Hospital OT ransomware: is segmentation keeping pace with convergence?

TL;DR: A ransomware incident at Winnipeg’s Health Sciences Centre reached facility maintenance systems, including door access, HVAC and elevators, showing how hospital OT can be hit once an attacker gets onto a flat network, according to Asimily. The lesson is that segmentation is a blast-radius control, not a compromise-prevention control, and it must be based on observed traffic, not assumptions.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “How Segmentation Contains a Hospital OT Ransomware Attack”.

Key questions

Q: What breaks when hospital OT systems are left on a flat network?

A: A flat network turns every reachable building system into a potential ransomware target.

Q: Why does segmentation matter more than initial infection prevention in OT incidents?

A: Because initial compromise is often unavoidable, while movement after compromise is what determines business impact.

Q: What do security teams get wrong about NAC in hospital environments?

A: They often assume that deploying NAC means segmentation is already working.

Practitioner guidance

• Inventory every connected building and OT device Create an authoritative, agentless inventory of badge readers, HVAC controllers, elevators, nurse-call dependencies and other unmanaged devices so they can be placed into enforceable zones.
• Validate segmentation with live traffic before enforcement Simulate proposed NAC-native rules against observed flows to identify which clinical, facilities and maintenance connections would break before policy is applied.
• Separate facilities systems from clinical and IT trust zones Define explicit segmentation boundaries for operational technology so a compromise in one zone does not automatically permit movement into another.

Bottom line: Hospital ransomware incidents can become OT incidents when building systems live on the same network as clinical and IT assets.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →