## 4 Results
### Stage 2 of the Framework: Logging and Monitoring
#### 4.3.2 Running Mock Malware Tests  
Alongside logging the network traffic and creating a map of packet flows, a test should be run involving mock malware to identify how far real malware could spread throughout the network. Many healthcare organisations still use outdated and vulnerable Windows operating systems to run legacy applications or control medical devices which are not supported in more current operating systems. Knowing this fact, it is recommended that the network administrators run a mock malware incident by introducing the EICAR test file onto one of the Windows workstations to see how far it spreads throughout the network  
\begin{table}
\begin{tabular}{c l} \hline \hline
**Stage of Framework** & **Summary** \\ \hline \multirow{4}{*}{Stage 4: Further Access Control} & No internet access for anyone unless it is required (e.g., radiology department does not need internet access) \\  & All internet-bound traffic to go through proxy server cluster first \\  & Users on the guest WiFi network can access the internet but nothing else \\  & BYOD to be restricted to company-owned devices only, as the risk is too high for casual \\  & BYOD \\ \hline \multirow{4}{*}{Stage 5: Defence in Depth} & DNS sinkholing if a host attempts to connect to a malicious domain \\  & Behavioural analytics on DMZ servers via an application such as VMware AppDefense to \\  & prevent attacks on 80 and 443 \\ \cline{1-1}  & Behavioural analytics on company-owned devices used by employees from home \\ \hline \hline \end{tabular}
\end{table}
Table 2: _Cont._with the current architecture and controls in place. The European Institute for Computer Antivirus Research (EICAR) test file is a DOS program containing a 68-byte ASCII string which, when executed, will print \"EICAR-STANDARD-ANTIVIRUS-TEST-FILE\" on the screen. The file can be downloaded to any workstation, but a script has to be written in order to allow the EICAR test file to spread between hosts [23; 24].  
Multiple tests should take place where the EICAR test file is introduced to one host in a different subnet each time in order to identify which sections of the network are most prone to causing malware to spread. In the case of the network simulations on CML, the EICAR test file was unable to be introduced to the hosts due to the limitation of only having access to Linux machines. The EICAR test file would not execute on Linux machines as it is a DOS program, but manual tests such as port scans were still carried out to showcase what information an attacker on a compromised machine would have access to. As the base network was built using traditional networking practices with the bulk of the security being at the perimeter firewall, an attacker on a compromised machine within the LAN could port scan subnets to discover the hosts, open ports, and operating systems being used. Because it was difficult to build a network architecture that would match perfectly with that of a real healthcare organisation, the security controls in the base network design were based on assumptions. It is recommended that healthcare organisations run their own mock malware incidents to identify how much damage would be caused to their network, as it will differ from organisation to organisation depending on their network device configurations.