Imaging and Radiation (IR)

Imaging and Radiation (CRI-IR), The Patient: a radiograph of a CT gantry ring around a skull.

Taxonomies › Hospitals and medical devices › Imaging and Radiation

The Patient · CRI-IR · suit 06 of 17 · 13 entries

X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine and radiotherapy, with their worklists, workstations, images and dose.

Scope: X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine, radiotherapy linacs and treatment planning; dose parameters, modality worklists, image tampering (adding or removing findings), DICOM files as malware carriers, modality workstations on old Windows, vendor remote service, treatment plan integrity, patient mix-ups, MRI safety interlocks.

Entries are ranked Ace (most severe) to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding in your own system.

Imaging and Radiation: each entry's ID, title, threat, mitigation principle and design measures. The full text follows below.

Text version: every entry is written out below, with its card prompts and mappings. The same text is in the PDF and Excel downloads on the overview page.

The threats

CRI-IR-A Radiotherapy plan altered before delivery

† Direct harm

Threat. Treatment plans pass from the planning system through the oncology information system to the linac. A changed dose, field shape, gantry angle or patient position between approval and delivery can give a serious overdose or miss the tumour, and harm may appear only weeks later.

Principle. The plan delivered is provably the plan the clinicians approved.

Design measures:

  1. Sign the approved plan in the planning system and verify the signature at the treatment console.
  2. Run independent dose verification of the delivered plan before the first fraction.
  3. Log every plan modification with user and reason, and alert on changes after approval.

Card prompts:

  • How do you prove the plan delivered matches the plan approved?
  • Which systems can change a plan between approval and the linac?
  • Would a changed field or dose be caught before the first fraction?

Mappings: STRIDE T, R · CAPEC-165, CAPEC-148 · CWE-353, CWE-354 · ATT&CK T1565.001, T0836 · MDS2 IGAU, AUDT, NAUT · IEC 80001-1; IEC 62304

CRI-IR-K Radiotherapy service halted

† Wrong or delayed treatment

Threat. Linacs depend on planning systems, oncology information systems and, increasingly, vendor-hosted cloud services. Ransomware at the hospital or the vendor stops treatment courses that must not be interrupted, and patients’ cancers progress.

Principle. Radiotherapy can continue safely for a defined period when its supporting systems are lost.

Design measures:

  1. Hold an offline, verified copy of active treatment plans and schedules for each linac.
  2. Plan and rehearse transfer of patients to partner centres with compatible equipment.
  3. Require vendors to document continuity for cloud-hosted components in the contract.

Card prompts:

  • How long can radiotherapy continue without its planning and cloud systems?
  • Which vendor services does treatment delivery depend on?
  • Who decides which patients’ courses continue during an outage?

Mappings: STRIDE D · CAPEC-607 · CWE-1357 · ATT&CK T1486, T1490 · MDS2 DTBK, RDMP · IEC 80001-1

CRI-IR-Q Image tampering adds or removes findings

† Wrong or delayed treatment

Threat. Images move from scanner to archive to reporting workstation, often without integrity protection. An attacker can add or remove a tumour, bleed or fracture in CT, MRI or X-ray images, leading to unnecessary surgery or missed treatment that radiologists cannot detect by eye.

Principle. Diagnostic images are integrity-protected from acquisition to reporting.

Design measures:

  1. Sign or hash images at the modality and verify them in the archive and on the viewer.
  2. Use TLS for all DICOM transfers inside the hospital, not only external ones.
  3. Alert when an image object is modified after acquisition and keep the original.

Card prompts:

  • Where are images integrity-protected between scanner and reporting?
  • Could a radiologist tell that a finding had been added or removed?
  • Who can write to the image archive?

Mappings: STRIDE T · CAPEC-148, CAPEC-94 · CWE-353, CWE-319 · ATT&CK T1565.002, T1565.001 · EMB3D TID-408 · MDS2 IGAU, TXIG · DICOM PS3.15; IEC 80001-1

CRI-IR-J Imaging dose protocols raised

† Direct harm

Threat. CT, fluoroscopy, mammography and X-ray dose depends on protocol libraries pushed to scanners. A tampered protocol raises tube current or exposure time across many patients, and the extra radiation is not noticed until audits or injuries appear.

Principle. Dose protocols are controlled, and dose outside reference levels is caught at the scanner.

Design measures:

  1. Sign protocol libraries and require physicist approval for changes.
  2. Enforce dose alerts and notifications at the scanner against reference levels.
  3. Monitor dose records centrally and alarm on shifts in average dose per protocol.

Card prompts:

  • Who can change scanner dose protocols, and is it reviewed?
  • How is dose outside reference levels caught at the scanner?
  • How long would raised doses go unnoticed across many patients?

Mappings: STRIDE T · CAPEC-176, CAPEC-75 · CWE-353, CWE-732 · ATT&CK T0836 · MDS2 IGAU, AUTH, AUDT · IEC 80001-1

CRI-IR-10 DICOM files carry malware

Threat. DICOM image files can also be valid executables, and images arrive on CDs, USB drives, shares and from other hospitals. Malware hides in patient images, and anti-malware that quarantines the file deletes clinical evidence.

Principle. Imported images are parsed and checked in isolation before they reach clinical workstations.

Design measures:

  1. Import external media through an isolated gateway that validates DICOM structure and strips unexpected content.
  2. Disable autorun and execution of files from imaging import folders.
  3. Agree with the vendor how infected images are handled without losing the clinical record.

Card prompts:

  • Where are imported images parsed before they reach clinical workstations?
  • What happens to an image file that anti-malware flags?
  • Which routes bring outside images in: CD, USB, share, network?

Mappings: STRIDE T, E · CAPEC-636, CAPEC-457 · CWE-434, CWE-1287 · ATT&CK T1204.002, T1027.009 · EMB3D TID-111 · MDS2 MLDP, SAHD · DICOM PS3.15

CRI-IR-9 Scanners stuck on unsupported systems

† Wrong or delayed treatment

Threat. CT, MRI and X-ray consoles often run operating systems the vendor certified years ago and that can no longer be patched. Ransomware spreading across the network shuts scanners down, and emergency imaging stops.

Principle. Imaging consoles that cannot be patched are isolated and kept recoverable.

Design measures:

  1. Place modalities in their own network segment allowing only DICOM traffic to named systems.
  2. Require vendors to commit to supported operating system lifetimes and validated patches.
  3. Keep a tested restore image for each console and practise recovery.

Card prompts:

  • Which imaging consoles run operating systems that can’t be patched?
  • What could reach those consoles if ransomware spread?
  • How quickly could a scanner be rebuilt and back in service?

Mappings: STRIDE D, E · CAPEC-682 · CWE-1104, CWE-1329 · ATT&CK T1210, T1486 · EMB3D TID-210 · MDS2 RDMP, CSUP, SAHD · IEC 80001-1; AAMI SW96

CRI-IR-8 Worklist mix-up assigns wrong patient

† Wrong or delayed treatment

Threat. Scanners take patient details from the modality worklist. A spoofed worklist server or altered entry puts images under the wrong patient, so a scan is reported for one person and acted on for another.

Principle. Patient identity on images comes from an authenticated worklist and is confirmed at the scanner.

Design measures:

  1. Authenticate the worklist server to the modality and restrict who can query it.
  2. Confirm patient identity at the scanner against the wristband before acquisition.
  3. Reconcile acquired studies with orders and flag mismatches before reporting.

Card prompts:

  • How does the scanner know the worklist server is genuine?
  • Where is patient identity confirmed before the scan starts?
  • How would images filed under the wrong patient be spotted?

Mappings: STRIDE S, T · LINDDUN I · CAPEC-151, CAPEC-194 · CWE-290, CWE-346 · ATT&CK T1557 · MDS2 NAUT, IGAU · DICOM PS3.15

CRI-IR-7 MRI safety limits overridden

† Direct harm

Threat. MRI scanners limit gradient switching and radiofrequency energy to prevent burns and nerve stimulation, and manage helium and quench systems. Altered limits, monitoring software or service settings can burn a patient or damage the magnet.

Principle. Patient safety limits in MRI are enforced in hardware or protected firmware, not configurable software.

Design measures:

  1. Enforce specific absorption rate and gradient limits in a protected controller.
  2. Separate quench and cryogen monitoring from the networked console.
  3. Restrict service settings to authenticated engineers with logged sessions.

Card prompts:

  • Are MRI safety limits enforced in hardware, firmware or settings?
  • Who can change gradient, energy or quench settings?
  • What alerts staff if a safety limit has been altered?

Mappings: STRIDE T, E · CAPEC-176, CAPEC-121 · CWE-1244, CWE-863 · ATT&CK T0836, T0837 · EMB3D TID-224 · MDS2 AUTH, AUDT · IEC TR 60601-4-5

CRI-IR-6 Nuclear medicine activity misrecorded

† Direct harm

Threat. Dose calibrators and radiopharmacy software record the activity drawn for each patient. Altered calibration factors or records give patients the wrong radiation dose or invalidate scans.

Principle. Radiopharmaceutical activity is measured and recorded with verified calibration.

Design measures:

  1. Protect calibration factors from change without physicist approval.
  2. Check calibrators daily against a reference source and record the result.
  3. Keep activity records append-only and linked to the order.

Card prompts:

  • How are dose calibrator calibration factors protected and checked?
  • Who can edit the activity recorded for a patient?
  • Would a wrong dose show up before administration?

Mappings: STRIDE T, R · CAPEC-165 · CWE-353 · ATT&CK T1565.001 · MDS2 IGAU, AUDT

CRI-IR-5 Imaging archive exposed online

Threat. Image archives and DICOM nodes reachable from the internet, or from guest networks, answer queries without authentication. Millions of images and reports with names and dates of birth can be downloaded.

Principle. Image archives answer only authenticated, authorised systems on approved networks.

Design measures:

  1. Never expose DICOM services directly to the internet; use authenticated gateways for external sharing.
  2. Require node authentication and TLS for every DICOM association.
  3. Scan regularly for exposed imaging services.

Card prompts:

  • Can the image archive be queried from the internet or guest Wi-Fi?
  • Which systems may query the archive, and how are they authenticated?
  • When did anyone last check what the archive answers to?

Mappings: STRIDE I · LINDDUN DD, I · CAPEC-1, CAPEC-158 · CWE-306, CWE-359 · ATT&CK T1190 · EMB3D TID-310 · MDS2 NAUT, TXCF, AUTH · DICOM PS3.15; ISO 27799

CRI-IR-4 Image metadata re-identifies patients

Threat. Images shared for research, teaching or AI training keep patient details in headers, burned-in text or the anatomy itself. Head CT and MRI can be rendered into recognisable faces, so de-identified data identifies people.

Principle. Images leaving clinical use are de-identified in headers, pixels and anatomy, and checked.

Design measures:

  1. Apply a de-identification profile that covers headers, private tags and burned-in annotations.
  2. Deface head and neck studies before release.
  3. Check a sample of every release for residual identifiers.

Card prompts:

  • What patient details remain in images shared for research or AI?
  • Is burned-in text removed from the pixels as well as headers?
  • Could a head scan be rendered into a recognisable face?

Mappings: STRIDE I · LINDDUN I, L, DD · CAPEC-497 · CWE-1230, CWE-359 · MDS2 DIDT · DICOM PS3.15; ISO 27799

CRI-IR-3 Portable imaging stores images unprotected

Threat. Portable ultrasound and X-ray units and handheld probes paired to phones store images locally and upload to clouds. A lost device or an unencrypted upload discloses patient images.

Principle. Portable imaging keeps no more data than needed, encrypted, and uploads only to approved destinations.

Design measures:

  1. Encrypt local image storage and wipe images after confirmed transfer.
  2. Restrict uploads to the hospital archive or an approved, contracted service.
  3. Support remote wipe and inventory for portable units and their phones.

Card prompts:

  • What images stay stored on portable units and paired phones?
  • Where do portable devices upload, and is that approved?
  • What happens to images when a handheld probe is lost?

Mappings: STRIDE I · LINDDUN DD · CAPEC-507 · CWE-359 · ATT&CK T1005 · MDS2 STCF, TXCF, PLOK · ISO 27799

CRI-IR-2 Viewer presets that hide findings

† Wrong or delayed treatment

Threat. Diagnostic viewers and displays rely on window settings, presets and calibration. Altered presets or display calibration can make a subtle finding invisible, and the radiologist reports a normal study.

Principle. Viewer presets and display calibration are controlled and checked.

Design measures:

  1. Manage presets centrally with change control and version history.
  2. Run regular display calibration checks and log results.
  3. Show when a non-standard preset is in use.

Card prompts:

  • Who can change viewer presets and window settings?
  • How is display calibration checked, and how often?
  • Would a changed preset be visible to the radiologist?

Mappings: STRIDE T · CAPEC-176 · CWE-451 · ATT&CK T1565.003 · MDS2 IGAU

Seen in the wild

Mappings

Imaging and Radiation: the mappings of each entry to STRIDE, LINDDUN, CAPEC, CWE, ATT&CK, EMB3D, MDS2 and standards.

Across the 13 entries, the STRIDE counts are Tampering 8, Elevation of privilege 3, Information disclosure 3, Repudiation 2, Denial of service 2, Spoofing 1 (an entry can carry more than one). 13 map to CAPEC 3.9, 13 to CWE 5.0, 12 to ATT&CK v20.0, 5 to MITRE EMB3D and 4 to LINDDUN. The MDS2 capabilities a buyer should check first are IGAU (6), AUDT (4), NAUT (3). 4 carry the red † for direct harm and 5 the amber † for wrong or delayed treatment. A blank means nothing fitted well; a loose tag would mislead.

← Medication Delivery · Hospitals and medical devices overview · Laboratory and Diagnostics →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the hospitals and medical devices overview.