Control for healthcare

Clinical network isolation and medical device protection.

Healthcare networks connect life-critical medical devices, patient records and clinical systems. When ransomware reaches a hospital network, it does not just encrypt data. It cancels surgeries, diverts ambulances and puts lives at risk.

• Patient safety risk
• Medical device vulnerabilities
• Flat hospital networks

The scenario

Scenario: hospital ransomware attack.

The only systems that survive a flat-network ransomware attack are the ones that happen to be switched off. Step through it, or play it through.

1. 01The attack path
2. 02With Control

Step 1 of 2

The attack path

Ransomware enters through a phishing email opened on an administrative workstation. Within four hours, it propagates across the flat hospital network, encrypting clinical workstations, imaging systems and electronic health records.

Emergency departments divert patients to neighbouring hospitals, surgical lists are cancelled for eleven days, and three MRI machines need a complete rebuild.

The path

Always there

What the attacker needs

A foothold and time

Play it through

An illustrative scenario.

Layer 1

Medical device network isolation

Governed

Paths between clinical and admin networks

5

Clinical zones with independent governance

Logged

Evidence for DSPT and NIS2

Where each Control module is deployed across clinical systems, devices and research.

Healthcare networks carry a corporate estate, clinical systems, a long tail of medical devices and a research environment. Control puts a real boundary at every change of trust, so a compromise in one estate does not become a clinical incident.

1. H0 to H1 linkFirebreakA physical cut on the corporate perimeter, ready to drop the live path into clinical systems during an incident.
2. H0 to H1, H1 to H2 and the clinical DMZValidateRequests crossing into clinical systems are checked for origin, integrity and authority.
3. H1 to H2, H3 to H4 and H3 to research linksIsolateCorporate, identity, clinical, devices and research sit on their own physical fabrics.
4. H2 to DMZ and H3 to H4 linksLockDevice and clinical messaging access tie to the right team, the right ward and the right authority.
5. Clinical DMZ and H3 to research linkTransferWhen data moves between clinical and research, Transfer governs the route, the de-identification and the landing point.

Explore the Control Blueprints

From first boundary to routine operation.

Four steps, piloted on one site before it extends across the estate.

1. 1

   Clinical network assessment

   Map all network paths between admin systems, clinical applications, medical devices and guest access.

2. 2

   Clinical zone design

   Design physically separated zones for administration, clinical systems, medical devices and imaging.

3. 3

   Ward-level pilot

   Deploy in a representative ward or department with full zone separation and controlled updates.

4. 4

   Trust-wide deployment

   Phased deployment across the trust, with verified configuration baselines and continuous DSPT evidence.

Explore more

Where to go next.

• Ransomware containment
• Critical infrastructure
• OSS for healthcare
• CP-01 Stop Kill-Chain Ransomware
• Control Blueprints
• Control by industry

• Firebreak
• Validate
• Isolate
• Lock
• Transfer

Speak to the team to organise a PoC.

Walk through your blueprint with the Firevault team and scope a proof of concept on your estate. 30 minutes, no sales pitch.