Understanding and Dealing with the Risks of IoT in Healthcare

With more healthcare providers relying on smart devices to engage with patients, the risk of IoT in healthcare increases.

That all spells great news for manufacturers, vendors, and users of these devices, but as each new device comes online, it provides another potential introduction into network systems by hackers using malware and ransomware. These attacks have become a considerable headache for those in the healthcare industry, which expects to see more than 30 percent of IoT devices deployed in hospitals, clinics, and surgical centers by 2025.

To make matters worse, healthcare is the number one cyber-attacked industry globally. It’s expected that ransomware damage across all industries will cost $11.5 billion by 2019 (with healthcare taking the biggest hit), with attacks occurring every 14 seconds by that time.

With that said, the healthcare industry must take proactive steps now to stem this growing tide of attacks. While we have explored how healthcare is lagging in cybersecurity, that does not mean that the industry, as a whole, can’t rise to meet this challenge. If the work is done now, it will prevent a future crisis. Let’s take a bird’s-eye view of some of the cybersecurity tools available for use.

Multi-factor Authentication

Multi-factor authentication is a security process whereby a user’s identity is confirmed by presenting two or more forms of evidence that they are who they say they are. Typically, that involves something only they know and something only they have.

For example, a user is granted access only after they present a password and some other form of identification. The second credential could be a USB stick, token, or bank card. In some cases, it could even be a biometric characteristic, such as a fingerprint or iris scan, but those types of authentication are typically only used in high-threat environments and other heavily-secured work environments.

End-to-End Encryption Both at Rest and In Flight

End-to-end encryption is a communication system that relies on encryption keys, pre-arranged strings of symbols, or a pre-shared secret, such as a one-time password or phrase between the communicating parties.

This type of encryption is typically employed to prevent eavesdropping and or surveillance by unauthorized parties. While this type of security solution may not have day-to-day relevance for healthcare organizations, another does: endpoint encryption.

Endpoint encryption protects computer networks that are remotely bridged to client devices such as laptops, tablets, and mobile phones. It is a widely-deployed cybersecurity tool in enterprise, government, and healthcare organizations, because of its versatility and because much of the encryption protections can reside in the cloud.

Careful Monitoring of Network Traffic for Malicious Activities

What is perhaps the best way to secure healthcare networks from hacking is non-digital and involves careful human surveillance of network activity. IT managers and other stakeholders are by far the best stewards of healthcare networks, because they can manage and study login/logout reports, port communication, app usage, email, and other network traffic for unusual activity.

When operating system patches are announced, they should be applied as quickly as possible. Some of the most notorious breaches in recent memory resulted from a failure to apply patches in a timely manner. WannaCry, Petya, and other ransomware attacks exploited global networks largely because operating system patches, although available for months, were not applied in a timely fashion.

As the healthcare industry relies more and more on digital devices to render medical services, vulnerabilities of IoT in healthcare will present themselves and remain persistent. Only due diligence by IT professionals will keep the private information of patients out of the hands of hackers and other nefarious actors seeking profits from this highly vulnerable industry.