Audit-ready documentation
Network diagram, rule set, access logs and patch status, prepared so that you can use them directly in audits.
OPNsense for medical centres and hospitals
Medical devices that cannot be patched, Germany’s telematics infrastructure (TI), multiple sites and audit obligations: in healthcare, the firewall is the central tool for segmentation and evidence.
Requirements
Medical centre and hospital compared
Medical care centre (MVZ)
- connecting several sites to a headquarters
- integrating the TI connector cleanly
- separating practice management, medical devices and guest Wi-Fi
- secure remote access for doctors and administration
- implementing the German IT security guideline for medical practices (§390 SGB V)
Hospital
- segmenting medical technology, hospital IT and building services
- high availability in a cluster, maintenance without downtime
- requirements from B3S Krankenhaus (the sector-specific security standard for hospitals), KRITIS and NIS2
- log evidence for audits and reporting obligations
- remote maintenance for medical device manufacturers
Segmentation first
Protection is built into the network
Many medical devices run on old operating systems and must not be modified because of their certification. In that case, the network is the only protection.
| Segment | Examples | Principle |
|---|---|---|
| Medical technology | imaging, laboratory, monitoring | only with PACS and HIS, no internet |
| TI | connector, card terminals | only to TI endpoints and practice management |
| Hospital and practice IT | hospital information system, practice management system, workstations | required servers, internet via filter |
| Building services | building management, lifts, access control | strictly isolated |
| Guests and patients | Wi-Fi | internet only |
| Remote maintenance | vendor access | VPN with 2FA, time-limited, logged |
Evidence
Documented for auditors, monitored for emergencies
SIEM and 24/7 SOC
For facilities with reporting obligations, the firewall logs flow to NEOSEC. Attacks are detected before they become incidents.
SOC with NEOSECFAQ
Frequently asked questions
Does the firewall affect the TI connection?
No, if it is configured correctly. We know the communication relationships of the connector and card terminals and map them precisely.
What about medical devices without updates?
Segmentation is crucial precisely for these devices. They only talk to the systems they actually need.
Can manufacturers still carry out remote maintenance?
Yes, via VPN with 2FA, time-limited and logged. That is more secure than permanently open access.
Contact
Network segmentation for your organisation
We start with an inventory of your networks and device classes.