Networked infusion pumps start talking to an unknown host
The prompt — read this to the room
Your SOC flags outbound connections from 40 networked infusion pumps on the oncology and intensive care floors to an IP address in a hosting range nobody recognises. The traffic started after last week's vendor maintenance visit. As far as nursing staff can tell, the pumps are still delivering medication normally. The manufacturer's support line says a patch is 'in validation' and will not commit to a date. Clinical engineering owns the pumps, IT owns the network, and the vendor holds the admin passwords. Pulling the pumps means moving patients to manual pumps you do not have enough of. What do you do in the next hour?
Who to involve
Most important first.
- Incident response lead
- OT / plant engineer
- SOC analyst
- IT operations
- CISO / Head of security
- Vendor / procurement manager
What it tests
- Assess patient-safety risk and decide on device isolation together with clinical engineering, not around it
- Contain suspicious device traffic with network controls that keep the pumps working
- Hold the manufacturer to its contractual and regulatory duties for vulnerability response and evidence
- Preserve device and network evidence without breaking device validation or warranty
Outline of activities
- 1Alert triage: what the pumps are doing and since when
- 2Patient-safety risk call with clinical engineering and nursing
- 3Network containment for devices you cannot patch
- 4Vendor escalation, remote-access review and evidence
- 5Recovery, monitoring plan and the asset-inventory gaps it exposed
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…