Threat Modeling · Part 1

Underneath it all, four questions

The four questions that structure an FDA-ready medical device threat model, and what each one has to produce.

What the graphic says

The full text version, so the content is readable without the image.

The structure behind an FDA-ready medical device threat model. Four questions, and every answer traces to a patient harm.

01. What are we working on?: Scope, the data flow diagram (DFD), entry points, and trust boundaries. The system as an attacker sees it, not as the architecture deck draws it.
02. What can go wrong?: STRIDE per element proves coverage. Three CIA attack trees add depth, each one rooted in a specific patient harm.
03. What are we going to do about it?: Eliminate, mitigate, accept, or transfer - then score. Never accept or transfer in silence; the rationale is part of the record.
04. Did we do a good enough job?: The QA gate. Completeness, traceability, and the link from every threat to a patient harm.

The Four Questions, from the MITRE / MDIC Playbook for Threat Modeling Medical Devices.

30-minute strategy session. No cost, no commitment - just answers from people who've shipped 275+ devices supported.