Threat Modeling

CVSS 4.0 at a glance, with a medical device example

The four CVSS 4.0 metric groups and a worked infusion pump example that scores 8.7 High.

Infographic of CVSS 4.0 Base, Threat, Environmental, and Supplemental metric groups, plus an illustrative infusion pump vulnerability with vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N scoring 8.7 High. — The base score is a starting point. Add Threat and Environmental metrics for how your device is actually deployed.

Download the graphic Talk through it with us

What the graphic says

The full text version, so the content is readable without the image.

The four metric groups

Base (required): Exploitability (AV, AC, AT, PR, UI), vulnerable system impact (VC, VI, VA), and subsequent system impact (SC, SI, SA).
Threat (optional): Exploit maturity (E), which updates the score as attacks appear.
Environmental (optional): Security requirements (CR, IR, AR), modified base metrics, and a Safety value for subsequent integrity and availability.
Supplemental (no effect on score): Safety, Automatable, Recovery, Value density, Response effort, and Provider urgency.

Worked example (illustrative)

An infusion pump on the hospital network accepts unauthenticated commands over its local service port. An attacker on the same network segment can change settings or stop the pump.

Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Score: 8.7, High (CVSS-B, base metrics only).

Source: FIRST CVSS v4.0 specification. Score computed with the same engine as our calculator.

Keep reading

More in Threat Modeling

Infographic: the four threat modeling questions - what are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job - each with the artifacts it produces.

Part 1

Underneath it all, four questions

Infographic: the nine-step medical device threat modeling workflow mapped to the four questions, from scoping and the DFD through STRIDE, attack trees, controls, testing, and the residual risk QA gate.

Part 2

Four questions, nine steps

Infographic chain of seven steps: threat, vulnerability, CIA loss, hazardous situation, harm rated per ISO 14971, security control, and verification, with shared IDs on every row.

Part 3

Cybersecurity hazard analysis: from threat to harm to control

Infographic of a device, phone app, and cloud separated by trust boundaries, with six STRIDE cards: spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege, each with the property it breaks and a device example.

STRIDE threats on a connected medical device

Ready when you are

Secure your device before it reaches patients.

30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.

Book strategy session Explore services