Life Support and Therapy (LS)

Life Support and Therapy (CRI-LS), The Patient: a radiograph of the lungs with a breathing tube and ventilator hose.

Taxonomies › Hospitals and medical devices › Life Support and Therapy

The Patient · CRI-LS · suit 04 of 17 · 13 entries

Ventilators and respirators, anaesthesia workstations, oxygen, defibrillators, dialysis, ECMO, neonatal incubators and surgical robots.

Scope: Ventilators/respirators, anaesthesia workstations, oxygen delivery and concentrators, defibrillators/AEDs, dialysis, ECMO and heart-lung machines, neonatal incubators, surgical robots; settings changed remotely, service modes, safe-state design, alarm defeat, connected settings logging, device-to-EHR writes, calibration, consumable authentication.

Entries are ranked Ace (most severe) to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding in your own system.

Life Support and Therapy: each entry's ID, title, threat, mitigation principle and design measures. The full text follows below.

Text version: every entry is written out below, with its card prompts and mappings. The same text is in the PDF and Excel downloads on the overview page.

The threats

CRI-LS-A Ventilation settings changed remotely

† Direct harm

Threat. The ventilator accepts changes to tidal volume, oxygen fraction, pressure or rate over the network or a connected gateway without a person at the bedside confirming them. A remote change can starve or injure a patient while the screen and the chart look normal.

Principle. Therapy-critical settings on life support change only with a local, deliberate action by a clinician at the device.

Design measures:

  1. Make network interfaces read-only for therapy parameters; any remote write path must be removed or disabled by default.
  2. Require on-device confirmation, showing old and new values, for every therapy change regardless of where it originated.
  3. Log every setting change with source, user and time, and alarm locally when a change arrives from outside the device.

Card prompts:

  • Which ventilator settings can change without someone at the bedside?
  • What confirms a remote change before it reaches the patient?
  • Would the screen and chart reveal a change made remotely?

Mappings: STRIDE T, E · CAPEC-137, CAPEC-212 · CWE-306, CWE-862 · ATT&CK T0836, T0831 · EMB3D TID-310, TID-406 · MDS2 AUTH, NAUT, TXIG · IEC TR 60601-4-5; ISO 14971; FDA premarket

CRI-LS-K Failure state that stops support

† Direct harm

Threat. When the ventilator, ECMO or heart-lung machine meets an unexpected message, crash or update, it reboots, stops or falls back to factory defaults instead of continuing the last safe therapy. A crafted packet or a faulty update can leave a dependent patient without support.

Principle. A life-support device keeps delivering its last verified therapy through software, network and update failures.

Design measures:

  1. Separate the therapy control function from networking and user interface software so a fault in one cannot stop the other.
  2. Define and test a continue-last-safe-therapy state for every fault, including malformed input and failed updates.
  3. Fuzz every network and data interface during verification, and treat any loss of therapy as a safety failure, not a bug.

Card prompts:

  • What does the device do after a crash, bad message or failed update?
  • Does it resume the last safe therapy or factory defaults?
  • How was the failure state tested with a patient connected?

Mappings: STRIDE D · CAPEC-153, CAPEC-125 · CWE-636, CWE-754, CWE-1088 · ATT&CK T0814, T0816, T0880 · EMB3D TID-404, TID-405, TID-217 · MDS2 SAHD, CSUP · IEC TR 60601-4-5; ISO 14971; IEC 62304

CRI-LS-Q Life-support alarms silenced

† Wrong or delayed treatment

Threat. Alarm volume, limits or delays on ventilators, anaesthesia machines and dialysis can be changed through a service menu, a configuration file or a remote profile. With alarms widened or muted, disconnection, low oxygen or a pressure fault goes unnoticed until the patient deteriorates.

Principle. Alarm limits that protect life have floors that no profile, file or remote command can go below.

Design measures:

  1. Enforce non-configurable minimum alarm settings for disconnection, apnoea and low oxygen in the device itself.
  2. Show a persistent indicator whenever any alarm is muted or widened, and limit mute duration.
  3. Sign alarm configuration profiles and reject unsigned or out-of-range profiles at load time.

Card prompts:

  • What is the lowest an alarm limit can be set, and by whom?
  • Can a profile, file or remote command mute a life-support alarm?
  • How would staff notice alarm settings had been widened?

Mappings: STRIDE T, D · CAPEC-176, CAPEC-75 · CWE-1188, CWE-357 · ATT&CK T0838, T0878 · EMB3D TID-224 · MDS2 AUTH, IGAU, AUDT · IEC TR 60601-4-5; ISO 14971

CRI-LS-J Service mode open during treatment

† Direct harm

Threat. Engineering and service modes, meant for calibration and repair, can be entered while a patient is connected, by a default code, a key combination, a debug port or a remote service tool. In service mode, safety limits and interlocks may not apply.

Principle. Service functions are unreachable while the device is delivering therapy.

Design measures:

  1. Block entry to service and calibration modes unless the device detects it is not connected to a patient.
  2. Require individual, revocable service credentials, never a code shared across every unit of the model.
  3. Disable or physically protect debug ports in production units and record every service-mode entry.

Card prompts:

  • Can service mode be entered while a patient is connected?
  • Which codes, ports or tools open service mode?
  • Which safety interlocks stop working in service mode?

Mappings: STRIDE E, T · CAPEC-121, CAPEC-554 · CWE-1244, CWE-489, CWE-798 · ATT&CK T0858 · EMB3D TID-224, TID-119, TID-328 · MDS2 AUTH, PLOK, RMOT · IEC TR 60601-4-5; AAMI SW96

CRI-LS-10 Anaesthesia workstation compromised

† Direct harm

Threat. Anaesthesia workstations run general-purpose operating systems and connect to the anaesthesia record and the network. Malware or tampering can change gas and agent delivery, freeze the displayed values, or falsify the anaesthesia record that later decisions rely on.

Principle. Gas and agent delivery are controlled independently of the networked computer that displays and records them.

Design measures:

  1. Keep delivery control on a separate, minimal controller that the record-keeping computer cannot command.
  2. Cross-check displayed and recorded values against an independent sensor and alarm on disagreement.
  3. Harden and allow-list the workstation software, and keep it on a segmented clinical device network.

Card prompts:

  • Is gas and agent delivery independent of the networked computer?
  • What would a frozen display look like to the anaesthetist?
  • How is the anaesthesia record protected from later tampering?

Mappings: STRIDE T, I, D · CAPEC-441, CAPEC-148 · CWE-1357, CWE-451 · ATT&CK T0832, T0831 · EMB3D TID-204, TID-205 · MDS2 MLDP, SAHD, IGAU · IEC TR 60601-4-5; IEC 80001-1

CRI-LS-9 Oxygen delivered differs from shown

† Direct harm

Threat. Connected oxygen blenders, high-flow systems and concentrators report flow and oxygen fraction from the same software that controls them. If that software is altered, the patient receives less oxygen than the display and the record say, and hypoxia is blamed on the illness.

Principle. Delivered oxygen is measured independently of the component that sets it.

Design measures:

  1. Measure delivered oxygen with a separate sensor and alarm when it departs from the set value.
  2. Verify firmware integrity at boot and refuse to run altered control software.
  3. For remotely managed home concentrators, restrict the manufacturer’s cloud to reading status, not changing flow.

Card prompts:

  • What measures delivered oxygen independently of the controlling software?
  • Would anyone notice the display overstating oxygen delivered?
  • Who checks that set and measured oxygen agree?

Mappings: STRIDE T, R · CAPEC-148, CAPEC-186 · CWE-353, CWE-494 · ATT&CK T0832, T0836 · EMB3D TID-201, TID-211 · MDS2 IGAU, CSUP · IEC TR 60601-4-5; ISO 14971

CRI-LS-8 Defibrillator ready status falsified

† Direct harm

Threat. Defibrillators and public-access AEDs report self-test results, battery and pad status to fleet dashboards. A tampered device or dashboard can show ready when the unit will not charge or shock, so the failure is found only during a cardiac arrest.

Principle. Readiness is reported from tamper-evident self-tests, and a missing or stale report is treated as not ready.

Design measures:

  1. Sign self-test reports on the device and verify them on the dashboard.
  2. Treat missing, late or unsigned reports as a fault that triggers an inspection.
  3. Keep a visible local readiness indicator that does not depend on the fleet service.

Card prompts:

  • How does the fleet dashboard know a defibrillator is really ready?
  • What happens when a self-test report is missing or stale?
  • Could a device show ready when it cannot charge?

Mappings: STRIDE S, T · CAPEC-194, CAPEC-148 · CWE-353, CWE-924 · ATT&CK T0832 · EMB3D TID-407, TID-406 · MDS2 IGAU, TXIG, NAUT · IEC TR 60601-4-5

CRI-LS-7 Dialysis prescription tampered

† Direct harm

Threat. Dialysis machines load the patient’s prescription, dialysate composition and fluid removal targets from a clinic system or a patient card. An altered prescription or card can remove too much fluid or deliver dialysate at the wrong conductivity or temperature.

Principle. Prescriptions loaded into a dialysis machine are authenticated and checked against safe ranges before treatment starts.

Design measures:

  1. Sign prescriptions in the clinic system and verify the signature on the machine.
  2. Hard-code physiological limits for conductivity, temperature and fluid removal that a prescription cannot exceed.
  3. Show the loaded prescription for a nurse to confirm against the order before starting.

Card prompts:

  • Where does the dialysis machine load its prescription from?
  • How is a prescription checked against safe ranges before treatment?
  • Could an altered patient card change fluid removal targets?

Mappings: STRIDE T, S · CAPEC-153, CAPEC-165 · CWE-353, CWE-1284 · ATT&CK T0836, T1565.002 · EMB3D TID-111 · MDS2 IGAU, NAUT, AUTH · IEC TR 60601-4-5; ISO 14971

† Direct harm

Threat. A surgical robot’s console sends motion commands to the arms over a cable, a network or, in remote surgery, a wide-area link. Injected, delayed or dropped commands can move an instrument inside the patient or stall it mid-procedure.

Principle. Every motion command is authenticated, fresh and checked, and the arms stop safely when the link is in doubt.

Design measures:

  1. Authenticate and sequence-number every command between console and arms, rejecting stale or replayed messages.
  2. Stop motion and hold position safely when latency or loss exceeds a validated limit.
  3. Run remote surgery only over dedicated links with monitored quality and a local surgeon able to take over.

Card prompts:

  • How are motion commands between console and arms protected?
  • What do the arms do when commands are delayed or lost?
  • Which links does remote surgery depend on, and who runs them?

Mappings: STRIDE T, D, S · CAPEC-94, CAPEC-60 · CWE-294, CWE-924 · ATT&CK T0830, T0831 · EMB3D TID-407, TID-221 · MDS2 TXIG, NAUT · IEC TR 60601-4-5; ISO 14971

CRI-LS-5 Neonatal incubator environment altered

† Direct harm

Threat. Networked incubators and warmers control air temperature, humidity and oxygen for premature babies and report them to a central station. Altered control or false readings can overheat, chill or over-oxygenate a baby who cannot signal distress.

Principle. Environmental limits for neonates are enforced in the incubator and verified by an independent sensor.

Design measures:

  1. Enforce fixed upper and lower temperature and oxygen limits in the incubator’s own controller.
  2. Use an independent probe on the baby that alarms locally when it disagrees with the control sensor.
  3. Make central station connections read-only for environmental settings.

Card prompts:

  • Where are temperature and oxygen limits enforced for the baby?
  • Does an independent sensor confirm the incubator’s readings?
  • What would the central station show if control were altered?

Mappings: STRIDE T, D · CAPEC-137, CAPEC-148 · CWE-862, CWE-1284 · ATT&CK T0836, T0832 · EMB3D TID-406 · MDS2 AUTH, IGAU · IEC TR 60601-4-5; ISO 14971

CRI-LS-4 Consumable checks that block therapy

† Direct harm

Threat. Devices that authenticate circuits, cartridges, filters or licences refuse to run when the check fails, the licence server is unreachable or the clock is wrong. An attacker, an outage or a supplier change can stop ventilation, dialysis or surgery when no approved consumable is accepted.

Principle. Consumable and licence checks never stop life-sustaining therapy; they warn and record instead.

Design measures:

  1. Let therapy continue with a clear warning and a log entry when a consumable or licence check fails.
  2. Never make therapy depend on reaching a remote licence or activation service.
  3. Document a clinical override for emergencies and test it during verification.

Card prompts:

  • What happens to therapy if a consumable or licence check fails?
  • Which outages could make the device refuse an approved consumable?
  • Does a failed check warn and record, or stop treatment?

Mappings: STRIDE D · CAPEC-607 · CWE-636, CWE-1357 · ATT&CK T0813, T0814 · EMB3D TID-222 · MDS2 EMRG, RDMP · ISO 14971; IEC TR 60601-4-5

CRI-LS-3 Setting history that proves nothing

Threat. Life-support devices keep setting and event logs that are unsigned, editable by service tools, or stamped by an unsynchronised clock. After an incident nobody can tell whether a setting was changed by a clinician, a fault or an attacker, so the cause is never found.

Principle. Device event logs are complete, tamper-evident and trustworthy in time.

Design measures:

  1. Sign or hash-chain event logs on the device and protect them from service-tool edits.
  2. Synchronise device clocks to a trusted hospital time source and record clock changes.
  3. Export logs automatically to a central store the device cannot rewrite.

Card prompts:

  • Are device event logs signed and protected from service tools?
  • Could investigators tell a clinician’s change from an attacker’s?
  • Which clock stamps the setting history?

Mappings: STRIDE R · LINDDUN Nr · CAPEC-268 · CWE-778, CWE-117 · ATT&CK T0872 · EMB3D TID-225 · MDS2 AUDT, IGAU · IEC TR 60601-4-5; AAMI SW96

CRI-LS-2 Service log exports leak patients

Threat. Service and error logs exported from ventilators, anaesthesia machines and dialysis units for vendor support include patient identifiers, settings and timestamps. Sent by email or left on service laptops, they disclose patient data outside the hospital.

Principle. Logs leaving the device carry only what the vendor needs, with patient identifiers removed.

Design measures:

  1. Strip or pseudonymise patient identifiers in every log export by default.
  2. Encrypt exported logs and send them through an approved, audited channel.
  3. Document in the security guide exactly what each export contains.

Card prompts:

  • What patient data is in exported service logs?
  • Where do exported logs travel, and who keeps them?
  • Can identifiers be removed before logs leave the device?

Mappings: STRIDE I · LINDDUN DD, I, U · CAPEC-497 · CWE-532, CWE-359 · ATT&CK T1005 · EMB3D TID-226 · MDS2 DIDT, STCF, MPII · IEC 80001-1; ISO 27799

Seen in the wild

No entry in this suit cites a public case yet. The overview page lists every case in the taxonomy.

Mappings

Life Support and Therapy: the mappings of each entry to STRIDE, LINDDUN, CAPEC, CWE, ATT&CK, EMB3D, MDS2 and standards.

Across the 13 entries, the STRIDE counts are Tampering 9, Denial of service 6, Spoofing 3, Elevation of privilege 2, Information disclosure 2, Repudiation 2 (an entry can carry more than one). 13 map to CAPEC 3.9, 13 to CWE 5.0, 13 to ATT&CK v20.0, 13 to MITRE EMB3D and 2 to LINDDUN. The MDS2 capabilities a buyer should check first are IGAU (7), AUTH (5), NAUT (4). 10 carry the red † for direct harm and 1 the amber † for wrong or delayed treatment. A blank means nothing fitted well; a loose tag would mislead.

← Patient Monitoring · Hospitals and medical devices overview · Medication Delivery →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the hospitals and medical devices overview.