Magazine menu Close Magazine menu

Author

Rodika Tollefson

Rodika Tollefson is a freelance writer and journalist who writes about technology and cybersecurity for publications and for impactful brands. When she’s not busy being a nerd, she likes to work on short documentary films.

Get in touch with Rodika

Latest stories by Rodika

data security metaverse

Why brands must get ahead on metaverse privacy and security

  • Digital transformation
  • min read
    • While there's much buzz around the metaverse, few conversations focus on its security, privacy and safety. But these challenges may be even bigger in this emerging space than in the rest of the digital world. I spoke with several experts who agree organizations wanting to embrace this new medium must think about the challenges now – not when the metaverse gains full steam. What is the metaverse? The metaverse is an immersive three-dimensional world where people engage in social and commercial activities through digital avatars. Users can access it on many kinds of connected devices, but it's most immersive when used with a virtual reality (VR) headset. There are many metaverses, including that being developed by Meta, formerly Facebook, Horizon Worlds. Some call it the future of the internet. In this metaverse future, our physical and virtual spaces and lives may converge seamlessly. It could create a common place to work, shop and socialize. Some put this future closer than we might think. Global analysts Gartner predict 25 percent of people will spend at least one hour in the metaverse by 2026. Market Research Future says the metaverse market will grow by 45 percent annually until 2030. By contrast, they expect the Internet of Things (IoT) to grow by just 26 percent each year. Little focus on metaverse security and safety "The metaverse's attack surface [possible entry points for malicious actors] is bigger, and it's also a new technology space," says Nick Donarski, co-founder and chief technology officer at blockchain company ORE System. "Developers don't have the experience, technical resources and exposure for long-term understanding of its security and how it applies to organizations." Al Pascual, senior vice president of enterprise risk solutions at identity security provider Sontiq, thinks we can easily get 'ahead of our skis' when it comes to security. "We invent new ways to give people experiences and products using old security paradigms and have to clean up the mess later," he says. "We must think about security before we start deploying the metaverse to everyone." Securing the 'Wild West' "The metaverse is like the Wild West right now. There aren't even any standards yet," says Aarti Dhapte, senior research analyst at Market Research Future and an author of its metaverse market forecast reports. "You can't even regulate it well because everybody doesn't define the metaverse the same way." Gartner defines the metaverse as "a collective virtual space created by the convergence of virtually enhanced physical and digital reality" that's "device-independent and not owned by a single vendor" with "an independent virtual currency." Other definitions include fully immersive experiences, a three-dimensional overlay on the physical world and a persistent collection of universes we can traverse with digital identities and assets. Despite its early stage, many security experts expect the metaverse will see familiar security threats: Social engineering, phishing, identity theft and more. "Cybercriminals' methods are rarely new. More often, they use the same methods in a new channel," says Pascual, whose fraud prevention career includes working for global banks. Adding blockchain to the mix Many think blockchain will play a central role in the metaverse because of the need to decentralize the space and enable the various worlds within it to interoperate. Cryptocurrency, which uses blockchain, is the natural candidate for metaverse ecommerce. The metaverse could use smart contracts – digital transactions stored on blockchain that self-execute under certain conditions – to implement rules. Also a new technology, blockchain adds complexity and security challenges to the metaverse. And while many think its immutability makes it more secure, recent attacks on blockchain highlight its security shortcomings. Virtual currencies, whether cryptocurrency or non-fungible tokens (NFTs,) are also hard to navigate, especially for a big metaverse user group – children. "It's risky for kids and teens to understand handling virtual money in all forms and can lead to big losses," Dhapte says. People still the weakest link Malicious actors most often use people manipulation to attack. For example, Verizon's 2022 Data Breach Investigations Report says 82 percent of data breaches involve a human element. The metaverse's human element is similarly exploitable. The metaverse will also magnify data privacy concerns. Artur Kane, vice president at secure remote access company GoodAccess, says that since the metaverse is a "world attacking even more of our senses," tech giants can use it to make more money with better-targeted advertising. That means tracking even more of our behavior online. "We give away much more information in the metaverse," says Kane, a frequent privacy speaker at industry events. "Companies can learn much about us – like race, sexual interest, potential health issues." He mentions recent research showing how attackers could exploit hardware and application weaknesses to violate privacy. They set up a benign-looking VR escape room game and inferred many participants' attributes, from height to age to location, with high accuracy using just minutes of gameplay. Regulation far behind Lagging data privacy and security regulation adds to the metaverse's Wild West feel. "We're giving away so much more data than we realize," says Kane. "There's huge potential for data breaches and leaks in a new environment where legislation doesn't restrict much." Blockchain regulation is also lacking, which Dhapte thinks could mean greater chance of fraud. "Since various countries don't have fixed regulations for blockchain, tracking fraudulent activities would be a real challenge for governments." User risks in immersive environments The metaverse is a rich playground for abuse – from sexual harassment to virtual assaults. "Any vulnerable group, especially children, faces higher risk as non-consensual contact and communication might be more intrusive and targeted, given how immersive the experience is," Kane says. A survey by global think tank Wunderman Thompson Intelligence found 66 percent of parents familiar with the metaverse have child safety concerns. Fears are not unfounded – one media investigation found behaviors like racist comments and sexually explicit content directed at children. Pascual of Sontiq says metaverse participants exchange little of monetary value today, "But in ten to 20 years, the potential for financial transactions is huge, especially as digital properties gain value. Thefts will become more meaningful." In the meantime, users still risk fraud. Pascual says scams draw kids looking for cryptocurrency and virtual swag. "We've seen evidence of predators targeting children in open worlds like Roblox. Parental oversight, education and control on who children can engage with and what they can see will be key." An investigation as part of Tomorrow Unlocked's hacker:HUNTER video series found rife hacking in children's games like Roblox, for example stealing hard-won digital items. These hacks had considerable impact on the child gamers. It's harder for parents to monitor children consuming content using VR headsets because they can't look over kids' shoulders as with a computer or phone. That gives brands launching metaverse experiences a greater responsibility to protect users. Protecting business in the metaverse For teams responsible for metaverse experiences, security experts like Pascual emphasize the need for moderation. He sees danger for brands in platforms ineffectively moderated. "Brand trust will be critical, so there's a need for moderation, including monitoring to ensure brands aren't easily imitated," he says. Moderation may not be easy. Tech giant Meta's chief technical officer said moderating user behavior "at any meaningful scale is practically impossible." Still, some experts think self-scrutiny by brands, alongside industry collaboration, will be a business imperative in the metaverse. The good news is security concepts are roughly the same in the metaverse, according to Donarski of ORE Systems. "The fundamental security practices carry over because the architecture is the same. It still runs on a server, you have databases on the backend, user and password management, and so on." It may take a while, but the metaverse will likely become a reality. Companies must consider security and privacy before that reality takes shape – whichever version of the metaverse unfolds.
Proglove digital twin

How digital factory clones are bringing new efficiency to industry

  • Artificial intelligence
  • min read
    • Tech entrepreneur Elon Musk thinks robots could do any job better than humans. And according to US billionaire investor Warren Buffet, automation replacing humans is no bad thing. Whether you agree or not, today, we're a long way from robots replacing humans in manufacturing. But factories are increasingly using smart technology to boost speed, improve quality and reduce waste. The shift is so important that this new era of connected, intelligent factories has a nickname: The fourth industrial revolution, or Industry 4.0. Ilhan Kolko, chief product officer at German-based smart factory tech firm ProGlove, doesn't see robots replacing humans anytime soon. He thinks future factories will involve machines collaborating with people for faster, safer manufacturing. "It's not a competition between humans and machines," says Kolko. "But any technology that augments human beings and helps us make better decisions in the industrial setting will take the driver's seat." Digital process copies help identify potential improvements Kolko thinks human-machine collaboration – blending human thinking and action with machine capabilities – will be at the heart of a post-COVID industrial renaissance. One technology ProGlove sees as leading the way is the human digital twin. A human digital twin is a digital clone of a manufacturing process, object or an entire environment in near real-time. Industry uses these twins to optimize business performance. A global professional services consultancy Accenture 2021 survey of over 6,000 IT and business executives found nearly two-thirds think their organization will increase investment in digital twins in the next three years. Among other sources, digital twins rely on data collected by smart technologies like internet of things (IoT) devices. Companies use the data to improve their manufacturing processes and even product design. ProGlove's products add new data points to manufacturing's digital twins: Human motion and tasks. They feel this extra data builds a next-level digital twin. "The human digital twin makes the workers' motions virtual and combines it with the data from tools and machinery on the factory or warehouse floor," Kolko explains. "We want to enrich the environment the person operates in with more context, so you can analyze everything happening on the shop floor." Wearables speed up processing and improve safety Founded in 2013 and now employing 200 people from 30 countries, ProGlove makes wearable, connected barcode scanners for industries from retail to transport. World Economic Forum named ProGlove as one of 100 technology pioneers for 2020. Their wearable scanners are designed to be small, lightweight and fast. Workers wear the scanner on their wrist so they can scan a part or product hands-free. It takes two seconds, compared with six seconds for a handheld scanner. Seconds add up when someone scans thousands of pieces a day. Customers of distribution center workflow designers Procensis are among ProGlove's users. "ProGlove lets them work faster without more effort and improve accuracy and safety, being hands-free. It also reduces distractions," says Ed Kennedy, Procensis founder and chief executive. Workers who wear ProGlove can keep their eyes on their task. "It's little different than wearing a watch and weighs about the same." ProGlove has added software that gives customers insight using machine learning models and data analytics. They're seeing significant gains: A parcel customer minimized worker movement by 25 percent while keeping performance the same and an airline reduced flight delays by 15 percent just by standardizing catering tray preparation. "As we collected human motion data and data around the tools workers use while picking, sorting, and assembling components, and time spent on activities, we realized we can add more data points, like machine data," says Kolko. How the human digital twin works ProGlove scanners already collect human motion data like step count and downtime. It can identify which tools a worker uses based on acceleration data points. The scanner's camera picks up other data points about processes and information from items' barcodes. Customers already use this data to optimize processes, whether to redesign the shop floor or improve productivity. The scanners can connect with WiFi, ethernet and Bluetooth, meaning they can interact with other shop floor systems – from mobile devices to wireless keyboards to IoT sensors. Kolko explains, "It's like seeing everything as if you were there, sat next to a worker or following them on the assembly line." Device security and worker privacy Cybersecurity has long been a concern for industrial IoT. Kolko says it's slowed down the adoption of technology like digital twins. "Logistics and manufacturing ideas like digital twins are now almost a decade old, but a big reason some aren't in common use are security concerns." To address these concerns, ProGlove built protections into its software, like encryption of data in the cloud. They allow integration with customers' existing security protocols like network segmentation or secure connectivity. In the age of data regulation such as the EU's General Data Protection Regulation (GDPR,) privacy concerns are also high on the agenda. Kolko says they anonymize ProGlove's data when it leaves the scanner and becomes process data for the analytics software. The end goal: AI-driven process optimization The human digital twin can be applied in many industries. Healthcare could use digital twins to simulate treatments before giving them to patients. It may be some time before the technology is robust enough for that, but Kolko thinks manufacturing is closer to implementing it widely. The main benefit for industry is allocating resources more efficiently. Kolko says a typical facility collects trillions of data points. The digital twin consolidates the data then interprets it. This is where AI comes in: Finding patterns and anomalies in processes. Today, facility supervisors who receive the insights must still translate them into processes that mean productive changes. ProGlove wants to move from enabling micro-efficiencies to true AI-enabled optimization in the next two to three years. "We're expanding our software capabilities. I see the next-generation product being able to solve optimization problems on its own," says Kolko. Industry's future is close That same 2021 Accenture survey found 63 percent of executives thought that since the COVID-19 pandemic, the pace of digital transformation in their organization is hotting up. Accenture identified digital twins as one of 2021's transformative technologies to watch. Kolko also sees the signs companies want to make their workflows, environments and workforces smarter. "In the post-COVID world, everyone wants to build resilience and make their processes futureproof," he says. The key thing, he thinks, is to make sure people aren't competing with machines but feel part of a collaborative environment. Luminaries like Musk and Buffet may be right that robots can do many things better than humans, and that's no bad thing. But the intelligent, automated factory of the future will still have an efficient human crew. The human digital twin may build a bridge between humans and machines, but humans will still be essential in solving human problems.
medication smart labels

Smart labels could smooth stressed medical supply chains

  • Emerging tech
  • min read
    • Every minute, unsafe care kills at least five people die around the world, according to the World Health Organization (WHO.) WHO identifies medication errors and unsafe prescribing as the leading avoidable cause of these deaths. Now, the new 'smart' medication label technology could help improve those odds. By giving healthcare providers real-time data, smart labels can reduce mistakes, improve supply chain security and add vital information to monitoring patients' health. What are medication smart labels? Smart labels use radio-frequency identification (RFID:) electromagnetic fields that automatically identify and track tags attached to objects, such as medication containers. But why is this helpful? Using RFID gives hospitals more accurate, real-time data they can use to manage their medication inventory. Like how microchips improve credit and debit card security, RFID helps ensure medications are authentic. Counterfeit medication is a big problem in the developing world, affecting an estimated 10 to 30 percent of prescribed drugs. "With smart labels, you can track the medication all the way through the supply chain for tracing and visibility," says Gary Burns, CEO and co-founder of eAgile, a US-based company providing RFID, internet of things (IoT) and other solutions. How smart labels work A smart label is like a barcode. The provider can gather medication-related information by scanning it. But barcode data is limited, static and easy to counterfeit. Research published in the Online Journal of Nursing Informatics concluded smart labels' benefits include safety, tracking and efficiencies like data accuracy, reduced administration and money savings. With RFID, healthcare practitioners can quickly check a medication's authenticity and access other data without the need for line-of-sight scanning. They can always have an accurate, real-time inventory. "A barcode only gives you the last known scan. The medication could have been used, wasted or disappeared," Burns says. "RFID tags give a record and time-date stamp of what it is, and where and when it was moved." Smart labels are mostly applied to highly controlled drugs such as opioids, critical drugs such as anesthetics and high-value medications like cancer treatments. Jay Williams, Vice President of Business Development at IntelliGuard, a US company that provides RFID technology, says, "[Smart labels] ensure the product is always there when needed." Ending manual errors and inefficiencies RFID technology is not new. Hospitals often use it to track assets, but not widely for drug management. Williams estimates about 10 to 15 percent of hospitals now use RFID for medications. One challenge with smart labels is the manual labor of the inventory process. Traditionally, pharmacists would manually attach each RFID tag to every vial, type the critical information into the computer and then associate the tag with the product in the system. Manual inventories are time-consuming. A 2016 survey of 400 healthcare workers found 78 percent were counting inventory manually in some parts of their supply chain. Some spent nearly one day a week managing their supply chain and inventory. This explains why hospitals have been hesitant to adopt smart labels: Manually associating RFID tags is labor-intensive and prone to human error. Pharma companies are stepping in to solve these challenges, applying smart labels as a service to their customers. Instead of hospitals doing the work, the manufacturers use companies like eAgile to program the drug's serial number and data into the RFID tag, attaching labels on the production line. In September 2020, global pharmaceutical manufacturer Fresenius Kabi began applying smart labels for an anesthetic product. It has smart tags for another 21 medications on its roadmap for 2021. "By embedding the RFID tag in the label, it saves the pharmacy all that inventory receiving time," says Jeanne M. Sirovatka, Director of Continuous Improvement for Fresenius Kabi. Sirovatka notes that a barcode and an RFID tag each take a second to scan. But scanning a hundred barcodes will take a hundred seconds while scanning a hundred RFID tags takes one second because the RFID reader simultaneously scans multiple tags. "And scanning the barcode only provides some product information, not all the supporting information that's critical to patient safety," she adds. This includes, for example, medication expiration date. Eliminating manual data entry also reduces the chance of human error, improving patient safety. A nurse administering a narcotic would usually have to account for each dose manually. Smart labels track the drug's use automatically. "Instead of spending time on inventory, the pharmacy could use that time on clinical activities," says Gwen Volpe, Fresenius Kabi's Director of Medication Technology and Pharmacist. "And there's added safety because we know our data is accurate." IntelliGuard also produces a smart anesthesia station that automatically reads smart labels, preventing distractions in the operating room. "In some cases, anesthesiologists have to turn their back on the patient in the operating room to scan a barcode," says Burns of eAgile. "With the smart anesthesia station, they just access the medication through an RFID-enabled door, and there's a record that the product moved." The need for standards While embedding RFID tags on the manufacturing line solves one challenge, there are other barriers to adoption. Burns believes there needs to be global standardization to overcome cost and interoperability issues. "We need the healthcare medication supply chain to be as low cost as possible," Burns says. "Everything must work together seamlessly – open, worldwide standards need to be followed." Industries like healthcare, retail and logistics have been using GS1 barcode standards worldwide since 1974, enabling barcodes to become the ever-present phenomenon we see today on anything from a pack of gum to cell phone packaging. Global non-profit GS1, with more than two million industry members, sets standards by consensus. There have been GS1 standards for RFID tags for more than a decade, but Fresenius Kabi is the first pharmaceutical company to adopt them to encode smart labels. "Using GS1 standards, rather than proprietary numbers, makes it much easier for hospitals to decode the data," Fresenius Kabi's Gwen Volpe says. Smart labeling's chicken-and-egg problem Even with standards in place, hospitals must still buy universal RFID scanners – they're different than barcode scanners. Volpe's colleague Sirovatka notes it's a chicken-and-egg problem. "As a manufacturer, we want to encourage this technology for use in hospitals because it's more efficient and safer," she says. "But to make it attractive to hospitals, we need more manufacturers supplying pre-embedded labels so hospitals will purchase the scanning equipment." IntelliGuard was the first tech vendor to adopt GS1 standards, making its smart cabinets and anesthesia stations compatible with Fresenius Kabi's labels. Volpe hopes more pharmaceutical and technology manufacturers will follow suit. "Having more medicines pre-tagged with RFID would create a turning point for GS1 to become a standard for hospital inventory," she says. A growing market Standardizing the smart label industry would have results like how consumers currently use credit cards. We can use them anywhere in the world. Merchants can accept cards from different issuers, regardless of country of origin, without needing a scanner for each type of card. The embedded chip makes the transaction more secure. "In the same way, any healthcare provider around the world would be able to scan a standard smart label," says Burns. Market analysis firm Grand View Research says the pharmaceutical tracking segment generated its largest revenue in 2018 in the healthcare RFID market. Whatever the reason for adopting smart labels, those healthcare organizations are paving the way, and others will see the opportunity. The COVID-19 pandemic has affected revenues as many hospitals have stopped elective procedures that help balance the budget. As the industry looks to rebound and innovate, hospitals may find smart labels an appealing way to improve efficiency.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • Cybersecurity training
  • min read
    • Now that organizations rate cyberattack as their biggest risk, cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Technology researchers Gartner found although fewer than 10 percent of organizations had one in 2017, they forecast 35 percent would have a cybersecurity champions program by 2021. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up Organizations often approach cybersecurity culture from the top down, starting at the C-Suite (executive-level managers.) University College London (UCL) surveyed more than 800 employees in one organization and found attitudes toward security varied greatly between the company's divisions. They recommended a bottom-up approach to help get buy-in from people at all levels. The study's co-author and lecturer at UCL's Department of Security and Crime Science Ingolf Becker thinks a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change. This article was published in May, 2020.
smart healthcare internet of medical things

Security in smart healthcare must make a fast recovery

  • Internet of things
  • min read
    • Wilhelm Conrad Röntgen's accidental discovery of the X-ray 125 years ago launched a new era of medical breakthroughs. Without the X-ray, we wouldn't have CT scans and MRIs. Now, the internet of things (IoT,) alongside big data and cloud computing, bring another new age – one of 'smart' healthcare that drastically improves patient care and operational efficiency. These technologies also bring new risks. IoT medical devices connect to each other, to the network and to public internet. Many weren't designed with cybersecurity in mind from the beginning. What might this mean for protecting patient privacy? Poor prognosis for patching and updates Information security veteran and entrepreneur Aviram Jenik believes healthcare faces a perfect storm. He's co-founder and CEO of US-based Beyond Security, a company that assesses and manages network vulnerability. "IoT devices use common web browsing engineers and operating systems. If there's a security hole one of these platforms, the device is vulnerable," he says. Unlike those common platforms, it's harder – sometimes impossible – to patch devices for vulnerabilities. Medical devices tend to have a life cycle of 15 to 20 years, so it's more likely they're running on outdated or unsupported operating systems. "Just because the operating system is at the end of life, it doesn't mean medical manufacturers can swap it out," says John Gomez, CEO of Sensato, a US company providing cybersecurity for medical devices. "It's a quandary for everybody, financially as well as technically." The rise of the internet of medical things The dilemma of weighing the risks vulnerabilities pose against the cost of patching or replacing devices will intensify as the market grows. Healthcare's adoption of the internet of medical things (IoMT) is in its infancy, but moving fast. Healthcare is the third fastest-growing sector for IoT globally, according to market analysis company IDC. Global accounting and audit giant Deloitte forecasts the medical device market will more than triple between 2017 and 2022, reaching a value of 52 billion US dollars. A 2019 IBM study found data breaches are most costly in healthcare, averaging nearly 6.5 million US dollars. Healthcare is a constant target, as seen in incidents like Singapore's health service data breach, affecting 1.5 million patients, or the ransomware attack that disabled IT systems at a French hospital. As IoMT matures, and concerns about security grow, manufacturers need to rethink their approach to design. But what happens in the meantime? Healthcare's IT support sparse and jumbled Looking at data from seven years of running projects with hospitals, Sensato found 60 percent of medical devices are at their end of life with no patches available. Just months before Microsoft support for Windows 7, 2008 and Mobile were to expire, security firm Forescout found 71 percent of Windows devices in healthcare used those outdated operating systems. "They're managing complicated infrastructure with hundreds of servers and applications that communicate with other healthcare organizations," Gomez says. "The problem exponentially grows when adding IoT or IoMT devices," he adds. "IT staff may not even have visibility into them because their management falls to other departments, such as facilities or clinical care." Gomez continues, "You're trying to secure an environment where you don't even know everything because it's not part of the IT department. It's a daunting task to lock down the devices." Healthcare data is attractive to cybercriminals. It has a high dark market value. Healthcare organizations may also be more inclined to pay out in ransomware attacks to avoid disrupting patient care. "Many healthcare organizations are still struggling to understand the risks. Growing device connectivity makes safeguarding data a bigger challenge. Connected medical devices not visible to IT are still visible to attackers," says Oleg Gorobets, Kaspersky's Senior Global Product Marketing Manager. Fast-growing awareness, slow improvement A few years ago, there was little conversation outside of the information security community about the risks of connected devices in healthcare. Todd Weber, Chief Technology Officer for security solutions integrator Optiv Security, notes there's also the mindset among healthcare leaders that hospitals are safe places. "Healthcare organizations have more of an open environment, which makes them vulnerable," Weber says. "It's a huge mindset to get over, to understand that hospitals are being purposefully attacked." But awareness of security problems with IoMT is growing. "For security, we like to say that awareness is 90 percent of the battle, and we have that," Jenik of Beyond Security says. "Everybody involved wants IoMT to be secure, so there's no conflict." Regulation may be helping Regulatory agencies around the world – like the US Food and Drug Administration (FDA) and the China Food and Drug Administration (CFDA) – have started pushing for better security. The FDA publishes security guidelines for manufacturers and issues advisories when vulnerabilities are discovered. This action ripples worldwide because eight of the world's top ten medical device companies are US-based, and about half their sales go offshore. While the FDA guidelines are non-binding, China took a more assertive stance, including mandatory security assessment and registration of networked devices, with fines for those who don't comply. The European Commission brought in sweeping changes in 2020: The Medical Device Regulation (MDR). As the regulation impacts all manufacturers selling in the European Union, it will have global effects. Like many in security, Gomez of Sensato isn't fond of regulation. But in healthcare, he thinks it could catalyze change. "Security in healthcare is behind, so you get a domino effect," he says. "At some point, only regulation or something like a terrorist attack will be a wake-up call." Cybersecurity risk taken to heart Awareness may be growing, but the pace of change in healthcare is slow. "It's for good reason because the stakes are different. You're impacting human lives," Weber says. Potentially vulnerable devices include implantable cardiac defibrillators (ICDs) and pacemakers. These use a wireless communication protocol so physicians can collect data and change therapy. In 2007, US Vice President Dick Cheney had his pacemaker's wireless communication disabled to avoid attack. Still, in 2016, researchers found a "weak adversary" could reverse-engineer a proprietary protocol used in 10 products with inexpensive, off-the-shelf equipment. Attacks on medical devices in the wild So far, cybercriminals haven't taken advantage of known vulnerabilities in cardiac devices, but security experts think risks will grow as many security holes open new opportunities for attack. That open environment in hospitals Weber noted means other weaknesses. Medical equipment is not only easily accessible, it often connects to the same network as hospital computers. "Even with a segregated IoMT network, cyberattackers can use one device to get to others," Kaspersky's Gorobets adds. Is 5G a symptom or treatment? A lot of buzz surrounds the emerging technology 5G, even though it's a few years away from its full potential. Telecommunications multinational Ericsson forecasts cellular IoT connections will quadruple to five billion by 2025. Weber says for security, 5G is another way to attack. "IoT devices will be able to communicate with networks in different ways. With 5G, many become easier to exploit because access is outside corporate governance." But Gomez speculates 5G may improve security. 5G has higher encryption levels because of its greater bandwidth capacity. Some leaders of new hospital projects may decide 5G makes financial sense. They could reduce their wireless infrastructure and use 5G providers for direct cloud access from every device. "5G also allows for software-defined networking, where you can put in place a powerful set of tools and lockdowns for the user and access controls based on traffic," Gomez says. The path to hospital-grade IoMT security Beyond Security's Jenik says after awareness, the next step is to work out how to secure devices. Consumers could also have a voice. "We should all push manufacturers and healthcare providers to meet security standards," he says. Kaspersky's Gorobets says healthcare institutions should take immediate action. "Implement better IT practices, like segmenting networks and controlling access, cybersecurity awareness training and using specialized solutions to lock down what can be secured now." Healthcare providers can't sit and wait for manufacturers to take action. But they can do something now to safeguard patients' lives in the future.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries