Segmenting 62 Clinics With Devices You Cannot Touch
Lakeview Health Partners runs 62 clinics over an MPLS hub-and-spoke network into two data centres, with a single inspected firewall pair at the core and no east-west inspection. Each clinic is a /24 inside one flat /16. Guest Wi-Fi sits on the same VLAN as clinical workstations and uses a shared WPA2 passphrase. The estate includes 1,100 infusion pumps and 400 imaging devices, many running unsupported Windows Embedded, none of which can take an endpoint agent or perform 802.1X. Third-party support engineers use a shared remote-support account that has a standing route into the clinical network. A recent penetration test showed that a guest Wi-Fi client could reach SMB on an imaging server and the EHR database port. Segmentation is now proposed as an 18-month programme requiring a capital request in the next budget cycle.
1. Design the target segmentation model given that 1,100 pumps cannot run agents or 802.1X.
Read the worked answer
Zone by function and trust, and let device constraints choose the enforcement point - network-level controls for devices that cannot carry one.
- Clinic core zone: workstations and EHR access, segmented per clinic with a local L3 boundary (branch firewall or SD-WAN policy) rather than one firewall pair at the core. Inter-clinic traffic should not exist at all; deny it at the hub and prove it with a connection test.
- Medical device zone: pumps and imaging on their own VLANs, grouped by manufacturer and model, because allowed flows are per-model, not per-clinic. Pumps cannot run agents or 802.1X, so enforcement is ACLs permitting only the pump management server, the EHR interface and the vendor support path. Use MAC authentication bypass or DHCP fingerprinting to place devices, and alert on unknown devices rather than blocking them until the inventory is trustworthy.
- Clinical workstation zone: 802.1X with certificates where supported, profiling where not.
- Guest zone: internet only, client isolation, captive portal, no route to clinical or device networks.
- Vendor zone: brokered remote support through a privileged access gateway; no standing inbound path from the internet.
Sequencing beats the diagram. Move devices by model with a documented allowed-flow list, tested in low-activity windows. Imaging first - a broken imaging path is immediately visible and easy to roll back. Pumps last, in small batches, because a pump that cannot reach its server overnight is a patient-safety event, not an outage.
Prerequisite: an asset inventory you actually trust. Without it, segmentation is guesswork and the first clinical outage ends the programme.
2. What can be delivered in 90 days, without a capital cycle, that materially reduces the risk the pen test demonstrated?
Read the worked answer
Choose controls that need configuration and process, not procurement.
- Guest Wi-Fi isolation. Dedicated VLAN, client isolation, deny to all internal ranges, sponsored captive portal. This closes the exact path the pen test found, and it is a controller change. Verify it by attempting the SMB and EHR connections from a guest device and keep the test output.
- Block legacy paths at the hub. Deny SMB (445), RDP (3389) and Telnet between clinic subnets except for documented flows; disable SMBv1 wherever reachable on Windows Embedded devices.
- NAC in monitor mode. Deploy profiling and MAC authentication bypass passively to build the inventory. It costs staff time, not capital, and it is the prerequisite for the device zones.
- Vendor access. Retire the shared remote-support account for named accounts through a privileged access gateway with MFA, just-in-time sessions and session recording. Scope the licence small - one vendor group at a time.
- Egress filtering. Block clinical subnets from reaching newly registered and uncategorised domains; ransomware callbacks and tooling downloads are the immediate payoff.
Be explicit about what is not delivered: full device microsegmentation, east-west inspection at the data centres and TLS inspection need the capital cycle and the inventory. State that a compromised clinic workstation can still reach the core until phase two, because otherwise leadership will believe the programme is complete when it has only started.
3. What controls do you require for guest Wi-Fi and third-party remote support, and how do you justify them to leadership?
Read the worked answer
Guest Wi-Fi. Separate SSID on a dedicated VLAN with no route to clinical, device or management networks; client isolation so guests cannot reach each other; captive portal with staff sponsorship or vouchers for visitors. Treat the guest network as internet - assume a device on it is compromised and make sure it can reach nothing else. Review the VLAN and ACLs monthly, because guest networks are the path least reviewed and most shared.
Third-party remote support.
- No shared session account. Named accounts per engineer, provisioned per ticket, expiring automatically, MFA enforced.
- Broker sessions through a privileged access or remote-access gateway that terminates inside the vendor zone. The vendor never receives a route to the clinical network or a standing firewall rule from the internet.
- Record sessions for medical devices, where a vendor change can affect safe operation, and state in the contract that sessions are recorded and unattended access is prohibited.
- Require the vendor to notify personnel changes and attest annually to its own controls.
Justification. Neither control is compliance theatre: the pen test already demonstrated a guest-to-clinical path, and the shared vendor account is an unattributed credentialed route into medical devices. Both are removable now, at low cost, and both are the first things an assessor, insurer or affected patient will ask about. Bring evidence rather than claims - the failed guest connection attempt with a timestamp, and a privileged access session log showing who connected, when and to what. That converts a policy statement into a tested control and makes the capital case for phase two much easier to argue.