Ask a hospital security leader how an attacker would break in, and most will mention a phishing email or a stolen password. Fair enough. But the attackers I worry about are looking somewhere else. They're looking up at the ceiling, at the little camera in the corner of the hallway. That camera might be the easiest way into your hospital, and there's a good chance nobody in IT has ever put it on a list.
Walk through any hospital and count what's connected. There's a camera in every hallway and parking level. There's a badge reader on every staff door. The heating and cooling system talks to a controller in the basement. Nurse call buttons sit beside every bed. Refrigerators in the pharmacy and lab report their temperatures. Tags on wheelchairs and infusion pumps tell staff where equipment is. Elevators, digital signs, and parking gates are all on the network too.
Each of these is a small computer. Each one has software inside it, a login, and a connection to your network. And almost none of them were bought by the security team.
The math is uncomfortable. Your security program was built to protect the computers on desks. But in a modern hospital, a growing share of the computers sit in the walls, ceilings, and basements instead. Those are the ones nobody is watching.
That's the heart of the problem. In most hospitals, these devices are owned by several groups at once. Facilities installed the cameras. A vendor manages the building controls. Clinical engineering looks after anything near a patient. IT runs the network they all plug into. When a device belongs to four teams, ownership of its risk gets split four ways, and the gaps fall in between.
Your regular security tools can't help much here either. The protection software you put on laptops and servers can't be installed on a camera or a door controller. These devices don't send the logs your security team is used to reading. Many can't be patched without a vendor visit, and some can't be patched at all.
So they sit there, year after year, quietly connected. To an attacker, that makes them perfect. They're always on. They're rarely watched. And they often sit on the same network as systems that hold patient records or support care.
One forgotten account
Picture a Friday morning in May 2021. It's five o'clock, and someone at Colonial Pipeline finds a ransom note on a company computer. Colonial carries about 45 percent of the gasoline the East Coast runs on. Within the hour, they shut the whole pipeline down.
The attackers never touched the pipeline itself. They logged in through an old remote access account that nobody was using anymore. It had no second check at the door, so one password was enough. When Colonial's CEO testified to the Senate a month later, he said the company still didn't know how the attackers got that password.1
They only reached the office side of the network. But nobody could say for sure where the office ended and the pipeline began. So everything stopped.
For nearly a week, fuel stopped flowing. People lined up with gas cans. More than 9,500 gas stations ran dry, from Washington, D.C., to Florida. Colonial paid the hackers $4.4 million.2
One password. One forgotten account. Nearly half the East Coast's gasoline.
Now ask yourself the question I ask every hospital leader I meet. If someone broke into the office side of your hospital tonight, could your team say for certain where it ends and patient care begins?
I like to say the building has become the new front door. You've spent years putting strong locks on the main entrance. Meanwhile, the side doors were left open because nobody thought of them as doors.
Questions for your team
Could your team produce a complete list of every connected device in your hospital by tomorrow? Do you know who owns the cameras and building controls from a security point of view? Do you know which of those devices can reach your clinical systems?
If any answer is "I'm not sure," you're not alone. Almost every hospital leader I talk to says the same thing. The rest of this book is about changing that answer.