Securing the Internet of Medical Things

The healthcare industry is seeing major shifts in the operational processes of information security, primarily due to digital transformation. As digital capabilities grow within healthcare, so does the potential threat landscape. One aspect of this transformation process — the rapid increase on the development and deployment of Internet of Medical Things (IoMT) devices — has opened the doors to improved processes and patient care. But it has simultaneously increased risk by expanding the potential threat vectors within a healthcare facility.

>> LISTEN: Who Is the Dark Overlord?

Network and internet-enabled IoMT devices — whether they are connected to a patient externally or have been medically implanted — enable healthcare providers to monitor and manage vital body functions at a distance. However, most IoMT devices were not designed with security in mind, which makes them especially vulnerable to compromise. In fact, one study suggested that there are an average of 164 cyberthreats detected per 1,000 connected host devices.

Malicious actors are always looking for low-hanging fruit, and they view these IoMT devices as a ripe opportunity for data theft, profit and hijacking control. The contamination and loss of data and the potential to seize control of a device should be top concerns for healthcare IT teams. An exploited vulnerability leading to the hijacking or ransoming of a device could not only result in clinical risk but even the loss of life.

3 Primary Risk Factors Inherent in IoMT Devices

First, though healthcare IT teams often carefully deploy firewalls along the network perimeters, once a threat is successfully inside, there are usually few security measures in place to detect it or slow it down. Further, IoMT devices have largely unquestioned access to much of the data stored on the network, making them an ideal target for cybercriminals. This is one reason why connected IoT medical devices are popular attack vectors.

Second, many IoMT devices are notoriously insecure. The U.S. Food and Drug Administration is trying to change this, based on its recent release of industry guidelines for securing medical devices. Still, many devices in use have been built to perform their medical function with little focus on securing the device or protecting the data they collect from cyberattacks. This reality further increases the chance of a data breach resulting from IoMT compromise.

Third, custom operating systems make connected medical devices difficult to patch and perform maintenance on. This results in IoMT devices remaining in use and continuing to circulate the network even with known vulnerabilities that can be targeted by cybercriminals as an entryway to the environment. It is critical to identify and risk-categorize these devices to establish a security perimeter around them through things like a dynamic segmentation architecture and security deployed throughout the network to enforce security policies locally.

Shoring Up Your Medical Device Security

It stands to reason that organizations are increasing their security spending to address the threats inherent in IoMT devices. Gartner forecasts that “the average security budget for IT, operational technology (OT) and IoT security requirements will respond to the growth of IoT devices across all business segments and scenarios,” rising to 20 percent by 2020.

>> READ: Defending Your Data from the Dark Overlord

Adequate budget to secure acquired IoMT devices is a necessary first step in combatting these threats, but money alone isn’t enough. Those additional dollars need an informed strategy — including process improvement — to optimize value and ensure protection. There are a number of features healthcare IT professionals should look for to augment their existing defenses to the greatest effect.

• Because the landscape of most networks is typically wide open and flat, internal segmentation firewalls (ISFWs) are a crucial defense against IoMT-based breaches. Because ISFWs operate inside the network instead of at the edge, they allow healthcare organizations to intelligently segment networks between patients, administrators, healthcare professionals and guests, as well as between types of devices — for example, between a patient information system and a life-saving heart monitor or infusion pump — to detect and stop malicious code from crossing between segments of the network. These segments can span an entire building, floor or care unit, or be limited to a single device. Furthermore, policy-driven segmentation can assign different levels of security clearance based on user identities to enable authorized east-west movement between segments.

• Combining ISFW solutions with network access control (NAC) enhances the ability of administrators to identify where and when a device has been deployed, and then use the ISFW to detect anomalous data movement that might indicate a compromised IoMT device. This visibility into east-west network movement allows IT teams to maintain security even when devices move laterally across the network into different segments.

• Monitoring is another critical function. Once ISFWs are in place, IT teams can prioritize IoMT devices that need the greatest protection and monitoring, and then implement deep inspection and monitoring of all traffic moving between the segments they are assigned to without affecting performance.

• It is also highly advisable to subscribe to real-time threat intelligence feeds, so threat and mitigation updates can be made before cybercriminals take advantage of any weaknesses in connected IoMT devices or interrupt the critical services they provide.

• Concerns about performance are legitimate when implementing and maintaining all of these barriers within the network. The flat, open structure of most networks, though insecure, exists to allow information to move quickly across the network, and deploying a traditional perimeter firewall deep within the network could result in serious network performance challenges. However, ISFWs are specifically engineered to add a layer of protection to these open networks without comprising speed by supporting wire-speed internal traffic, low latency and high throughput performance for even the most CPU-intensive functions, such as inspecting encrypted data.

Choose Your Medical Devices Well

Connected medical devices hold the promise of revolutionizing patient care and improving healthcare processes. However, the relative newness of these devices to the market, and the single-minded approach to development employed by many vendors, means they can introduce significant vulnerabilities into the healthcare IT environment. Organizations looking to strengthen their security stance by acquiring additional IoMT solutions should use the above recommendations as a guide to ensure their security budget is well spent on those tools designed to address the core vulnerabilities of IoMT devices.

Sonia Arista is a seasoned information security and technology specialist with more than 20 years’ experience. At Fortinet, she is responsible for the go-to-market strategy, solutions and sales growth for the company’s healthcare business. She is a member of the 2019 AEHIS Foundation (Association for Executives in Healthcare Information Security) Board. Sonia is currently pursuing an executive master’s degree in cybersecurity at Brown University.

Get the best insights in healthcare analytics directly to your inbox.

Related

Yes, Healthcare’s Data Breach Problem Really Is That Bad

Overcoming the Cultural Resistance to Health Tech

Make Sure You’re HIPAA Compliant Before You Have to Prove It