Five cyber security measures for IoT medical devices

The reason is clear: those IoT medical devices are all interconnected on their own web, and carry their own digital signatures, IP addresses and, most distressingly, patient medical data that can be hacked, read, exploited and dumped by predatory cybercriminals.  

According to Forrester Research Analyst Chris Sherman and his May 2016 report on the growing crisis, Healthcare’s IoT Dilemma: Connected Medical Devices: “You have less control over connected medical devices than any other aspect of your technology environment. Many times, vendors control patch and update cycles, and vulnerabilities persist that require segmentation from your network. Considering that many of these devices are in direct contact with patients, this is a major cause for concern.”

Indeed, but here are five ways to protect medical devices on the IoT from cyber breach or data exploit:

1. Categorise potential cyberattack risk of existing devices. Once electronic medical devices are placed on wireless networks, they become part of an interlinked (and hackable) system. A website like Shodan, aka “the search engine for the Internet of Things,” catalogues devices on the IoT and exposes myriad searchable endpoints globally that lack proper security. Medical device security watchdogs should then use sites like Shodan to calculate the riskiness of having that heart monitor, CAT scanner or IV-drip on the IoT and step up their security accordingly.
2. Establish a clinical risk management framework. This one rightly follows on the heels of number one, as it is sequentially relevant and is based on language in the Sherman/Forrester report that calls for a risk-management “framework [that] focuses on how to manage and balance risks associated with safety, effectiveness and data/system security. It will help you determine the risk levels of your medical devices, mitigate and control that risk, and ultimately bring the risk exposure of your hospital network to acceptable levels.”
3. Ensure your enterprise or organisation follows strict security “hygiene”. The Forrester Research report states that the great majority of healthcare data breach cases in recent years were due to “social engineering and spear-phishing attacks”. This shows that there needs to be a deep awareness of corporate culture within vulnerable industries, and tighter controls on employee access and greater recognisance of the aforementioned cyber threats and attacks. Security control in healthcare needs to adopt “frequent, relevant, and engaging communication to ensure [their] workforce doesn’t miss security messages,” according to the report.
4. Arrange security requirements in new device requests’ proposals and contract verbiage. It’s important to note that as potential customers, healthcare organisations do have the power to get manufacturers of vulnerable devices to agree to special security requirements in proposals and contracts for IoT-connected device rollouts or upgrades.
5. Implement a no-tolerance, zero-trust networking policy. This relies on the fact that you can’t control what’s coming at your data network from 'out there', but you can control how you respond from within your organisation. Adopting ubiquitous security procedures rather than just perimeter measures; including risk-based, segmented devices, and enforcing zero-trust policies that vet-out any conceivably possible cybersecurity threat will help cement across-the-board security measures that protect healthcare data networks far better than mostly passive, perimeter controls.

The Forrester Report ends on this note: although tech innovation in healthcare holds great promise to improve the “quality and speed with which patient care is delivered, the unfortunate reality is that security is all too often an afterthought in the design and development of these innovative new technologies. This is especially true for IP-enabled medical devices.”