Sample Security Audit — Brightsmile Dental Studio

1 · Executive Summary

Brightsmile holds Protected Health Information (dental = HIPAA-covered) on an unsegmented office network that also runs digital X-ray equipment, guest Wi-Fi, and the front-desk email client. The practice would survive a single hard-drive failure but would not survive a ransomware event intact: the only backup is an external USB drive left permanently attached to the front-desk PC (the first thing ransomware encrypts). Email phishing is the most probable entry path — one unannounced test email (simulated with staff consent during this engagement) was opened by 3 of 5 staff, and 2 entered credentials. No multi-factor authentication exists anywhere in the practice. Findings and ratings below.

2 · Assets & Crown Jewels

Asset	Data held	Impact if lost/public
Eaglesoft EHR server (front-closet mini-PC)	1,847 patient records: charts, X-rays, payment history	CRITICAL HIPAA breach notification, HHS fines, practice-ending reputational loss
Front-desk PC (email + scheduling)	Email w/ attachments of insurance scans, SSNs	HIGH BEC pivot, identity-theft exposure
Digital X-ray PC (Win 10, vendor-managed)	Imaging shares; networked to EHR	HIGH unpatched lateral pivot
Payroll via cloud (ADP) + QuickBooks file	Bank routing, employee PII	HIGH payroll-diversion fraud
Guest Wi-Fi + CCTV on same VLAN	—	MEDIUM lateral path into clinical VLAN

3 · Findings & Severity

#	Finding	Detail	Severity
F1	Sole backup is a locally-attached USB drive	No offline/immutable copy; restore never tested. Ransomware standard behavior encrypts attached media.	CRITICAL
F2	No MFA on email (Microsoft 365) or payroll	Simulated phish captured 2 sets of live credentials in this engagement's consented test.	CRITICAL
F3	Flat network	EHR server, X-ray PC, POS, guest Wi-Fi, cameras — all one subnet. ARP scan from the reception-area guest network enumerated everything in 40 seconds.	HIGH
F4	Vendor remote access via open TeamViewer	X-ray vendor's TeamViewer runs 24/7 with a 6-character password. Known-brokered access vector (public breach history for dental-imaging vendors).	HIGH
F5	Shared Windows logons ("FrontDesk"/"Doctor")	No per-user accountability; audit trail meaningless. HIPAA access log requirement unmet in practice.	HIGH
F6	X-ray PC 47 missing security updates	Vendor claims patching "not supported." Unsupported by vendor ≠ acceptable risk — compensating controls required.	MEDIUM
F7	No written incident-response steps	Staff's intended ransomware plan: "call the imaging vendor." No HIPAA 60-day notification owner.	MEDIUM
F8	Website contact form plaintext → receptionist inbox	Patients send medical descriptions unencrypted; not HIPAA-aligned for intake.	LOW

4 · Threat Model — most probable attack paths

T1 · Ransomware via phishing

Likelihood high, impact critical. Entry: malicious attachment/credential phish to front desk → F2 → full-disk encryption → F1 means no recovery → HIPAA breach + ransom demand. This is the practice's existential scenario.

T2 · Business email compromise

Stolen mailbox (F2) → vendor/payroll instruction fraud. Two similar practices in Lake County lost five figures in 2025 to exactly this (FBI IC3 data pattern).

T3 · Vendor supply-chain pivot

F4's always-on TeamViewer → X-ray vendor gets breached (industry pattern) → straight line into F3's flat network → EHR.

Attack narrative · T1 mapped to MITRE ATT&CK

TA0001 Initial Access — spearphishing attachment (T1566.001) to frontdesk@
TA0002 Execution — macro/payload (T1204.002) on the shared FrontDesk logon (F5)
TA0008 Lateral Movement — SMB shares (T1021.002) across the flat subnet (F3) to the EHR mini-PC
TA0040 Impact — data encrypted (T1486), attached USB backup destroyed first (T1490 inhibits recovery)
Outcome — practice dark for est. 14 days; HHS breach filing; ≈$40–80K total event cost.

5 · Risk Matrix (likelihood × impact)

Impact →

LowModerateHighSevereExistential Likely

Possible

T2F4

Unlikely

F1 solo

Rare

Rating method: qualitative 5×4 matrix keyed to CIS Control v8 implementation groups; likelihoods informed by sector incident data (HHS OCR breach reports for dental, FBI IC3 2025 health-sector statistics). Overall risk 7.4/10 = weighted mean of finding severities (Critical ×4, High ×2, Medium ×1.5, Low ×1) normalized against mitigations in place (few).

6 · Remediation Roadmap

Week 1 — Immovable backups ≈ $320 + $18/mo

Immutable cloud backup with 90-day retention for the EHR + a second offline rotation drive. First full restore test done on-site, timed and documented.

Week 1 — MFA everywhere $0 license delta

M365 MFA (already licensed, just unconfigured) + payroll MFA. 2-hour rollout with staff phones.

Week 2 — Segment the network ≈ $850 hardware + labor

Three VLANs: Clinical · Office · Guest/IoT. Cameras + guest Wi-Fi can no longer see clinical. Inter-VLAN rules deny everything except print/schedule flows.

Week 2 — Kill standing vendor access $0

TeamViewer comes down; replaced with on-demand attended access the practice initiates. Contract addendum sent to the imaging vendor documenting the change (standard wording provided).

Week 3 — Individual accounts + endpoint protection ≈ $660 + $14/user/mo

Named logins per staff member; EDR on every endpoint; screen locks at 5 min. HIPAA access-log requirement now actually satisfiable.

Week 4 — One-page incident plan + tabletop included

60-minute staff drill; laminated card at the front desk; HIPAA notification owner named; website form reworked to a secure intake link.

7 · Residual Risk Statement

After Phase 1 (~week 4): projected overall risk 3.1/10 (LOW-MODERATE). Remaining exposures: vendor patch policy on the X-ray system (mitigated by segmentation, not eliminated), and the inherent phishing-residual that no technology closes — addressed quarterly with 15-minute micro-trainings. Risk statement to be re-scored in 90 days or upon any material IT change, whichever occurs first.