Infusion Pump Segmentation Under a Two-Hour Window
Northbridge Regional Hospital runs a 3,200-endpoint network on a single 10.0.0.0/16 VLAN. Its 180 infusion pumps share that VLAN with nursing workstations, VoIP handsets, and badge readers. The pumps use broadcast discovery, and the vendor states firmware cannot be updated until Q3. At 02:10, the IDS reports a workstation at 10.0.44.19 scanning 10.0.0.0/16 on TCP 445 and 3389; 14 pump management ports answer. The workstation has a signed EDR agent but no alert. The CISO wants the pumps separated before the 06:00 medication round. The only change window is 02:30-04:30, and the pump vendor's on-call engineer is available by phone. Clinical engineering says losing pump connectivity for more than 10 minutes requires diversion to paper MAR. The network team has saved configs and a rollback script.
1. What is the first containment action, and why is an ACL on the core router alone insufficient?
Read the worked answer
The first action is to isolate the workstation at 10.0.44.19 from the network while preserving it for investigation: apply a switch-port ACL or disable the port, and do not shut the host down. In parallel, block workstation-to-pump SMB/RDP at the access layer.
A core-router ACL alone is insufficient because the workstation and pumps are in the same VLAN and subnet. Same-subnet traffic is switched at Layer 2 and never reaches the router, so a router ACL cannot see or filter it. The control must be applied where the traffic actually crosses: switch-port ACLs, a VLAN ACL on the distribution switch, or private VLAN isolation on pump ports. If the switch supports it, a port ACL on pump-facing ports that permits only the vendor management server, DHCP, DNS, and required broadcast while denying TCP 445/3389 from user ports gives immediate containment without moving 180 ports during a short window. Confirm that the block is bidirectional and logged, then verify that the vendor heartbeat still works.
2. Design a bounded segmentation approach for the 02:30-04:30 window that preserves pump discovery and clinical availability. State the sequence, allow rules, and rollback trigger.
Read the worked answer
Do not attempt a full 180-port VLAN migration in two hours. Use a two-phase approach.
Phase 1, immediate: on every pump-facing access port, apply an ACL that permits the vendor management server, DHCP relay, DNS, and broadcast/multicast needed for discovery; deny all other IP traffic, especially TCP 445 and 3389. Log denies. Test one pump on each of the 12 access switches before applying to all. Notify clinical engineering before each unit is touched.
Phase 2, after 06:00: create a dedicated pump VLAN, move ports in unit-sized batches, and place the vendor server on a promiscuous or management port. Broadcast discovery then stays inside the pump VLAN. Use DHCP reservations and documented port maps so rollback is deterministic.
Rollback trigger: more than two pumps lose management connectivity for more than five minutes, the vendor heartbeat disappears, or clinical staff report a pump not visible in the central system. Roll back the affected switch only, not the whole change, using the saved config. Success requires no workstation SMB/RDP reaching pump IPs and no clinical diversion.
3. What evidence should be collected to prove the containment worked, and what should be escalated after the window?
Read the worked answer
Collect evidence at three layers. First, switch counters and ACL logs showing denies for TCP 445/3389 from user ports to pump addresses, plus confirmation that no permit rule is too broad. Second, IDS/flow data showing the original scan stopped and no new same-subnet SMB scans appear. Third, clinical and vendor checks: pump inventory count, management-server heartbeat, and a documented test from a nursing workstation that fails to connect to a pump while the vendor server succeeds.
Escalate the workstation to forensics, not just cleanup. The EDR agent did not alert, so determine whether it was disabled, bypassed, or simply missed the behavior. Review the workstation's logon history, scheduled tasks, and recent USB or email activity. Preserve switch configs and ACL logs because they are the evidence that containment was real.
Finally, schedule the full VLAN migration and a pump firmware review with the vendor. The temporary ACL is compensating control, not the target architecture; document the residual risk of broadcast traffic and unpatched pumps until Q3.