Your security architecture likely contains numerous attack paths you could eliminate tomorrow without affecting clinical workflows. The question isn't whether these paths exist, continuous threat exposure monitoring already shows they do. The real question is: what's your path erasure rate?
Chris Frenz's OWASP Subtractive Hardening Top 10 reframes security architecture as a reliability engineering discipline. Instead of adding more detection around an unchanged environment, you systematically remove capabilities attackers need. This checklist translates that approach into concrete steps for healthcare IT environments where operational continuity is essential.
What This Checklist Covers
This checklist guides you through implementing architectural deletion and constraint controls before relying on detection and response. Each item reduces the attack surface measurably. You'll identify unnecessary capabilities, remove them from non-essential users, and constrain what remains. The framework applies across healthcare IT environments, from EHR systems to medical device networks.
Prerequisites
Before removing capabilities, you need visibility into what's actually being used:
Behavioral analytics baseline (30-90 days): Deploy user and entity behavior analytics across your environment. You can't determine what's unnecessary until you know who uses what, when, and from where. Aim for automated logging of application launches, protocol usage, and administrative tool access by user role and device type.
Asset inventory with role mapping: Document which systems, applications, and protocols exist, then map them to job functions. This isn't a compliance exercise; you're building the decision matrix for what to remove. A good example is a queryable database showing "SSH client installed on 847 workstations, actively used by 23 IT staff members in past 90 days."
Change control process with rollback capability: You'll be removing functionality from production systems. Your change management process must support rapid rollback if a deletion affects an undocumented workflow. Implement staged deployment with pilot groups, automated rollback scripts, and defined escalation paths.
Checklist Items
1. Identify administrative utilities on clinical workstations: Query your endpoint management system for tools like Secure Shell clients, Remote Desktop Protocol clients, PowerShell, command prompt, and database management tools. Cross-reference against behavioral analytics to see who launched these tools in the past 90 days. A good practice is a spreadsheet showing 600 nurse workstations have SSH clients installed but zero usage events, while 15 IT workstations show regular SSH sessions to network devices.
2. Remove unused administrative tools from non-IT endpoints: Uninstall or disable administrative utilities on devices where behavioral analytics shows zero legitimate usage. Start with the most dangerous: SSH clients, RDP clients, and scripting interpreters on clinical workstations. Aim to remove the SSH client from all workstations except those assigned to network and server teams, reducing potential pivot points by 95%.
3. Disable unused network protocols at the host level: Review which protocols your systems support versus which they actually use. Common candidates: SMBv1, NetBIOS, LLMNR, and legacy authentication protocols. Disable at the host firewall or through group policy. A good result is SMBv1 disabled on all Windows endpoints except three legacy medical devices that require it, which you've now documented as remediation targets.
4. Implement application allowlisting on high-risk endpoints: On workstations that handle protected health information, shift from "block known bad" to "allow known good." This prevents unauthorized tools from running even if an attacker gains initial access. Aim for clinical workstations that can run only approved EHR clients, browsers, and communication tools, execution of anything else generates an alert and is blocked.
5. Constrain lateral movement paths through micro-segmentation: Map your network segments to determine which systems can reach which other systems. Then eliminate connections that aren't operationally required. A compromised workstation shouldn't be able to reach your imaging servers or billing systems. Aim for clinical workstations that can reach the EHR application tier but cannot directly connect to database servers, file shares, or other workstation subnets.
6. Remove local administrator rights from clinical and business users: Audit who has local admin rights on their workstations. Behavioral analytics should show you whether they actually use elevated privileges. If they don't, remove them. If they do, implement Just-in-Time Access instead. Aim for zero standing local admin rights on clinical workstations; IT staff request time-limited elevation through a privileged access management system.
7. Establish path erasure rate tracking: Create a metric that counts how many discrete attack paths you eliminate each quarter. An attack path is a specific capability an attacker could use to move laterally, escalate privileges, or access sensitive data. Aim for a quarterly report showing "Q1: removed 847 SSH clients from clinical endpoints; Q2: disabled SMBv1 on 1,200 systems; Q3: implemented micro-segmentation blocking 15,000 potential lateral movement connections."
8. Convert recurring alerts into architectural changes: When your SIEM generates the same alert repeatedly, don't just tune the rule or add another detection layer. Ask whether you can eliminate the underlying capability that triggers the alert. For example, after seeing monthly alerts for PowerShell execution on clinical workstations, disable PowerShell on those devices instead of adding more monitoring.
9. Document architectural decisions in your Statement of Applicability: If you're pursuing ISO/IEC 27001 certification, your subtractive hardening decisions belong in your Statement of Applicability. Each removed capability is a control implementation. Aim for SoA entries that read "Control 8.1 (User endpoint devices): SSH clients removed from all non-IT workstations based on 90-day behavioral analysis showing zero legitimate usage."
10. Test ransomware containment through tabletop exercises: After implementing architectural constraints, validate that they actually limit lateral movement. Run a tabletop exercise where you assume a clinical workstation is compromised. Document which systems the attacker can reach from that foothold. Aim for post-compromise scenarios where the attacker can reach only the EHR application tier, not database servers, file shares, or other workstations, lateral movement options reduced from hundreds to single digits.
Common Mistakes
Waiting for perfect visibility: You'll never have complete behavioral analytics coverage. Start removing obvious unnecessary capabilities (like SSH clients on nurse workstations) while you build deeper visibility elsewhere.
Removing capabilities without communication: Clinical staff and IT teams need to understand why functionality is disappearing. Frame it as reducing what attackers can do after they compromise a device, not as restricting legitimate users.
Treating this as a one-time project: Path erasure is continuous. New applications introduce new capabilities. Mergers add new systems. Your quarterly path erasure rate metric keeps this work visible and ongoing.
Skipping the rollback plan: You will occasionally remove something that breaks an undocumented workflow. Fast rollback prevents a security initiative from becoming an availability incident.
Next Steps
Start with behavioral analytics on your highest-risk endpoints, those handling protected health information or those with broad network access. Collect 30 days of data, then identify your first architectural deletion target: a capability that's installed widely but used rarely. Remove it from a pilot group, monitor for operational impact, then scale.
Your goal isn't to respond to every alert faster. It's to eliminate the attack paths that generate alerts in the first place.
