Red Team Intel

LOBBY

RED TEAM: ATTACKERS

  1. Break in: social engineering, leaked passwords, a USB stick, or the supply chain.
  2. Spread through the links: shared care record, vendor VPN, reused passwords.
  3. Disrupt care: ransomware, tamper with devices, steal records.
  4. Stay quiet. Blue only sees what it detects.

BLUE TEAM: SOC

  1. Triage the alert queue on screen A. Some alerts are just noise.
  2. Respond: isolate, reset passwords, restore, and harden against the kind of attack you're seeing.
  3. Every response costs care. Isolating the EHR slows the wards too.
  4. Win by keeping network care at 60% or more.

Intercepted attacker activity // 15s delay, details redacted

Attack points

0

Attack surface // links

Attack path timeline // replayed on screen B

Shift handover report