Dark by Default: Hardening Medical Device Paths with Software-Defined Perimeter

Smart healthcare networks must preserve availability, confidentiality, and the integrity of safety-critical workflows in the presence of active adversaries. To that end, we examine the Software-Defined Perimeter (SDP) as a defensive architecture for clinical IoT by contrasting an SDP-protected micro-network with a functionally equivalent, traditionally reachable baseline. We implement a reproducible GNS3 testbed that mirrors a common clinical path (Lab → Controller → Gateway → Medical Device). Two representative adversarial scenarios are evaluated on both the SDP and non-SDP topologies: a volumetric flood targeting the medical device and unauthenticated reconnaissance using ICMP/TCP probing. For each topology, we collect stage-wise measurements (Before, During, After) from parsed CLI artifacts and aggregate round-trip time and packet-delivery outcomes. The qualitative outcome is consistent across trials: the SDP path maintains authorized reachability and preserves service continuity under load, while cloaking prevents reconnaissance from leaking information about protected services. By contrast, the non-SDP baseline exposes the medical device directly, allowing scans to terminate on the service and causing material degradation during flood. These results indicate that SDP's authenticate-then-connect model, coupled with fine-grained entitlements and default-deny enforcement, offers a pragmatic way to harden clinical micro-segments without relying on perimeter reachability or broad network trust. Rather than proposing a new SDP mechanism, this work provides a reproducible, applied evaluation of SDP's availability and cloaking properties in a healthcare-style micro-network under active adversarial conditions.