Scribd
Upload
19 views2 pages

Hospital IT Security Vulnerabilities Guide

Uploaded by

danujkethaka
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
19 views2 pages

Hospital IT Security Vulnerabilities Guide

Uploaded by

danujkethaka
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Based on your description of the hospital’s current situation (billing, CCTV, and medicine

systems are separate, no integration, doctor doesn’t know stock levels, likely no strong IT
security), here are realistic example vulnerabilities you can identify for your assignment:

1. Weak or No Access Control


 Description: Systems (billing, medicine, CCTV) may use shared accounts or weak
passwords. No role-based access control (e.g., pharmacists, doctors, and admin staff
having the same privileges).
 Impact: Unauthorized staff could view or modify sensitive patient or financial data.
 Example Evidence: Default passwords like admin123 or “password” found in system.
 Reference: OWASP A07:2021 – Identification and Authentication Failures.

2. Unencrypted Data Storage


 Description: Patient records, billing data, or medicine inventory stored without
encryption on local computers.
 Impact: If a laptop or PC is stolen, all sensitive data can be accessed.
 Example Evidence: CSV/Excel files with patient data stored openly on desktop.
 Reference: MITRE CWE-311 – Missing Encryption of Sensitive Data.

3. Outdated or Unsupported Software


 Description: CCTV system or billing software running on old versions with known
security flaws.
 Impact: Attackers could exploit old vulnerabilities to gain access.
 Example Evidence: Windows 7 or unsupported software versions still in use.
 Reference: CVE database for outdated software exploits.

4. No Centralized Inventory Tracking


 Description: Medicine stock system is not integrated, and inventory is manually
checked.
 Impact: Stock mismanagement, financial loss, and inability to detect theft or fraud.
 Example Evidence: Doctor unaware of real-time medicine quantities.
 Reference: CWE-285 – Improper Authorization.
5. No Network Segmentation
 Description: CCTV, billing, and staff computers on the same network without VLAN
separation.
 Impact: If one system is hacked, the attacker can move laterally to others.
 Example Evidence: Ping tests or network scan shows all devices are on the same subnet.
 Reference: OWASP Testing Guide – Network Infrastructure Testing.

6. Weak Physical Security for Servers


 Description: Servers and network equipment are kept in open areas accessible to all
staff.
 Impact: Anyone could unplug, reset, or steal equipment.
 Example Evidence: Server stored in open pharmacy area without locks.
 Reference: NIST SP 800-53 PE-3 – Physical Access Control.

7. No Backup or Disaster Recovery Plan


 Description: Billing and patient data have no backup or are only backed up irregularly.
 Impact: Data loss in case of hardware failure or ransomware attack.
 Example Evidence: Staff confirms backups are done “sometimes” or stored on the same
machine.
 Reference: NIST SP 800-34 – Contingency Planning.

8. Default CCTV Credentials


 Description: CCTV system still uses factory-default username and password.
 Impact: Hackers can view or control cameras remotely.
 Example Evidence: Login with “admin/admin” works on CCTV system.
 Reference: OWASP IoT Top 10 – Weak, Guessable, or Hardcoded Passwords.

You might also like