A legacy MRI and a ransomware crew
Sint-Lucas is a 600-bed regional hospital. Its radiology department depends on an MRI scanner running Windows 7 Embedded. The vendor supports the device until 2027 but will not allow operating-system patches without a recertification that costs €180,000 and takes 14 months. The scanner sits on the same flat /16 network as 1,800 nurse workstations, and a shared local administrator password is used by radiology staff to restart the viewing software. Last year a worm reached an outpatient clinic through a USB stick and disrupted appointments for two days. The board has approved a €250,000 security budget and wants 'all critical patches within 30 days'. The CISO proposes network segmentation, application allow-listing on the scanner, a firewall restricting traffic to two image servers, and a jump host for vendor support. Radiology managers fear segmentation will break the clinical workflow and delay scans.
1. Explain why the board's patch mandate cannot be the whole answer. What risk does the legacy scanner represent, and how do the CISO's controls reduce it?
Read the worked answer
A patch mandate is a control objective, not a risk strategy. The scanner cannot be patched without vendor recertification, so forcing a 30-day patch either breaks clinical service or is quietly ignored. The board needs an exception process and a funded migration path, not a slogan.
The risk is not only the old operating system. The scanner sits on a flat network with 1,800 workstations and a shared local administrator password. A workstation infected by USB malware could reach the scanner, and the shared password would help an attacker move and persist. The scanner is a high-impact asset because loss of imaging delays diagnosis and can affect patient safety.
The CISO's controls are compensating controls:
- Segmentation limits lateral movement and blast radius.
- Application allow-listing stops unauthorised executables, including ransomware, on the scanner.
- Firewall rules restrict the scanner to the two image servers it actually needs.
- A jump host controls and logs vendor access.
They do not remove the underlying vulnerability. Residual risk remains, so the board must see it, own it and review it.
2. Prioritise the four proposed controls for the first 90 days. Justify with the likely threat path and clinical impact.
Read the worked answer
Order for the first 90 days
- Firewall micro-segmentation around the MRI and image servers, with a clinical rollback plan. The likeliest path is lateral movement from a workstation or USB infection. Segmentation gives the biggest reduction in blast radius. Do it in a maintenance window, test image transfer, and keep a documented rollback.
- Jump host and vendor access control. Vendor access is a common entry point and is easier to control than the scanner itself. Require named accounts, MFA, session recording and time-bound approvals.
- Application allow-listing. This is strong against ransomware, but it can break viewing-software updates and clinical workflows. Test with radiology, maintain an emergency change process, and log blocked executions.
- Broader network segmentation and removal of the shared local administrator password. This is essential but slower; use unique local credentials or a managed password tool in the meantime.
Measure scan delays, blocked traffic and blocked executables. If segmentation causes clinical delays, adjust the rules rather than abandoning the control. The priority is to break the most likely attack path with the least patient impact.
3. How should the organization document and accept residual risk, and who owns it? What evidence should an auditor see?
Read the worked answer
Documentation Record the scanner in the risk register with: asset and clinical function, threat, vulnerability, existing controls, likelihood and impact, residual rating, treatment plan, owner, review date and expiry of any exception. State clearly that the vendor will not permit patching and that recertification takes 14 months.
Ownership The CEO or board owns acceptance of risk above the CISO's authority. The CISO advises and operates the controls; the clinical safety officer must confirm that segmentation and allow-listing do not create unacceptable patient-safety risk. Radiology management owns the workflow validation. A single signature from the CISO is not sufficient.
Evidence
- Approved risk acceptance with a review date.
- Segmentation firewall rules and change records.
- Application allow-list changes and blocked-execution logs.
- Jump-host session logs and vendor access approvals.
- Patch exception records for other systems that meet the 30-day mandate.
- Minutes showing board discussion in business terms.
If residual risk exceeds appetite, escalate and consider service changes. The goal is not to make the risk disappear on paper; it is to make the trade-off explicit, owned and auditable.