Post-Incident Prioritization at a Regional Hospital
Riverside Regional Medical Center runs 1,200 clinical workstations, 340 servers, and about 60 medical devices on a single flat /16 VLAN. Last month an attacker used credentials harvested from a phishing email to log into the VPN appliance with a service account that six IT staff shared, then moved laterally to a file server holding 42,000 patient records. The intrusion was noticed only when the file server dropped off the network.
Findings since: the VPN firmware is eight months behind, MFA is licensed but not enabled, three of the 340 servers run an unsupported operating system, EDR is deployed on servers but not on workstations, and nightly backups complete at 02:00 with two weeks of retention on a NAS that is domain-joined. A peer hospital paid $1.8 million after a ransomware event. Leadership has authorized $180,000 and two additional FTE for the next 90 days and asked for a prioritized plan.
1. Rank the first 90 days of work and defend the ordering using what the incident actually demonstrated.
Read the worked answer
The incident names the controls that failed, in sequence. Fund the ones that break that chain or make failure unrecoverable.
- MFA on VPN and all administrative access. The attacker used valid credentials; patching never touches that. Licensing already exists, so the cost is enrollment and configuration time rather than capital. Target 100% of remote users and privileged accounts within 30 days.
- Backup isolation and a tested restore. Two weeks of retention on a domain-joined NAS means one compromised service account can encrypt production and backups together. Fund immutable or offline copies and run an actual restore. This is the only control whose failure cannot be bought back later.
- Retire the shared account and tier administrative rights. Six people on one credential destroys attribution and makes revocation impossible. Issue named accounts, separate admin accounts, and check whether the same pattern exists elsewhere before assuming one file server was the only target.
- Patch the VPN appliance and compensate for the three unsupported servers. Isolate those hosts behind restrictive rules rather than waiting for a patch that may never ship.
- EDR on workstations with whatever budget remains.
Order by attack-path interruption and irreversibility, not by severity score. Patching a medium-severity host nobody can reach is worth less than blocking the login path that was actually used.
2. With $180,000 and 90 days, what network segmentation is realistic, what is not, and how do you justify the boundary to leadership?
Read the worked answer
Full segmentation is an 18-month program, not a quarter. It touches clinical workflow, biomedical vendors who forbid active scanning, and change control a hospital cannot shortcut. Do the parts that shrink blast radius now.
Realistic within 90 days:
- Medical-device VLAN with ACLs permitting only the specific server addresses and ports each device needs and no route to the internet. Keep the device inventory small and documented; do not scan aggressively.
- Enclave the three unsupported servers behind a firewall policy, or host-based firewalls with default deny, so an unpatched host is unreachable from a workstation subnet.
- 802.1X on wireless and port security on access switches where wiring permits, to stop a rogue laptop joining the flat /16.
- Host firewalls on servers to approximate micro-segmentation without a network rebuild.
Not realistic within 90 days: a full zone model across 340 servers, a VLAN per department, or east-west inspection everywhere. Say so explicitly, with the 12-month plan and named owners attached.
The justification is not architectural elegance. The flat /16 is what let a single credential reach 42,000 records; each enclave removes one reachable path from a compromised workstation.
3. What evidence at day 90 would show the plan worked, and what signals would give false comfort?
Read the worked answer
Evidence of real progress:
- VPN and admin accounts at 100% MFA enforcement, verified by a report from the appliance, not by a policy document.
- A live test: disable a named admin account and measure time to revoke all sessions. Minutes, not days.
- A restore from the isolated copy completed inside a stated recovery time objective, with date and duration recorded.
- Counts of domain-admin accounts and shared credentials trending to zero.
- Denied east-west connections logged at the new device VLAN and enclave rules, which proves the controls are actually in the traffic path.
False comfort:
- Patch-compliance percentages computed only from reachable agents, so unsupported servers quietly drop out of the denominator.
- Agent coverage with no triage-time metric; 1,200 endpoints reporting and nobody investigating is worse than no agent at all.
- Tabletop exercises passed on paper while a real restore has never run.
- A clean external audit score the month before an incident.
Report both directions: what is now blocked, and what an attacker holding valid credentials could still do tomorrow. The second half is the honest measure of residual risk.