Zero Trust for Unagentable Medical Devices in a Flat Hospital Network
Metro General Hospital has 4,000 endpoints, 800 servers, and 1,200 medical devices on a flat VLAN. Devices include MRI scanners, infusion pumps, and nurse stations; many run Windows XP/7 and cannot accept a VEN. Last month ransomware on a radiology workstation spread to a shared file server and disrupted imaging for 14 hours. The board mandates zero trust microsegmentation in 90 days. The CISO has Illumio Core for managed servers and endpoints, but only 65 percent of servers have VENs. The network team can implement VLANs and ACLs at the core, but change control for clinical devices is slow. The security team has mapped 40 critical clinical flows but has not validated them with device owners.
1. How would you apply zero trust principles where devices cannot run an agent?
Read the worked answer
Zero trust is a policy outcome, not a product requirement. The principles are: identify and authenticate the workload or device as far as possible, grant least-privilege access, deny by default between zones, and monitor continuously. Where a VEN cannot be installed, the enforcement point moves to the network: VLANs, ACLs, firewalls, and NAC or 802.1X where the device supports it.
For medical devices, build microperimeters around clinical functions, not around individual old devices. For example, put MRI scanners in a radiology device zone that can reach only the PACS and imaging management systems on required ports, and block SMB, RDP, and internet access from that zone. Use Illumio for the managed servers that talk to those devices, with label-based rules for the server side. Treat the unagentable devices as exceptions with compensating controls, documented owners, and periodic review. Do not tell the board that agentless devices are under full zero trust; tell them the enforcement model for those devices is network-based and narrower than the flat VLAN.
2. What 90-day segmentation plan would most reduce ransomware blast radius?
Read the worked answer
Prioritize the paths that turned the radiology incident into a 14-hour outage.
- Days 1-15: validate flows and ring-fence the highest-risk clinical zones. Meet device owners and confirm the 40 flows. Put radiology devices, infusion pumps, and nurse stations into separate VLANs with ACLs that allow only clinical traffic. Block SMB and RDP from user endpoints and IT servers into those zones.
- Days 16-45: protect the shared services that ransomware reaches. Segment file servers, backup servers, and domain controllers. Use Illumio labels to enforce app-tier rules on managed servers, and use ACLs for servers without VENs. Restrict backup access so a compromised clinical workstation cannot encrypt backups.
- Days 46-75: extend to managed servers and endpoints. Raise VEN coverage above 90 percent, build allow rules from observed traffic, and move high-risk server groups to selective enforcement. Create deny rules for lateral SMB and RDP between clinical, corporate, and data-center zones.
- Days 76-90: test and measure. Run a tabletop or controlled containment exercise. Measure validated flows, enforcement coverage, blocked lateral attempts, and time to isolate a simulated infected workstation. Do not chase full enforcement everywhere; close the paths that matter most.
3. What would you tell the board about zero trust in 90 days, and how would you measure progress?
Read the worked answer
Tell the board the truth: 90 days will not deliver enterprise-wide zero trust, but it can deliver measurable reduction in ransomware blast radius. The realistic 90-day outcome is validated clinical flows, microperimeters around the highest-risk device groups, segmented backups and file services, and enforcement on a large share of managed servers. Full zero trust for unagentable devices will remain a network-enforcement program with compensating controls.
Use metrics that reflect risk reduction rather than tool installation: percentage of critical clinical flows validated with owners; percentage of high-risk zones with deny-by-default ACLs; number of allowed lateral SMB/RDP paths removed; VEN coverage on servers; number of workloads in selective or full enforcement; time to isolate a simulated infected host; and results of a ransomaware tabletop. Also report exceptions openly, especially Windows XP/7 devices and servers without VENs. The board should see a trajectory and a residual-risk statement, not a claim that zero trust is complete.