Facilities and Building Systems (FB)

Facilities and Building Systems (CRI-FB), The Hospital: a radiograph of medical gas cylinders and pipework with a valve.

Taxonomies › Hospitals and medical devices › Facilities and Building Systems

The Hospital · CRI-FB · suit 14 of 17 · 13 entries

Medical gases, theatre and isolation ventilation, backup power, cold storage, water, sterile services, pneumatic tubes, lifts, infant security and building management.

Scope: Medical gases and their alarms, theatre and isolation-room ventilation and pressure, power, UPS and generators, pneumatic tube systems, lifts, building management, blood, vaccine and pharmacy cold storage, sterile services (washer-disinfectors, autoclaves), water systems, infant tagging and door access, mortuary.

Entries are ranked Ace (most severe) to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding in your own system.

Facilities and Building Systems: each entry's ID, title, threat, mitigation principle and design measures. The full text follows below.

Text version: every entry is written out below, with its card prompts and mappings. The same text is in the PDF and Excel downloads on the overview page.

The threats

CRI-FB-A Medical gas alarms suppressed or altered

† Direct harm

Threat. Oxygen and other medical gas plant, pressure monitoring and area alarm panels are networked for remote monitoring with weak or no authentication. Changing pressures or suppressing alarms can starve a ward of oxygen or vacuum without anyone at the panel or on the ward being told.

Principle. Medical gas safety depends on local engineered protections and alarms that no network command can disable.

Design measures:

  1. Keep pressure relief, low-pressure alarms and manifold changeover hardwired, independent of the monitoring network.
  2. Make remote monitoring read-only, and route any remote control through an authenticated, logged path that operators approve.
  3. Alarm on loss of the monitoring link itself, and test area alarms against the plant on a schedule.

Card prompts:

  • Which medical gas alarms and pressures can be changed over the network?
  • What local protection works whatever the network says?
  • Would ward staff learn of a gas fault if the panel were silenced?

Mappings: STRIDE T, D · CAPEC-212 · CWE-306, CWE-636 · ATT&CK T0838, T0878, T0836 · EMB3D TID-310 · MDS2 AUTH, AUDT · IEC 62443

CRI-FB-K Theatre and isolation pressure reversed

† Direct harm

Threat. Building management controls the air changes and pressure regimes of theatres and isolation rooms. A changed setpoint or schedule turns a negative-pressure room positive or cuts theatre air changes, spreading airborne infection or raising surgical site infection, with displays still showing normal.

Principle. Critical-room pressure and air changes are monitored independently of the system that controls them, at the room.

Design measures:

  1. Fit independent pressure monitors with local alarms at each isolation room and theatre.
  2. Lock critical-room setpoints and schedules, requiring authenticated, logged changes with an engineering approval.
  3. Compare commanded and measured air changes daily and investigate any divergence.

Card prompts:

  • What measures room pressure independently of building management?
  • Who can change setpoints or schedules for theatres and isolation rooms?
  • Where would staff see that a negative-pressure room had reversed?

Mappings: STRIDE T, R · CAPEC-212 · CWE-306, CWE-862 · ATT&CK T0836, T0832, T0831 · MDS2 AUTH, AUDT · IEC 62443

CRI-FB-Q Backup power controls disabled

† Direct harm

Threat. Generator, automatic transfer switch and UPS controllers are reachable from the building network or the internet, often with default credentials. Disabling the transfer or setting generators to manual means the next mains failure, accidental or engineered, takes theatres, ICU and life support down.

Principle. Changeover to backup power is protected locally and cannot be disabled from the network.

Design measures:

  1. Keep transfer and generator start logic local and hardwired, with network access read-only by default.
  2. Change default credentials, remove internet exposure and put power controllers in their own segment.
  3. Run load tests on a schedule and alarm when any controller leaves automatic mode.

Card prompts:

  • Can generator or transfer switch controls be reached from the network?
  • Who would notice if backup power had been set to manual?
  • When was a real changeover to backup power last tested?

Mappings: STRIDE D, T · CAPEC-70, CAPEC-212 · CWE-1392, CWE-306 · ATT&CK T0816, T0837, T0858 · EMB3D TID-311 · MDS2 SAHD, AUTH · IEC 62443

CRI-FB-J Cold storage excursions hidden

† Direct harm

Threat. Blood, vaccine, tissue and pharmacy fridges report to a central temperature monitoring system that can be edited or fed false readings. A heated or failed fridge looks normal, and patients receive spoiled blood products, vaccines or drugs.

Principle. Temperature evidence for stored blood, vaccines and drugs is tamper-evident and checked independently of the monitoring system.

Design measures:

  1. Use loggers that sign their readings, and keep an independent local display and alarm on each critical unit.
  2. Make recorded temperatures read-only after capture and log every acknowledgement and edit.
  3. Quarantine stock automatically when readings stop or gaps appear, until a person reviews them.

Card prompts:

  • How is fridge temperature evidence protected from editing?
  • What independent check confirms blood and vaccines stayed in range?
  • Would a failed fridge still look normal on the central system?

Mappings: STRIDE T, R · CAPEC-148, CAPEC-268 · CWE-353, CWE-778 · ATT&CK T0832, T0838 · MDS2 IGAU, AUDT

CRI-FB-10 Water treatment controls changed

† Direct harm

Threat. Controllers for dialysis water treatment and hot water temperature are networked and maintained remotely. A changed setpoint or silenced quality alarm exposes dialysis patients to contaminated water, or lets Legionella grow in wards where patients are immunocompromised.

Principle. Water quality for dialysis and for vulnerable patients is protected by local interlocks and checked by independent testing.

Design measures:

  1. Interlock dialysis water production locally so out-of-specification water cannot reach the loop, whatever the network says.
  2. Restrict and log setpoint changes on water controllers, and alarm on any change outside a maintenance window.
  3. Keep independent sampling and temperature checks on a schedule that does not rely on the control system.

Card prompts:

  • What local interlocks protect dialysis water quality?
  • Who can change hot water setpoints remotely?
  • How often does independent testing confirm water quality?

Mappings: STRIDE T, D · CAPEC-212 · CWE-306 · ATT&CK T0836, T0838, T0880 · MDS2 AUTH, AUDT · IEC 62443

CRI-FB-9 Sterilisation cycle records falsified

† Direct harm

Threat. Washer-disinfectors and autoclaves record cycle parameters to a tracking system that releases instruments. Altered parameters or forged records release unsterile instruments to theatres, or force a recall of every set processed while records cannot be trusted.

Principle. Instrument release depends on cycle evidence that cannot be forged and on physical indicators the network cannot change.

Design measures:

  1. Have sterilisers sign their cycle records and have the tracking system verify them before release.
  2. Keep chemical and biological indicators as an independent check on every load.
  3. Restrict cycle parameter changes to authenticated engineers, logged and reviewed by sterile services.

Card prompts:

  • What releases instruments: the record, or physical evidence too?
  • Who can change cycle parameters or tracking records?
  • How would you recall sets if cycle records could not be trusted?

Mappings: STRIDE T, R · CAPEC-148 · CWE-353 · ATT&CK T0836, T0832 · MDS2 IGAU, AUTH

CRI-FB-8 Pneumatic tube system stops or misroutes

† Wrong or delayed treatment

Threat. The pneumatic tube system carries samples, blood and drugs between wards, labs and pharmacy, under one networked controller with embedded stations. Stopping or misrouting it delays results across the hospital, and a compromised station is a foothold on the network.

Principle. The tube system’s controller and stations are hardened, updated and isolated, and the hospital can run without it.

Design measures:

  1. Put tube controllers and stations in their own segment with only the connections they need.
  2. Require signed firmware for stations and keep them on supported versions.
  3. Keep a porter-run courier procedure for urgent samples and blood, and rehearse it.

Card prompts:

  • How would the hospital move samples and drugs without the tube system?
  • What can a tube station reach on the network?
  • Who patches the tube controller and its stations?

Mappings: STRIDE D, T · CAPEC-186 · CWE-494, CWE-306 · ATT&CK T0814, T0866 · EMB3D TID-211 · MDS2 IGAU, SAHD

CRI-FB-7 Building management as a pivot

Threat. Building management servers and controllers are maintained by contractors, often exposed to the internet, and sit on networks that reach clinical systems. Once inside the building network an attacker moves to device and clinical networks the hospital thought were separate.

Principle. Building systems are a separate zone with controlled conduits, and their remote access is treated like any other privileged access.

Design measures:

  1. Separate building systems from clinical and corporate networks, allowing only defined, monitored flows between them.
  2. Remove internet exposure and route contractor access through the hospital’s managed remote access with multi-factor login.
  3. Include building controllers in the asset inventory and vulnerability management.

Card prompts:

  • What can the building management network reach in the clinical estate?
  • How do contractors connect to building systems remotely?
  • Is any building controller reachable from the internet?

Mappings: STRIDE E, I · CAPEC-700 · CWE-923 · ATT&CK T0883, T0866, T0822 · MDS2 CONN, RMOT · IEC 62443

CRI-FB-6 Infant security and door access defeated

† Direct harm

Threat. Infant tagging, maternity door locks and access control share controllers and credentials that can be cloned, overridden or disabled. Defeating them enables abduction, and a mass lock or unlock traps people in or opens secure areas during a fire or incident.

Principle. Secure doors fail safe for fire and fail secure for abduction, and their controllers resist cloning and remote override.

Design measures:

  1. Use access cards that cannot be cloned, and alarm on doors held or forced in maternity and paediatric areas.
  2. Make fire release hardwired and local, and log any remote lock or unlock command with who issued it.
  3. Test infant tag alarms and door interlocks on a schedule, including when the network is down.

Card prompts:

  • Can infant tags or door credentials be cloned or overridden remotely?
  • What do secure doors do in a fire, and in an abduction alert?
  • Who could trigger a mass lock or unlock?

Mappings: STRIDE S, E, D · LINDDUN I · CAPEC-395, CAPEC-390 · CWE-1263, CWE-294 · MDS2 PLOK, AUTH, AUDT

CRI-FB-5 Lift priority for patient transfers lost

† Wrong or delayed treatment

Threat. Lifts that move patients between emergency, theatre and intensive care are run from networked controllers with remote service. Stopping them or removing priority modes delays critical transfers and can trap a patient and team between floors.

Principle. Patient-transfer lifts keep their priority and safety functions locally, and remote service cannot take them out of service unannounced.

Design measures:

  1. Keep firefighter and bed-priority modes under local key control, independent of the network.
  2. Restrict remote service to read-only by default and log any command that changes lift mode.
  3. Plan alternative transfer routes and staffing for when priority lifts are out of service.

Card prompts:

  • Can remote service take patient-transfer lifts out of priority mode?
  • What happens to a patient and team if a lift stops between floors?
  • Who is told before a lift is taken out of service?

Mappings: STRIDE D · CAPEC-212 · CWE-306 · ATT&CK T0816, T0858 · MDS2 RMOT, AUTH

CRI-FB-4 Facilities alarms reach nobody

† Wrong or delayed treatment

Threat. Plant alarms for gases, power, fridges and ventilation are relayed to estates staff by email, SMS or a pager gateway that is unmonitored. When the relay fails, or is overwhelmed by nuisance alarms, a critical alarm sits unread while the plant fails.

Principle. Critical facilities alarms reach a person who acknowledges them, and failure of the relay is itself an alarm.

Design measures:

  1. Require acknowledgement of critical alarms and escalate automatically when none arrives in time.
  2. Send a heartbeat through the alarm relay and alarm locally when it stops.
  3. Review alarm volumes monthly and remove nuisance alarms so critical ones stand out.

Card prompts:

  • Who receives critical plant alarms, and must they acknowledge them?
  • What tells estates staff that the alarm relay has failed?
  • How many nuisance alarms bury the critical ones?

Mappings: STRIDE D · CAPEC-607 · CWE-1320, CWE-754 · ATT&CK T0878 · MDS2 CONN

CRI-FB-3 Engineering drawings and asset data exposed

Threat. Drawings of gas, power and ventilation systems, asset registers and controller addresses are shared in tenders, contractor portals and project files. They tell an attacker exactly which controller feeds which theatre or ward.

Principle. Engineering information about critical building systems is shared on a need-to-know basis and tracked.

Design measures:

  1. Classify engineering drawings and asset data, and share them only through controlled portals with named access.
  2. Remove controller addresses and credentials from tender and handover documents.
  3. Require contractors to return or destroy engineering information at the end of a project.

Card prompts:

  • Where are drawings of gas, power and ventilation shared?
  • Who can see which controller feeds which theatre?
  • Is access to engineering information tracked and limited?

Mappings: STRIDE I · CAPEC-169, CAPEC-406 · CWE-552 · ATT&CK T0882 · MDS2 MPII

CRI-FB-2 Energy optimisation darkens clinical areas

Threat. Energy and lighting optimisation schedules, set centrally or by a vendor platform, apply office logic to clinical areas. A changed schedule switches off lighting, ventilation or heating in a ward, theatre or recovery area overnight.

Principle. Clinical areas are excluded from automated energy schedules unless clinicians have approved the rule.

Design measures:

  1. Tag clinical zones in the building system and block energy rules from applying to them by default.
  2. Log and review every schedule change, including those pushed by the vendor platform.
  3. Give each clinical area a local override that restores lighting and ventilation immediately.

Card prompts:

  • Which clinical areas do automated energy schedules touch?
  • Who approves an energy rule that affects a ward or theatre?
  • Could a vendor platform change lighting or ventilation overnight?

Mappings: STRIDE T, D · CAPEC-212 · CWE-1188 · ATT&CK T0836 · MDS2 AUTH

Seen in the wild

Mappings

Facilities and Building Systems: the mappings of each entry to STRIDE, LINDDUN, CAPEC, CWE, ATT&CK, EMB3D, MDS2 and standards.

Across the 13 entries, the STRIDE counts are Tampering 8, Denial of service 8, Repudiation 3, Elevation of privilege 2, Information disclosure 2, Spoofing 1 (an entry can carry more than one). 13 map to CAPEC 3.9, 13 to CWE 5.0, 12 to ATT&CK v20.0, 3 to MITRE EMB3D and 1 to LINDDUN. The MDS2 capabilities a buyer should check first are AUTH (8), AUDT (5), IGAU (3). 7 carry the red † for direct harm and 3 the amber † for wrong or delayed treatment. A blank means nothing fitted well; a loose tag would mislead.

← Emergency and External Communications · Hospitals and medical devices overview · Suppliers, Service and Lifecycle →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the hospitals and medical devices overview.