November 10, 2015 By Jeff Crume 3 min read

Remember when it seemed like the most that would happen if your personal information was compromised was that you’d have to get a new credit card (or two or three) and notify any merchants that had your numbers on file to update their records? It’s hard to believe you may one day pine for the relative ease of those simpler times.

What could be worse than having your identity stolen? How about having your personal health information (PHI) leaked or, worse still, having your health compromised by a cybercriminal?

Why would someone want to steal your PHI? While hard and fast numbers are difficult to come by, it has been widely reported that such data can fetch around $50 per record on the black market, which is substantially more than a credit card number would typically be resold for. A more sinister motivation involves blackmail, where the attacker leverages the personal nature of the information to extort payments or specific actions on the part of the victim.

That sounds bad enough, but it could get a lot worse.

The Internet of Medical Things

Imagine the case of a cardiac patient with an implanted pacemaker or defibrillator. Such a device can literally be a lifesaver — when operating properly.

That last bit is important. Medical equipment of this sort is not of the “set it and forget it” type. It needs regular monitoring and adjustment by a trained medical professional. What happens if the patient lives 200 miles from the nearest clinic and frequent travel of this duration would be a hardship?

A solution that the device manufacturers have cooked up involves adding a wireless control capability so that adjustments can be made without having to open the patient’s chest. Better still, the telemetry can be gathered at the patient’s home and transmitted automatically to the physician, who can, in turn, make adjustments to the device remotely. This allows for more frequent tweaks at lower cost and a better quality of life for the patient — a win-win scenario, right?

The Downside

If the good guys can do this, then there always exists the possibility that the bad guys can, too. With the wrong person at the controls, a lifesaving device can become a killing machine.

Before you dismiss this scenario as scaremongering, bear in mind that more and more such medical devices are being rolled out every day. Some are implanted in the patient’s body, as in the previous example, and some are external, such as an insulin pump with wireless controls. The fact is that these great gadgets are increasingly being connected to the Internet, therefore making them and the people who depend on them more vulnerable.

Attacks of this sort have been demonstrated repeatedly. Dating back at least as far as 2008, insulin pumps have been shown to be hackable. In 2013, the U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) issued an alert that reported researchers had found “a hard-coded password vulnerability affecting roughly 300 medical devices across approximately 40 vendors.”

The report went on to say, “The affected devices are manufactured by a broad range of vendors and fall into a broad range of categories including but not limited to: surgical and anesthesia devices, ventilators, drug infusion pumps, external defibrillators, patient monitors and laboratory and analysis equipment.”

In other words, the vulnerability was not isolated, but rather spanned a wide variety of vendors with an even wider variety of devices. Throw in the fact that some of these devices and their vulnerabilities could be networked and the risk increases further.

If you think that equipment of this sort isn’t networked, point your browser to Shodan, which bills itself as “the world’s first search engine for Internet-connected devices.” Think of it as Google for the Internet of Things (IoT). On this site, you can find networked gear ranging from unsecured webcams to equipment in health care facilities. With more and more devices coming online, you can expect this list of exposed endpoints to continue to grow.

Now That Health Has Your Attention…

So now you hopefully have a sense of the scope and danger that exits. What about a solution?

Clearly, we have our work cut out for us. Security professionals need to work hand in hand with medical device manufacturers to ensure that the necessary critical thinking happens during the earliest design stages. They can also apply best practices and lessons learned from decades of defending corporate networks to this relatively newer ecosystem of interconnected lifesavers.

The health care industry needs to develop standards and certification programs to establish baselines for what constitute due diligence in this area where IoT and medicine meet.

Consumers have to pull their weight and ask critical questions of health care providers just as they would with other significant purchases. At the same time, regulatory agencies need to step up their game and provide necessary oversight before patients are put in harm’s way.

The path forward promises amazing ways to improve outcomes, quality of life and longevity for patients as we leverage advances in health care and computing technologies. We just need to take care not to allow these medical marvels to be hijacked along the way.

More from Healthcare

Ransomware on the rise: Healthcare industry attack trends 2024

4 min read - According to the IBM Cost of a Data Breach Report 2024, the global average cost of a data breach reached $4.88 million this year, a 10% increase over 2023.For the healthcare industry, the report offers both good and bad news. The good news is that average data breach costs fell by 10.6% this year. The bad news is that for the 14th year in a row, healthcare tops the list with the most expensive breach recoveries, coming in at $9.77…

Cybersecurity risks in healthcare are an ongoing crisis

4 min read - While healthcare providers have been implementing technical, administrative and physical safeguards related to patient information, they have not been as diligent in securing their medical devices. These devices are critical to patient care and can leave hospitals at risk for cyberattacks, causing major disruptions to patient care. In fact, 88 million individuals were affected by large breaches, compromising vast amounts of electronic protected health information (ePHI) last year according to the U.S. Department of Health & Human Services. This year,…

Cost of a data breach: The healthcare industry

3 min read - Cyberattacks grow every year in sophistication and frequency, and the cost of data breaches continues to rise with them. A new report by IBM and the Ponemon Institute, the 2024 Cost of Data Breach Study, details the financial impacts of attacks across multiple industries.The global average cost of a data breach reached an all-time high of $4.45 million in 2023, which is a 15% increase over the past three years. This increase was mainly driven by rising expenses associated with…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today