": "mitigates", "source_ref": "course-of-action--9b9e4331-7e20-5647-aa09-6efe952ab551", "target_ref": "attack-pattern--08b4f3e0-a555-588d-9e84-d47c18fa1049" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--27068e0c-0613-5294-9c5e-ad16cc323051", "created": "2026-11-04T00:00:00.000Z", "modified": "2026-11-04T00:00:00.000Z", "created_by_ref": "identity--f0ac97b8-3341-535d-8958-671009eaf1eb", "object_marking_refs": [ "marking-definition--641afd15-0bc3-5c47-9044-93340639cfe8", "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487" ], "name": "TR Structural hazards", "description": "Ten structural hazards of hospitals and medical devices as a whole. Both decks carry them, ranked 1 (highest) to 10.", "context": "unspecified", "object_refs": [ "attack-pattern--717d53e4-d528-56c4-a8c2-050c005ef854", "course-of-action--6b8489a8-df97-5a9b-8138-81b2c0c4b76c", "attack-pattern--d59fe841-2a76-51a1-b74e-c21546db307a", "course-of-action--1d4729b3-0566-59db-b40f-ef743344621c", "attack-pattern--c8e389d4-5d1f-5e57-bff9-70322ffdf389", "course-of-action--5b152825-95ad-51b2-889f-a2c58a7e76d8", "attack-pattern--b47e7211-2fb5-5ae5-b2d3-7634fe44f19f", "course-of-action--e95b8fdf-777a-50da-a44f-4f959289902e", "attack-pattern--1f0ef489-e541-51c0-b981-f7d0d345fb82", "course-of-action--cb64638b-c1eb-5f3b-9081-27d3cb7ef433", "attack-pattern--dd20481e-1157-5262-a811-b8cee10aba10", "course-of-action--da9ef02f-5635-5677-a5c1-43ce25f55457", "attack-pattern--737911fb-980d-59f9-9a4d-c523dc31f203", "course-of-action--1e161ccf-fb29-511e-9376-f9f25c7e6abe", "attack-pattern--f025c68b-cd4e-598d-adb6-d97401e62905", "course-of-action--53e5a5dc-e038-55af-b6b1-c3bcc5b90e3c", "attack-pattern--50fae21a-c84b-53dc-b4e4-c7e1ddb5c38e", "course-of-action--a2a36639-e024-527b-83bc-06f6a0730052", "attack-pattern--08b4f3e0-a555-588d-9e84-d47c18fa1049", "course-of-action--9b9e4331-7e20-5647-aa09-6efe952ab551" ], "external_references": [ { "source_name": "ostering", "external_id": "CRI-TR", "url": "https://ostering.com/taxonomies/hospitals-and-medical-devices/structural-hazards/" } ] } ] }