Information Technology and Cybersecurity
Information Technology and Cybersecurity
This domain tests confidentiality, integrity, and availability for medical devices and clinical networks. Expect risk assessment, network architecture, access control, patching, incident response, and standards such as IEC 62443 and HIPAA.
Core rules
- Medical devices are part of the clinical network; flat networks increase blast radius.
- Use segmentation or VLANs, firewalls, least privilege, MFA, unique accounts, encryption, and logging.
- Vulnerability management requires inventory, SBOM review, risk ranking, vendor coordination, and compensating controls when patching is unsafe.
- Patch only after validation; clinical impact and rollback plans matter.
Worked example
A legacy infusion pump runs an unsupported OS and cannot be patched. Compensate with a dedicated VLAN, ACLs allowing only required clinical systems, no internet access, restricted USB ports, monitoring, and documented risk acceptance with an expiration date. Reassess when a supported replacement is available.
Traps
- Using shared local administrator accounts.
- Patching during clinical hours without validation or rollback.
- Assuming HIPAA covers every device-security requirement.