IoMT security is the combined cybersecurity defense mechanisms and strategy that protect against cyberattacks targeting connected medical devices. IoMT security can be understood as a cybersecurity strategy and protection mechanism that safeguards against the possibility of cyberattacks that target Internet of Medical Things (IoMT) devices which are connected to a healthcare network. IoMT security is also sometimes referred to as medical IoT Security.
The Internet of Things (IoT) can have a variety of meanings in different industries. Any internet-connected device with the ability to collect, transfer, and analyze data over a network is a “thing” in the IoT ecosystem.
In the healthcare industry, any medical device that connects to a healthcare provider’s network is classified as “medical IoT device,” a “connected medical device,” a “connected clinical device,” or an IoMT device. With functions from monitoring heart rates to taking temperatures, there is a wide array of IoMT devices, including:
IoMT adoption is accelerating as connected devices have become prevalent in healthcare. As IoMT technology evolves, it will continue extending beyond the walls of clinics and hospitals.
The healthcare industry’s digitalization journey is progressing, further accelerated by the COVID-19 pandemic. Healthcare providers, medical device manufacturers, and hospital systems alike are recognizing the crucial role of connected medical devices.
1Allied Market Research, Internet of Things in Healthcare Market, 2022.
Figure 1. IoMT device and application examples
IoT is viewed as a business enabler in most industries, but medical IoT plays a different role in healthcare. IoMT use cases include:
One of the main drawbacks of IoT in healthcare is weak security. Most IoMT devices were not designed with security in mind, which makes them especially vulnerable to compromise. IoMT demands better security because, unlike other industries, a security breach in a healthcare network can quite literally become a matter of losing lives.
Some of the key security challenges in healthcare related to connected medical devices include:
Unit 42® researchers at Palo Alto Networks analyzed crowdsourced data from security assessments of more than 200,000 infusion pumps on the networks of hospitals and other healthcare organizations using IoT Security for Healthcare from Palo Alto Networks. This topic is of critical concern for providers and patients because security lapses in these devices have the potential to put lives at risk or expose sensitive patient data.
The published findings show an alarming 75% of infusion pumps scanned had known security gaps that put them at heightened risk of being compromised by attackers. These shortcomings included exposure to one or more of 40 known cybersecurity vulnerabilities. Alerts showed they had one or more of 70 additional types of known security shortcomings for IoT devices.
Clearly, healthcare is a prime target for attackers. This heightens the concern around connected medical devices, because any exploited vulnerability enables cybercriminals to take malicious actions. Attacks on connected medical devices can pose significant risks healthcare organizations and their patients, including:
There is already a vast array of information about known vulnerabilities and approaches for securing these devices. This is a result of the efforts of medical equipment makers, security researchers, cybersecurity vendors and regulators who have spent the past decade working to better understand cyber risks associated with use of infusion pumps and other connected medical devices. For example, the U.S. Food and Drug Administration (FDA) announced seven recalls for infusion pumps or their components in 2021, and nine other recalls in 2020.
There are also initiatives led by industry and government aimed at standardizing device information and establishing baseline security criteria for manufacturing these devices. Yet the average infusion pump has a life of eight to 10 years. The widespread use of equipment whose functional life is much longer than the life of its operating system has hampered efforts to improve security.
Security for connected clinical devices needs to be taken seriously, making it vitally important for all healthcare security leaders to implement connected medical device security strategies. A robust medical device security strategy can alleviate healthcare organizations’ worries about cyberattacks and allow them to focus on delivering positive patient care and outcomes.
IoMT security recommendations include:
Healthcare organizations with vulnerable clinical and nonclinical devices on their network might also consider the IoT or IoMT Security lifecycle approach (figure 2). These are steps that can be taken immediately to reduce exposure to medical device threats.
Figure 2. The IoT security lifecycle is an approach that organizations can use to reduce exposure to cybersecurity threats related to medical devices on their networks.
Healthcare organizations face an urgent need to tackle the security challenges related to connected medical devices. The most basic step in securing connected medical devices begins with a Zero Trust security approach (figure 3). By doing this, healthcare IT teams will be empowered to take a prevention-first instead of an alert-only approach to keeping connected medical devices safe.
Figure 3. Zero Trust Network Security provides consistent access control and security regardless of where users, devices, or applications are located.
A Zero Trust security framework requires internal and external users to be continuously authenticated, authorized, and verified for security configuration and posture before being granted or retaining access to applications and data. Users are granted access on a need-to-have basis and keep it only so long as there is a valid need.
Key steps to establishing aZero Trust security posture include:
Zero Trust allows healthcare organizations to take advantage of the connected clinical devices’ many benefits without being susceptible to cyberthreats that can compromise patients’ safety and privacy. In addition, it protects them from other attacks such as ransomware.
