◇ OpenCyber Academy
Technical · Chapter 2 · English

Chapter 2 — Networks and protocols

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Networks and protocols

Lesson map

Lesson 02 published. Map, example, EX005.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Clinic networks"]
  N2["2.2 Protocols in use"]
  N3["2.3 Checking encryption"]
  N4["2.4 Recommending separation"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX005"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Clinic networks"]
  N2["2.2 Protocols in use"]
  N3["2.3 Checking encryption"]
  N4["2.4 Recommending separation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX005"]

[Learning outcomes]
    |
    v
[2.1 Clinic networks]
    |
    v
[2.2 Protocols in use]
    |
    v
[2.3 Checking encryption]
    |
    v
[2.4 Recommending separation]
    |
    v
[Worked example] --> [Exercise EX005]

Learning outcomes

You will (1) trace patient data across clinic networks; (2) check protocols for encryption; (3) recommend network separation.

2.1 Clinic networks

Each Marlow clinic has a small network connecting reception computers, dental chairs with intraoral cameras, the imaging server, a printer and a guest Wi-Fi access point. Leila maps the network with the clinic's IT contractor and discovers that guest Wi-Fi and the imaging server share one flat network in three clinics. A patient in the waiting room could therefore reach the server's file shares. She explains that separating networks into zones is a basic measure under Article 32, because it limits who can even attempt to access sensitive systems.

2.2 Protocols in use

Leila lists the protocols that carry patient data: HTTPS between browsers and the practice-management system, DICOM for X-ray images between cameras and the imaging server, SMB file shares for scanned letters, and SMTP for email. She learns that DICOM traffic inside the clinic is unencrypted by default, which is common in medical imaging. She records this as a risk rather than a failure, because changing imaging protocols needs vendor support and testing, and she proposes protecting it through network separation first. Each protocol is listed with its port.

2.3 Checking encryption

Using a test workstation and synthetic records, Leila checks which connections are encrypted. The booking website and practice-management system use TLS. The SMS gateway's interface also uses TLS. However, the clinic printer receives referral letters over plain text, and the scanning station saves files to an unencrypted share. She documents each finding with the protocol, the data carried and the recommended change, so that the IT contractor can plan the work and Mr. Okafor can check her reasoning before anything is altered.

2.4 Recommending separation

Leila proposes three zones per clinic: a clinical zone for chairs, cameras and the imaging server; an office zone for reception and printers; and a guest zone with internet access only. Traffic between zones is limited to what each workflow needs, such as reception viewing images through the practice-management system rather than browsing the imaging server directly. The contractor implements the design in one clinic first. Leila tests from the guest Wi-Fi with a laptop and confirms that the imaging server is no longer reachable.

Worked example

Leila maps clinic networks, finds guest Wi-Fi sharing a network with the imaging server, lists protocols including unencrypted DICOM and printing, and recommends three zones that are tested in one clinic.

Synthetic case. Networks are synthetic; GDPR Article 32 is real.

Errors and limits

Separation can break workflows; test with clinic staff before rolling out.

Exercises

Continue studying — lesson 02 (chapter 02 of 18)

← Chapter 01 · Course chapter index · Chapter 03 →

Continue to the next authored lesson.