Medical Device Segmentation and Vendor Access at a Hospital
St. Alder Hospital has 600 beds, 4,200 wired and wireless endpoints, and a flat clinical VLAN. It uses Aruba CX switches, Aruba wireless, and ClearPass, but NAC is in monitor mode. There are 1,100 medical devices from 40 vendors, including infusion pumps, nurse call, and imaging modalities. Many devices use static IPs, some run unsupported operating systems, and vendor support tunnels terminate on a jump host with domain administrator rights. A recent worm spread from a radiology workstation to the clinical VLAN and disrupted nurse call for 40 minutes. Clinical leadership will not accept a network outage caused by NAC. The security team wants microsegmentation between device classes and vendor access controls. The hospital has a change freeze during weekday clinic hours and a small network team.
1. Design a segmentation approach for the medical device estate that reduces worm spread without breaking clinical workflows. What zones, enforcement points, and discovery steps would you use?
Read the worked answer
Start with discovery and a device inventory, not with VLAN changes. Use ClearPass profiling, switch ARP and MAC data, and passive traffic analysis to classify devices by vendor, function, and required flows. Define zones by clinical function and risk: infusion and life-support, nurse call, imaging, biomedical engineering, guest, corporate, and vendor support. Enforce at the CX access layer with role-based ACLs or dynamic segmentation, using ClearPass roles where possible, so enforcement follows the device rather than a static port. Permit only required flows, such as pump-to-server and nurse-call-to-controller, and deny lateral device-to-device traffic that is not clinically required. Keep the initial scope to a pilot ward and one device class, with a rollback plan. Static IP devices need address management, not DHCP forcing, so plan exceptions carefully. The goal is to contain a compromised workstation before it reaches nurse call, not to create a perfect zero-trust design in one change window.
2. NAC is in monitor mode and clinical leadership fears an outage. How would you move to enforcement, and where would you use fail-open versus fail-closed?
Read the worked answer
Move to enforcement in stages by device class and location, starting with non-clinical and low-risk endpoints, then imaging, then nurse call and infusion pumps. Use monitor mode data to build the allow policy and identify unknown devices. For life-support and nurse call, use a fail-open posture with a restricted remediation or quarantine ACL if ClearPass or the policy service is unavailable during the transition, and log every bypass. For guest, corporate, and vendor endpoints, fail-closed is acceptable because a temporary denial does not stop patient care. Require redundant ClearPass nodes, local caching or survivability features on the switches, and a tested NAC outage procedure before enforcement. Schedule changes outside weekday clinic hours and use a pilot ward. Success criteria should include no unintended clinical device disconnects, a documented bypass count, and a shorter containment time in a tabletop exercise. Clinical leadership needs evidence, not assurances.
3. Vendor support tunnels currently terminate on a jump host with domain administrator rights. What controls would you put in place, and how would you verify them?
Read the worked answer
Remove shared domain administrator use from the vendor path. Create per-vendor, time-bound accounts with multi-factor authentication, least privilege, and access only to the specific device or management subnet. Terminate vendor sessions through a privileged access gateway that records sessions, enforces approval, and logs commands. Segment the vendor access zone from clinical zones and require a jump path that cannot reach the domain controller or broad clinical VLANs. Verify with a controlled test: attempt access outside the approved window, attempt lateral movement to another device class, and confirm that session recording and alerts work. Review vendor accounts quarterly and disable dormant ones. The hospital should also require vendor security attestations and a support escalation path that does not rely on standing domain admin. These controls reduce the blast radius of a compromised vendor credential and make the access auditable during an incident.