Patient-Side Threat Modeling

Why network-side models miss it

An asset inventory sees two nodes running the same OS with the same CVE. It cannot see that one of them is keeping a chest rising and the other is archiving vitals for the morning report. Same score. Not remotely the same risk.

PSTM tiers every device before anything gets scored:

From the floor

The same vulnerability disclosure lands on a networked ventilator and on the server that stores its historical trend data. The register scores them identically. On the ventilator, exploitation is a code blue. On the archive, it’s a breach-notification workflow. Any model that can’t separate those two outcomes isn’t modeling healthcare — it’s modeling a data center that happens to contain patients.

Why network-side models miss it

CVSS measures exploitability and impact to the system. It has no axis for how fast a human deteriorates. Two findings with the same score can sit on opposite ends of the only clock that matters at the bedside.

From the floor

A suppressed telemetry alarm hurts no one at minute one. It hurts someone at hour three, when the rhythm changes and nothing sounds. A deleted allergy field hurts no one for days — until the next admission, the next order, the next push of the wrong drug. Latency isn’t a technicality. It is the response window, and it tells you which findings you fix tonight and which can wait for the change window.

Why network-side models miss it

Detection engineering ends at the SOC. But a “detected” event in the SOC is not a detected event on the floor. Most IoMT compromise is silent at the point of care: the device keeps displaying what the clinician expects to see, and the clinician has four other patients.

Alarm fatigue makes it worse — it is an attacker’s ally. Clinical staff silence hundreds of alarms per shift because most of them mean nothing. An attacker doesn’t have to hide the alarm. The environment hides it for them.

From the floor

A compromised pump can display the ordered rate while delivering a different one. There is no visual difference at the bedside between a pump that is working and a pump that is lying. The nurse checks the screen — that’s the verification step the workflow allows — and the screen confirms the order. Every control downstream of that glance assumes the glance means something.

Why network-side models miss it

Shared logins. Propped doors. A badge taped over the reader. Screens left unlocked because the timeout fires mid-code. Every one of them was invented by a rational person trying to keep a patient alive.

The workaround is the vulnerability. No scanner finds it, no register scores it, and no network-side model can produce this lens — because producing it requires having been the clinician who invented the workaround.

From the floor

I have been the clinician the screen timeout fired on — mid-resuscitation, gloves on, seconds mattering. The next shift, that workstation stays logged in as whoever touched it first. Security calls that an audit finding. The floor calls it Tuesday. Design the control for the code, not the demo, or the floor will redesign it for you.

Why network-side models miss it

The register ends where the outage begins. Paper downtime procedures exist on paper. Most staff hired after 2015 have never executed one — never charted a med pass by hand, never run orders on carbon-copy forms, never worked a floor where the EHR simply is not coming back this shift.

From the floor

Downtime survivability is a set of testable questions. Are the downtime forms in the box current? Does the charge nurse know where the box is? Is the read-only EHR snapshot fresher than 24 hours? Has anyone on nights — the shift ransomware actually hits — run a paper med pass end to end? Every one of those has a yes/no answer. Almost nobody asks.