IoT Adoption in Healthcare Brings Security Opportunities

By Anand Oswal, Senior Vice President and GM at cyber security leader Palo Alto Networks

Connected medical devices, also known as the Internet of Medical Things or IoMT, are revolutionizing healthcare, not only from an operational standpoint but related to patient care. In hospital and healthcare settings around the world, connected medical devices support critical patient care delivery and a wide variety of clinical functions, from medical infusion pumps and surgical robots to vital sign monitors, ambulance equipment, and so much more. At the end of the day, it’s all about patient outcomes and how to improve the delivery of care, so this kind of IoT adoption in healthcare brings opportunities that can be life-changing, as well as simply being operationally sound.

Yet, enabling these amazing patient outcomes through IoT technology brings with it an associated set of security risks to hospitals and patients that are in the news far too often. Ransomware, for example, is a particularly prevalent threat to healthcare providers around the world. In August 2022, the French hospital Centre Hospitalier Sud Francilien (CHSF) was the victim of a ransomware attack that disabled medical imaging and patient admission systems. And in October 2022, CISA issued an advisory to healthcare providers warning of a ransomware and data extortion group targeting the healthcare and public health sector with a particular interest in accessing database, imaging, and diagnostics systems within networks. But ransomware isn’t the only risk. In fact, according to a report in HIPAA Journal, there has been a 60% increase in cyberattacks of all varieties in healthcare in 2022,¹  making it an unfortunately routine aspect of delivering care that the industry must be prepared to address.

Why Medical IoT Devices Are at Risk

There are a number of reasons why medical IoT devices are at risk. Among the most common reasons is the fact that many of these devices are not designed with security in mind.

Many connected devices ship with inherent vulnerabilities. For example, according to research from Unit 42, 75% of infusion pumps have unpatched vulnerabilities.² Over half (51%) of all X-Ray machines had a high severity CVE (CVE-2019-11687), with around 20% running an unsupported version of Windows.³

Unit 42 research also found that 83% of ultrasound, MRI, and CT scanners run on an end-of-life operating system.⁴ Those operating systems have known vulnerabilities that can potentially be exploited. Attackers are known to target vulnerable devices and then move laterally across the organization’s network to infect and damage the rest of a hospital network.

The impact of medical IoT device vulnerabilities is serious and potentially life-threatening. It’s not always easy and sometimes not even possible to update or patch some of these devices, either because doing so requires operational disruption of care delivery or due to a lack of computing capability of many types of devices. As a result, we’ve seen patient data exposed. We’ve seen hospital operations halted. While the attack potential is widespread, healthcare providers can take proactive steps to help minimize the vast majority of device-related security risks.

Four Necessary Steps to Improve Medical IoT Security

• Ensure visibility and risk assessment of all connected medical and operational devices. The first step in securing IoT in healthcare is to know what’s there; you can’t secure what you can’t see. Device visibility isn’t enough—you have to be able to continuously assess the risk the devices and their evolving vulnerabilities pose to the network.
• Apply contextual network segmentation and least-privileged access controls. Knowing a device is present is useful. What’s more useful is understanding what network resources or information can be accessed by the device. That’s where network segmentation comes into play, creating and enforcing policies that limit device access to only the resources necessary for its intended use and nothing more.
• Continuously monitor device behavior and prevent known and unknown threats. As these devices communicate across clinical environments and with external networks and services, they ensure that you establish baseline behavior, monitor devices for anomalous behavior, and protect network-connected devices against threats such as malware.
• Simplify operations. In order to effectively manage and secure the sheer volume of devices on a healthcare network, providers require a solution that integrates with existing IT and security solutions to eliminate network blind spots, automate workflows, and reduce the burden of tedious manual processes for network administrators.

Better IoT Security Helps Ease Regulatory Compliance Challenges

Understandably, there are a lot of compliance requirements in healthcare. Healthcare compliance covers numerous areas like patient care, managed care contracting, Occupational Safety and Health Administration (OSHA), and Health Insurance Portability and Accountability Act (HIPAA) privacy and security, to name a few. Any attack that involves a patient system or medical IoT device is most likely a compliance breach, resulting in the loss of sensitive data or access to sensitive data from unauthorized entities. Limited IoMT visibility and risk assessment make it difficult to meet regulatory, audit, and HIPAA requirements. Having complete visibility into all devices and their utilization data reduces the burden of preparing for compliance audits and compiling compliance reports.

Implementing Zero Trust for Medical IoT

Recommended Reading