> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.
# Imaging and Radiation (IR)
- URL: https://www.ostering.com/taxonomies/hospital-and-medical-devices/cri-imaging-and-radiation/
- Published: 2026-11-05T21:00:00.000Z
- Updated: 2026-11-05T20:42:19.869Z
- Description: Imaging and Radiation: 13 threats in the Hospital and Medical Device Threat Taxonomy, each with a principle, design measures and mappings.
- Author: Brett Crawley
[Taxonomies](/taxonomies/) › [Hospitals and medical devices](/taxonomies/hospital-and-medical-devices/) › Imaging and Radiation
**The Patient · CRI-IR · suit 06 of 17 · 13 entries**
X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine and radiotherapy, with their worklists, workstations, images and dose.
**Scope:** X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine, radiotherapy linacs and treatment planning; dose parameters, modality worklists, image tampering (adding or removing findings), DICOM files as malware carriers, modality workstations on old Windows, vendor remote service, treatment plan integrity, patient mix-ups, MRI safety interlocks.
Entries are ranked Ace (most severe) to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding in your own system.
*Text version: every entry is written out below, with its card prompts and mappings. The same text is in the PDF and Excel downloads on the [overview page](/taxonomies/hospital-and-medical-devices/#downloads).*
## The threats
### CRI-IR-A Radiotherapy plan altered before delivery
**† Direct harm**
**Threat.** Treatment plans pass from the planning system through the oncology information system to the linac. A changed dose, field shape, gantry angle or patient position between approval and delivery can give a serious overdose or miss the tumour, and harm may appear only weeks later.
**Principle.** The plan delivered is provably the plan the clinicians approved.
**Design measures:**
1. Sign the approved plan in the planning system and verify the signature at the treatment console.
2. Run independent dose verification of the delivered plan before the first fraction.
3. Log every plan modification with user and reason, and alert on changes after approval.
**Card prompts:**
- How do you prove the plan delivered matches the plan approved?
- Which systems can change a plan between approval and the linac?
- Would a changed field or dose be caught before the first fraction?
**Mappings:** STRIDE T, R · CAPEC-165, CAPEC-148 · CWE-353, CWE-354 · ATT&CK T1565.001, T0836 · MDS2 IGAU, AUDT, NAUT · IEC 80001-1; IEC 62304
### CRI-IR-K Radiotherapy service halted
**† Wrong or delayed treatment**
**Threat.** Linacs depend on planning systems, oncology information systems and, increasingly, vendor-hosted cloud services. Ransomware at the hospital or the vendor stops treatment courses that must not be interrupted, and patients' cancers progress.
**Principle.** Radiotherapy can continue safely for a defined period when its supporting systems are lost.
**Design measures:**
1. Hold an offline, verified copy of active treatment plans and schedules for each linac.
2. Plan and rehearse transfer of patients to partner centres with compatible equipment.
3. Require vendors to document continuity for cloud-hosted components in the contract.
**Card prompts:**
- How long can radiotherapy continue without its planning and cloud systems?
- Which vendor services does treatment delivery depend on?
- Who decides which patients' courses continue during an outage?
**Mappings:** STRIDE D · CAPEC-607 · CWE-1357 · ATT&CK T1486, T1490 · MDS2 DTBK, RDMP · IEC 80001-1
### CRI-IR-Q Image tampering adds or removes findings
**† Wrong or delayed treatment**
**Threat.** Images move from scanner to archive to reporting workstation, often without integrity protection. An attacker can add or remove a tumour, bleed or fracture in CT, MRI or X-ray images, leading to unnecessary surgery or missed treatment that radiologists cannot detect by eye.
**Principle.** Diagnostic images are integrity-protected from acquisition to reporting.
**Design measures:**
1. Sign or hash images at the modality and verify them in the archive and on the viewer.
2. Use TLS for all DICOM transfers inside the hospital, not only external ones.
3. Alert when an image object is modified after acquisition and keep the original.
**Card prompts:**
- Where are images integrity-protected between scanner and reporting?
- Could a radiologist tell that a finding had been added or removed?
- Who can write to the image archive?
**Mappings:** STRIDE T · CAPEC-148, CAPEC-94 · CWE-353, CWE-319 · ATT&CK T1565.002, T1565.001 · EMB3D TID-408 · MDS2 IGAU, TXIG · DICOM PS3.15; IEC 80001-1
### CRI-IR-J Imaging dose protocols raised
**† Direct harm**
**Threat.** CT, fluoroscopy, mammography and X-ray dose depends on protocol libraries pushed to scanners. A tampered protocol raises tube current or exposure time across many patients, and the extra radiation is not noticed until audits or injuries appear.
**Principle.** Dose protocols are controlled, and dose outside reference levels is caught at the scanner.
**Design measures:**
1. Sign protocol libraries and require physicist approval for changes.
2. Enforce dose alerts and notifications at the scanner against reference levels.
3. Monitor dose records centrally and alarm on shifts in average dose per protocol.
**Card prompts:**
- Who can change scanner dose protocols, and is it reviewed?
- How is dose outside reference levels caught at the scanner?
- How long would raised doses go unnoticed across many patients?
**Mappings:** STRIDE T · CAPEC-176, CAPEC-75 · CWE-353, CWE-732 · ATT&CK T0836 · MDS2 IGAU, AUTH, AUDT · IEC 80001-1
### CRI-IR-10 DICOM files carry malware
**Threat.** DICOM image files can also be valid executables, and images arrive on CDs, USB drives, shares and from other hospitals. Malware hides in patient images, and anti-malware that quarantines the file deletes clinical evidence.
**Principle.** Imported images are parsed and checked in isolation before they reach clinical workstations.
**Design measures:**
1. Import external media through an isolated gateway that validates DICOM structure and strips unexpected content.
2. Disable autorun and execution of files from imaging import folders.
3. Agree with the vendor how infected images are handled without losing the clinical record.
**Card prompts:**
- Where are imported images parsed before they reach clinical workstations?
- What happens to an image file that anti-malware flags?
- Which routes bring outside images in: CD, USB, share, network?
**Mappings:** STRIDE T, E · CAPEC-636, CAPEC-457 · CWE-434, CWE-1287 · ATT&CK T1204.002, T1027.009 · EMB3D TID-111 · MDS2 MLDP, SAHD · DICOM PS3.15
### CRI-IR-9 Scanners stuck on unsupported systems
**† Wrong or delayed treatment**
**Threat.** CT, MRI and X-ray consoles often run operating systems the vendor certified years ago and that can no longer be patched. Ransomware spreading across the network shuts scanners down, and emergency imaging stops.
**Principle.** Imaging consoles that cannot be patched are isolated and kept recoverable.
**Design measures:**
1. Place modalities in their own network segment allowing only DICOM traffic to named systems.
2. Require vendors to commit to supported operating system lifetimes and validated patches.
3. Keep a tested restore image for each console and practise recovery.
**Card prompts:**
- Which imaging consoles run operating systems that can't be patched?
- What could reach those consoles if ransomware spread?
- How quickly could a scanner be rebuilt and back in service?
**Mappings:** STRIDE D, E · CAPEC-682 · CWE-1104, CWE-1329 · ATT&CK T1210, T1486 · EMB3D TID-210 · MDS2 RDMP, CSUP, SAHD · IEC 80001-1; AAMI SW96
### CRI-IR-8 Worklist mix-up assigns wrong patient
**† Wrong or delayed treatment**
**Threat.** Scanners take patient details from the modality worklist. A spoofed worklist server or altered entry puts images under the wrong patient, so a scan is reported for one person and acted on for another.
**Principle.** Patient identity on images comes from an authenticated worklist and is confirmed at the scanner.
**Design measures:**
1. Authenticate the worklist server to the modality and restrict who can query it.
2. Confirm patient identity at the scanner against the wristband before acquisition.
3. Reconcile acquired studies with orders and flag mismatches before reporting.
**Card prompts:**
- How does the scanner know the worklist server is genuine?
- Where is patient identity confirmed before the scan starts?
- How would images filed under the wrong patient be spotted?
**Mappings:** STRIDE S, T · LINDDUN I · CAPEC-151, CAPEC-194 · CWE-290, CWE-346 · ATT&CK T1557 · MDS2 NAUT, IGAU · DICOM PS3.15
### CRI-IR-7 MRI safety limits overridden
**† Direct harm**
**Threat.** MRI scanners limit gradient switching and radiofrequency energy to prevent burns and nerve stimulation, and manage helium and quench systems. Altered limits, monitoring software or service settings can burn a patient or damage the magnet.
**Principle.** Patient safety limits in MRI are enforced in hardware or protected firmware, not configurable software.
**Design measures:**
1. Enforce specific absorption rate and gradient limits in a protected controller.
2. Separate quench and cryogen monitoring from the networked console.
3. Restrict service settings to authenticated engineers with logged sessions.
**Card prompts:**
- Are MRI safety limits enforced in hardware, firmware or settings?
- Who can change gradient, energy or quench settings?
- What alerts staff if a safety limit has been altered?
**Mappings:** STRIDE T, E · CAPEC-176, CAPEC-121 · CWE-1244, CWE-863 · ATT&CK T0836, T0837 · EMB3D TID-224 · MDS2 AUTH, AUDT · IEC TR 60601-4-5
### CRI-IR-6 Nuclear medicine activity misrecorded
**† Direct harm**
**Threat.** Dose calibrators and radiopharmacy software record the activity drawn for each patient. Altered calibration factors or records give patients the wrong radiation dose or invalidate scans.
**Principle.** Radiopharmaceutical activity is measured and recorded with verified calibration.
**Design measures:**
1. Protect calibration factors from change without physicist approval.
2. Check calibrators daily against a reference source and record the result.
3. Keep activity records append-only and linked to the order.
**Card prompts:**
- How are dose calibrator calibration factors protected and checked?
- Who can edit the activity recorded for a patient?
- Would a wrong dose show up before administration?
**Mappings:** STRIDE T, R · CAPEC-165 · CWE-353 · ATT&CK T1565.001 · MDS2 IGAU, AUDT
### CRI-IR-5 Imaging archive exposed online
**Threat.** Image archives and DICOM nodes reachable from the internet, or from guest networks, answer queries without authentication. Millions of images and reports with names and dates of birth can be downloaded.
**Principle.** Image archives answer only authenticated, authorised systems on approved networks.
**Design measures:**
1. Never expose DICOM services directly to the internet; use authenticated gateways for external sharing.
2. Require node authentication and TLS for every DICOM association.
3. Scan regularly for exposed imaging services.
**Card prompts:**
- Can the image archive be queried from the internet or guest Wi-Fi?
- Which systems may query the archive, and how are they authenticated?
- When did anyone last check what the archive answers to?
**Mappings:** STRIDE I · LINDDUN DD, I · CAPEC-1, CAPEC-158 · CWE-306, CWE-359 · ATT&CK T1190 · EMB3D TID-310 · MDS2 NAUT, TXCF, AUTH · DICOM PS3.15; ISO 27799
### CRI-IR-4 Image metadata re-identifies patients
**Threat.** Images shared for research, teaching or AI training keep patient details in headers, burned-in text or the anatomy itself. Head CT and MRI can be rendered into recognisable faces, so de-identified data identifies people.
**Principle.** Images leaving clinical use are de-identified in headers, pixels and anatomy, and checked.
**Design measures:**
1. Apply a de-identification profile that covers headers, private tags and burned-in annotations.
2. Deface head and neck studies before release.
3. Check a sample of every release for residual identifiers.
**Card prompts:**
- What patient details remain in images shared for research or AI?
- Is burned-in text removed from the pixels as well as headers?
- Could a head scan be rendered into a recognisable face?
**Mappings:** STRIDE I · LINDDUN I, L, DD · CAPEC-497 · CWE-1230, CWE-359 · MDS2 DIDT · DICOM PS3.15; ISO 27799
### CRI-IR-3 Portable imaging stores images unprotected
**Threat.** Portable ultrasound and X-ray units and handheld probes paired to phones store images locally and upload to clouds. A lost device or an unencrypted upload discloses patient images.
**Principle.** Portable imaging keeps no more data than needed, encrypted, and uploads only to approved destinations.
**Design measures:**
1. Encrypt local image storage and wipe images after confirmed transfer.
2. Restrict uploads to the hospital archive or an approved, contracted service.
3. Support remote wipe and inventory for portable units and their phones.
**Card prompts:**
- What images stay stored on portable units and paired phones?
- Where do portable devices upload, and is that approved?
- What happens to images when a handheld probe is lost?
**Mappings:** STRIDE I · LINDDUN DD · CAPEC-507 · CWE-359 · ATT&CK T1005 · MDS2 STCF, TXCF, PLOK · ISO 27799
### CRI-IR-2 Viewer presets that hide findings
**† Wrong or delayed treatment**
**Threat.** Diagnostic viewers and displays rely on window settings, presets and calibration. Altered presets or display calibration can make a subtle finding invisible, and the radiologist reports a normal study.
**Principle.** Viewer presets and display calibration are controlled and checked.
**Design measures:**
1. Manage presets centrally with change control and version history.
2. Run regular display calibration checks and log results.
3. Show when a non-standard preset is in use.
**Card prompts:**
- Who can change viewer presets and window settings?
- How is display calibration checked, and how often?
- Would a changed preset be visible to the radiologist?
**Mappings:** STRIDE T · CAPEC-176 · CWE-451 · ATT&CK T1565.003 · MDS2 IGAU
## Seen in the wild
- **Elekta cloud outage, 2021** ([CRI-IR-K](/taxonomies/hospital-and-medical-devices/cri-imaging-and-radiation/#cri-ir-k)). Ransomware hit Elekta's first-generation US cloud service for radiation oncology software, and about 170 US health systems were affected; some cancer centres could not treat patients for over a week because treatment programming was held in the cloud. Sources: [Compliancy Group: Healthcare vendor ransomware attack, 170 health systems hit](https://compliancy-group.com/healthcare-vendor-ransomware-attack-170-health-systems-hit/); [Yale Daily News: YNHHS pauses radiotherapy treatment for six days](https://yaledailynews.com/blog/2021/04/27/ynhhs-pauses-radiotherapy-treatment-for-six-days-after-software-breach).
- **DICOM files carrying malware, 2019** ([CRI-IR-10](/taxonomies/hospital-and-medical-devices/cri-imaging-and-radiation/#cri-ir-10)). Cylera researchers showed that the DICOM file format allows an image file to also be a working Windows executable, so malware could hide inside medical images protected as patient data (CVE-2019-11687). Sources: [NVD: CVE-2019-11687](https://web.nvd.nist.gov/vuln/detail/CVE-2019-11687); [GovInfoSecurity: Researchers, malware can be hidden in medical images](https://www.govinfosecurity.com/researchers-malware-be-hidden-in-medical-images-a-12388).
- **WannaCry and the NHS, 2017** ([CRI-IR-9](/taxonomies/hospital-and-medical-devices/cri-imaging-and-radiation/#cri-ir-9)). WannaCry ransomware disrupted at least 81 of England's 236 NHS trusts and infected 595 GP practices; the NAO estimated over 19,000 appointments were cancelled, and some trusts diverted ambulances. Sources: [NAO: Investigation, WannaCry cyber attack and the NHS](https://www.nao.org.uk/reports/investigation-wannacry-cyber-attack-and-the-nhs/); [GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks](https://www.gov.uk/government/news/foreign-office-minister-condemns-north-korean-actor-for-wannacry-attacks).
- **Open PACS servers, 2019** ([CRI-IR-5](/taxonomies/hospital-and-medical-devices/cri-imaging-and-radiation/#cri-ir-5)). Greenbone found about 590 imaging archive (PACS) servers reachable on the internet without protection, exposing records of about 24 million patients and hundreds of millions of images; an update later counted over a billion images. Sources: [Help Net Security: Confidential data of 24.3 million patients discovered online](https://www.helpnetsecurity.com/2019/09/18/confidential-patient-data/); [HIPAA Journal: Exposed medical image total rises to 1.19 billion](https://www.hipaajournal.com/update-issued-on-unsecured-pacs-as-exposed-medical-image-total-rises-to-1-19-billion/).
## Mappings
Across the 13 entries, the STRIDE counts are Tampering 8, Elevation of privilege 3, Information disclosure 3, Repudiation 2, Denial of service 2, Spoofing 1 (an entry can carry more than one). 13 map to CAPEC 3.9, 13 to CWE 5.0, 12 to ATT&CK v20.0, 5 to MITRE EMB3D and 4 to LINDDUN. The MDS2 capabilities a buyer should check first are IGAU (6), AUDT (4), NAUT (3). 4 carry the red † for direct harm and 5 the amber † for wrong or delayed treatment. A blank means nothing fitted well; a loose tag would mislead.
---
← [Medication Delivery](/taxonomies/hospital-and-medical-devices/cri-medication-delivery/) · [Hospitals and medical devices overview](/taxonomies/hospital-and-medical-devices/) · [Laboratory and Diagnostics](/taxonomies/hospital-and-medical-devices/cri-laboratory-and-diagnostics/) →
*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [hospitals and medical devices overview](/taxonomies/hospital-and-medical-devices/).*