Why DHCP is risky
DHCP by itself is not necessarily risky BUT under some cases it could be a potential hazard (not just for medical devices, but in general). in example: if an attacker connectes a rogue device into the network and immediately gets assigned with a lease from the DHCP server the attacker will get:
- A valid IP enabling communications within the environment
- Understanding of the internal IP ranges, gateway, internal DNS, WINS etc.
- In older environments, the attacker may find public SMB shares and other open services
This is the reason that in the past large organizations have attempted to implement 802.1x to authenticate and authorize any device connecting to the network, and grant DHCP lease solely to authorized devices (needless to say most organizations were not successful in that implementation due to the never ending whitelisting battle and management overhead)
Specifically for medical devices (or other ICT use cases), most of them run very old and vulnerable operating systems (i've seen X-Ray machines running windows95) and in that case giving an attacker an IP and the method to communicate with those devices would be hazardous.
Using non-standards ports
That actually might be a good idea on most use cases. attackers attempt to reduce their network footprint, and conducting a full network sweeping is very noisy. by reducing the scanning ports to those most likely to give value to the attacker (SMB, DNS, HTTP, MSSQL etc.) they may miss non-standard ports. Having said that, this solution has not been considered much more secure over time and cause a bigger hassle to manage, configure and debug.