The Unpatchable MRI Workstation
Northbridge Regional Health is a 240-bed hospital. Its MRI suite runs a vendor-controlled Windows 7 embedded workstation that cannot be patched; the vendor says remediation is bundled with a $1.8 million scanner replacement scheduled in 18 months. The workstation has outbound internet access for telemetry and SMBv1 enabled to a PACS share. A recent internal scan also found the same local administrator password reused on six imaging devices. The risk register lists the finding as High, but no business owner has accepted it. The CISO has $150,000 in discretionary spend and must present a one-page decision to the board next week. Clinical leadership insists that any control cannot add more than two minutes to scan turnaround. The vendor has refused to allow endpoint agents on the workstation.
1. Which risk treatment should the CISO recommend, and what must be true before residual risk is accepted?
Read the worked answer
Recommend mitigation first, not acceptance. The CISO should segment the scanner into a dedicated imaging VLAN, permit only the PACS flows and vendor telemetry proxy, remove direct internet access, replace the shared local administrator password with per-device managed credentials, and log all traffic to the SIEM. These controls address the most likely lateral-movement path without touching the clinical workflow. Acceptance should not be the CISO's decision: the CIO and CMO must accept residual risk in writing, with a sunset date tied to scanner replacement. Conditions should include quarterly scanning, no new SMB exposure, vendor notification SLA, and revocation if conditions fail. Transfer through cyber insurance or vendor indemnity can supplement mitigation but cannot replace it. The $150,000 should be allocated to segmentation and privileged-access management, with the remainder held for contingency. If the business refuses even those controls, document the refusal and escalate rather than silently accepting the risk.
2. The board asks why the hospital cannot simply accept the risk for 18 months. How should the CISO frame the decision?
Read the worked answer
Frame the question as what exposure is being accepted, by whom, and at what cost, not as whether the hospital can tolerate risk in the abstract. Eighteen months is a long exposure window for a internet-reachable, unpatched system with SMBv1 and shared credentials. Present expected loss using available figures: downtime cost per hour for imaging, potential breach notification and HIPAA penalties, and the operational cost of diverting scans. Compare that with the cost of interim controls. Also distinguish likelihood reduction from risk elimination: segmentation and credential management may lower likelihood substantially, but they do not make the device safe. Recommend conditional acceptance only if the interim controls are funded and the replacement date is contractually firm. Define trigger events that reopen the decision, such as a new public exploit, a failed scan, or a vendor delay. This gives the board a defensible decision rather than a blanket acceptance.
3. The vendor refuses endpoint agents and resists network changes. What contractual and operational levers should the CISO use?
Read the worked answer
Use procurement and contract leverage before accepting the vendor's position. The CISO should involve procurement and legal to invoke the security addendum, right-to-audit clause, liability terms, and service credits, and should escalate to the vendor's executive leadership rather than the field engineer. Operationally, isolate the device at the network edge, force telemetry through an authenticated proxy, and require vendor remote support to enter through a privileged access gateway with unique accounts, MFA, session recording, and time-bound approval. Do not accept a shared TeamViewer account. If the vendor still refuses, document the refusal, obtain a written exception from the CMO and CIO, and add compensating monitoring. The CISO should also verify whether the device falls under regulatory reporting or safety obligations. The goal is not to win the argument with the vendor; it is to make the residual risk explicit and owned at the right level.