Identity and Access (AC)

Taxonomies › Hospitals and medical devices › Identity and Access

The Hospital · CRI-AC · suit 16 of 17 · 13 entries

Clinician identities, default and hard-coded credentials, shared directories, shared logins, break-glass, session handover, privileged and temporary accounts, badges.

Scope: Shared clinical logins and generic accounts, break-glass, badge-tap and smartcards, session handover on shared workstations, default and hard-coded device credentials, service passwords shared across a vendor’s customers, agency/locum/student accounts, leavers, privileged IT and biomed accounts, directory shared with the device estate, MFA that slows emergencies, help-desk resets.

Entries are ranked Ace (most severe) to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding in your own system.

Text version: every entry is written out below, with its card prompts and mappings. The same text is in the PDF and Excel downloads on the overview page.

The threats

CRI-AC-A Stolen clinician identity prescribes and signs

† Wrong or delayed treatment

Threat. A clinician’s account can prescribe, sign results, discharge patients and change care plans from any workstation or remote session, with no stronger check for high-risk actions. A phished or reused password lets an attacker order, cancel or approve care under a trusted name.

Principle. High-risk clinical actions need stronger proof of who is acting than reading a record does.

Design measures:

1. Require step-up authentication, such as a smartcard tap or a second factor, for prescribing, signing results and changing allergies.
2. Bind remote and off-site clinical sessions to managed devices and phishing-resistant authentication.
3. Alert the clinician and their lead when orders are placed under their name from an unusual place or time.

Card prompts:

• Which clinical actions need stronger proof than reading a record?
• How are remote clinical sessions authenticated?
• Who is told when orders appear under a clinician’s name unusually?

Mappings: STRIDE S, E, R · CAPEC-560, CAPEC-98 · CWE-308 · ATT&CK T1078, T1566 · MDS2 PAUT, AUTH, AUDT · ISO 27799

CRI-AC-K Default and hard-coded device credentials

† Direct harm

Threat. Devices ship with default administrator passwords that nobody changes, or with credentials compiled into the firmware that cannot be changed. Anyone on the clinical network can log in and change settings, alarm limits or therapy, and the hospital has no way to close the door short of replacing the device.

Principle. No device should be reachable with a credential the hospital did not set and cannot change.

Design measures:

1. Force a unique credential to be set at installation before the device will run clinically.
2. Remove hard-coded accounts; where an account must exist, make it changeable and disable it by default.
3. Ask for default and hard-coded credentials in procurement (MDS2) and reject devices that cannot answer.

Card prompts:

• Which devices still use default or hard-coded credentials?
• Can the hospital set and change every device credential?
• What could someone on the clinical network change with a default password?

Mappings: STRIDE S, T, E · CAPEC-70, CAPEC-115 · CWE-1393, CWE-259, CWE-798 · ATT&CK T1078.001, T0859 · EMB3D TID-311, TID-328 · MDS2 PAUT, SAHD, AUTH · IEC 81001-5-1; IEC TR 60601-4-5; FDA premarket

CRI-AC-Q One directory for IT and devices

† Wrong or delayed treatment

Threat. Modality workstations, monitoring servers, lab middleware and pharmacy systems all join the same directory as office PCs. One stolen administrator account or one domain compromise reaches every clinical system at once, and ransomware spreads to the devices along with the desktops.

Principle. A compromise of the corporate identity system must not hand over the clinical device estate.

Design measures:

1. Run clinical device systems in a separate identity domain with no trust from the corporate directory.
2. Use separate administrator accounts and workstations for the device estate, never reused for email or browsing.
3. Test that a fully compromised corporate domain cannot log in to any device or clinical server.

Card prompts:

• Which clinical systems join the same directory as office PCs?
• What would one stolen domain administrator account reach?
• Could clinical devices keep running if the directory were lost?

Mappings: STRIDE S, E, D · CAPEC-560, CAPEC-652, CAPEC-509 · CWE-266, CWE-1220 · ATT&CK T1078.002, T1021.002, T1486 · MDS2 AUTH, SAHD · IEC 80001-1; IEC 62443

CRI-AC-J Devices without their own identity

† Wrong or delayed treatment

Threat. Systems accept vital signs, results or images from anything on the network that speaks the right protocol. A rogue or spoofed node can pose as a monitor, analyser or modality and write false values into the record, which clinicians then act on.

Principle. Every device that writes clinical data proves which device it is, and the receiver refuses data from unknown sources.

Design measures:

1. Give each device a certificate or key at installation and require mutual authentication to gateways and interfaces.
2. Keep a register of devices allowed to send to each interface and reject the rest.
3. Alert clinical engineering when a new or unexpected source appears on a clinical feed.

Card prompts:

• How does a receiving system know which device sent the data?
• What happens to data from an unknown or spoofed node?
• Could a rogue device pose as a monitor or analyser?

Mappings: STRIDE S, T · CAPEC-151, CAPEC-194 · CWE-306, CWE-924 · ATT&CK T1565.002 · EMB3D TID-406 · MDS2 NAUT, IGAU · IEC 80001-1; IEC 81001-5-1

CRI-AC-10 Help-desk resets for urgent callers

Threat. The service desk resets passwords and multi-factor enrolment for anyone who sounds like a busy consultant with a patient waiting. An attacker who knows names and rotas from public pages gets a clinician’s or administrator’s access in one phone call.

Principle. Urgency must never replace identity proofing for credential resets, and resets must be harder for privileged accounts.

Design measures:

1. Verify callers through a second channel or in person before any reset, with a fast route for genuine emergencies.
2. Require a manager or second approver for resets of privileged and remote-access accounts.
3. Notify the account owner on every reset and enrolment change, through a channel the caller does not control.

Card prompts:

• How does the service desk prove a caller’s identity?
• Are privileged resets harder than ordinary ones?
• What public information would help an attacker sound convincing?

Mappings: STRIDE S, E · CAPEC-407, CAPEC-416 · CWE-640 · ATT&CK T1566.004, T1098.005, T1078 · MDS2 PAUT, AUTH · ISO 27799

CRI-AC-9 Break-glass becomes the normal route

Threat. Emergency access to records and devices is so easy, or normal access so slow, that staff use break-glass every shift. Nobody reviews it, so snooping on records and unattributed changes hide in the noise, and the control meant for emergencies stops meaning anything.

Principle. Emergency access is quick in an emergency, rare in practice and reviewed every time it is used.

Design measures:

1. Fix the routine access problems that drive break-glass use before adding more controls.
2. Ask for a reason at break-glass and send every use to a reviewer within a day.
3. Report break-glass rates by ward and role so routine use is visible and challenged.

Card prompts:

• How often is break-glass used, and why so often?
• Who reviews each break-glass use, and how quickly?
• Is normal access slow enough to push staff to emergency access?

Mappings: STRIDE R, I, E · LINDDUN Nr, DD, Nc · CAPEC-122 · CWE-778, CWE-863 · ATT&CK T1078 · MDS2 EMRG, AUDT · ISO 27799; IEC 80001-1

CRI-AC-8 Generic and shared clinical logins

Threat. Wards share generic accounts on workstations, devices and departmental systems because individual logins are too slow. Orders, results, settings and record views cannot be tied to a person, so mistakes and misuse go uninvestigated and leavers keep access through the shared password.

Principle. Every clinical action is attributable to a person, without making shared devices slower to use.

Design measures:

1. Replace generic accounts with fast individual sign-on, such as badge tap with a short PIN.
2. Where a device must run under a shared account, record who is signed in to the session alongside it.
3. Change shared passwords whenever a holder leaves and audit for generic account use on clinical systems.

Card prompts:

• Which wards or devices still rely on generic accounts?
• Can every order and setting change be tied to a person?
• What would make individual login as fast as the shared one?

Mappings: STRIDE S, R · LINDDUN Nr · CAPEC-21 · CWE-286, CWE-1220 · ATT&CK T1078.003 · MDS2 PAUT, AUDT · ISO 27799

CRI-AC-7 Session handed to the next user

† Wrong or delayed treatment

Threat. Shared workstations on wheels and bedside terminals stay signed in as the last person. The next clinician prescribes, records or views under someone else’s name, sometimes on the wrong patient’s open record, and the record shows the wrong author for clinical decisions.

Principle. A shared screen always shows who is signed in and which patient is open, and switches user quickly and safely.

Design measures:

1. Use fast user switching that closes the previous user’s patient context.
2. Show the signed-in user and patient prominently on every clinical screen.
3. Lock idle sessions on a timeout suited to the area, shorter in public areas than in theatres.

Card prompts:

• Does the shared screen always show who is signed in?
• How quickly can the next clinician switch user?
• Could someone prescribe on the wrong patient’s open record?

Mappings: STRIDE S, R · LINDDUN Nr · CAPEC-593, CAPEC-60 · CWE-1463, CWE-1464 · MDS2 ALOF, PAUT · ISO 27799

CRI-AC-6 Standing privilege for biomed and IT

† Wrong or delayed treatment

Threat. Clinical engineering and IT staff hold permanent administrator rights to every device console, monitoring server and integration engine. One phished or reused account gives an attacker the power to change any device or interface in the hospital, with nothing to approve or notice.

Principle. Privilege over clinical systems is granted for a task, for a time, and is seen by someone else.

Design measures:

1. Grant device and integration admin rights just in time, with approval and expiry.
2. Use phishing-resistant authentication for every privileged clinical account.
3. Alert on privileged changes to device settings, alarm limits and interface routes outside change windows.

Card prompts:

• Which biomed and IT accounts hold standing administrator rights?
• Is privilege granted for a task and seen by someone else?
• What could one phished engineer account change?

Mappings: STRIDE E, R · CAPEC-122, CAPEC-233 · CWE-250, CWE-266 · ATT&CK T1078, T1098.007 · MDS2 AUTH, AUDT, PAUT · IEC 80001-1; IEC 62443

CRI-AC-5 Agency, locum and leaver accounts

Threat. Agency nurses, locum doctors, students and contractors get accounts in a hurry and nobody removes them. Accounts outlive the people, are shared between shifts or reach remote access, giving former staff and anyone who buys their password a way into records and systems.

Principle. Every account has an owner, an end date and a sponsor who answers for it.

Design measures:

1. Give temporary staff accounts an end date at creation and require a sponsor to extend them.
2. Feed starters and leavers from rostering and HR into account removal automatically.
3. Review dormant and remote-capable accounts monthly and disable those unused for a set period.

Card prompts:

• Who sponsors each agency, locum and contractor account?
• Does every temporary account have an end date?
• How quickly is access removed when someone leaves?

Mappings: STRIDE S, E · LINDDUN I · CAPEC-560 · CWE-286 · ATT&CK T1078, T1133 · MDS2 AUTH, PAUT · ISO 27799

CRI-AC-4 Authentication friction drives workarounds

† Wrong or delayed treatment

Threat. Logins and multi-factor prompts that take too long in a resuscitation or theatre push staff to write passwords on monitors, share tokens, prop sessions open or disable locks. The workaround becomes the real control, and both security and care suffer.

Principle. Authentication is designed around clinical workflow, measured in seconds, and tested with clinicians.

Design measures:

1. Time sign-in and switch-user on real wards and set a target in seconds.
2. Use proximity or badge tap with risk-based step-up rather than repeated full logins.
3. Watch for workarounds such as written passwords and fix the cause, not the person.

Card prompts:

• How many seconds does login take in resuscitation or theatre?
• Which workarounds do staff use when authentication is slow?
• Were clinicians involved in testing the authentication design?

Mappings: STRIDE S, E · CAPEC-416 · CWE-655 · MDS2 PAUT, EMRG · IEC 80001-1

CRI-AC-3 Credentials in service files

Threat. Passwords, keys and interface credentials sit in plain text in device configuration backups, export files, service reports and installation notes. Whoever gets a copy, from a shared drive, an old laptop or a disposed device, gets the keys to the clinical systems they describe.

Principle. Secrets never appear in configuration exports, logs or documents that leave the device.

Design measures:

1. Store device and interface secrets in a protected store and redact them from exports and service reports.
2. Scan shared drives and ticket systems for clinical system credentials and rotate any found.
3. Wipe credentials when devices are decommissioned, returned or sent for repair.

Card prompts:

• Where do configuration backups and service reports keep credentials?
• Who can read exported device files on shared drives?
• Are secrets removed before files leave the device?

Mappings: STRIDE I, E · CAPEC-406 · CWE-256, CWE-522 · ATT&CK T1552.001 · EMB3D TID-329, TID-226 · MDS2 STCF, SAHD · IEC 81001-5-1

CRI-AC-2 Badges cloned, shared and left in

Threat. Proximity badges and smartcards give access to doors, drug rooms and clinical systems. Cards that are easy to clone, left in readers or lent to colleagues let someone else walk into restricted areas or act as the card holder on clinical systems.

Principle. A badge proves who is present only when it is hard to copy and backed by a second factor where it matters.

Design measures:

1. Use badges with cryptographic authentication rather than readable serial numbers.
2. Require a PIN or biometric with the badge for controlled drugs, prescribing and restricted areas.
3. Remove the session automatically when the card leaves the reader.

Card prompts:

• How easily can your badges be cloned?
• Where is a second factor needed beyond the badge?
• What happens when a badge is left in a reader?

Mappings: STRIDE S · LINDDUN I · CAPEC-390 · CWE-654, CWE-308 · MDS2 PAUT, PLOK · ISO 27799

Seen in the wild

• WannaCry and the NHS, 2017 (CRI-AC-Q). WannaCry ransomware disrupted at least 81 of England’s 236 NHS trusts and infected 595 GP practices; the NAO estimated over 19,000 appointments were cancelled, and some trusts diverted ambulances. Sources: NAO: Investigation, WannaCry cyber attack and the NHS; GOV.UK: Foreign Office Minister condemns North Korean actor for WannaCry attacks.
• Conti attack on Ireland’s HSE, 2021 (CRI-AC-Q). Conti ransomware encrypted about 80% of the Health Service Executive’s IT environment and about 700 GB of data was taken; the HSE shut its national IT down and took around four months to recover fully. PwC’s independent post-incident review was published in December 2021. Sources: HSE: Conti cyber attack on the HSE, full report (PwC); HHS HC3: Lessons learned from the HSE cyber attack.

Mappings

Across the 13 entries, the STRIDE counts are Spoofing 10, Elevation of privilege 9, Repudiation 5, Tampering 2, Information disclosure 2, Denial of service 1 (an entry can carry more than one). 13 map to CAPEC 3.9, 13 to CWE 5.0, 10 to ATT&CK v20.0, 3 to MITRE EMB3D and 5 to LINDDUN. The MDS2 capabilities a buyer should check first are PAUT (9), AUTH (6), AUDT (4). 1 carry the red † for direct harm and 6 the amber † for wrong or delayed treatment. A blank means nothing fitted well; a loose tag would mislead.

← Suppliers, Service and Lifecycle · Hospitals and medical devices overview · Continuity and Downtime →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the hospitals and medical devices overview.