Healthcare — Layered Protect Surface

Defense-in-depth view of a typical Healthcare enterprise. Hover a component to surface its cross-layer dependencies, or run an attack path drawn from a CISA advisory relevant to this vertical.

HealthcareHIPAA Security Rule · state breach laws · HHS 405(d) HICP · FDA premarket/postmarket cybersecurity guidancepermalink →

Vertical

OT - Volt Typhoon AA24-038A — This scenario reaches OT/ICS components (engineering workstations, historians, PLCs) that this sector’s enterprise inventory does not carry. See the energy / manufacturing maps for the renderable version.

External · Internet · Untrusted

●

Services

DNS & Domain

Identity (Okta/Entra)

CDN & Edge

Email Security

SIEM / XDR

Backup & DR

Secure Web Gateway

Privileged Access Mgmt

■

Assets

Laptops & Desktops

Mobile (iPhone/Android)

Network (Cisco/Meraki)

Firewalls (Palo Alto)

Cloud (AWS/Azure)

Servers (On-Prem)

Printers & IoT

USB & Removable Media

Infusion Pumps

Imaging Modalities (CT/MRI/X-ray)

Patient Monitors

Anesthesia Workstations

⬢

Applications

ERP (SAP/Oracle)

CRM (Salesforce)

Google Workspace

Custom Web Apps

DevOps (GitHub/CI)

HR Platform

Accounting (NetSuite)

Slack / Teams

VPN / Remote Access

EHR (Epic / Cerner)

PACS / Radiology

◆

Data

Customer PII

Financial Records

IP & Trade Secrets

Employee HR Data

Cloud Object Storage

Databases (SQL/NoSQL)

Email & Messaging

Logs & Telemetry

Protected Health Information (PHI)

Protect-surface inventory · Healthcare

JavaScript is disabled — the interactive map, vertical selector, and attack-path simulation are unavailable. The four layers and their 40 components for this vertical are listed below.

● Services · 8 components

DNS & Domain — Domain name resolution services — the first query in nearly every network connection. DNS is both critical infrastructure and an attack vector.
Identity (Okta/Entra) — Identity provider services including SSO, MFA, directory sync, and lifecycle management — the control plane of Zero Trust.
CDN & Edge — Content delivery and edge compute services accelerating web applications while providing DDoS protection and bot management.
Email Security — Email filtering, anti-phishing, and email authentication services (SPF/DKIM/DMARC) protecting the #1 attack vector.
SIEM / XDR — Security information and event management services correlating alerts across the entire protect surface for detection and response.
Backup & DR — Backup, disaster recovery, and business continuity services ensuring data survivability against ransomware and catastrophic events.
Secure Web Gateway — Web traffic inspection and filtering services enforcing acceptable use policies and blocking malicious content at the network edge.
Privileged Access Mgmt — Privileged access management services controlling and auditing admin access to critical systems — a cornerstone of Zero Trust.

■ Assets · 12 components

Laptops & Desktops — Employee workstations (Windows, macOS, Linux) used for daily operations — the primary endpoint attack surface in most enterprises.
Mobile (iPhone/Android) — Company-owned and BYOD smartphones and tablets accessing corporate email, apps, and data through MDM-managed profiles.
Network (Cisco/Meraki) — Routers, switches, wireless access points, and SD-WAN appliances forming the physical and logical network infrastructure.
Firewalls (Palo Alto) — Next-generation firewalls at network perimeter and internal segmentation points enforcing traffic policies and threat prevention.
Cloud (AWS/Azure) — IaaS and PaaS resources including EC2 instances, Lambda functions, Kubernetes clusters, and managed services across multi-cloud environments.
Servers (On-Prem) — Physical and virtual servers in on-premises data centers running legacy applications, Active Directory, and file shares.
Printers & IoT — Network printers, smart displays, conference room systems, HVAC controllers, and badge readers — often unmanaged and unmonitored.
USB & Removable Media — USB drives, external hard disks, and removable media that bypass network controls and can introduce malware or exfiltrate data.
Infusion Pumps — Network-connected infusion pumps (smart pumps with drug libraries, dose-error-reduction software, and EHR integration). High-volume fleet at the bedside; long replacement cycles mean unsupported firmware is common.
Imaging Modalities (CT/MRI/X-ray) — Diagnostic imaging systems (CT, MRI, X-ray, ultrasound, mammography) running OEM-locked Windows/Linux variants. Vendors restrict OS patching; segmentation and compensating controls are the primary defenses.
Patient Monitors — Bedside and central-station patient monitors (ECG, SpO2, NIBP, capnography). Continuous-telemetry data flows to nursing stations and the EHR; safety-critical alarm signal integrity is the dominant risk.
Anesthesia Workstations — OR-resident anesthesia delivery systems with integrated ventilation, gas delivery, and patient-record interfaces. Safety-critical and OT-adjacent (closer to OT than to IT in risk posture).

⬢ Applications · 11 components

ERP (SAP/Oracle) — Enterprise resource planning system managing finance, supply chain, HR, and operations — the operational backbone of the enterprise.
CRM (Salesforce) — Customer relationship management platform containing sales pipeline, customer contacts, deal history, and marketing data.
Google Workspace — Productivity suite including Gmail, Drive, Docs, Sheets, and Meet used daily by every employee for collaboration and communication.
Custom Web Apps — Internal line-of-business applications, customer portals, and microservices built in-house and deployed on cloud infrastructure.
DevOps (GitHub/CI) — Source code repositories, CI/CD pipelines, container registries, and infrastructure-as-code tools forming the software delivery chain.
HR Platform — Human resources information systems (Workday, BambooHR) managing employee lifecycle, payroll processing, and benefits administration.
Accounting (NetSuite) — Financial management application handling invoicing, expense tracking, financial reporting, and regulatory compliance (SOX).
Slack / Teams — Real-time messaging and collaboration platforms where sensitive discussions, file sharing, and integrations create invisible data flows.
VPN / Remote Access — Legacy VPN concentrators and modern ZTNA solutions providing remote workforce access to internal applications and resources.
EHR (Epic / Cerner) — Electronic health record system — the central clinical application. Holds PHI, drives orders, integrates with every other clinical system. Single largest authorization surface in a hospital.
PACS / Radiology — Picture archiving and communication systems plus radiology information systems. Stores diagnostic images, integrates with modalities and the EHR. The largest data-volume application in most hospitals.

◆ Data · 9 components

Customer PII — Personally identifiable information including names, SSNs, addresses, and payment details stored across CRM, ERP, and cloud databases.
Financial Records — General ledger, accounts payable/receivable, payroll data, and tax records maintained in ERP and accounting systems.
IP & Trade Secrets — Product designs, source code repositories, proprietary algorithms, and strategic plans stored in document management and version control systems.
Employee HR Data — Personnel records, benefits information, performance reviews, and compensation data in HRIS platforms like Workday or BambooHR.
Cloud Object Storage — AWS S3 buckets, Azure Blob Storage, and GCP Cloud Storage containing backups, media assets, logs, and application data.
Databases (SQL/NoSQL) — Production databases including PostgreSQL, MySQL, MongoDB, and Redis instances hosting application state and business-critical data.
Email & Messaging — Corporate email archives, Slack/Teams message history, and attached files containing sensitive business communications.
Logs & Telemetry — Security logs, application telemetry, network flow data, and audit trails aggregated in SIEM and observability platforms.
Protected Health Information (PHI) — Patient health records as defined by HIPAA — demographics, diagnoses, treatments, prescriptions, imaging, billing tied to identifiable patients. Regulated by HIPAA Privacy + Security Rules and state breach laws.