Red Team Intel

LOBBY

RED TEAM: ATTACKERS

  1. Break in: phish a nurse, stuff leaked passwords, drop a USB, or hijack the supplier VPN.
  2. Spread through the links: shared care record, vendor VPN, reused passwords.
  3. Disrupt care: ransomware, tamper with devices, steal records.
  4. Stay quiet. Blue only sees what it detects.

BLUE TEAM: SOC

  1. Triage the alert queue on screen A. Some alerts are just noise.
  2. Respond: isolate, reset passwords, block the supplier, restore.
  3. Every response costs care. Isolating the EHR slows the wards too.
  4. Win by keeping network care at 60% or more.

Intercepted attacker activity // 15s delay, details redacted

Attack points

0

Attack surface // links

Attack path timeline // replayed on screen B

Shift handover report