Segment rules for an unpatchable imaging modality are keyed to its fixed IP. How can an attacker inherit that permit?

## Why the permit is keyed to an address at all Everything you would normally key a policy to is an assertion the endpoint makes about itself: a client certificate, an agent identity, a machine account, a signed supplicant response. A device that accepts no patch, no agent and no credential can make none of them. What is left is the address it occupies, and so the segment rule for a clinical modality ends up shaped like *this address may originate to that address on that port, and nothing else*. It works, and it is usually the right answer, but a candidate should be able to say precisely what it does and does not assert. ## What the boundary actually verifies It verifies the source field of a packet arriving on an interface. Combined with anti-spoofing at the edge - source filtering that drops traffic arriving on a port from addresses that do not belong to that segment - it verifies that a packet with that source arrived from the place that address is supposed to live. It does not verify that the machine at that address is the modality. Those are different claims, and the gap between them is where the permit leaks. ## The concrete inheritance paths - **Decommissioning.** The modality is retired. The permit outlives it because nobody told the network team, and the address is later re-issued to something else - or claimed deliberately. - **Replacement.** Clinical engineering swaps a unit under a service contract. The replacement is configured by the vendor engineer, possibly with a different address, possibly with the old one, and the register is updated days later or never. - **Duplication.** Someone statically configures a second host with the same address. Depending on where each sits, some of the permitted flow is now originated by the wrong machine. - **Claiming it.** An adversary already on the same layer-2 domain can answer for the address. This is why the size of that domain matters and why a device with a valuable permit should not share a broad broadcast domain with general-purpose hosts. - **The device itself.** Most important and most often forgotten: the modality is the machine at that address, and it is unpatchable. If it is exploited, the permit is being used by exactly the right address and nothing about the binding is violated. Address-keying provides no defence at all against the case it was written for. ## The price of keeping the binding true This is the half candidates skip, and on a defensive design question it is half the answer. - **Addressing is frozen.** The address becomes part of the device's configuration contract, so re-addressing a subnet - a merger, a site renumber, an IPv6 rollout - now requires coordinated work with a department that schedules around clinical activity, not around your change window. - **A register is maintained by hand.** Device, address, permitted flows, exception owner, expiry. It is manual because the device cannot enrol itself in anything, and a register nobody reconciles quietly becomes fiction. - **Every swap is a change ticket in two organisations.** The network team learns about hardware changes only if clinical engineering tells them, and the incentive to tell them is weak because the device works either way until a rule blocks it. - **The failure mode is a widening.** A broken binding fails closed, which is correct security behaviour and terrible clinical behaviour. The flow stops, the escalation arrives, and at 02:00 the fastest restoration is to widen the rule from one address to the subnet, or from one port to any. That widening is written in an outage, is never reviewed, and is exactly the extra reach an intruder needed. Anticipating it is the mark of someone who has lived with this. ## What to do about it You cannot make the device prove who it is, so improve the binding's surroundings instead. Reserve the address permanently rather than relying on a lease. Filter at the access port so the address can only be sourced from the port the device is actually plugged into, which turns a soft binding into something an attacker has to be physically or logically adjacent to abuse. Keep the device's layer-2 neighbourhood small. Alert when the address goes quiet, because silence usually means the device was replaced and the register is now wrong. And treat any widened rule created during an outage as an incident follow-up item with a date, not as a permanent fixture. ## The honest summary Address-keyed policy is the correct control for a population that can carry no control of its own, and it buys real reduction in reachable surface. What it never buys is authentication of the endpoint. It is a permit attached to a location, and both an operational accident and an adversary can arrive at that location.