A hospital's biomedical team has deployed a fleet of networked infusion pumps that ship with hard-coded credentials, no firmware signing, and a vendor-mandated flat clinical VLAN. The vendor refuses to alter the firmware and the pumps cannot be replaced for two years. The security architect must recommend the MOST effective mitigation given that these devices are embedded IoT systems running on a clinical network. Which approach should be recommended?
- ARequire the biomedical team to change the hard-coded credentials on each pump quarterly and document the rotation in the asset register.
- BPlace the pumps in a dedicated segmented network zone with strict egress filtering, broker all clinical traffic through a monitored gateway, and apply compensating monitoring for anomalous device behaviour. Correct
- CDeploy host-based endpoint protection software onto every infusion pump to detect malware and block unauthorised processes.
- DAdd the pumps' network ranges to the perimeter intrusion detection system and review weekly alerts for known IoT exploit signatures.
Why A is wrong: Hard-coded credentials are baked into firmware images, so they typically cannot be rotated through normal device interfaces, and even where a runtime password exists the underlying account remains. This treats the symptom on paper while the real exposure persists in the firmware.
Why B is correct: Embedded medical devices whose firmware cannot be changed are textbook candidates for compensating network controls: a segmented zone limits lateral movement, a brokering gateway enforces protocol and destination policy, and behavioural monitoring catches misuse the device itself cannot report. This is the risk-led architectural answer when the device cannot be fixed.
Why C is wrong: Embedded medical devices typically run locked, regulator-approved firmware that does not permit third-party agents, and installing them would void clinical certification. The control is defensible on paper but architecturally infeasible on this class of device.
Why D is wrong: Perimeter detection sees only traffic that already crossed the boundary, and signature-based detection misses bespoke clinical protocols and abuse of legitimate functions. It provides some visibility but does not constrain lateral movement on the flat clinical VLAN where the real risk lives.