The Unpatchable MRI Controller
Regional Medical Center (RMC) operates 14 MRI machines running Windows 7 Embedded, which the vendor will not patch due to FDA certification. A new ransomware variant exploits SMBv1 and has breached three hospitals in the region. RMC's network is flat, with 10,000 endpoints, and a recent penetration test showed lateral movement from an office PC to the MRI network in three hops. The CISO proposes network segmentation with ACLs and a jump host, but radiology says any change could disrupt image transfer during surgery. The IT director estimates segmentation would take 6 months and cost $300k, with no approved budget. RMC runs a 24/7 operating schedule; downtime costs $50k per hour. A board update is scheduled in 48 hours. The security team must decide on immediate actions to reduce risk without disrupting clinical operations.
1. Identify the top three risks in this scenario and prioritize them using a likelihood-impact matrix. Justify your prioritization with specific reference to the facts.
Read the worked answer
Top three risks:
- Ransomware propagation to MRI network via SMBv1: Likelihood high (active variant, flat network, pen test confirms 3-hop path). Impact high ($50k/hour downtime, patient safety, regulatory breach). Priority: critical.
- Data exfiltration from MRI network: Likelihood medium-high (SMBv1 exploitation can lead to data theft; 200 GB could be exfiltrated before detection). Impact high (PHI breach, HIPAA fines, reputational harm). Priority: high.
- Clinical disruption from rushed segmentation: Likelihood medium (change management gaps, radiology resistance). Impact high (surgery delays, patient harm). Priority: high.
Prioritization rationale: Risk 1 is the most urgent because the ransomware variant is actively exploiting SMBv1 in the region, the network is flat, and the pen test proves a viable path. The combination of high likelihood and high impact makes it the top priority. Risk 2 is serious but contingent on Risk 1 occurring or on a separate exfiltration vector. Risk 3 is a consequence of mitigation, so it must be managed through careful change control rather than ignored.
2. Propose a 48-hour interim mitigation plan that does not disrupt clinical operations. Include at least three technical and two procedural controls.
Read the worked answer
Technical controls (within 48 hours):
- Disable SMBv1 on all endpoints and servers via Group Policy, except where explicitly required. Test on a small pilot group first. SMBv1 is the exploit vector; disabling it blocks the ransomware's propagation path.
- Host-based firewall rules on MRI controllers to block inbound SMB traffic from all IPs except the single imaging server. This is a low-risk change that does not require network re-architecture.
- Temporary network ACL on existing switches to isolate the MRI VLAN from office VLANs. Use a maintenance window agreed with radiology; test with one MRI machine first. This reduces lateral movement without full segmentation.
- Deploy EDR in monitor-only mode on the MRI network if compatible, to detect malicious activity without blocking clinical traffic.
Procedural controls:
- Change management with radiology sign-off: Any network or system change must be approved by radiology and scheduled during low-usage periods. Create a rollback plan.
- Incident response tabletop with clinical leadership to rehearse ransomware containment and downtime procedures.
- Increase monitoring of SMB traffic and alert on anomalous connections to MRI subnet.
- Brief staff on phishing awareness and reporting suspicious emails.
These controls are reversible, require minimal budget, and can be implemented without disrupting surgery. Full segmentation remains the 6-month goal.
3. Draft a one-paragraph executive summary for the board that communicates the residual risk and the decision required.
Read the worked answer
RMC faces a credible and immediate ransomware threat because 14 MRI machines run unpatchable Windows 7 Embedded on a flat network, and a regional variant actively exploits SMBv1. A penetration test confirms lateral movement from office PCs to the MRI network in three hops. Over the next 48 hours, we are implementing interim controls-disabling SMBv1, adding host-based firewall rules, and isolating the MRI VLAN-without disrupting clinical operations. These measures reduce but do not eliminate the risk of a $50k-per-hour outage or a PHI breach. Full network segmentation requires $300k and 6 months. The board must approve emergency funding for segmentation and formally accept the residual risk until the project completes, with quarterly risk reviews. Immediate decision is required to protect patient safety and regulatory standing.