legacy-medical-device-security-frameworks

STRIDE-HC Threat Model: ExampleMed Volumetric Infusion Pump v3.2

Worked example for paper §4.5 — large-volume infusion pump representative of Archetype 2 (embedded RTOS legacy).

1. Device profile

Field Value
Device name and model ExampleMed Volumetric Infusion Pump v3.2
Manufacturer ExampleMed Inc.
Device class (FDA) Class II
UMDNS code 16495
GMDN code 35143
MDS² reference ExampleMed-IP3.2-MDS2-2024
Archetype Archetype 2 (embedded RTOS legacy)
Operating system VxWorks 6.9 (EOL — no further patches)
Networking 100Mbit Ethernet, HL7 v2 over TCP/2575, no TLS
Authentication Hardcoded service-mode credential; no per-user login
Patching Manufacturer no longer issues patches; FDA clearance limits modification
Audit logging None on device; only at upstream nursing station
Physical interfaces RS-232 service port; USB-A (firmware update); Bluetooth (paired display)
Deployment 240 units across ICU and oncology
Clinical use Continuous medication infusion

2. STRIDE-HC threat scenarios

S — Spoofing (CAW = 1.2)

Network-attacker scenarios:

Physical / insider-attacker scenarios:

Detection methods (Framework V):

Compensating controls (Framework I):

CCD coverage assessment: Partial — physical fingerprinting and badge correlation cover most scenarios; vendor impersonation requires improved staff training.

T — Tampering (CAW = 1.1)

Network-attacker scenarios:

Physical / insider-attacker scenarios:

Detection methods (Framework V):

Compensating controls (Framework I):

CCD coverage assessment: Partial — Pattern C addresses primary physical vector; firmware push is mitigated by IPS but not eliminated.

R — Repudiation (CAW = 0.9)

Network-attacker scenarios:

Physical / insider-attacker scenarios:

Detection methods (Framework V):

Compensating controls (Framework I):

CCD coverage assessment: Partial — strong network and physical correlation, but bedside parameter changes outside service mode remain attributable only to “the assigned nurse” rather than to a specific user action.

I — Information Disclosure (CAW = 1.2)

Network-attacker scenarios:

Physical / insider-attacker scenarios:

Detection methods (Framework V):

Compensating controls (Framework I):

CCD coverage assessment: Full — comprehensive controls validated annually via penetration test; protocol-aware IDS deployed.

D — Denial of Service (CAW = 1.5)

Network-attacker scenarios:

Physical / insider-attacker scenarios:

Detection methods (Framework V):

Compensating controls (Framework I):

CCD coverage assessment: Partial — strong network-side controls; physical destruction is mitigated by surveillance and backup staging but not prevented.

E — Elevation of Privilege (CAW = 1.1)

Network-attacker scenarios:

Physical / insider-attacker scenarios:

Detection methods (Framework V):

Compensating controls (Framework I):

CCD coverage assessment: Partial — Patterns A and C jointly cover primary EoP vectors; vendor tooling remains a residual risk requiring contractual SLA improvements.

3. MDRS-relevant outputs

Coverage summary for CCD calculation:

Category Coverage
S Partial
T Partial
R Partial
I Full
D Partial
E Partial

Five categories partial, one full → CCD score in the 7–8 band → CCD = 7.

This feeds the MDRS calculation: with CIS=9.0, ES=7.5, DCI=8.0, NEF=8.0, CCD=7.0, the composite is 8.175 → CRITICAL tier (paper Table 7).

4. Document control

Field Value
Author Clinical Engineering / InfoSec joint authoring
Reviewer CISO and Director of Clinical Engineering
Approval date 2026-04-10
Next review 2027-04-10
Linked CJRs CJR-EMPump-001-MFA, CJR-EMPump-002-Encryption, CJR-EMPump-003-ServicePort
Current MDRS 8.175 → CRITICAL
This site is open source. Improve this page.