The Unpatchable Population

## What unpatchable actually means A device is unpatchable when nothing you control can change its state. The vendor ships no fix; or a fix exists but the support contract voids if you apply it yourself; or the platform underneath went end-of-life years before the device was installed; or there is no agent build for it; or the only account is a shared service password printed in the installation manual. In a hospital that describes infusion pumps, imaging modalities and an anaesthesia workstation, each bought as a certified system rather than as a computer. The shape recurs wherever equipment is purchased whole and certified against a regulator. ## Every normal control lives on the host, and none of them are available Patch it, install a sensor, rotate the credential, disable the listening service, enforce a local firewall: all of those act on the host. Here none can be used. What remains is policy written **about** the device by the first device upstream of it - the access port it is plugged into and the boundary between its segment and everything else. That policy can assert exactly two things: - what may reach the device, and - what the device may originate. That is the entire control surface, and stating it that starkly is the point of the question. It forces the honest next sentence: none of it reduces the vulnerability. The pump remains precisely as exploitable as it was. What changed is who can reach the flaw and where an intruder can travel afterwards. ## What the segment can and cannot claim | The segment can | The segment cannot | | --- | --- | | Stop unrelated hosts reaching the device's listening service | Stop its authorised clinical peer reaching it, which is the path that matters | | Stop the device originating flows nobody authorised | Distinguish a legitimate flow from an intruder using the same permit | | Record that bytes moved to a permitted destination | See inside an encrypted session, or produce host telemetry | | Deny by default and produce evidence of the denial | Prove the device is not already compromised | The right-hand column is what a strong candidate volunteers. A weak one says the device is safe because it is segmented, which confuses a reduced reachable set with a fixed defect. ## Inheritance: what an intruder gets for free This is the framing the question exists for. On an ordinary server an attacker must escalate, evade a sensor, steal a credential, and move. On a device everybody agreed never to constrain, the attacker skips all of that. Every flow the exception permits is now theirs, sourced from an address that appears in the register as expected, at hours nobody reviews, from a host that generates no local log you can read. The exception you wrote precisely because the device could not be fixed is the same exception the intruder receives on arrival. That is why the permitted origination set has to be narrow to the point of being boring: one destination, one port, one direction, and a default deny for everything else. ## The price, and who actually pays it The control is not free and interviewers want to hear the bill: - **An exception record per device**, not a blanket one, with what it may originate and why. - **A named owner** who renews it. In a clinical estate that is a clinical-engineering or biomedical department, not the network team, and the counter-argument in the room is patient safety. - **An expiry**, because the failure mode is an exception approved once for a go-live that is still in the rule base a decade later, attached to a device nobody can identify and that nobody dares delete. - **Addressing discipline**, because the permit is keyed to something that must not change. - **Evidence**, because when an auditor or a regulator asks how the risk is managed, the answer is not the word segmentation, it is the enumerated permit list plus proof the boundary denies the rest. ## How to answer this in a loop Three beats: the control moved off the host and onto the segment; the segment constrains reach and origination and does not fix the flaw; the constraint is a standing exception with an owner and an expiry that an intruder inherits intact. A candidate who gives all three has shown they understand both halves - the mechanism and the bill - and they have not pretended the problem was solved.