Clinic Ransomware Preparedness on a $6,000 Budget
Northside Family Clinic has 12 staff, a single NAS holding 40,000 patient records, and a flat network. Last month a nearby clinic was hit by ransomware that encrypted its scheduling system; Northside's manager wants to buy an expensive next-generation firewall. The clinic has a limited budget of about $6,000 and one part-time IT contractor who visits twice a month. Staff share three generic login accounts because it is faster during patient intake. Backups run nightly to a USB drive that stays connected to the NAS. The clinic also accepts walk-in payments on a laptop at the front desk. The manager asks you to recommend the first three security investments. You must weigh likelihood, impact, cost, and operational disruption, and explain how each choice maps to confidentiality, integrity, and availability. The clinic cannot close for a week to retrain everyone.
1. Rank the first three security investments and justify the order using likelihood, impact, cost, and the CIA triad.
Read the worked answer
- Fix backup recovery first. Move the USB drive off the NAS, keep at least one offline or immutable copy, and test a restore. The most likely serious event is ransomware or accidental deletion; the highest-impact outcome is loss of availability and integrity of 40,000 records. A connected USB backup is often encrypted along with the NAS, so it is not a real recovery control. Cost is low and disruption is minimal.
- Replace shared generic accounts with unique accounts and add MFA for remote or administrative access. Shared accounts destroy accountability, make least privilege impossible, and let one phished password expose all intake workstations. This improves confidentiality and integrity. Training can happen in short shift huddles, not a week-long closure.
- Separate the front-desk payment laptop from the NAS and clinical workstations, or at minimum restrict its access. Card data and patient records should not share a flat network. A next-generation firewall may help later, but it is not first because it does not fix shared credentials or backup recovery. Residual risk remains: phishing, unpatched software, and physical theft.
2. The manager says the $6,000 firewall is the only 'real' security. How do you respond, and what would you buy with the budget?
Read the worked answer
A firewall controls network traffic, but it does not stop a staff member from using a shared password, open a malicious attachment, or plug in an infected USB drive. The clinic's biggest weaknesses are that one credential compromise can reach everything and that the backup is connected to the same NAS. Buying only a firewall leaves those weaknesses intact. With roughly $6,000, I would allocate money to an offline backup drive plus offsite rotation, a password manager and MFA for the few remote/admin accounts, and simple network segmentation using the existing switch's VLAN capability. I would also fund a short phishing-awareness session. If a firewall is still desired, a modest business firewall with logging and segmentation support is enough; the expensive next-generation model can wait until basic controls are working. The test is not whether the clinic owns a firewall, but whether it can restore data and limit one stolen password to one account.
3. What 90-day metrics would show that the changes actually reduced risk?
Read the worked answer
Use metrics tied to the controls, not vanity metrics. For backups: one successful full restore test, documented restore time, and confirmation that at least one copy is offline or immutable. For identity: percentage of staff on unique accounts, percentage of remote/admin accounts with MFA, and number of shared accounts remaining. For segmentation: a test showing the payment laptop cannot reach the NAS on clinical ports, with exceptions documented. For awareness: phishing simulation click rate and reporting rate, compared with a baseline. Also track mean time to disable a departed or compromised account. A good 90-day target is 100% unique accounts, 100% MFA on remote/admin access, one passed restore test, and a measurable drop in phishing clicks. If a metric cannot be produced cheaply, do not invent it; the part-time contractor should record evidence in a simple log.