Observed in a NetOps IQ pilot
They found a camera that could be reached and started testing it. Once they had a foothold, they began looking around, trying to see what else that camera could talk to. That is the whole game. The camera itself isn't the prize. It's a stepping stone toward the systems that matter: patient records, clinical applications, and the controls that keep the building running.
It took about eleven minutes from the first touch to the moment it was stopped. That's the part I want every hospital leader to remember. These attacks don't take weeks to unfold. They move fast, and they move quietly. If nothing is watching the traffic coming out of your devices, eleven minutes is more than enough.
In this case, something was watching. Our system saw the camera behaving in a way it never had before. When the team turned on our agents, the camera was cut off from the rest of the network, and the attacker had nowhere left to go. Patient care never paused.
So how do hackers get in? After many assessments, we see the same handful of paths again and again. Here they are in plain terms, along with the answer to each.
Seven ways in
Factory passwords
Many cameras, door readers, and building controllers still use the login they came with from the factory, or one shared password across hundreds of devices. Attackers know these passwords and try them first. The answer is to know every device you have, give each one its own strong password, and get an alert when someone keeps trying to log in.
Old software
These devices often run software that is years out of date, with weaknesses that are publicly known. Updating them usually means calling a vendor and scheduling downtime, so it gets put off. The answer is to track the software version on every device, fix the ones that can reach important systems first, and wall off the ones you can't update yet.
Flat networks
In many hospitals, a camera or heating controller sits on the same network as clinical systems. Once an attacker is inside one device, they can reach almost anything. The answer is to separate building devices from clinical systems, and to be ready to cut off a single device the moment it starts acting strangely.
Vendor remote access
Many building systems have a permanent remote connection so the vendor can service them. That's convenient, but it's also a standing door into your hospital. The answer is to see every vendor connection as it happens, allow it only during approved times, and question anything unexpected.
Exposed control panels
The setup pages for many devices can be reached from guest Wi-Fi or even the internet. The answer is to find every one of them and close it off.
Quiet calls home
A device that has been taken over may start sending data out or be used to relay an attack. Nobody notices because nobody knows what normal looks like for that device. The answer is to learn each device's normal behavior so anything new stands out right away.
Tampering with the building itself
Some attackers go after the heating and cooling commands, door access, or tracking tags to disrupt operations or open doors. The answer is to watch the control traffic for commands that don't make sense and stop them before they take effect.
See. Prove. Control.
You may have noticed a pattern. Every answer comes down to three things. First, you have to see the device. Then you have to prove what risk it carries. Then you have to be able to control it quickly. I call this See, Prove, Control , and the next chapters walk through each part.
