October 20, 2016 By Larry Loeb 2 min read

While the Internet of Things (IoT)-enslaving distributed denial-of-service (DDoS) attackers have hogged much of the public’s attention lately, the medical devices segment of the IoT has flown under the radar. The field is growing too quickly for security to keep up. Devices can be compromised individually, but they can also provide an attacker with a way into the overall health care infrastructure.

According to ABI Research, as reported by Help Net Security, medical IoT insecurity could endanger patient safety and impair patient care.

Medical IoT Spending to Skyrocket

Michela Menting, the research director at ABI Research, said that health care providers and original equipment manufacturers (OEM) will spend $5.5 billion on cybersecurity in 2016. Only $390 million of that figure will be dedicated to improving the security of medical devices, however.

OEMs will use the majority of that money to embed security into their hardware, as required by regulatory oversight agencies. OEMs must also spend money on reviews, analysis, penetration testing, patch development and over-the-air (OTA) updates when the device software is revised.

Medical devices have historically suffered from multiple vulnerabilities due to a variety of causes. The use of hardcoded passwords may help a service technician access the device, but it also provides a useful stepping stone for attackers. Many devices also lack an authentication mechanism — an issue that security leaders must address before the industry can achieve a reasonable level of security.

Squashing Silos

The overall environment today can be visualized as a set of stakeholder silos. The industry lacks a common effort to devise a standard of security and ensure all stakeholders are protected. ABI cited only a few companies that are significantly committed to medical cybersecurity. Additionally, the U.S. seems to be the only major nation devoting serious effort to this problem.

According to ABI, spending on medical IoT-connected devices will triple globally by 2021. Such an increase in use can only force the security problems of the devices to the forefront in the years to come.

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today