Legacy Infusion Pumps on a Shared WPA2-Personal SSID

The risk is not just that TKIP is deprecated; it is the combination of a shared PSK across 300 devices, a visible SSID, and a flat trust path toward the EHR server. A single extracted PSK-from a lost device, a maintenance laptop, or an insider-allows an attacker to associate and reach whatever the pump VLAN can reach. TKIP adds weaknesses around Michael MIC and key mixing, but the dominant risk is credential reuse and lack of per-device identity.

Prioritize controls by impact first, then likelihood:

1. Microsegment the pump traffic. Put the pumps on a dedicated SSID and VLAN with no inter-VLAN routing except a firewall rule that permits only the pump VLAN to the EHR medication-management server on the required TCP/UDP ports. This reduces impact because a compromised PSK no longer gives access to other clinical systems.
2. Enforce device profiling and admission. Use the NAC to permit only profiled pump MAC addresses or device fingerprints on that SSID. This does not stop PSK theft, but it raises the likelihood cost because an attacker must also spoof a known device profile.
3. Monitor with the WIPS. Alert on new BSSIDs using the pump SSID, deauthentication floods, and any traffic from the pump VLAN to destinations outside the EHR rule. This reduces detection time and limits dwell time.
4. Reduce PSK blast radius. If the controller supports group PSKs or per-floor PSKs, split the 300 pumps into smaller groups and rotate quarterly during scheduled maintenance. This lowers likelihood of mass compromise but is operationally expensive; do it after segmentation and monitoring.
5. Disable SSID broadcast only as a minor hygiene step. It is not a security control, so do not count it as risk reduction.

The residual risk is accepted only because the pumps cannot do 802.1X and replacement is not immediate. Document the accepted risk with the CISO and review it whenever the WIPS detects anomalous pump-VLAN traffic or the vendor publishes a firmware change.

A defensible decision needs criteria that compare patient safety, regulatory exposure, cost, and operational feasibility-not just a binary “replace or accept.”

Criteria to apply:

• Patient safety: Could a compromise alter medication orders or deny pump connectivity? If yes, the tolerable duration of risk is short.
• Regulatory exposure: HIPAA requires reasonable safeguards; PCI DSS applies to the separate payment network, so keep the pump VLAN out of PCI scope. A shared PSK on a clinical network is hard to defend without documented compensating controls.
• Detectability and containment: The WIPS and NAC can detect rogue devices and restrict traffic, so the risk is not unmonitored.
• Cost and care disruption: USD 2.1 million and clinical disruption are material; a phased replacement aligned to the 2027 end-of-support date is more realistic than immediate replacement.
• Vendor roadmap: If the vendor will not provide a firmware fix, the risk cannot be engineered away permanently.

Recommendation: Conditionally accept the risk for 18 months with the segmentation, profiling, monitoring, and PSK-reduction controls in place, and fund a replacement plan that completes before the 2027 end-of-support date. Set explicit triggers for early replacement: WIPS detects unauthorized association to the pump SSID, the PSK is suspected compromised, the vendor withdraws support earlier than 2027, or the EHR rule must be widened. Require the CISO to sign the risk acceptance and review it quarterly. This is a judgment call: immediate replacement is safest but may not be operationally justified if the compensating controls are real and tested.