NP-200 system security design review

NimbusPump NP-200 Program · candidate AREV-0004 vs effective baseline DRB-0007

PRJ-2026-0042-DRV-0001Threat review

Threat workbench

STRIDE register for candidate AREV-0004; a row opens the threat record.

Threats by generation origin
Segment	Count	Share
Deterministic	12	75%
Enrichment	3	19%
Manual	1	6%


Attacker sends unauthorized dosing commandTV-000118TamperingSpoofingSafety	Critical	Mitigation pending	Noor Haddad	High
Replay of captured dosing command re-doses patientTV-000124Tampering	High	Treatment planned	Noor Haddad	High
Unauthenticated serial service port grants privileged shellTV-000101Elevation of privilege	High	Closed	Noor Haddad	High
Unsigned application firmware package accepted by update agentTV-000112TamperingElevation of privilege	High	Assessed	Noor Haddad	High
Tampered drug library uploaded from compromised pharmacy workstationTV-000129TamperingSafety	High	Treatment planned	Noor Haddad	High
Gateway flood starves dosing command channelTV-000133Denial of service	High	Treatment planned	Owen Blake	High
Rogue device impersonates clinician app over BLE pairingTV-000126Spoofing	High	Assessed	Noor Haddad	Medium
Maintenance actor alters or truncates pump audit logTV-000127RepudiationTampering	Medium	Treatment planned	Noor Haddad	High
Cloud telemetry stream exposes PHI to unauthorized readerTV-000131Information disclosure	Medium	Treatment planned	Owen Blake	Medium
Maintenance mode left enabled exposes diagnostic shellTV-000135Elevation of privilege	Medium	Assessed	Noor Haddad	Medium
Protocol downgrade between gateway and cloud ingestionTV-000138TamperingInformation disclosure	Low	Assessed	Owen Blake	High
EHR adapter verbose errors leak integration credentialsTV-000140Information disclosure	Not assessed	Dismissed	Unassigned	Low
Shared service account between gateway services enables lateral movementTV-000141Elevation of privilege	Not assessed	Proposed	Unassigned	Medium
Clinician session fixation on mobile app hand-offTV-000142Spoofing	Not assessed	Proposed	Unassigned	Low
Time source manipulation skews infusion event timestampsTV-000143Repudiation	Not assessed	Proposed	Unassigned	Medium
Legacy NP-100 import path retains plaintext exportTV-000144Information disclosure	Not assessed	Out of scope	Unassigned	Medium

Attacker sends unauthorized dosing commandTV-000118TamperingSpoofingSafety
CriticalMitigation pending
Owner
Noor Haddad
Replay of captured dosing command re-doses patientTV-000124Tampering
HighTreatment planned
Owner
Noor Haddad
Unauthenticated serial service port grants privileged shellTV-000101Elevation of privilege
HighClosed
Owner
Noor Haddad
Unsigned application firmware package accepted by update agentTV-000112TamperingElevation of privilege
HighAssessed
Owner
Noor Haddad
Tampered drug library uploaded from compromised pharmacy workstationTV-000129TamperingSafety
HighTreatment planned
Owner
Noor Haddad
Gateway flood starves dosing command channelTV-000133Denial of service
HighTreatment planned
Owner
Owen Blake
Rogue device impersonates clinician app over BLE pairingTV-000126Spoofing
HighAssessed
Owner
Noor Haddad
Maintenance actor alters or truncates pump audit logTV-000127RepudiationTampering
MediumTreatment planned
Owner
Noor Haddad
Cloud telemetry stream exposes PHI to unauthorized readerTV-000131Information disclosure
MediumTreatment planned
Owner
Owen Blake
Maintenance mode left enabled exposes diagnostic shellTV-000135Elevation of privilege
MediumAssessed
Owner
Noor Haddad
Protocol downgrade between gateway and cloud ingestionTV-000138TamperingInformation disclosure
LowAssessed
Owner
Owen Blake
EHR adapter verbose errors leak integration credentialsTV-000140Information disclosure
Not assessedDismissed
Owner
Unassigned
Shared service account between gateway services enables lateral movementTV-000141Elevation of privilege
Not assessedProposed
Owner
Unassigned
Clinician session fixation on mobile app hand-offTV-000142Spoofing
Not assessedProposed
Owner
Unassigned
Time source manipulation skews infusion event timestampsTV-000143Repudiation
Not assessedProposed
Owner
Unassigned
Legacy NP-100 import path retains plaintext exportTV-000144Information disclosure
Not assessedOut of scope
Owner
Unassigned

16 threats