September 22, 2023

Internet of Medical Things Security

The Internet of Medical Things (IoMT) enhances traditional healthcare systems by delivering improved scalability, efficiency, reliability, and precision in healthcare services. IoMT facilitates the creation of intelligent hardware and software platforms that operate via communication systems and data-processing algorithms, supporting informed decision-making. While IoMT plays a pivotal role in delivering extensive medical services, the resource limitations of these devices expose them to significant security and privacy vulnerabilities.

IoMT security encompasses a cybersecurity strategy and protective framework aimed at defending against potential cyberattacks targeting Internet of Medical Things (IoMT) devices connected to healthcare networks. This field of cybersecurity is sometimes denoted as medical IoT security.

IoMT Devices in Healthcare

Within the healthcare sector, any medical apparatus linked to a healthcare provider's network falls under the category of "medical IoT device," often referred to as a "connected medical device," "connected clinical device," or simply an IoMT device. These devices serve a diverse range of functions, spanning from heart rate monitoring to temperature measurement, and encompass a wide array of equipment, such as:

• Medical imaging systems
• Smart thermometers
• Infusion pumps
• Medical device gateways
• Biosensors integrated into wearables (for use in clothing or implanted within the human body)

Rapid Growth in IoMT Adoption

The global Internet of Things in the healthcare market, valued at $113.75 billion in 2019, is projected to soar to $332.67 billion by 2027, indicating a robust CAGR of 13.20% during 2020-2021.

IoMT adoption is gathering momentum as connected devices become increasingly prevalent in healthcare settings. With ongoing advancements in IoMT technology, its reach is expanding beyond the confines of clinics and hospitals.

The healthcare sector's digital transformation journey is advancing, spurred further by the impact of the COVID-19 pandemic. Healthcare providers, medical device manufacturers, and hospital systems alike are recognizing the pivotal role played by connected medical devices in this evolving landscape.

IoMT Application Examples

While IoT often serves as a business facilitator across various industries, the role of Medical IoT (IoMT) in healthcare is distinct. IoMT offers a range of application scenarios, including:

• Remote patient monitoring
• Hospital asset tracking
• Patient and staff location tracking
• Smart hospital solutions
• Remote care delivery

IoMT Security Challenges

One of the primary concerns with IoT in healthcare is its susceptibility to security weaknesses. Many IoMT devices were not initially designed with security as a top priority, rendering them particularly vulnerable to breaches. In the healthcare sector, the need for robust security is paramount, as a security breach within a healthcare network can potentially translate into life-threatening situations.

Key security challenges in healthcare associated with connected medical devices encompass:

• Vulnerabilities
• Data privacy
• Malware and ransomware attacks
• Interoperability
• Legacy systems

In the event of data breaches, it is imperative to consider the post-attack scenario, focusing on the identification and removal of critical information. While credit card details, bank accounts, and financial services can be readily canceled or rectified, patients' identities may still harbor essential health-related information. The European Union's Information Commission has introduced new regulations aimed at bolstering the privacy protection of individuals. The General Data Protection Regulation (GDPR), a legal framework governing data protection and privacy within the European Union and the European Economic Area, imposes stringent privacy standards on companies. It mandates the prompt reporting of any data breaches within 72 hours of their occurrence. Additionally, this legislation places restrictions on companies based on factors such as their revenue, the nature of the attack, and the scale of the data breach.

In the United States, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 established rules for safeguarding medical data. This law ensures data integrity, security, and privacy, compelling companies to report data breaches within 60 days of such incidents.

IoMT Security Risks

Researchers from Unit 42 at Palo Alto Networks conducted an analysis of crowdsourced data derived from security assessments encompassing over 200,000 infusion pumps connected to hospital and healthcare organization networks. The issue at hand holds critical importance for both healthcare providers and patients, as security vulnerabilities in these devices have the potential to endanger lives or compromise sensitive patient information.

The published findings are indeed concerning, revealing that a staggering 75% of scanned infusion pumps exhibited well-documented security deficiencies, elevating their susceptibility to potential compromises by malicious actors. These vulnerabilities included exposure to at least one of the 40 known cybersecurity vulnerabilities. Additionally, the alerts indicated the presence of one or more of 70 other recognized security flaws common in IoT devices.

Evidently, the healthcare sector is a prime target for cyberattacks, further highlighting the significance of addressing security concerns surrounding connected medical devices. The exploitation of vulnerabilities in such devices can lead to severe risks for healthcare organizations and their patients, encompassing:

• Patient safety
• Data breaches
• Ransomware attacks
• Malware infiltrations
• Device takeover
• Compliance issues

Medical IoT Security Vulnerabilities

A wealth of information exists regarding known vulnerabilities and strategies for securing these devices, thanks to the efforts of medical equipment manufacturers, cybersecurity researchers, security vendors, and regulatory bodies that have dedicated the past decade to comprehending cyber risks associated with infusion pumps and other connected medical devices. For instance, in 2021, the U.S. Food and Drug Administration (FDA) issued seven recalls for infusion pumps or their components, along with nine additional recalls in 2020.

Industry and government-led initiatives are also underway to standardize device information and establish fundamental security criteria for manufacturing these devices. However, it is worth noting that the typical infusion pump has a lifespan of eight to ten years. The widespread use of equipment with a functional life significantly longer than its operating system's life has posed challenges in enhancing security.

IoMT Security Best Practices

Internet of Medical Things Security demands the utmost attention, necessitating healthcare security leaders to implement robust strategies for securing connected medical devices. An effective medical device security strategy can alleviate healthcare organizations' concerns regarding cyberattacks, allowing them to prioritize delivering optimal patient care and outcomes.

Key recommendations for IoMT security encompass:

• Ensure visibility and conduct risk assessments for all connected medical and operational devices utilizing Device-ID policies.
• Implement contextual network segmentation and employ least-privileged access controls.
• Continuously monitor device behavior and proactively prevent both known and unknown threats.
• Simplify operational procedures.

Healthcare organizations with vulnerable clinical and nonclinical devices within their networks may also consider adopting the IoT or IoMT Security lifecycle approach. These are immediate steps that can be taken to reduce exposure to threats targeting medical devices.

Zero Trust: The Foundation of Effective Connected Medical Device Security

Healthcare institutions are facing a pressing imperative: addressing the security challenges posed by the proliferation of connected medical devices. The fundamental step in ensuring the security of these devices is the adoption of a Zero Trust security approach. By implementing this approach, healthcare IT teams can shift from a reactive, alert-centric strategy to a proactive, prevention-focused stance in safeguarding connected medical devices.

A Zero Trust security framework mandates continuous authentication, authorization, and verification of both internal and external users' security configurations and postures before granting or maintaining access to applications and data. Access is granted strictly on a need-to-know basis and is retained only for as long as a legitimate need exists.

Crucial measures for establishing a Zero Trust security posture encompass:

• Attaining comprehensive and precise visibility into all connected medical devices.
• Assessing the risk profile associated with each connected clinical device.
• Harnessing the power of machine learning to accurately profile and segment all connected medical and IoT devices.
• Implementing granular, least-privileged policies for devices based on their classifications.

Zero Trust empowers healthcare organizations to harness the numerous advantages offered by connected clinical devices while fortifying their resilience against cyber threats that could jeopardize patient safety and privacy. Furthermore, it serves as a robust defense against various attacks, including the ever-persistent menace of ransomware.

Our Experience

Device for remote control of street sirens

Amidst the ongoing war, Stfalcon has remained steadfast in its commitment to serve the people of Ukraine, with a particular focus on preserving lives. Our mission has evolved to "Developing software that improves and SAVES people's lives."

During the second month of the full-scale war with Russia, the Khmelnytskyi regional military administration approached us with a critical mission: to automate the activation and deactivation of street warning sirens, vital for informing the population about imminent threats.

Bottom Line

IoMT (Internet of Medical Things) devices are wireless IoT devices designed to seamlessly connect to healthcare networks and facilitate the transmission of data. These devices encompass a wide range of applications, including medical imaging systems, intelligent thermometers, infusion pumps, medical device gateways, and biosensors integrated into wearables (either as part of clothing or implanted within the human body). The scope of IoMT use cases continues to expand steadily.

Security guidelines for connected medical devices encompass:

• Endpoint Protection: Implement robust security measures for all IoMT devices to safeguard them against potential threats.
• Identity and Access Management: Maintain strict control over user access and identity verification to prevent unauthorized entry.
• Asset Management: Ensure comprehensive tracking and management of all IoMT devices within your network.
• Vulnerability Management: Regularly assess and address vulnerabilities to fortify the security of connected medical devices.
• Network Segmentation: Divide your network into segments to limit access and contain potential breaches.
• Employee Training: Provide training to employees to mitigate risks associated with their interactions with IoMT devices.

If you are interested in creating secure IoMT devices, contact us, our dedicated team will help you to implement your project idea into reality.