Microsegmentation in a Hospital Converged Network
St. Aiden's Health System operates 1,400 beds across three campuses on a single 10.0.0.0/16 network. About 12,000 endpoints share VLANs: nurse stations, infusion pumps, MRI consoles running Windows XP Embedded, badge readers, and the building management system. 802.1X is enforced only on wireless; wired ports use MAC authentication bypass with a shared fallback VLAN. A sister hospital was hit by ransomware 14 months ago that moved laterally over SMB within 36 hours. The security team sees recurring ARP spoofing alerts between the imaging VLAN and the pharmacy VLAN, and a broadcast storm took down a switch stack for 40 minutes last month. MRI and pump vendors refuse to install supplicants and will void support if agents are added. Clinical engineering allows a single two-hour maintenance window per quarter. The board has funded a segmentation program but wants measurable risk reduction within six months.
1. Define the target security zones, the enforcement points, and the order in which you would implement them.
Read the worked answer
First verify the topology. ARP is link-local: a genuine ARP spoofing alert between the imaging and pharmacy VLANs means those segments share a Layer 2 broadcast domain, or the sensor is seeing mirrored traffic from a trunk. If the VLANs are bridged, the segmentation is cosmetic. Confirm VLAN membership and STP topology before buying anything; the 40-minute broadcast storm points to a Layer 2 loop or an uplink problem, not an L3 design issue.
Target zones, ordered by blast radius and known attack path:
- Medical devices - imaging consoles, infusion pumps, anaesthesia, lab analysers. Group by clinical function and vendor, not by floor.
- Building management/OT - HVAC, power, badge access. Highest availability sensitivity and lowest patchability.
- Clinical workstations and EMR - the main user population.
- Corporate/guest - should never reach devices directly.
- Data centre and management - separate management plane.
Enforcement points: routed boundaries at the distribution layer with ACLs or internal firewalls; private VLANs and port isolation for device ports; host firewalls on workstations; NAC for admission. On a flat /16 you cannot re-IP 12,000 endpoints quickly, so enforce at the core and distribution with ACLs first and re-address during refresh.
First six months: block SMB (445), RDP (3389), and Telnet between clinical zones and from corporate to devices; contain BMS; isolate imaging; then pumps. Metrics: east-west SMB attempts denied, critical-device reachability reduced to required flows, broadcast domain size, and time to detect ARP anomalies.
2. How should devices that cannot run an 802.1X supplicant be admitted, and what are the risks of relying on MAC authentication bypass?
Read the worked answer
MAB is identification, not authentication. A MAC address is trivially spoofed, and a shared fallback VLAN means any device that fails 802.1X lands in a permissive segment. Use MAB only as a trigger for profiling, not as trust.
Compensating controls for devices that cannot run a supplicant:
- Profiling before admission - DHCP fingerprint, LLDP/CDP, OUI, and observed traffic pattern. Unknown devices go to a registration or quarantine VLAN, not the fallback VLAN.
- Per-device ACLs - an infusion pump only needs to reach the drug library/EMR server and the vendor management endpoint. Deny everything else, including internet.
- Layer 2 hardening - private VLAN or port isolation, DHCP snooping, dynamic ARP inspection, BPDU guard, disabled unused ports, and port security limiting MAC counts.
- Vendor access - time-bound, monitored remote sessions through a jump host, not permanent tunnels.
- Detection - baseline each device's normal destinations and alert on new ones; medical device anomaly detection is more useful than agent-based EDR that cannot be installed.
- Patch workaround - for Windows XP Embedded, network isolation is the primary control; document the accepted risk with clinical engineering.
Keep the shared fallback VLAN but restrict it to remediation only, with no route to clinical systems.
3. Given one two-hour maintenance window per quarter, how would you sequence the changes and measure risk reduction?
Read the worked answer
Use the two-hour window as an enforced change slot, not as time to design.
Before the window: stage the configuration in a lab with representative devices; pre-build ACLs and rollback scripts; get the vendor and clinical engineering on a bridge; identify a clinical champion per unit; confirm out-of-band access to switches; set a go/no-go call at T-24h.
In the window:
- Apply changes one distribution pair at a time, never the whole campus.
- Start in monitor mode for one window where possible: log what would be denied, review with clinical staff, then enforce in the next window. If the quarter allows only one window, use a short monitor period inside the window for the highest-risk devices.
- Enforce the least controversial rules first (corporate-to-device SMB block), then device-to-device rules.
- Keep a timer: if a critical device loses connectivity for more than 15 minutes, roll back that pair immediately.
After: verify device availability with clinical engineering, collect flow logs, and publish a rollback-ready change record.
Measure risk reduction by counting critical devices reachable from more than one zone, denying east-west SMB, shrinking broadcast domains, and tracking mean time to detect ARP anomalies. Target a measurable drop each quarter, not a one-off project milestone.