NP-200 system security design review
NimbusPump NP-200 Program · candidate AREV-0004 vs effective baseline DRB-0007
PRJ-2026-0042-DRV-0001Threat review
Threat workbench
Attacker sends unauthorized dosing command
PRJ-2026-0042-TV-000118Mitigation pendingCriticalSafety-linked
- Proposed (passed)
- Confirmed (passed)
- Assessed (passed)
- Treatment planned (passed)
- Mitigation pending (current)
- Verified (pending)
- Closed (pending)
An attacker with a foothold on the hospital clinical network reaches the NP command API exposed through the NimbusLink Gateway and submits a crafted dosing command. The candidate source declares POST /dose without a security scheme, so the dosing command processor would accept and sequence a command that no clinician authorized, altering infusion delivery for the connected patient.
Safety-linkedDeterministic ruleConfidence high
Actor: Network-resident attacker (compromised hospital host or rogue device on VLAN 12); moderate skill, commodity tooling; no physical access required.
- Attacker can route to the gateway command listener across TB-003.
- Hospital VLAN segmentation (CTRL-006, assumed control) is bypassed or misconfigured.
- Remote dosing feature enabled for the target pump (OPST-001 normal infusion).
- Enumerate gateway service ports from a compromised workstation on the clinical VLAN.
- Replay a captured API session shape or craft a request against POST /dose (no authentication scheme in candidate).
- Gateway forwards the command across TB-003 to AE-000042.
- Dosing command processor validates only schema and drug-library limits, then sequences actuation via DF-000073.
Inherent
CriticalL4 × I5
Residual
HighL2 × I5
Factors (1 to 5)
Exploitability4
Impact: confidentiality2
Impact: integrity5
Impact: availability5
Impact: authenticity5
Detectability2
| Category | Value | Share |
|---|---|---|
| Exploitability | 4 | 17% |
| Impact: confidentiality | 2 | 9% |
| Impact: integrity | 5 | 22% |
| Impact: availability | 5 | 22% |
| Impact: authenticity | 5 | 22% |
| Detectability | 2 | 9% |
Safety consequence: Potential hazardous situationScope: Multi patientUncertainty: LowSafety-risk linkage: confirmed
- Exploitability
- 4/5
- Reachable from any clinical-network foothold; commodity HTTP tooling suffices; only segmentation assumption (CTRL-006) stands in the way.
- Impact: confidentiality
- 2/5
- Command payloads carry limited PHI.
- Impact: integrity
- 5/5
- Unauthorized modification of delivered dose; direct falsification of therapy.
- Impact: availability
- 5/5
- Malicious commands can halt or exhaust delivery on the active channel.
- Impact: authenticity
- 5/5
- Command origin cannot be attributed to an authorized clinician.
- Safety consequence
- Potential hazardous situation
- Over/under-delivery scenario referred to ISO 14971 file HZ-0141; confirmed potential hazardous situation by Clinical Safety.
- Affected scope
- Multi patient
- Any connected NP-200 with remote commands enabled; multi-patient reach via shared clinical environment.
- Detectability
- 2/5
- No command-origin audit distinguishable from legitimate traffic today; weak detection.
- Uncertainty
- Low
- Two corroborating sources; API behavior reproduced in test harness.
Inherent Critical 20 = L4 x I5 per MTX-2026-01. Impact aggregated as max(C2,I5,A5,Au5) with dimensions retained. Cyber exploitability is not equated to probability of harm (DR-TST-024).
- Responsible implementer
- Noor Haddad (Firmware Engineer)
- Accountable manager
- Tomas Novak
- Independent security reviewer
- Priya Raman
- Risk owner
- Marcus Chen
- Target date
- 30 Jun 2026
- Disposition
- Confirmed by Marcus Chen, 15 Apr 2026
- Treatment adopted (passed)
- Implemented (current)
- Evidence accepted (current)
- Retest passed (pending)
- Closed (pending)
- REM-201Mutual device/service authentication on the remote command pathAdopted
- REM-202Signed nonce-bound commands with anti-replay windowAdopted
- REM-203Gateway network allowlist for command listenerdefense-in-depthAdopted
- VOB-000211Authenticated-command fuzz testPendingdue 10 Jul 2026
- VOB-000212Authentication-bypass penetration test on command pathPendingdue 24 Jul 2026
- VOB-000213Allowlist enforcement and bypass-attempt alerting testPendingdue 12 Jun 2026
EvidenceRequestedRetestNot scheduled
- Treatment adoptedTomas Novak · REM-201 + REM-202 adopted as primary controls; REM-203 adopted defense-in-depth. Obligations created.
- Safety linkage reviewDr. Lena Fischer · Potential hazardous situation confirmed for over-delivery scenario; ISO 14971 file HZ-0141 referenced.
- Risk assessed (RSK-000118)Marcus Chen · Inherent Critical 20; safety consequence referred to Clinical Safety.
- ConfirmedMarcus Chen · Corroborated by OpenAPI evidence; safety linkage suspected.
- Proposed by deterministic rule DFL-AUTH-02 (run TMR-0009)system
SourceSRC-0001NP-200_SystemArchitecture.vsdx, page 3 connector 81MappedSourceSRC-0002dosing-api.openapi.yaml, POST /doseParsedElementAE-000042Infusion dosing command processorFlowDF-000077Remote dosing command (crosses TB-003)ThreatTV-000118Attacker sends unauthorized dosing commandMitigation pendingRiskRSK-000118Inherent Critical 20 / residual High 10 (projected)RemediationREM-201Mutual device/service authenticationAdoptedRemediationREM-202Signed nonce-bound commands + anti-replayAdoptedRemediationREM-203Network allowlist (defense-in-depth)AdoptedControlDC-000314Command authentication requirementControlDC-000315Anti-replay command envelope requirementObligationVOB-000211Authenticated-command fuzz testPendingObligationVOB-000212Auth-bypass penetration testPending