A biomedical engineering department at a regional hospital plans to integrate networked smart infusion pumps into the facility's network. To minimize the threat of malware spreading laterally from compromised medical devices to critical electronic health record (EHR) databases while still allowing automated telemetry collection by central servers, which network architecture control should the security team implement?
- Place the medical devices into an isolated network segment enforced by firewalls that restrict traffic solely to authorized telemetry collector endpoints.Cevap
- BConnect the medical devices directly to the internal enterprise subnet while relying on perimeter firewalls to block external malicious traffic.
- CImplement a complete physical air gap around the medical devices, disconnecting them entirely from all corporate and monitoring networks.
- DDeploy a passive Network Intrusion Detection System (NIDS) tap as a preventive isolation control between the medical devices and the core network.
Cevap
Place the medical devices into an isolated network segment enforced by firewalls that restrict traffic solely to authorized telemetry collector endpoints.
Placing the medical devices into a dedicated, firewall-enforced network segment (such as a restricted VLAN or microsegment) isolates potentially vulnerable hardware while permitting explicitly defined, unidirectional or limited telemetry traffic to monitoring servers. This enforces the principle of least privilege at the network level and contains lateral threat propagation.
Adım Adım Çözüm
Anahtar Kavram
Secure Network Design and Segmentation