The following is a guest article by Dr. Jaushin Lee, Founder and CEO at Zentera Systems
If you see “healthcare” and “cybersecurity” in the same sentence, the discussion usually focuses on protecting electronic health records (EHRs), patient portals, or core enterprise platforms. Given the amount of sensitive data they hold, it makes sense to devote significant resources to protecting them.
However, some of the most serious cybersecurity risks in the healthcare industry aren’t found in hospital EHR systems or clinical applications. Instead, they can be found woven into the thousands of connected devices and systems that support the critical work that these facilities provide—systems that aren’t often designed with leading-edge cybersecurity controls in mind.
Across the country, critical infrastructure, such as HVAC systems, oxygen supply systems, imaging equipment, and other devices, is frequently connected to the same networks as EHR systems and other healthcare applications. Many of these devices also run on specialized operating systems that make it hard to run security agents or even patch.
This interconnected environment, in which embedded but vulnerable systems play an essential role in providing effective healthcare, creates levels of risk that many organizations are just beginning to recognize. Without integrating the protections that Zero Trust provides, healthcare organizations can face consequences that extend beyond data exposure to include broad service disruptions.
Recognizing Overlooked Cyber-Risks in Hospital Infrastructure
Prioritizing security investments for major software, such as EHR systems, billing platforms, and clinical applications, makes perfect sense because they’re obvious targets for many attackers. Yet today’s more sophisticated attackers rarely begin with the most protected systems. Instead, they hunt for the weakest entry points within a network.
Several of the most commonly overlooked attack vectors are:
Building and Environmental Control Systems
HVAC controls, air filtration, and temperature management systems are often network-connected, but they’re rarely designed with modern security protections in mind, let alone tested for vulnerabilities. When attackers target these systems, they can disrupt sterile environments or critical care spaces or use them to pivot to other parts of an enterprise network—or both.
Medical Imaging and Diagnostic Equipment
Devices such as X-ray machines, CT scanners, and cardiac care systems often use embedded software that can’t support standard security tools or enable regular patching. Artificial intelligence makes it easier than ever for attackers to probe these systems and create targeted exploits to gain a foothold in a network.
Critical Infrastructure and Operational Technology (OT) Controllers
Core infrastructure and OT controllers—such as systems responsible for controlling oxygen supply and power management and utilities that operate on proprietary firmware—often lack modern authentication mechanisms or threat monitoring capabilities. This makes these OT systems low-hanging fruit for persistent threat actors.
Understanding How Cyberattacks Can Spread Inside Hospital Networks
Finding a vulnerable device or service and exploiting it to gain a foothold is rarely the most damaging part of a cyberattack; the real risk comes from what happens next: expansion across the network.
Attackers then use their newfound access to move laterally across connected systems on their hunt for more valuable targets, pivoting from device to device until they reach critical datasets or infrastructure. Because of the wide range of connected systems often comprising new and legacy equipment, hospital networks are particularly susceptible to what is known as “east-west” network movement. This allows attackers to move undetected for extended periods of time.
This means that a seemingly minor vulnerability in one OT or medical device can quickly escalate into a large incident with the potential to affect broader hospital operations.
Containing Breaches Without Network Redesign with Zero Trust
For most healthcare organizations, the idea of redesigning their entire network architecture to prevent the rapid spread of malicious activity and to improve cybersecurity isn’t realistic. Replacing, restructuring, or updating large swaths of the network can be costly, operationally risky, and time-consuming. That’s why healthcare organizations should instead focus on containing potential breaches, preventing attackers from pivoting once they have initial access.
A Zero Trust security architecture addresses this challenge by requiring system and user verification for every connection. This flips the traditional model of “assumed trust,” which is typically assigned to traffic inside a network, on its head.
Implementing a Zero Trust architecture begins with placing protective controls around one critical system at a time, slowly broadening the Zero Trust principle. These network-level controls are established to match real business operations performed by authenticated users for predefined reasons using approved devices.
By isolating sensitive infrastructure and devices, healthcare organizations can create security boundaries that limit how devices communicate with the rest of the network, ensuring that each connection request is legitimate. This type of control and segmentation ensures that even if one device is compromised, attackers can’t easily spread to other systems.
Using Zero Trust to Secure What Matters Most
Modern Zero Trust platforms give healthcare cybersecurity teams the ability to introduce strong access controls around their critical systems and applications without requiring expensive and risky changes to their network infrastructure. By verifying users, devices, and applications before allowing connections, Zero Trust helps ensure that only legitimate activity is allowed to flow through the network.
By making this shift to a Zero Trust architecture, healthcare organizations can then focus their security efforts where they matter most: protecting the systems that directly support patient care and hospital operations. Instead of relying on perimeter defenses alone, Zero Trust security platforms provide a way to ensure that trust is continuously evaluated and access is tightly controlled. Ultimately, this helps healthcare providers to not just prevent data breaches and protect patient care but also build network environments that are more resilient and better able to withstand tomorrow’s rapidly evolving threats.
Dr. Jaushin Lee is the Founder and CEO at Zentera Systems. He is a serial entrepreneur with many patents. He is also the visionary architect behind CoIP Platform, Zentera’s award-winning Zero Trust security overlay. Jaushin has more than 20 years of management and executive experience in networking and computer engineering through his experience with Cisco Systems, SGI, and Imera Systems.
