Theory: How to Approach These
This case is the course’s running example. In the activity you play the attacker (“Now, you are the Hacker”); in the discussion you switch to the defender.
- Criticality (see 2.2): Criticality = Value to the business × Sensitivity of the information, rated Low → Medium → High → Critical. Remember that safety counts as value.
- Vulnerability categories (see 2.2): Human/Process, Technical, Physical. Point to a weakness that is actually present in the background, not a generic one.
- Threat actors and motivations (see 2.3): name a specific category (cybercriminal, insider, script kiddie…), not just “a hacker,” and link its motive to the asset.
- Attack vectors and the chain (see 2.1 and 2.3): connect the actor to the vulnerability with a plausible path: Asset → Threat → Vulnerability → Exploit → Impact.
- Defender’s response (see 2.3): Monitor & Analyze, Penetration Test, Security Analyst decides (risk assessment under limited budget).
- A strong mapping answer has four parts: a plausible threat actor, a vulnerability present in the case, an attack vector that connects the two, and one sentence of reasoning tied to the asset’s criticality.
The Case
MediCare Plus Hospital is a fictional 200-bed private hospital in a mid-sized city.
Rapid growth. Over the past 18 months, patient volume has risen by nearly 30%, a new outpatient wing opened last year, and the hospital began accepting a wider range of insurance providers. Staff headcount is now about 800 (clinical, administrative and support).
IT has not kept pace. The IT department has three people: a systems administrator, a help-desk technician, and an IT manager who splits time between technical and administrative work. They are responsible for:
- the Electronic Health Records (EHR) system, used for 11 years and heavily customized;
- general network infrastructure and the guest/patient Wi-Fi;
- since the outpatient wing opened, a fleet of network-connected medical devices (infusion pumps and patient monitors) from a third-party vendor.
Unreviewed devices. The vendor’s technicians installed the devices on a timeline driven by the opening date, not IT’s review schedule. The IT manager has said in meetings that a full security review has not been completed, but it has not been treated as urgent.
The phishing near-miss. Three months ago, a billing department staff member received an email that appeared to come from the insurance-claims portal, asking them to “re-verify” their credentials. They entered their credentials before noticing the page looked wrong, and reported it to IT the same afternoon. The IT manager reset the password and reviewed access logs; nothing unusual was found and the incident was treated as resolved. It was not formally documented beyond an internal email.
Compliance and budget. As a Thai healthcare provider, the hospital is subject to the PDPA and sector expectations for medical-record confidentiality. A compliance review is scheduled for later this year, but budget planning has prioritized clinical equipment and staffing over IT security.
Other facts used in the questions. Hospital policy keeps the guest Wi-Fi separate from clinical systems, but staff sometimes use personal devices on both networks for convenience.
| Key asset | Notes from the case |
|---|
| EHR system | 11 years old, heavily customized |
| Networked medical devices | Infusion pumps, patient monitors; newly installed, unreviewed |
| Financial / insurance billing system | Recently expanded to more insurance providers |
| Staff & professional licensing database | Holds staff and licensing records |
| Guest / patient Wi-Fi network | Policy-separated from clinical systems |
Case Questions & Model Answers
Part 1: Asset–Threat Mapping (In-Class Activity)
Exercise Asset 1
Map the Electronic Health Records (EHR) system: criticality, threat actor, vulnerability, attack vector and reasoning.
Show solution ↓Hide solution ↑
Solution
| Field | Model answer |
|---|
| Criticality | Critical: essential to daily care (highest business value) and holds medical records protected by the PDPA (highest sensitivity). |
| Threat actor | Cybercriminal: patient medical records carry high resale value and are protected under the PDPA, making them a prime financial target (for sale or extortion). |
| Vulnerability | Technical: an 11-year-old, heavily customized legacy system is less likely to have modern security patches applied consistently. |
| Attack vector | Phishing targeting staff credentials (the case’s own near-miss is a direct clue), leading to unauthorized EHR login. |
| Reasoning | The highest-value data asset in the case, directly regulated, and the background already shows a related near-miss. |
Critical; cybercriminal; Technical (legacy, likely unpatched); phishing for staff credentials.
Exercise Asset 2
Map the networked medical devices (infusion pumps and patient monitors).
Show solution ↓Hide solution ↑
Solution
| Field | Model answer |
|---|
| Criticality | Critical |
| Threat actor | Script kiddie / opportunist: the devices were installed without a completed security review, making them an easy, low-skill target that doesn’t require a sophisticated actor. |
| Vulnerability | Technical: newly installed IoT devices with an incomplete security review; likely weak default configurations. |
| Attack vector | Direct network access due to insufficient segmentation between clinical devices and the rest of the network. |
| Reasoning | Critical not because of data value, but because compromising Integrity (wrong dose) or Availability (pump stops) can directly harm a patient. |
Critical (for patient safety, not data); script kiddie/opportunist; Technical (unreviewed IoT, default settings); direct network access.
Exercise Asset 3
Map the financial / insurance billing system.
Show solution ↓Hide solution ↑
Solution
| Field | Model answer |
|---|
| Criticality | High |
| Threat actor | Cybercriminal: direct financial motive; billing fraud or stolen payment/insurance data can be monetized quickly. |
| Vulnerability | Human/Process: the system recently expanded to more insurance providers, likely faster than the integrations could be fully vetted. |
| Attack vector | Phishing targeting billing staff, or exploitation of a newly added, less-vetted insurance integration. |
| Reasoning | High financial value plus a recent, rushed expansion (an explicit clue in the background) make this a plausible, well-justified target. |
High; cybercriminal; Human/Process (rushed expansion); phishing billing staff or a weak new integration.
Exercise Asset 4
Map the staff & professional licensing database.
Show solution ↓Hide solution ↑
Solution
| Field | Model answer |
|---|
| Criticality | Medium |
| Threat actor | Insider: a staff member (or a former contractor) already has legitimate access, which is the core insider risk. |
| Vulnerability | Human/Process: overly broad or un-revoked access privileges. |
| Attack vector | Misuse of existing valid credentials rather than any external technical exploit. |
| Reasoning | Lower criticality than the EHR or billing, but a good example of why insider threats are often underestimated: no “break-in” is even required. |
Medium; insider; Human/Process (broad/unrevoked access); misuse of valid credentials.
Exercise Asset 5
Map the guest / patient Wi-Fi network.
Show solution ↓Hide solution ↑
Solution
| Field | Model answer |
|---|
| Criticality | Low |
| Threat actor | Opportunist / script kiddie: a low-value target on its own, more likely to attract an unsophisticated attacker testing for open networks. |
| Vulnerability | Technical/Physical: staff personal devices connect to both the guest and clinical networks, physically bridging them and undermining segmentation (a weakness rooted in a Human/Process habit). |
| Attack vector | Lateral movement: gain a foothold on the guest network, then pivot toward clinical systems via a device that bridges both. |
| Reasoning | Its importance is not its own value; it can become the entry point to a much more critical asset. A good example of an asset acting as a stepping stone. |
Low on its own; opportunist; devices bridging the two networks; lateral movement into clinical systems.
Part 2: Discussion Questions
Exercise Q1
Rank the five key assets by Criticality (Criticality = Value to the business × Sensitivity of the information). Justify your top choice and explain what would need to be true for your ranking to change.
Show solution ↓Hide solution ↑
Solution
Ranking:
| Rank | Asset | Value | Sensitivity | Criticality |
|---|
| 1 | EHR system | Very high (all care depends on it) | Very high (medical records, PDPA) | Critical |
| 2 | Networked medical devices | Very high (patient safety) | Low data sensitivity | Critical |
| 3 | Billing system | High (revenue) | High (financial/insurance data) | High |
| 4 | Staff & licensing database | Medium | Medium–High (staff personal data) | Medium |
| 5 | Guest Wi-Fi | Low | Low | Low |
Top choice: the EHR. It is the only asset that scores at the top on both factors: the hospital cannot deliver care without it, and it holds the most sensitive, legally protected data. The near-miss phishing incident shows it is already being targeted indirectly.
What would change the ranking:
- If the medical devices were found to have no network segmentation and clear exploitable flaws, their safety impact could push them to the top, since a death outweighs a data breach.
- If the guest Wi-Fi were proven to bridge directly into clinical systems, its effective criticality would rise because it becomes a path to Critical assets.
- If the EHR had a reliable paper fallback and tested backups, its availability impact would fall (though its sensitivity would remain).
Key grader points: uses both factors of the formula; justifies the #1 choice; names concrete conditions that would change the order.
Exercise Q2
The hospital just added network-connected infusion pumps. Beyond data theft, what unique consequence could occur if this asset’s Availability or Integrity were compromised, given that it is a medical device rather than a data system?
Show solution ↓Hide solution ↑
Solution
The unique consequence is direct physical harm to patients, including death.
- Integrity: an attacker (or malware) changes the dose or infusion rate; a patient receives an overdose or underdose of insulin, painkillers or chemotherapy, and staff may not notice because the device appears to be working.
- Availability: pumps stop or lock up (e.g., ransomware spreading to devices); treatments are interrupted, and staff must switch to manual methods, delaying care across the ward.
Secondary consequences follow: loss of trust in all hospital equipment, regulatory investigation, lawsuits, and possibly having to take every pump of that model out of service.
A compromised data system leaks or loses information; a compromised medical device can injure or kill. This is why the devices are Critical despite holding little sensitive data.
Exercise Q3
How would a breach of patient billing data damage MediCare Plus’s reputation differently than a temporary EHR outage? Which would you expect to be more costly in the long run, and why?
Show solution ↓Hide solution ↑
Solution
| Billing data breach | Temporary EHR outage |
|---|
| CIA leg | Confidentiality | Availability |
| What patients feel | “They gave my personal and financial details to criminals”; betrayal, fear of fraud | “Service was slow for a day”; frustration, but temporary |
| Reversibility | Irreversible: leaked data cannot be “un-leaked” | Recoverable: once restored, service is back to normal |
| Legal exposure | PDPA penalties, regulator notification, possible lawsuits | Lower, unless patient harm resulted |
| Partner impact | Insurance providers may question the partnership | Limited |
The billing data breach is likely more costly in the long run. An outage is visible but temporary, and if handled well, can even be forgiven. A breach is permanent, carries regulatory fines and legal costs, can lead to identity or insurance fraud against patients, and damages the trust that makes patients choose a private hospital. The exception: if the outage directly caused patient harm, its reputational cost could be greater.
Key grader points: contrasts temporary vs. permanent harm; mentions legal (PDPA) consequences; notes the patient-harm exception.
Exercise Q4
Given MediCare Plus’s profile (small IT team, sensitive patient data, recent rapid expansion), which threat actor type(s) seem most likely to target the hospital? Justify with reference to typical motivations and targets.
Show solution ↓Hide solution ↑
Solution
- Cybercriminals / organized crime (most likely). Motivation: financial gain. Healthcare data sells well and hospitals are known to pay ransoms because downtime endangers patients. A three-person IT team means weaker detection and slower response, which makes the hospital a soft, profitable target.
- Insiders (likely). With 800 staff, rapid hiring, contractors from the expansion and a stretched IT team, access reviews are probably weak. Insiders target data they can already access; negligence (e.g., the billing clerk who entered credentials) is just as relevant as malice.
- Script kiddies / opportunists (plausible). Unreviewed IoT devices with likely default settings and a guest Wi-Fi network are exactly the easy openings they scan for.
Less likely: nation-state actors (a single private hospital is not usually strategic, unless it serves important patients or is part of critical infrastructure) and hacktivists (nothing in the case suggests a political cause).
Most likely: cybercriminals/organized crime, followed by insiders and opportunists, because the hospital combines valuable data with limited defensive capacity.
Exercise Q5
The phishing incident was resolved without any documented follow-up investigation. From a threat-actor perspective, what type of attacker commonly relies on exactly this kind of unresolved, undocumented near-miss to eventually succeed?
Show solution ↓Hide solution ↑
Solution
Organized cybercriminal groups and other persistent attackers (who run repeated, targeted phishing campaigns) rely on this.
Why the near-miss helps them:
- The attacker now knows that phishing works at this hospital: a staff member entered credentials. They will try again, with better lures, against other staff.
- Because nothing was documented, there is no record to spot a pattern if a second or third attempt arrives; each one looks like a fresh, isolated event.
- The password reset fixed one account, but the root cause (no training, no MFA, no reporting process) remains. The credentials may also have been reused elsewhere, or used in ways the log review did not cover.
- Persistent attackers often wait before using access, so “no unusual activity found” on the same day is not proof the threat is over.
Persistent, financially motivated attackers (organized cybercriminals) exploit undocumented near-misses because the organization fixes the symptom but never learns from the pattern.
Exercise Q6
Suppose a former IT contractor who helped install the new medical devices still has valid remote-access credentials that were never revoked. What threat actor category does this represent, and why is this category often underestimated in security planning?
Show solution ↓Hide solution ↑
Solution
Category: Insider (a former contractor is still an insider threat, because the access came from a legitimate relationship with the organization).
Why it is underestimated:
- No break-in is required. The person logs in with valid credentials, so firewalls and intrusion detection see an ordinary login.
- Trust bias. Organizations plan mainly against “outside hackers” and assume people they have worked with are safe.
- Process gaps. Revoking access on offboarding (especially for contractors, managed by a vendor rather than HR) is a Human/Process control that is easily forgotten, as this rushed device installation shows.
- Deep knowledge. This contractor knows the devices, their configuration and how they connect, which is exactly the knowledge an attacker would want.
- Negligence risk too. Even if the contractor is honest, their stale credentials could be stolen from their laptop and used by someone else.
Insider threat; underestimated because it uses legitimate access, bypasses perimeter defenses, and depends on offboarding processes that are often neglected.
Exercise Q7
Identify at least two vulnerabilities implied in the background narrative and classify each as Human/Process, Technical, or Physical.
Show solution ↓Hide solution ↑
Solution
| Vulnerability in the case | Category |
|---|
| 11-year-old, heavily customized EHR (legacy; hard to patch) | Technical |
| Networked medical devices with no completed security review (likely default configurations) | Technical |
| Only three IT staff for 800 users and a growing estate | Human/Process |
| Phishing near-miss not formally documented or investigated | Human/Process |
| Staff susceptibility to phishing (no evidence of training) | Human/Process |
| Budget prioritizes clinical equipment over IT security | Human/Process (governance) |
| Insurance integrations added quickly during expansion | Human/Process |
| Staff personal devices connecting to both guest and clinical networks | Technical/Physical (devices bridging the networks), rooted in a Human/Process habit |
Any two correctly classified items are acceptable; a strong answer includes at least one Technical and one Human/Process vulnerability.
Exercise Q8
If an attacker wanted to reach the EHR system specifically, what attack vector(s) seem most plausible given the hospital’s current setup? Walk through a plausible path from Threat to Exploit, naming each step.
Show solution ↓Hide solution ↑
Solution
The most plausible vectors are phishing for staff credentials (proven to work here) and lateral movement from the guest Wi-Fi or unreviewed devices. A plausible path:
| Step | In this case |
|---|
| Threat / threat actor | A cybercriminal group wanting medical records to sell or to hold for ransom |
| Target | The EHR and the patient records it holds |
| Attack vector | A phishing email, styled like the insurance-claims portal, sent to clinical and billing staff; a user enters their credentials on a fake page |
| Initial access | The attacker logs in with the stolen credentials (no MFA stops them) |
| Vulnerability | The legacy, heavily customized EHR is behind on patches; staff accounts have broad access |
| Exploit | The attacker uses a known flaw in the outdated EHR software (or simply the user’s legitimate access) to escalate privileges and export records in bulk |
| Impact | Confidentiality breach of patient records (and, if ransomware is deployed, loss of Availability) |
An alternative path: compromise a staff phone on the guest Wi-Fi → it later joins the clinical network → pivot to the EHR server.
Most plausible: phishing for credentials → login → exploitation of the unpatched legacy EHR → data theft or ransomware.
Exercise Q9
Hospital policy keeps the guest Wi-Fi separate from clinical systems, but staff sometimes use personal devices on both networks for convenience. Explain how this practice could create an attack vector even though network segmentation is officially in place.
Show solution ↓Hide solution ↑
Solution
- Segmentation only works if nothing crosses the boundary. A staff phone or laptop that joins both networks becomes a bridge between them.
- The path: an attacker on the open guest Wi-Fi (or a malicious site visited there) infects the staff member’s personal device → the device later connects to the clinical network → the malware now runs inside the clinical segment and can scan for and attack clinical systems (lateral movement).
- Personal devices are weaker: they are not managed or patched by IT, may lack endpoint protection, and are used for personal browsing and apps.
- The lesson: a policy on paper is not the same as a control in practice. The gap between policy and behavior (a Human/Process weakness) undoes the technical control.
Management responses: enforce technical controls (only hospital-managed devices can join the clinical network, e.g., via network access control), provide a convenient alternative so staff don’t need personal devices, and train staff on why the rule exists.
The personal device bridges the two networks, so malware picked up on guest Wi-Fi can be carried into the clinical network, bypassing segmentation that exists only on paper.
Exercise Q10
With only three IT staff, MediCare Plus cannot monitor every system with equal intensity. Propose a resource allocation for Monitor & Analyze: which assets should get continuous monitoring, and which can rely on periodic review? Justify your ranking.
Show solution ↓Hide solution ↑
Solution
Allocate monitoring by criticality and likelihood of attack.
| Monitoring level | Assets | Justification |
|---|
| Continuous (real-time alerts) | EHR system (logins, bulk exports, admin changes) | Critical; already targeted by phishing; a breach is irreversible |
| Continuous | Networked medical devices (unexpected connections, configuration changes) | Critical for patient safety; unreviewed; a change must be caught immediately |
| Continuous | Remote access / VPN and authentication (failed logins, off-hours or overseas logins) | The main entry path for phishing-stolen and unrevoked credentials |
| Frequent (daily review) | Billing system | High value; new integrations; fraud may build slowly |
| Periodic (weekly/monthly review) | Staff & licensing database (access reviews) | Medium; insider risk best handled by periodic access recertification |
| Periodic | Guest Wi-Fi (check that segmentation holds) | Low on its own; the key control is segmentation, checked periodically |
Practical points for a three-person team: automate alerting rather than reading logs manually; define clear escalation rules (who responds, how fast, including out of hours); and consider outsourcing 24/7 monitoring to a managed security provider.
Continuous monitoring for the EHR, medical devices and remote access; periodic review for the licensing database and guest Wi-Fi, because limited staff should watch where impact and likelihood are highest.
Exercise Q11
A Penetration Test reveals five vulnerabilities of varying severity in the same week the hospital must prepare for its PDPA compliance review. As the Security Analyst, how would you decide which one(s) to fix first? What factors beyond technical severity might weigh into that decision?
Show solution ↓Hide solution ↑
Solution
Start with technical severity, then adjust for business factors:
- Criticality of the affected asset: a medium flaw in the EHR or medical devices may matter more than a severe flaw in the menu board.
- Patient safety: anything that could alter or stop medical devices goes to the top.
- Likelihood / exploitability: is it reachable from the internet? Is a public exploit available? Is it already being used against hospitals?
- Regulatory impact: the PDPA review makes flaws that expose personal data a priority, since an unfixed, known flaw is also a compliance finding.
- Cost and effort to fix: quick, cheap fixes (changing default passwords, disabling an unused service) can be done immediately for fast risk reduction.
- Operational disruption: patching the EHR may need downtime that must be scheduled around clinical care.
- Available compensating controls: if a flaw cannot be fixed this week, can it be isolated or monitored more closely in the meantime?
Decision: fix the highest-risk items (critical asset × likely exploitation × safety/PDPA impact) first, apply quick wins in parallel, and document the remaining items with a remediation plan and owner. A documented, prioritized plan is itself evidence of good governance for the compliance review.
Prioritize by risk (asset criticality, likelihood, safety and PDPA impact), not severity alone; factor in cost, downtime and compensating controls, and document what is deferred.
Exercise Q12
The Security Analyst’s job involves deciding “which risk to accept, and which to fix” under a limited budget. What would be different about MediCare Plus’s approach to this decision compared to a well-funded technology company? What trade-offs are unique to a healthcare setting?
Show solution ↓Hide solution ↑
Solution
Differences from a well-funded tech company:
- Fewer resources: MediCare Plus must accept more risk, fix fewer things and rely on cheap, high-impact controls (MFA, training, segmentation, outsourcing monitoring). A tech company can fund a full security team and fix most issues.
- Security competes with patient care for budget: leadership has already chosen clinical equipment and staffing; security must be argued in terms of patient safety and compliance, not only data protection.
- Less in-house expertise: legacy, vendor-supplied systems (the customized EHR, vendor medical devices) cannot be patched or replaced as freely as a tech company’s own software.
Trade-offs unique to healthcare:
- Availability vs. security: patching or rebooting systems may interrupt care; locking down records may block a doctor in an emergency (the “break-glass” problem from 1.2).
- Safety vs. security: medical devices often cannot be patched quickly because changes need vendor approval; leaving them unpatched is a risk, but a broken device is too.
- Confidentiality vs. clinical speed: strict access controls slow clinicians who need information fast.
- Regulatory weight: the PDPA and medical-confidentiality expectations make some risks impossible to “accept.”
- Human cost: some failures cost lives, not just money, so risk acceptance has an ethical dimension.
MediCare Plus must make leaner, more trade-off-heavy decisions where patient safety and care availability constrain what security can do, unlike a tech company where security mainly competes with cost and speed.
Exercise Q13
Looking back across the entire story, from Target to the Security Analyst’s decision, where in this chain would you argue security investment would produce the greatest risk reduction for MediCare Plus, and why?
Show solution ↓Hide solution ↑
Solution
A strong answer picks one point and defends it. Model answer: invest in the Human/Process vulnerabilities, specifically credential protection and people.
- The evidence points there. The only attack actually seen in the case is phishing, and it succeeded in capturing credentials. Phishing is also the most plausible path to the EHR and billing systems (Q8).
- High leverage, low cost. Multi-factor authentication, phishing awareness training and a documented incident-reporting process are cheap compared with replacing the EHR, and they protect every system that staff log into, not just one.
- It addresses insiders too. An access-review and offboarding process closes the unrevoked-contractor risk (Q6).
- Pair it with one technical quick win: complete the security review of the medical devices and segment them, because their impact (patient harm) is the most severe in the case.
Alternative defensible answers: investing in Monitor & Analyze (outsourced 24/7 monitoring compensates for the three-person team and catches what prevention misses), or in asset inventory and review of the medical devices (the highest-impact, least-understood asset). Any choice is acceptable if it is linked to evidence from the case and explains why it reduces the most risk per baht.
Key grader points: a clear choice; justified with facts from the case (phishing near-miss, small team, unreviewed devices); considers cost-effectiveness under the limited budget.