Network Security and Infrastructure Protection
Network questions test segmentation, secure remote access, and protection of connected medical devices. eHealth networks mix clinical systems, IoMT, guest Wi-Fi, and cloud services, so a flat network is a finding.
Core controls
Segment by function and trust: clinical VLANs, medical-device VLANs, management, guest, and DMZ. Enforce inter-segment traffic with firewalls and ACLs; microsegmentation limits lateral movement. Place internet-facing services in a DMZ behind a WAF. Use NAC to admit known devices. IDS/IPS, NetFlow, and DNS monitoring provide visibility. Remote access should use VPN or zero-trust network access with MFA, not direct exposure of clinical systems. Encrypt ePHI in transit with TLS 1.3 and disable weak protocols. In cloud, apply shared responsibility: the provider secures infrastructure, while you secure identity, configuration, and data.
Medical devices
Inventory IoMT, change default credentials, restrict outbound traffic, and isolate devices that cannot be patched. Many devices run unsupported operating systems; compensating controls include network ACLs and virtual patching.
Worked example
Infusion pumps need vendor remote support. Put pumps on a dedicated VLAN with no internet egress. Allow management only from a jump host with MFA. Permit vendor access through a time-bound VPN tunnel to a single pump, logged and approved. Reasoning: segmentation reduces blast radius; least-privilege remote access replaces always-on vendor connections; logging supports audit.
Traps
Flat networks and unrestricted east-west traffic. Exposing DICOM or FHIR endpoints directly to the internet. Assuming TLS solves endpoint compromise. Forgetting guest Wi-Fi isolation. Ignoring unpatched IoMT because it is clinical.