The network environment in the medical sector is highly sensitive and complex: hospitals have core operational systems such as HIS (hospital information system), EMR (electronic medical records), PACS (image archive), LIS (test information), workstations with doctor nurses and mobile house-checking equipment, patient self-service terminals and visitors WiFi, and a large number of medical network equipment (guardians, fluid pumps, respirators, smart medicine cabinets, etc.). These systems and equipment carry life health information and privacy data for patients, which are unanticipated if the network is compromised or the data leaked. The application of the web-access certification system in the medical sector needs to take full account of the specificities and compliance requirements of the health environment.
The special nature of the medical industry network and security challenges
The network environment in the medical sector has several salient features: first, high business continuity requirements and hospital core operating systems (HIS, EMR, PACS etc.) are required to be 7×(b) A 24-hour operation, with any network interruptions that may affect patients ' medical consultations and even endanger life; second, the complex end type of medical nurses ' PC and mobile equipment (rolling cars, tablet computers, cell phones), as well as a large number of medical network equipment (guardians, fluid pumps, respirators, smart medicine cabinets, RFID positioning labels, etc.), which often operate in an old system, cannot install safe software or can not be activated at will; Third, the patient ' s privacy data are sensitive and a large number of personal information and clinical records are transmitted and stored in hospital networks, which are strictly protected by regulations such as the Personal Information Protection Act, the Data Security Act, the Health Care Institutions Network Safety Management Scheme; fourth, there is a high demand for visitors ' networks, a large number of patients and family members in hospitals need to use WiFi, and the visitors ' network must be strictly segregated from the internal business network; fifth, compliance requirements are stringent and the medical sector needs to meet multiple compliance requirements such as the 2.6 level 3 (the core system usually requires a 4 level) level, etc., and the health industry safety code. These characteristics determine that the deployment of network access to the medical sector must strike a fine balance between security, availability and compliance.
Off-site access strategy for the area of operations and visitors
Access to the hospital network is primarily based on strict segregation of areas of operation and visitors. The endpoints in the area of operations (internal office and medical network), mainly doctors’ nurses' workstations, mobile house-checking equipment, medical operations system servers, etc. should be used as a means of compliance check 802.1 X+, requiring that the terminal access to the business network be through identification and security checks and only to systems resources necessary for its operations. Doctors ' mobile room search equipment (drills, tablets) should be certified plus equipment binding to ensure that only authorized equipment and personnel are connected and that access is limited to designated areas (e.g. wards). The visitors’ area (WiFi used by patients and families) should be physically or logically isolated from the area of operations, with visitors accessing only the Internet through Portal certification (cell number authentication code), no access to any internal resources of the hospital, and visitors’ online behaviour requiring recording and auditing. Strict segregation between the areas of operation and the visitors’ area through firewalls or VLAN requires authorization and audit for any cross-section visits. For patient self-service service terminals (telephones, contributory machines, report printers, etc.), the MAC white list plus fixed VLAN should be used, allowing access only to specified interfaces of the operational system and not other in-house resources. The partition isolation strategy should be designed to follow."Minimum Permissions"and"Deep defense."Principle is to ensure that even if a region is broken, it will not affect the security of other regions.
Access control for medical network equipment
There are a large number of medical network equipment (IoMT) in hospitals, such as monitors, fluid pumps, respirators, smart medicine cabinets, body temperature monitoring stickers, RFID positioning labels, etc. that directly affect the lives of patients but often have very weak safety capabilities: operating systems are old (many are Windows XP or embedded systems), no poison-killing software can be installed, no free patch and restarting is possible, default password simple, communication protocols are not encrypted. Access control to these equipment requires special strategies: first, fingerprinting and white lists of equipment, the system identifying manufacturers, models, MACs, IPs, communications protocols etc. through web scans, the creation of white lists of equipment that can be accessed only by means of white-listed equipment; second, microsegregation, the segregation of medical equipment into an independent VLAN or virtual network, limiting its reach to designated operational systems (e.g. guardianship centres, nurse stations), and the inability to access other internal resources and the Internet; Third, the detection of abnormal behaviour, which systematically monitors communications with medical equipment on a continuous basis, automatically alerts and isolates when an anomaly is detected (e.g., a monitor suddenly visits strange IPs, unusual traffic increases, attempts to use unauthorized protocols); fourth, there are no proxy means that medical equipment cannot install proxy software, and systems must be provided with non-agent access and surveillance methods to enable equipment identification and behavioural monitoring through network flow analysis. It should be stressed, in particular, that any change in access strategy for medical equipment must be very cautious: it must not affect the normal operation of the equipment because of a security strategy; it must be fully validated in the test environment before changing strategies and requires adequate communication with equipment manufacturers and clinical offices to ensure that patients are not affected by safe treatment.
Compliance audit and data protection in the medical sector
Compliance requirements in the medical sector are very stringent, and network access certification systems require a strong capacity for compliance auditing and data protection. First, complete access logs, which need to record each endpoint, network access behaviour per user: access times, access locations, terminal information, user identity, resources accessed, operating behaviours, etc., have been kept for not less than six months (the core system usually requires more than one year) and cannot be tampered with; second, patient privacy protection, where direct recording of patient ' s personal information (name, ID number, medical history, etc.) should be avoided during logging and auditing processes, and de-esensitization should be done if records are required; Third, compliance statements, which enable the system to generate compliance check reports that meet requirements such as equivalency 2.0, network security codes for the medical industry and support one key export and audit retroactives; fourth, rights control, with administrative authority being stratified, managers at different levels having different operational privileges, critical operations (e.g. strategy change, permission adjustment, log deletion) require double authorization or approval and all operation-wide records are recorded; fifth, data encryption, where communication between systems and terminals, network equipment, identity sources should be encrypted (e.g. TLS, IPsec), so that data is not tapped or tampered with during transmission."To cope with the inspection"For hospitals, it is recommended that web access logs and audits be integrated into the overall hospital safety operating system, linking them to business systems such as HIS, EMR, etc.
High availability and emergency coverage of medical scenes
Hospitals have very high business continuity requirements, and no network access system malfunctions can affect normal hospital consultations. Therefore, network access deployment to medical settings must ensure high availability and emergency security. For high utility, network access certification systems should be based on dual-machine heat or cluster deployment, multiple load balances should be deployed by RADIUS servers, and the identity sources (AD domain, LDAP) should also be highly usable; there should be an overtime and downgrading mechanism for the connection of systems to switches, wireless controllers, and when access is compromised, network equipment should automatically be able to support-open (dealing certified terminals), ensuring uninterrupted operations, while triggering alert alert alert alert carriers. In terms of emergency security, hospitals should develop contingency plans for network access systems: how to quickly switch to the backup system in case of a serious malfunction, how to temporarily ease access strategies to ensure operations, how to notify relevant sections and personnel, how to conduct safety checks and audits after a failure recovery. Special attention should be paid to the need for a sound time-consuming and retesting mechanism for medical scene access: doctors use mobile devices when checking houses, which may affect clinical efficiency if they are too late or fail to do so, and should support rapid reconnection and unconscious roaming (where doctors move from wards, equipment automatically switch AP without requiring recertification). At the same time, emergency access routes should be established for critical situations such as first aid, surgery, etc., ensuring that emergency equipment and personnel have rapid access to the network and are not restricted by routine access processes.
Implementation recommendations for medical sector deployment
Hospital deployment of network access certification system recommended for compliance"Integrated planning, step-by-step implementation, security and operational alignment"(a) Principles for advancing: the first step is to complete a network asset mapping exercise to identify the endpoints, systems and areas of hospitals and to establish a full inventory of assets that are the basis for the design of access strategies; the second step is to deploy access in non-core regions (e.g. administrative office space, visitors WiFi), build experience and capability in transportation, validate stability of the system; and the third step is to deploy access in core operational areas (e.g. doctor ' s workstations, nurses ' stations), use 802.1 X+ terminal compliance checks, connect with access control in HIS, EMR etc.; Fourth, deployment of access to the medical network area, using device fingerprint plus microsegregation+ abnormal detection to protect medical equipment; fifth, establishment of continuous peacekeeping optimization mechanisms, regular updating of equipment white lists, optimal access strategies, analysis of safety logs, security training and emergency drills. In doing so, special attention is paid to coordination with clinical sections: access to the network may affect the daily work of doctors, and it must be understood and coordinated by clinical units, avoiding conflicts due to security measures affecting the efficiency of diagnostic treatment. At the same time, manufacturers and implementation teams with experience in the medical sector are selected, who know better about the characteristics of the network and compliance requirements and can provide more realistic solutions. Finally, good luck peacekeepers need to be trained to handle basic system operations, fault check-ups, and emergency response, ensuring that they operate steadily when they are online.
The application of the network access certification system for the medical sector requires a fine balance between safety, availability and compliance. Through strict segregation of operations from visitors areas, special access control to medical items networking equipment, improved compliance audit and data protection, high availability and emergency safeguards, and step-by-step implementation strategies, hospitals can establish effective network access control systems that protect patient privacy and hospital data security without affecting clinical services."Optional"It is, however, a necessary component of the safety of the medical network, particularly in the context of the increasing use of health information and intelligence hospitals, which protect the patient ' s right to life, health and privacy.