Beyond pacemakers and implanted devices, healthcare facilities are installing and using IoT wonders like robotic surgical equipment. Developed to assist in surgical procedures from minimally invasive to hard-to-access anatomy, this equipment must be protected at high levels and there must be assurances that it operates correctly when in use. It is critical that these machines are receiving the right data from the right source, to ensure that no mishaps occur. Patients and practitioners must be able to trust that these IoT connected devices will do what they were created and instructed to do by authorized and properly authenticated users. So how do we ensure that these machines are safe?

Enter ‘digital birth certificates’
Today’s medical devices can be plagued by security issues from a number of sources. Security bugs and vulnerabilities can be discovered during manufacture or not until the device is in operation. Medical device vendors may also employ open source (or free) software in order to accelerate time to marketing without seriously considering the security implications, or without keeping an accurate record of that software to aid in future vulnerability management.
To enable a medical device to be authenticated, an embedded "digital birth certificate" forms a means by which trust in the device can be established. Digital birth certificates create a unique, provable identity for each device. Not only do these certificates identify devices, they can also help in defending against remote attacks that attempt to introduce malicious code or alter the purpose of a device during the firmware update process. Much like how PC operating systems check digital signatures of software updates automatically, a certificate from a reliable public key infrastructure can help validate the update before the installation is approved.

Encrypt, encrypt, encrypt
Recent data shows that 95% of hospitals and clinics are adopting digitally transformative technologies including cloud, big data and IoT. This rise in new digital technologies without proper security in place leaves hospitals and their patients open to attacks. Encryption, then, needs to be top of mind to protect high-value patient data, whether it is on-device, in transit, in a local data center, or in the cloud. Encryption, with strong life cycle key management, is a fundamental technology to preserve integrity and confidentiality of data saved on, and shared by, medical devices. Think of encryption as another line of defense in the battle against hackers, making information useless to the attacker if stolen.

Health IT Homepage