Evenchick, Eric

Zanero, Stefano

ZANERO, STEFANO

Archivio istituzionale della ricerca - Politecnico di Milano

Up close and personal: cybersecurity in medical IoT devicesStefano Zanero, Senior Member, IEEE; Eric Evenchick, Member, IEEEAbstract— The growing field of cybersecurity encompassesa wide range of challenges, but we argue that none is morepressing and timely than the rising issue of securing devicesin the so-called Internet of Things. In particular, we reviewthe challenges in securing IoT devices designed to interact ina highly intimate and personal relationship with the humanbody, e.g. medical devices. Their unique features, conjoined toa very high potential impact of any security issue, pose specificchallenges and require novel approaches and research effortsto be solved.I. EXTENDED ABSTRACTThe field of cybersecurity has rapidly risen in status,thanks to the growing perception of the value of the assetsthat are managed, connected and empowered by computersystems and networks, as well as the growing prevalence ofcyber threats (as shown, for instance, in [1]).One of the emerging fields of ICT, the so-called Internetof Things, is gathering a lot of attention from researchers.In a recent report [2], 70% of the tested systems were foundto be vulnerable to different types of attacks.Among the so-called IoT devices, a class which particu-larly deserves attention is the category of medical devices, inparticular implantable ones. These are growing in prevalence,thanks also to the increasing efficiency and low cost ofsmall scale, sense-actuate embedded systems: In 2001, theestimated number of patients in the United States with an im-plantable medical device exceeded 25 million [3]. Thanks toultra-low-power wireless connectivity, and the developmentof a number of lightweight communication protocols, suchsystems belong to a so-called Body Area Network (BAN) [4]and can collect a number of physiological values and provideactuation or treatment based on the measurements.A seminal work exploring the security issues in Im-plantable Medical Devices (IMDs) is [5], and a good reviewof the state of the art of medical device security is offeredin [6]. While the details vary across different types ofdevices and architectures, we can easily identify a numberof challenges in securing this peculiar class of IoT devices:• They are designed to interact in a highly intimate andpersonal relationship with the human body. They requirehigh precision and an impeccable safety record.• They are often necessarily small in scale, and con-strained in power consumption and heat generation.Partially funded by the European Union’s H2020 research and innovationprogramme under the Marie Skłodowska-Curie grant agreement n. 690972.S. Zanero is with the Politecnico di Milano, Milan, Italy (phone: +39 022399 4017; fax: +39 02 2399 3411; e-mail: stefano.zanero@polimi.it).E. Evenchick is with Linklayer Labs, Toronto, Canada (e-mail:eric@evenchick.com).• They may need to connect wirelessly to be effective,and at the same time require appropriate segmentationand insulation from the public Internet• Firmware updates might be unfeasible, or risky.There are also challenges with the mindset of designersand engineers. Safety-critical systems, as well as medicaldevices, are most often tested according to standards andregulatory specifications: Unfortunately, it is well knownthat this type of testing is inapplicable, as of our currentunderstanding, to security engineering, where most testing isnegative (i.e. conducted by trying to break the system). Also,security assessment and design needs a systemic approach,whereby all components of a system are tested together,observing their interactions.One of the main challenges in several IoT domains (in-cluding, for instance, automotive security) is the lack of aperceived threat level to justify the investment of significantresources. While it seems relatively straightforward to pointout the potentially dire consequences of an attack, securityinvestment is a risk-based decision, factoring in the likeli-hood of an event. The perception of the industry is perhapsshifting, but until now it has been a major factor in slowingdown the development and adoption of secure solutions andapproaches.ACKNOWLEDGMENTWe would like to recognize and remember the unique,seminal contributions of Barnaby “Barnes” Jack (1977–2013). An inspiration to many, his bright mind and uniqueskills will always be missed by the security community.REFERENCES[1] “Internet security threat report,” Symantec Corporation, Tech. Rep.Vol. 21, April 2016. [Online]. Available: https://www.symantec.com/content/dam/symantec/docs/reports/istr-21-2016-en.pdf[2] “Internet of things research study,” HP Fortify, Tech. Rep., 2014.[Online]. Available: http://go.saas.hpe.com/fod/internet-of-things[3] A. Pope, F. J. Manning, P. Bouxsein, K. E. Hanna et al., Innovationand Invention in Medical Devices: Workshop Summary. NationalAcademies Press, 2001.[4] S. Ullah, H. Higgins, B. Braem, B. Latre, C. Blondia, I. Moerman,S. Saleem, Z. Rahman, and K. S. Kwak, “A comprehensive survey ofwireless body area networks,” Journal of Medical Systems, vol. 36,no. 3, pp. 1065–1094, 2012.[5] D. Halperin, T. S. Heydt-Benjamin, B. Ransford, S. S. Clark, B. Defend,W. Morgan, K. Fu, T. Kohno, and W. H. Maisel, “Pacemakers andimplantable cardiac defibrillators: Software radio attacks and zero-power defenses,” in 2008 IEEE Symposium on Security and Privacy,May 2008, pp. 129–142.[6] M. Rushanan, A. D. Rubin, D. F. Kune, and C. M. Swanson, “Sok:Security and privacy in implantable medical devices and body areanetworks,” in 2014 IEEE Symposium on Security and Privacy, May2014, pp. 524–539.

Up Close and Personal: Cybersecurity in Medical IoT Devices

https://re.public.polimi.it/retrieve/handle/11311/1007239/163547/embc-zanero.pdf

Up Close and Personal: Cybersecurity in Medical IoT Devices

Abstract

Similar works

Full text

Available Versions

Archivio istituzionale della ricerca - Politecnico di Milano