November 10, 2015 By Jeff Crume 3 min read

Remember when it seemed like the most that would happen if your personal information was compromised was that you’d have to get a new credit card (or two or three) and notify any merchants that had your numbers on file to update their records? It’s hard to believe you may one day pine for the relative ease of those simpler times.

What could be worse than having your identity stolen? How about having your personal health information (PHI) leaked or, worse still, having your health compromised by a cybercriminal?

Why would someone want to steal your PHI? While hard and fast numbers are difficult to come by, it has been widely reported that such data can fetch around $50 per record on the black market, which is substantially more than a credit card number would typically be resold for. A more sinister motivation involves blackmail, where the attacker leverages the personal nature of the information to extort payments or specific actions on the part of the victim.

That sounds bad enough, but it could get a lot worse.

The Internet of Medical Things

Imagine the case of a cardiac patient with an implanted pacemaker or defibrillator. Such a device can literally be a lifesaver — when operating properly.

That last bit is important. Medical equipment of this sort is not of the “set it and forget it” type. It needs regular monitoring and adjustment by a trained medical professional. What happens if the patient lives 200 miles from the nearest clinic and frequent travel of this duration would be a hardship?

A solution that the device manufacturers have cooked up involves adding a wireless control capability so that adjustments can be made without having to open the patient’s chest. Better still, the telemetry can be gathered at the patient’s home and transmitted automatically to the physician, who can, in turn, make adjustments to the device remotely. This allows for more frequent tweaks at lower cost and a better quality of life for the patient — a win-win scenario, right?

The Downside

If the good guys can do this, then there always exists the possibility that the bad guys can, too. With the wrong person at the controls, a lifesaving device can become a killing machine.

Before you dismiss this scenario as scaremongering, bear in mind that more and more such medical devices are being rolled out every day. Some are implanted in the patient’s body, as in the previous example, and some are external, such as an insulin pump with wireless controls. The fact is that these great gadgets are increasingly being connected to the Internet, therefore making them and the people who depend on them more vulnerable.

Attacks of this sort have been demonstrated repeatedly. Dating back at least as far as 2008, insulin pumps have been shown to be hackable. In 2013, the U.S. Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) issued an alert that reported researchers had found “a hard-coded password vulnerability affecting roughly 300 medical devices across approximately 40 vendors.”

The report went on to say, “The affected devices are manufactured by a broad range of vendors and fall into a broad range of categories including but not limited to: surgical and anesthesia devices, ventilators, drug infusion pumps, external defibrillators, patient monitors and laboratory and analysis equipment.”

In other words, the vulnerability was not isolated, but rather spanned a wide variety of vendors with an even wider variety of devices. Throw in the fact that some of these devices and their vulnerabilities could be networked and the risk increases further.

If you think that equipment of this sort isn’t networked, point your browser to Shodan, which bills itself as “the world’s first search engine for Internet-connected devices.” Think of it as Google for the Internet of Things (IoT). On this site, you can find networked gear ranging from unsecured webcams to equipment in health care facilities. With more and more devices coming online, you can expect this list of exposed endpoints to continue to grow.

Now That Health Has Your Attention…

So now you hopefully have a sense of the scope and danger that exits. What about a solution?

Clearly, we have our work cut out for us. Security professionals need to work hand in hand with medical device manufacturers to ensure that the necessary critical thinking happens during the earliest design stages. They can also apply best practices and lessons learned from decades of defending corporate networks to this relatively newer ecosystem of interconnected lifesavers.

The health care industry needs to develop standards and certification programs to establish baselines for what constitute due diligence in this area where IoT and medicine meet.

Consumers have to pull their weight and ask critical questions of health care providers just as they would with other significant purchases. At the same time, regulatory agencies need to step up their game and provide necessary oversight before patients are put in harm’s way.

The path forward promises amazing ways to improve outcomes, quality of life and longevity for patients as we leverage advances in health care and computing technologies. We just need to take care not to allow these medical marvels to be hijacked along the way.

More from Healthcare

Cost of a data breach 2023: Healthcare industry impacts

3 min read - Data breaches are becoming more costly across all industries, with healthcare in the lead. The 2023 Cost of a Data Breach Report analyzes data collected from March 2022 to March 2023. Healthcare remains a top target for online criminal groups. These data breach costs are the highest of any industry and have increased for the 13th consecutive year. Healthcare is a highly regulated industry that the U.S. government considers critical infrastructure. As such, recent federal privacy standards, security standards and…

Cyberattackers target the Latin American health care sector

3 min read - Cyberattacks on the healthcare sector are a growing threat in Latin America, and the large amount of confidential data these organizations handle makes these attacks a top concern. The value of healthcare data in the illegal market, such as the personal, medical and financial information of patients and healthcare companies, creates an appealing target for threat actors. This can have serious consequences for the privacy and information security of these organizations. Cyberattacks could lead to reputational risks, interruption of operations,…

Increasingly sophisticated cyberattacks target healthcare

4 min read - It’s rare to see 100% agreement on a survey. But Porter Research found consensus from business leaders across the provider, payer and pharmaceutical/life sciences industries. Every single person agreed that “growing hacker sophistication” is the primary driver behind the increase in ransomware attacks. In response to the findings, the American Hospital Association told Porter Research, “Not only are cyber criminals more organized than they were in the past, but they are often more skilled and sophisticated.” Although not unanimous, the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today