Vulnerability Scanning & Assessment

Common findings in medical practice scans.

First-time vulnerability scans in medical practices typically surface a predictable pattern of findings:

• Unpatched operating systems and applications. Windows systems behind on security updates, browsers not updated, Adobe Reader at end-of-life version, Java/Flash/other deprecated runtimes still installed.
• Misconfigurations. Weak SMB/Samba configurations, insecure remote access configurations, overly-permissive file shares, weak password policies, unnecessary services running.
• Exposed services. Services that should be on internal network only but are reachable from the internet — remote desktop, database ports, unpatched web applications, management interfaces.
• End-of-life software. Operating systems and applications past vendor support dates — Windows 7 still in use, SQL Server versions past support, legacy specialty applications running on unsupported platforms.
• Weak authentication. Default passwords on network equipment, missing MFA on administrative accounts, shared accounts in use, passwords that don't meet policy.
• Certificate issues. Expired SSL/TLS certificates, self-signed certificates where CA certificates should be used, weak cipher suites still enabled.
• Medical device exposures. Unpatched medical devices (common and often unavoidable), exposed to network segments where they shouldn't be, running legacy operating systems.

Different scan types for different purposes.

External scanning (monthly)

Scans practice-facing services from the internet perspective — what can attackers see and potentially exploit from outside the practice network? Common findings: exposed management interfaces, unpatched web-facing services, weak SSL/TLS configurations, open ports that shouldn't be.

Internal scanning (quarterly)

Scans internal network from inside — what would an attacker find after compromising one endpoint? Findings include server vulnerabilities, workstation issues, network misconfigurations, and lateral movement paths. Essential because most breaches involve some internal movement.

Authenticated scanning (quarterly)

Scans with authenticated access to endpoints — reveals missing patches, configuration issues, and local vulnerabilities that unauthenticated scans can't see. Most thorough scan type; requires coordination to avoid false positives from running during backup or maintenance windows.

Web application scanning (as needed)

For practices with custom-developed web applications, patient portals, or public-facing websites — application-layer scanning finds vulnerabilities that network scans miss. Scoped specifically to the applications in question.