Cybersecurity
Threat Modeling
In one line
A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.
Definition
Threat modeling is a structured engineering activity in which a cross-functional team analyzes a device's architecture, data flows, trust boundaries, and assets to identify how an attacker could compromise confidentiality, integrity, availability, or safety - and then designs or selects controls to mitigate the identified threats. The most widely used framework in MedTech is STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) developed by Microsoft, often combined with attack-tree or kill-chain analysis. AAMI TIR57:2016 "Principles for Medical Device Security - Risk Management" provides MedTech-specific guidance.
Why it matters
Threat modeling is most effective when done early (during architecture) and revisited at every major design change. Mature MedTech teams keep the threat model as a living artifact in the Design History File and re-walk it as part of design reviews. AAMI TIR57 and the MITRE Playbook for Threat Modeling Medical Devices both provide templates and examples MedTech teams can adapt.
Common pitfalls
- •Producing a one-shot threat model at submission rather than maintaining it through the lifecycle.
- •Listing generic threats (malware, ransomware) without mapping them to specific device interfaces and trust boundaries.
- •Skipping the four views FDA specifically calls out - global system, multi-patient harm, updateability/patchability, security use case.
- •Failing to feed threat-model outputs into the ISO 14971 risk management file.
Sources