Physical Security and Cyber: Where Hospitals Lose the Thread
Hospitals are deliberately open buildings with network ports in public corridors. The controls that matter sit where physical access and network access meet — and nobody owns that boundary.
GuardsArm Team
Security Experts
A hospital is designed to be entered. Visitors arrive at all hours, corridors connect public areas to clinical ones, and staff in scrubs are unremarkable because everyone is in scrubs. Most cyber security programmes assume a building with a controlled perimeter. Hospitals do not have one, and the place this matters most is a boundary nobody owns: physical security reports to facilities, cyber reports to IT, and the gap between them is where the risk sits.
The live network port problem
Walk a corridor and count the wall sockets. In most hospitals a proportion are live, on a VLAN with real access, and reachable by anyone who sits down with a laptop for ten minutes.
The fix is network access control: a port authenticates the device before granting access, and an unrecognised device lands in a quarantine VLAN. That is the correct answer and it is a project.
Meanwhile, these are achievable now:
- Disable unused ports administratively. Tedious, effective, needs no new product.
- Port security by MAC count to stop someone unplugging a device and inserting a switch.
- Move public-area ports to a guest VLAN with internet-only egress.
- Sticky MAC on device ports so a swap raises an alert.
Unattended workstations
The clinical workstation logged in and unattended is the most exploited physical-cyber gap in healthcare, and the solution is the same one that makes MFA workable — badge-driven session handling, covered in MFA in clinical workflows.
Short idle timeouts only work when there is a fast way back in. Without that, staff defeat the lock, and the control is worse than absent because it is believed to be working.
The badge system is a computer
Physical access control systems are networked applications, frequently running on older operating systems, frequently administered by facilities rather than IT, and frequently never included in the security programme at all.
| Question | Why it matters |
|---|---|
| Is it on its own network segment? | Compromise should not reach clinical systems, or vice versa |
| Who administers it, and with what credentials? | Often a shared password held by a contractor |
| Is it patched? | It is a server, whoever owns it |
| Are badge revocations tied to HR offboarding? | Otherwise leavers keep physical access |
| Are access logs retained and reviewed? | They are decisive during an investigation |
| Can badges be cloned? | Older proximity formats can be copied in seconds |
That last one deserves attention. Legacy 125 kHz proximity cards can be cloned with inexpensive equipment from a short distance. If your badge also authenticates to workstations, cloning it is both a physical and a logical compromise.
Correlate the two signals
The highest-value convergence control is comparing physical and logical access:
Useful correlations:
- Logon from a site the person has not badged into
- Badge access to a restricted area outside that person's working pattern
- Terminated employee badge use, which should be impossible and occasionally is not
- Server room entry with no corresponding change ticket
Where to start
Two things, both cheap. First, the port test above. Second, pull the badge system into the security programme — ask who patches it and who holds the administrator credentials. In most hospitals both answers are uncomfortable, and both are fixable without a project.
GuardsArm assesses physical and cyber convergence in healthcare, including network port exposure and access control system review. Book a scoping call.
Written by GuardsArm Team
Our team of cybersecurity experts brings decades of combined experience in penetration testing, compliance auditing, and incident response. We're dedicated to helping organizations strengthen their security posture.
Take the next step on “Physical Security and Cyber: Where Hospitals Lose the Thread”
Talk to the GuardsArm team about how these services apply to your environment.
