Zero Trust Rollout vs. a Flat Legacy Network
A hospital system with 14 facilities runs a flat internal network: clinical workstations, MRI scanners, infusion pumps, and administrative PCs all share one VLAN. The CISO proposes a zero trust program centered on microsegmentation and identity-aware proxies. The biomedical engineering lead warns that several MRI and infusion pump models run unsupported operating systems and cannot host an agent; vendor contracts prohibit network changes without recertification, which costs $80K per device class and takes nine months. The CISO has budget for one year and 6 FTEs. A recent tabletop exercise showed that a single compromised admin laptop could reach the imaging archive in under four minutes. Clinicians report that repeated MFA prompts during shift changes are causing workarounds, including shared passwords written on notes.
1. Critique the CISO's zero trust plan against the constraints. What should be sequenced first?
Read the worked answer
The plan is directionally right but mis-sequenced. Microsegmentation across a flat network with un-agentable medical devices is a multi-year effort gated by vendor recertification at $80K per class and nine months each. Attempting it broadly in year one with 6 FTEs spreads effort thin and risks clinical disruption.
Sequence by risk reduction per unit effort: (1) Contain the demonstrated path - the admin laptop to imaging archive - with network-level controls that do not require device agents, such as firewall policy and VLAN separation at the infrastructure layer. (2) Segment the imaging archive and administrative zones first, since those are standard systems. (3) Place un-agentable devices in dedicated segments with restrictive allow-lists, which achieves segmentation without touching device software. (4) Address identity workarounds before expanding MFA prompts.
The judgment point is that zero trust is an outcome, not a product rollout. Network-layer controls can deliver most of the containment benefit while device recertification proceeds in parallel.
2. How should the CISO handle the MFA workaround problem?
Read the worked answer
Shared passwords on notes are a signal that the control design, not clinician discipline, is the problem. Repeated prompts at shift change collide with a high-tempo workflow, so users optimize around friction.
Options: extend session lifetime for clinical applications within risk tolerance; use phishing-resistant authenticators with fast re-authentication (badge tap, platform biometrics); apply conditional access so prompts trigger on risk signals rather than fixed intervals; and pilot with one unit before scaling. Measure prompt frequency and workaround reports as leading indicators.
The judgment point is that a control that produces workarounds has negative net security value. The CISO should treat workaround reports as a defect report against the identity design and fix the design rather than issue a compliance reminder.
3. The biomedical lead asks for a written risk acceptance for the un-agentable devices. What should the CISO do?
Read the worked answer
Accept the constraint but not a blanket acceptance. Distinguish what is truly unchangeable (device OS, vendor contract terms) from what is a choice (no compensating network controls).
Produce a scoped acceptance that names each device class, the specific control that cannot be applied, the compensating controls in place (dedicated VLAN, allow-listed flows, monitoring, restricted egress), the residual risk, an owner, and a review date. Tie recertification budget requests to the acceptance so the organization sees the cost of the residual risk.
The judgment point is that risk acceptance is a governance instrument, not a waiver. A blanket acceptance would hide the exposure; a scoped one makes it visible and fundable.