While the Internet of Things (IoT)-enslaving distributed denial-of-service (DDoS) attackers have hogged much of the public’s attention lately, the medical devices segment of the IoT has flown under the radar. The field is growing too quickly for security to keep up. Devices can be compromised individually, but they can also provide an attacker with a way into the overall health care infrastructure.

According to ABI Research, as reported by Help Net Security, medical IoT insecurity could endanger patient safety and impair patient care.

Medical IoT Spending to Skyrocket

Michela Menting, the research director at ABI Research, said that health care providers and original equipment manufacturers (OEM) will spend $5.5 billion on cybersecurity in 2016. Only $390 million of that figure will be dedicated to improving the security of medical devices, however.

OEMs will use the majority of that money to embed security into their hardware, as required by regulatory oversight agencies. OEMs must also spend money on reviews, analysis, penetration testing, patch development and over-the-air (OTA) updates when the device software is revised.

Medical devices have historically suffered from multiple vulnerabilities due to a variety of causes. The use of hardcoded passwords may help a service technician access the device, but it also provides a useful stepping stone for attackers. Many devices also lack an authentication mechanism — an issue that security leaders must address before the industry can achieve a reasonable level of security.

Squashing Silos

The overall environment today can be visualized as a set of stakeholder silos. The industry lacks a common effort to devise a standard of security and ensure all stakeholders are protected. ABI cited only a few companies that are significantly committed to medical cybersecurity. Additionally, the U.S. seems to be the only major nation devoting serious effort to this problem.

According to ABI, spending on medical IoT-connected devices will triple globally by 2021. Such an increase in use can only force the security problems of the devices to the forefront in the years to come.