One Score for Three Worlds: Enterprise, Mobile and ICS in a Hospital Group
Harborview Health is a 900-bed hospital group. Its estate spans three worlds: 12,000 Windows and macOS workstations and servers; 4,000 iOS and Android tablets used by nurses for medication administration; and a clinical device network holding 300 infusion pumps, 40 building-automation controllers and a vendor-managed HMI, separated from the corporate LAN by a firewall but reachable from the clinical VLAN. A red team reported four findings: the internet-facing VPN concentrator permits password-only authentication; the mobile device management server still accepts the vendor default administrator password; a pump-server HMI answers on port 502 from the clinical VLAN; and a vendor support modem on the device network has no monitored logging. The new CISO has asked for one ATT&CK coverage score for the whole organization to present to the board, and separately wants the four findings ranked by risk before the next clinical governance meeting.
1. Assign each of the four findings to a matrix and a technique, and justify the matrix choice where it is not obvious.
Read the worked answer
VPN without MFA - Enterprise, T1133 External Remote Services, with T1078 Valid Accounts as the likely follow-on and M1032 Multi-Factor Authentication as the direct mitigation. This is an IT entry point into the corporate estate.
MDM default administrator password - Enterprise, T1078.001 Default Accounts. The matrix follows the asset, not the technology story. The MDM server is a server; the fact that it manages tablets does not move it into the Mobile matrix. Mobile covers the adversary behaviours on the device and its data, not the compromise of the management infrastructure behind it.
HMI answering on port 502 - ICS, T0883 Internet Accessible Device, with T0886 Remote Services and, if an attacker reaches it, T0855 Unauthorized Command Message and T0836 Modify Parameter as the consequences that matter clinically. Port 502 is Modbus; the target is a control system, so the ICS matrix applies even though the path runs through an ordinary clinical VLAN.
Unmonitored vendor modem - ICS, T0883 again, plus a data source problem rather than a technique problem: without logging there is no detection to map in the first place.
The judgement rule to state explicitly: choose the matrix by the system being attacked and the consequence you care about, not by the protocol or the department that owns it.
2. The CISO wants a single coverage score for the organisation. Explain why that is not meaningful and propose what to present instead.
Read the worked answer
A single percentage across these three domains cannot be computed honestly, for four reasons.
- Different denominators. Enterprise, Mobile and ICS are separate matrices with different technique counts and different tactic sets. ICS includes tactics with no enterprise equivalent, such as Inhibit Response Function and Impair Process Control; Mobile's tactic columns differ from both. A 70 percent of Enterprise and 70 percent of ICS describe entirely different amounts of work.
- Different consequences. A missed enterprise technique means data loss or fraud; a missed ICS technique can mean a pump delivering the wrong dose. Averaging them destroys the only information the board needs.
- Different ownership. Endpoint, mobility and clinical engineering are different teams with different budgets; a blended number gives none of them an actionable target.
- Different maturity of the underlying data. There is logging on the enterprise estate and effectively none on the device network, so an ICS percentage would be measuring aspiration.
Present instead: three short sections, one per matrix, each with a heat map pinned to a named ATT&CK version, a stated counting rule, and the top three uncovered techniques tied to real findings - the VPN, the MDM and the HMI. Then a one-page risk narrative that connects each gap to a clinical or regulatory consequence. The board gets comparability and a decision; it does not need a fake average.
3. Rank the four findings by risk and justify the ranking in ATT&CK terms, including where the matrix itself does not capture the severity.
Read the worked answer
1. MDM default administrator password. Highest. Default credentials are directly exploited, require no tooling, and the asset is a single point of control over 4,000 devices used at the point of care. T1078.001 plus the persistence an attacker could gain over the managed fleet. Fix cost is trivial, which makes leaving it unaddressed indefensible.
2. VPN without MFA. Very high. T1133 is among the most common ransomware entry paths, password-only authentication is brute-forceable and credential-stuffable, and the estate behind it is 12,000 endpoints. Fix is a licence and a configuration change; medium effort, very large risk reduction.
3. HMI reachable on port 502 from the clinical VLAN. High but subtler. T0883 plus T0855 means the path from an ordinary clinical workstation to unauthorised command messages against pumps. Likelihood is lower than the first two because it needs a foothold, but impact is physical and cannot be undone by restoring a backup. Segmentation and protocol-aware monitoring are the controls.
4. Unmonitored vendor modem. Rank it high on uncertainty rather than likelihood: you cannot currently say whether it is being used. Treat it as a visibility gap that blocks assessment of everything else on the device network.
Where ATT&CK stops helping: the matrices describe behaviour, not blast radius. Two techniques carry the same label whether they touch a billing server or an infusion pump, so the clinical impact argument has to be made alongside the mapping, not derived from it.