Internet of Things (IoT) medical devices have become commonplace among healthcare providers. Smart medical equipment and electronic medical record systems facilitate real-time monitoring of patients, efficient data collection, and improve decision-making processes.
However, the proliferation of IoT devices in healthcare also presents significant security challenges. Connected devices provide a larger attack surface for cybercriminals to exploit and infiltrate networks. With the healthcare sector already a popular target for criminals, connected medical devices can significantly increase cyber risk exposure.
As the healthcare industry continues to embrace digital transformation to improve patient outcomes, securing IoT devices has become a critical concern requiring immediate and effective solutions.
The dangerous impacts of medical cyberattacks
The past year has seen a significant increase in cyberattacks targeting the healthcare sector, with ransomware attacks becoming particularly prevalent. These attacks can potentially disrupt patient care and services, posing a serious threat to the industry and the individuals it serves. According to the 2023 Cost of a Data Breach Report by IBM Security, the average cost of a healthcare data breach in 2022 reached $11 million, an increase of $1 million compared to the previous year.
Unlike most cyber threats, attacks on the healthcare industry can directly threaten human life. For example, a ransomware attack could result in operations being cancelled or critical medical devices such as a heart bypass machine, not working. This ultimately puts healthcare organisations in an uncomfortable and immoral position where they feel like they have no choice but to pay the ransom demand in order to get services back up and running.
Medical data has also long been a popular target for criminal gangs, serving as a commodity sold on the dark web and as additional leverage to coerce ransom payments. In July 2023, the ALPHV group, also known as BlackCat, claimed to have stolen 70 terabytes of sensitive data from Barts Health NHS Trust, the UK’s largest NHS trust.
When such breaches happen, it can have immense damage on healthcare providers. Patients that have had their data stolen feel like their trust has been broken, and providers can suffer heavy regulation penalties if found to be at fault when the data breach is made public. Therefore, some healthcare organisations are willing to pay ransom demands to stop such incidents going public.
Challenges in securing connected medical devices
The risks outlined above means IoT security weighs heavily on the minds of most healthcare providers. But securing systems against these risks can often prove to be a complex and challenging task.
One of the primary obstacles is the high cost of medical devices. Unlike consumer-grade IoT devices, the price tag for medical hardware such as MRI and CAT scanners, runs into the millions, making replacing outdated and unsecured devices almost unfeasible. Additionally, the software that powers these devices is often proprietary and complex, making upgrades and patches to the machines themselves challenging to implement. This also poses problems with the dedicated computers receiving the information being collected by these machines as it becomes near impossible to update and/or patch these computers as that could make them no longer compatible with the medical hardware they are married to. Whilst the situation is improving somewhat, connected devices, are often not been designed with accessibility and security maintenance in mind.
Moreover, the healthcare industry operates under stringent regulations to protect patient data, adding another layer of complexity to securing IoT devices. Compliance with these regulations can be daunting, especially when dealing with a diverse array of devices from different manufacturers, each with its own security features and vulnerabilities.
Nevertheless, with a breach potentially harming patients and causing crippling financial harm, providers must find a way to better secure their IoT devices.
Unified SASE – Improving security without driving up the cost
Tackling healthcare security requires a multi-faceted approach, with layers of protection that can account for a large and complex IT environment. Yet it must also be cost-effective and manageable for IT and security teams working with limited resources.
One potential solution to these contradictory needs is the implementation of Unified Secure Access Service Edge (SASE) platforms. Unified SASE integrates network security and wide area networking (WAN) capabilities into a single cloud-based service. It offers a holistic approach to securing all types of remote access, including IoT devices.
Unified SASE can be used to reduce the impact of an attack through micro-segmentation. This process divides a network into secure, isolated segments, limiting the potential impact of a security breach. Micro-segmentation is especially valuable for healthcare providers with many connected devices. If any medical IoT assets are compromised, the attack is restricted to one area of the network, thus minimising the impact of an attack and allowing other critical patient services to continue as normal.
As well as limiting the impact, Unified SASE provides a range of other security features that can help prevent cyberattacks. These include advanced threat protection, as well as Next-Generation Firewall (NGFW) services, to detect and block threats in real time. Another useful capability is URL filtering, which restricts user access to certain websites to prevent access to malicious web content. Finally, it also facilitates Cloud Access Security Broker (CASB) capabilities to provide visibility and control over cloud services to protect sensitive data.
Not only does Unified SASE platforms improve cyber resilience, but it can potentially reduce the Total Cost of Ownership (TCO). By consolidating multiple security services into a single platform, healthcare organisations can streamline their security operations and reduce the costs of managing multiple security solutions. This can also ease the burden on IT and security departments, allowing them to focus on other critical tasks.
As the healthcare sector continues to grapple with the security challenges posed by IoT devices, solutions like Unified SASE platforms offer a promising way forward. By adopting such technologies, healthcare organisations can enhance their cybersecurity posture, protect patient data, and ensure the delivery of safe and effective care.
By Jon Taylor, Director and Principal of Security at Versa Networks
