Legacy Infusion Pumps and Network Segmentation
Summit Medical Center is a 400-bed hospital with 1,800 networked infusion pumps. A security scan finds 120 pumps running Windows 7 with unpatched vulnerabilities; the manufacturer will not release a patch and plans replacement in 2027. The pumps are on the same VLAN as nurse stations and the EHR, and vendor remote support uses an always-on outbound connection. Clinical engineering says the pumps cannot be taken offline for more than two hours without disrupting oncology and ICU. The CISO proposes immediate network segmentation and a restricted vendor access gateway; the CIO worries segmentation will break drug-library updates and telemetry. A recent industry advisory describes attacks on similar pumps, but no incident has occurred at Summit. The hospital has no medical device inventory beyond a spreadsheet. The board asks for a risk-based decision and a 90-day plan.
1. How should Summit assess and prioritize the risk from the 120 unpatched pumps?
Read the worked answer
Do not rely on the scan's vulnerability count alone. Build a cross-functional risk assessment with security, clinical engineering, nursing, pharmacy, and the vendor. For each pump, record model, operating system, network reachability, clinical area, data flows, vendor remote access, and whether the device can affect drug delivery. Assess threat, exposure, and patient-safety impact together. A pump in oncology or ICU with network reachability and an always-on vendor connection is higher risk than an isolated pump in a storage area. Consider the advisory as a threat indicator, but do not assume an incident. Evaluate compensating controls already present: network access rules, clinical staff observation, alarm limits, and vendor maintenance. Score likelihood and impact on a defined matrix and prioritize the 120 devices by clinical criticality. Document residual risk and the decision to accept, mitigate, or replace. Update the medical device inventory as the first action; a spreadsheet is not sufficient for board-level risk reporting or incident response.
2. Evaluate the proposed segmentation and vendor access controls and outline a 90-day plan.
Read the worked answer
Segmentation is the right primary compensating control because patching is unavailable. It must be designed with clinical workflows, not imposed. Put the pumps on dedicated VLANs with firewall rules allowing only required traffic to the EHR, drug-library server, and monitoring systems. Move drug-library updates to an internal server or a tightly controlled path so segmentation does not break updates. Replace always-on vendor access with a gateway that requires multifactor authentication, time-bound sessions, approval, and session recording. Test changes in a pilot unit before hospital-wide rollout, and maintain downtime procedures because segmentation can fail. The 90-day plan should sequence: inventory and owner assignment in weeks 1 to 2; pilot segmentation and vendor gateway in weeks 3 to 6; clinical validation in weeks 7 to 8; phased rollout in weeks 9 to 12; continuous monitoring and incident response updates throughout. Add compensating controls such as network anomaly detection and restricted USB ports. Report residual risk to the board and fund replacement in the capital plan.