Every hospital leader I meet has a hunch. "I'm pretty sure our cameras are a mess," they'll say, or "I bet half those building controllers still have the factory password." They're usually right. But a hunch won't get you a budget, and it won't get a vendor to show up on a Saturday. Proof will.
A focused device assessment is how you get that proof. It turns "we think we're exposed" into "here are the exact devices, here's what's wrong with each one, and here's what to fix first." Suddenly you're not asking for faith. You're showing facts.
What assessments reveal
We've done these assessments in hospitals, including reviews of camera systems spread across several sites. I can't name the hospitals, but I can tell you the kinds of things we tend to find, because they show up almost everywhere.
We find devices still using factory passwords, or one password shared across an entire fleet. We find software that hasn't been updated in years. We find cameras and building controllers sitting on the same network as clinical systems, with nothing between them. We find setup pages that anyone on the guest network could open. And we often find devices sending traffic to places they have no business talking to.
None of this means anyone did a bad job. These devices were installed by different teams over many years, usually with the goal of getting them working, not locking them down. The assessment simply shows you the truth of where things stand today.
What a useful report contains
A good assessment report should do four things. It should list every finding with real evidence, not guesses. It should explain what each finding means in plain language, including what an attacker could reach from there. It should rank the findings so you know where to start. And it should tell you how to fix each one, or how to contain it if a fix isn't possible yet.
There's one more thing that matters a lot. A device assessment is not the same as a regular vulnerability scan. A scan gives you a long list of technical issues, often thousands of them, with little sense of which ones matter. A device assessment looks at how each device is actually connected and what it could lead to. That's the difference between a list and a plan.
At NetOps IQ, we deliver our assessment on a small appliance that we prepare and ship to you. It connects through the listening approach from the last chapter, so nothing is disrupted while the evidence is gathered.
Questions for your team
If your board asked tomorrow which devices are your biggest risk, could you show them evidence? Do you know how many of your devices still use factory passwords? Has anyone ever reviewed your camera fleet from a security point of view?