Risk-Based Treatment in a Hospital Medical Device Estate
Riverside General Hospital runs 3,000 endpoints, 400 infusion pumps, and a flat clinical network. Patching is quarterly because clinical staff fear disrupting care; 60% of pumps run an unsupported OS. The risk register scores every risk as likelihood × impact and lists 'cyber attack' as a single risk with a score of 20. The insurer has asked for evidence of controls, and the board wants a three-month plan. A recent scan found 37 critical vulnerabilities on internet-facing imaging servers. The CISO has two analysts, no OT engineer, and a freeze on capital spending until next fiscal year. Clinical leaders will accept disruption only for life-critical devices and demand safety-first prioritization.
1. Critique the current risk assessment approach and describe how ISO/IEC 27032 risk management concepts would improve it.
Read the worked answer
The register collapses many threats, assets and controls into 'cyber attack = 20'. ISO/IEC 27032 risk guidance starts with context: clinical services, safety, law, suppliers, and the hospital's risk appetite. Then identify assets and processes (pumps, imaging, EHR, network), threat sources (ransomware, insider, vendor), vulnerabilities (unsupported OS, flat network, remote access), existing controls and their effectiveness. Likelihood and impact need defined criteria, including patient safety and clinical availability, not just financial loss. Risks should be evaluated against thresholds, treated, and residual risk accepted by an accountable owner. The current method cannot distinguish a billing server from an infusion pump, cannot show the insurer which controls exist, and cannot justify the three-month plan. An improved register would have separate risk statements, asset criticality, control evidence, and review dates. It would also record uncertainty and assumptions. This is not bureaucracy: it lets the CISO argue for segmentation and compensating controls using safety impact rather than generic 'high' ratings.
2. Propose a treatment plan for infusion pumps and internet-facing imaging servers under the constraints, using compensating controls where patching is not possible.
Read the worked answer
Treat the two groups separately by exposure and safety. Imaging servers: remove direct internet exposure, place behind a firewall with allow-listed access, require MFA and a jump host, apply emergency patching for the 37 critical vulnerabilities, enable virtual patching/IPS, central logging, and tested offline backups. If a server cannot be patched, document a time-bound exception with compensating controls and an owner. Infusion pumps: do not rush unsupported OS replacement. Build an inventory by model and clinical area, segment pumps onto clinical VLANs with strict ACLs, restrict outbound traffic, monitor for anomalous connections, enforce vendor remote-access controls, and schedule patching in maintenance windows with clinical sign-off. Where patching is impossible, use compensating controls and a device-specific incident playbook; prioritize life-critical devices for replacement in the next capital cycle. The reasoning is to reduce likelihood and blast radius first, preserve clinical availability, and make residual risk explicit. A capital freeze does not remove risk; it shifts it to monitored exceptions that the board must see.
3. Define four risk metrics that the board can use to track progress without implying zero risk.
Read the worked answer
Four board metrics: (1) percentage of critical clinical assets in segmented, monitored network zones; (2) median days to remediate critical vulnerabilities on internet-facing assets, with a separate count of overdue exceptions; (3) percentage of unsupported medical devices covered by an approved compensating control and owner; (4) number and severity of risk acceptances above appetite, plus incident detection time. These are outcome and exposure measures, not activity counts. They show direction of travel without promising zero risk. The board should also see a short narrative on patient-safety implications and a trend line. A target of 100% patching would be unrealistic and encourage gaming; a target of 'no unowned exceptions' is achievable and meaningful. Review monthly for three months, then quarterly.