Skip to content

Cybersecurity

The question this discipline answers

What could an attacker do, and what stops them?

Cybersecurity asks what in the device is worth protecting, who could attack it and how, which weaknesses would let them, and what controls stand in the way. For a medical device the answer matters beyond the data: an attack that changes a therapy setting is a safety problem. MEMO therefore builds the security argument from the same kinds of element as the safety argument. A threat is a requirement driver, as a risk is. A vulnerability is a risk item, as a hazard is. A cyber mitigation is a risk control. Security can show where it meets safety.

Namespace: memo::assurance::cybersecurity ยท Source: src/assurance/cybersecurity/

Key elements

What is protected. A CybersecurityAsset is something worth protecting: data, a credential, a configuration, software, hardware, and so on. It states its confidentiality, integrity and availability needs, and whether it is privacy- or safety-relevant.

Where attacks enter. An AttackSurface is an entry point, with its exposure and whether authentication is expected. A TrustBoundary is a boundary between zones of different trust. It states the assumption made about each side and the constraint on crossing.

Who attacks, and through what. A Threat is a requirement driver with a threat category. The categories are STRIDE's six (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege), plus privacy loss and supply chain. A threat also records its attack vector, source and preconditions. A Vulnerability is a weakness, with its CWE reference and CVSS v3.1 base score and vector.

Risk and control. A CyberHazard is a hazard with security, safety, privacy and operational impact. A CyberRisk is a risk with exploitability, attack complexity and patient-safety contribution. A CyberMitigation is a risk control, of a kind such as prevent, detect, respond, recover, hardening, authentication, authorisation, encryption, or integrity protection. A SecurityRequirement is a requirement with a security objective.

Product security and threat intelligence. A ThreatActor is who attacks: an insider, a service technician, an opportunist, a cybercriminal, a nation state or a supply-chain party, with a motivation, a capability and the way they get access. An AttackTechnique names a technique in an external framework (MITRE ATT&CK for ICS, EMB3D, CAPEC) by its identifier, so MEMO points at the framework instead of copying it. An AttackPath is an operative scenario that chains techniques from an entry point to an attack goal. A SecurityProperty is a security objective an asset must keep (confidentiality, integrity, availability, authenticity, accountability, privacy or safety) at an impact level. A CybersecurityAssumption is a stated assumption with an owner, a review date and whether it still holds. An SBOMEntry is an inventory record of the bill of materials (SoftwareBillOfMaterials) that points at the software element it lists, with its supplier, license expression, checksum, package URL and the SPDX or CycloneDX reference it came from. A SecurityAssessmentCase is a verification case (penetration test, SAST, DAST or SCA, stated once as its method) that produces a SecurityAssessmentReport (ProducesEvidence); the report holds its SecurityFindings, each with its CVSS rating, its status and, where the method gives them, the weakness, source location or tested endpoint. A PostmarketProcess is a monitoring, disclosure, patching or incident-response process and its cadence. A vulnerability also carries its CVE reference and a disposition (open, mitigated, accepted or closed).

Inherent and residual risk. A CyberRisk stays the one identity of a risk. A CyberRiskAssessment records its state before controls (inherent) or after them (residual), with the probability and severity estimates, the resulting level, whether it is acceptable, who assessed it and who approved it, without copying the risk.

How it connects

  • Assets are threatened (ThreatenedBy, in Core), and a threat exploits a vulnerability (Exploits).
  • Threats play out in scenarios. A threat is realised by an operative scenario (RealizedByScenario). See Operational.
  • Security meets safety. A security element can impact a safety risk item (ImpactsSafety), and a mitigation reduces a vulnerability with Mitigates (mitigationKind = vulnerability). See Safety and risk.
  • Threats drive requirements. A threat or risk derives a security requirement (DerivesCyberRequirement, in Core). See Requirements.
  • What is exposed and what it must keep. An attack surface exposes an asset (ExposesAsset), and an asset has security properties (HasSecurityProperty).
  • Who, how and what follows. A threat is attributed to an actor (AttributedToThreatActor), uses a technique (UsesAttackTechnique) and realises a cyber hazard (RealizesCyberHazard). An attack path includes the techniques it chains (IncludesAttackTechnique).
  • Findings and components. A security finding identifies a vulnerability (IdentifiesVulnerability) and demonstrates an attack path (DemonstratesAttackPath). A vulnerability affects an SBOM entry (AffectsSBOMEntry), which a postmarket process monitors (MonitorsSBOMEntry).
  • Evidence and assumptions. Evidence supports a mitigation's effectiveness (SupportsMitigationEffectiveness), an assessment assesses a cyber risk (AssessesCyberRisk), and an assumption conditions any cyber element (ConditionsCyberElement).
  • Trust boundaries sit on the architecture. A TrustBoundary is an interface element, and an element can cross one (CrossesTrustBoundary, in Core). See Logical.

In the running example

The temperature alarm has no security model, so this example comes from the GPCA infusion pump. An unauthorised change to the therapy configuration through the maintenance port is the threat. A shared default credential in service mode is the vulnerability that enables it, and a tampered-configuration scenario is how it plays out.

part unauthorizedConfigChangeThreat : Threat {
    @MemoIdentity { :>> providedId = "TH-001"; :>> label = "UnauthorizedTherapyConfigurationChange"; }
    attribute :>> driverKind = "cybersecurity";
    attribute :>> threatCategory = ThreatCategoryKind::tampering;
    attribute :>> attackVector = "maintenance port";
    attribute :>> threatSource = "unauthorized actor with local access";
    attribute :>> precondition = "maintenance interface exposed without strong authentication";
    attribute :>> affectedConcern = ConcernKind::cybersecurity;
item weakServiceAuthentication : Vulnerability {
    @MemoIdentity { :>> providedId = "VULN-001"; }
    attribute :>> weakness = "service mode relies on shared default credential";
    attribute :>> exploitability = "moderate";
    attribute :>> discoveryMethod = "architecture review";
    ref :>> affectedElement = gpcaSoftware.config;
    attribute :>> cweReference = "CWE-798";
connection : ThreatenedBy connect protectedAsset ::> therapyConfigurationAsset to threat ::> unauthorizedConfigChangeThreat;

connection : ThreatenedBy connect protectedAsset ::> patientEventLogAsset to threat ::> eventLogTamperingThreat;

connection : Exploits connect threat ::> unauthorizedConfigChangeThreat to enablingVulnerability ::> weakServiceAuthentication;

connection : RealizedByScenario connect realizedThreat ::> unauthorizedConfigChangeThreat to scenario ::> tamperedConfigurationScenario;

The full inventory

Generated from src/assurance/cybersecurity/.

Elements

Core concepts

Element SysML kind What it is
CybersecurityAsset part def Cybersecurity asset definition specializing MemoPart.
AttackSurface part def Attack surface definition specializing MemoPart.
Threat part def Threat definition specializing RiskDriver.
Vulnerability item def Vulnerability definition specializing RiskItem.
CyberHazard item def Cyber hazard definition specializing Hazard.
CyberRisk part def Cyber risk definition specializing Risk.
CyberMitigation part def Cyber mitigation definition specializing RiskControlMeasure.
SecurityRequirement requirement def Security requirement definition specializing Requirement.
TrustBoundary part def Trust boundary definition specializing InterfaceElement.
ThreatActor part def Threat actor definition specializing MemoPart.
AttackTechnique part def Attack technique definition specializing MemoPart.
SecurityProperty part def Security property definition specializing MemoPart.
CybersecurityAssumption part def Cybersecurity assumption definition specializing MemoPart.
AttackPath action def The path's narrative is the inherited pathSummary.
SecurityAssessmentCase verification def Security assessment case definition specializing VerificationCase.
SecurityFinding part def Security finding definition specializing MemoEvidence.
SecurityAssessmentReport part def Security assessment report definition specializing MemoEvidence.
PostmarketProcess action def Postmarket process definition specializing MemoAction.
CyberRiskAssessment part def Cyber risk assessment definition specializing MemoPart.

Connections at a glance

Each arrow is one relationship, from its source end to its target end. A grey box belongs to another layer.

flowchart LR
  CybersecurityAsset["CybersecurityAsset"]
  Threat["Threat"]
  Vulnerability["Vulnerability"]
  RequirementDriver["RequirementDriver"]:::other
  OperativeScenario["OperativeScenario"]:::other
  MemoPart["MemoPart"]:::other
  RiskItem["RiskItem"]:::other
  SecurityProperty["SecurityProperty"]
  AttackSurface["AttackSurface"]
  ThreatActor["ThreatActor"]
  AttackTechnique["AttackTechnique"]
  AttackPath["AttackPath"]
  CyberHazard["CyberHazard"]
  CyberRiskAssessment["CyberRiskAssessment"]
  CyberRisk["CyberRisk"]
  SecurityFinding["SecurityFinding"]
  SBOMEntry["SBOMEntry"]:::other
  MemoEvidence["MemoEvidence"]:::other
  CyberMitigation["CyberMitigation"]
  CybersecurityAssumption["CybersecurityAssumption"]
  anyElement["any element"]:::other
  PostmarketProcess["PostmarketProcess"]
  CybersecurityAsset -->|ThreatenedBy| Threat
  Threat -->|Exploits| Vulnerability
  RequirementDriver -->|RealizedByScenario| OperativeScenario
  MemoPart -->|ImpactsSafety| RiskItem
  CybersecurityAsset -->|HasSecurityProperty| SecurityProperty
  AttackSurface -->|ExposesAsset| CybersecurityAsset
  Threat -->|AttributedToThreatActor| ThreatActor
  Threat -->|UsesAttackTechnique| AttackTechnique
  AttackPath -->|IncludesAttackTechnique| AttackTechnique
  Threat -->|RealizesCyberHazard| CyberHazard
  CyberRiskAssessment -->|AssessesCyberRisk| CyberRisk
  SecurityFinding -->|IdentifiesVulnerability| Vulnerability
  Vulnerability -->|AffectsSBOMEntry| SBOMEntry
  SecurityFinding -->|DemonstratesAttackPath| AttackPath
  MemoEvidence -->|SupportsMitigationEffectiveness| CyberMitigation
  CybersecurityAssumption -->|ConditionsCyberElement| anyElement
  PostmarketProcess -->|MonitorsSBOMEntry| SBOMEntry
  classDef other fill:#eef1f4,stroke:#9aa7b2,color:#4a5a66

Relationships declared here

Relationship From To What it says
ThreatenedBy CybersecurityAsset Threat Typed relationship from CybersecurityAsset to Threat.
Exploits Threat Vulnerability Typed relationship from Threat to Vulnerability.
RealizedByScenario RequirementDriver OperativeScenario Typed relationship from RequirementDriver to OperativeScenario.
ImpactsSafety MemoPart RiskItem Typed relationship from MemoPart to RiskItem.
HasSecurityProperty CybersecurityAsset SecurityProperty Typed relationship from CybersecurityAsset to SecurityProperty.
ExposesAsset AttackSurface CybersecurityAsset Typed relationship from AttackSurface to CybersecurityAsset.
AttributedToThreatActor Threat ThreatActor Typed relationship from Threat to ThreatActor.
UsesAttackTechnique Threat AttackTechnique Typed relationship from Threat to AttackTechnique.
IncludesAttackTechnique AttackPath AttackTechnique Typed relationship from AttackPath to AttackTechnique.
RealizesCyberHazard Threat CyberHazard Typed relationship from Threat to CyberHazard.
AssessesCyberRisk CyberRiskAssessment CyberRisk Typed relationship from CyberRiskAssessment to CyberRisk.
IdentifiesVulnerability SecurityFinding Vulnerability Typed relationship from SecurityFinding to Vulnerability.
AffectsSBOMEntry Vulnerability SBOMEntry Typed relationship from Vulnerability to SBOMEntry.
DemonstratesAttackPath SecurityFinding AttackPath Typed relationship from SecurityFinding to AttackPath.
SupportsMitigationEffectiveness MemoEvidence CyberMitigation Typed relationship from MemoEvidence to CyberMitigation.
ConditionsCyberElement CybersecurityAssumption any element Typed relationship from CybersecurityAssumption to any element.
MonitorsSBOMEntry PostmarketProcess SBOMEntry Typed relationship from PostmarketProcess to SBOMEntry.

Relationships from elsewhere that reach this layer

None with an end typed in this layer.

Enumerations

Enumeration Values
ThreatActorKind insider, serviceTechnician, opportunistic, cybercriminal, nationState, supplyChain
ThreatCapabilityKind low, moderate, high, advanced
ThreatAccessKind physical, local, network, remote, supplyChain
AttackTechniqueFrameworkKind mitreAttackIcs, mitreEmb3d, capec, other
SecurityObjectiveKind confidentiality, integrity, availability, authenticity, accountability, privacy, safety
CyberAssumptionValidityKind valid, reviewDue, invalid, retired
VulnerabilityDispositionKind open, mitigated, accepted, closed
SecurityFindingStatusKind open, inRemediation, accepted, closed
PostmarketProcessKind monitoring, vulnerabilityDisclosure, patching, incidentResponse
CyberRiskAssessmentStageKind inherent, residual
SecurityAssessmentMethodKind penetrationTest, sast, dast, sca

Go deeper