Chapter 2 — Computing systems
Lesson map
Lesson 02 published. Map, example, EX004.
flowchart TD
N0["Learning outcomes"]
N1["2.1 The estate"]
N2["2.2 Logs as sensors"]
N3["2.3 Enforcement points"]
N4["2.4 Medical devices"]
N5["2.5 Asset inventory"]
N6["Cloud and supplier systems"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX004"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 The estate"]
N2["2.2 Logs as sensors"]
N3["2.3 Enforcement points"]
N4["2.4 Medical devices"]
N5["2.5 Asset inventory"]
N6["Cloud and supplier systems"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX004"]
[Learning outcomes]
|
v
[2.1 The estate]
|
v
[2.2 Logs as sensors]
|
v
[2.3 Enforcement points]
|
v
[2.4 Medical devices]
|
v
[2.5 Asset inventory]
|
v
[Cloud and supplier systems]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX004]
Learning outcomes
You will (1) describe the components of a hospital's computing estate relevant to CTI; (2) explain what logs each component produces; (3) identify where indicators can be checked; (4) recognise medical devices as special cases.
2.1 The estate
HCHT runs staff workstations, clinical applications, a patient portal, email, a directory service, cloud mailboxes, laboratory systems and networked medical devices. Each has owners, update routes and logs. CTI is only useful if it reaches the place where it can be checked or enforced.
Amara's first task is to list, for each part of the estate, who owns it, how it is updated and what it logs. The list shows where intelligence can be used quickly, such as email filtering, and where it cannot, such as laboratory systems run by a supplier under contract.
2.2 Logs as sensors
Email gateways log senders and attachments; web proxies log URLs; DNS resolvers log lookups; endpoints log processes; the directory logs logons. When HSSC shares a malicious domain, Amara can search DNS and proxy logs for past contacts — a retrospective hunt.
A retrospective hunt answers a simple question: did anything at HCHT contact this domain before we knew it was malicious? Amara checks that log retention covers the period the HSSC report describes, since a hunt cannot find contacts older than the oldest log. Where retention is short, she notes the gap rather than reporting a clean result.
2.3 Enforcement points
Email filters, DNS blocking, proxy categories and endpoint rules can act on indicators. Each has a different blast radius. Blocking a domain at DNS affects every device that uses the resolver, including clinical systems.
A wrong block at DNS could stop a clinical application from reaching a supplier's service and delay patient care. Amara therefore records, for each enforcement point, who can change it, how quickly a block can be reversed and which systems it affects. Indicators with low confidence go to monitoring first, where they raise alerts without stopping traffic, until the evidence supports a block.
2.4 Medical devices
Infusion pumps and imaging systems often run old operating systems and cannot be patched quickly. They may not tolerate scanning or agent software. CTI about threats to such devices goes to the clinical engineering team, who decide on network isolation rather than host changes.
Amara learns that patient safety comes first: a security change that stops a pump working is worse than the threat it was meant to address. Intelligence about these devices is phrased for clinical engineers, naming the device model and the exposure, and they decide what change is safe for patients.
2.5 Asset inventory
An accurate inventory lets analysts answer "do we run the affected product?" within minutes when an advisory arrives. Without it, every advisory triggers a guessing exercise.
HCHT's inventory lists software products and versions for workstations and servers, but medical devices are recorded by model only, so Amara notes that advisories about device software need extra checking with clinical engineering. Keeping the inventory current is an operations task; Amara's role is to report where gaps slowed an answer, so that the owners can fix them.
Cloud and supplier systems
Some HCHT services run on supplier platforms: cloud mail, the appointment portal and pathology software. Their logs sit with the supplier. Contracts should state what logs HCHT can obtain and how fast, because an indicator hunt is impossible without access to the relevant records.
Worked example
HSSC shares an advisory about a vulnerable imaging-server product. Amara queries the inventory: two servers at one hospital match. She sends the advisory to clinical engineering with the asset identifiers, rather than to the general IT queue, because the servers are certified medical systems.
Synthetic case. The advisory and servers are invented.
Errors and limits
Inventories go stale; confirm with owners. Do not scan medical devices without clinical engineering approval.
Exercises
- EX004 — Log source. Which log would show whether any HCHT device looked up a malicious domain last week? Rubric: 3 = DNS resolver logs (proxy as secondary); 2 = proxy only; 1 = endpoint antivirus; 0 = none.
- EX005 — Device route. Why did Amara route the imaging advisory to clinical engineering? Rubric: 3 = certified medical systems; special change/safety process; owners; 2 = owners only; 1 = convenience; 0 = none.
- EX006 — Blast radius. Give one risk of blocking a domain at the DNS resolver in a hospital. Rubric: 3 = may break clinical systems relying on it/collateral; 2 = vague; 1 = no risk; 0 = none.
Synthesis
Know the estate, its logs and enforcement points, treat medical devices separately and keep the inventory current.
Continue studying — chapter 02 of 40
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →