Magazine menu Close Magazine menu

internet of things

Latest stories

river privacy predictions 2020

Never the same river: Predictions for privacy’s next decade

  • min read
    • Your phone. Your smartwatch. Your smart home. Your data is now everywhere. Collecting personal data makes services better for the user, but over the past decade, multiple cases have demonstrated the risk. In privacy, you never step in the same river twice. Concerns, threats and priorities are always changing. What privacy hazards will we see in the coming decade, and how should your business prepare? 1.  Governments will allow themselves to access more of citizens' data It's already happened, but in the next decade, governments around the world will adopt laws that let them access more of citizens' data. They may cite many reasons, including terrorism, instability and the already widespread use of the same data by business. 2.  The gap between regulation and the real world will only grow While the rationale for it is clear, enhanced access to people's data carries risks, such as unauthorized access and leaking information. It will be a big challenge for regulators to keep adapting regulations at the same speed as new technologies come into play. Companies have been slow to change how they're dealing with user data. The only recent significant change has been asking users to consent to how the company will use their data, now mandatory in many countries. We don't see any strong trend toward adding security to protect sensitive user data. There's already a growing gap between regulation and real-world practice, making regulation seem toothless. 3.  Counter-tools will fuel a privacy cyberbattle The trends I've already mentioned will encourage innovators to develop privacy protection technologies. The tech-savvy will adopt these, and more technologies will arise to circumvent them. It will be a privacy cyberbattle. Meanwhile, users will become more proactive about their privacy. There'll be high demand for password managers, virtual private networks (VPNs) and tokens (automatically generated codes) for two-factor authentication (2FA). However, protection mechanisms like 2FA tokens and password managers are just at the endpoint. Attacks and misuse are often at the backend. These tools protect the local environment, but they don't protect against attacks and abuse of systems such as the cloud. And as cloud-based tools go from being leading-edge to indispensable, all employees will need to understand where the risks are. VPNs protect against some data collection (real IP-addresses, geolocation) but don't protect against users voluntarily sharing data with services like Google and Facebook. 4. We'll keep getting fooled by fun Cybercriminals can use this strategy to attack businesses, targeting employees for personal information, and using it to access business systems and data. 5. We'll see new attacks on democratic process and  protections against disinformation These attacks have been with us for many years, and there's no reason for them to stop. Technology for fake visual and audio IDs already exist, and with the political pendulum of a US presidential election, these will bring undesired attention and abuse from multiple parties. 6. Internet of Things (IoT) vendors will scale up security investment The last few years have been turbulent for the cybersecurity industry. IoT-specific malware, data breaches and disinformation campaigns across the globe have all been challenging. This activity will push vendors to a new level of collaboration for the sake of security. Amazon, Apple, Google and the Zigbee Alliance have announced they're creating a working group to develop and promote a royalty-free connectivity standard. This will increase compatibility among IoT products and embed fundamental security. I hope others will follow their lead. All in all, we're looking at an interesting decade ahead for privacy. The challenges will be significant. Businesses will be a key player in securing the privacy of both their employees' and customers' data. Let's hope solutions from innovators follow fast on the heels of each new threat. In the meantime, by putting in place adequate, regular privacy training and cyberthreat education for all employees, any business can be part of the solution.
smart healthcare internet of medical things

Security in smart healthcare must make a fast recovery

  • min read
    • Wilhelm Conrad Röntgen's accidental discovery of the X-ray 125 years ago launched a new era of medical breakthroughs. Without the X-ray, we wouldn't have CT scans and MRIs. Now, the internet of things (IoT,) alongside big data and cloud computing, bring another new age – one of 'smart' healthcare that drastically improves patient care and operational efficiency. These technologies also bring new risks. IoT medical devices connect to each other, to the network and to public internet. Many weren't designed with cybersecurity in mind from the beginning. What might this mean for protecting patient privacy? Poor prognosis for patching and updates Information security veteran and entrepreneur Aviram Jenik believes healthcare faces a perfect storm. He's co-founder and CEO of US-based Beyond Security, a company that assesses and manages network vulnerability. "IoT devices use common web browsing engineers and operating systems. If there's a security hole one of these platforms, the device is vulnerable," he says. Unlike those common platforms, it's harder – sometimes impossible – to patch devices for vulnerabilities. Medical devices tend to have a life cycle of 15 to 20 years, so it's more likely they're running on outdated or unsupported operating systems. "Just because the operating system is at the end of life, it doesn't mean medical manufacturers can swap it out," says John Gomez, CEO of Sensato, a US company providing cybersecurity for medical devices. "It's a quandary for everybody, financially as well as technically." The rise of the internet of medical things The dilemma of weighing the risks vulnerabilities pose against the cost of patching or replacing devices will intensify as the market grows. Healthcare's adoption of the internet of medical things (IoMT) is in its infancy, but moving fast. Healthcare is the third fastest-growing sector for IoT globally, according to market analysis company IDC. Global accounting and audit giant Deloitte forecasts the medical device market will more than triple between 2017 and 2022, reaching a value of 52 billion US dollars. A 2019 IBM study found data breaches are most costly in healthcare, averaging nearly 6.5 million US dollars. Healthcare is a constant target, as seen in incidents like Singapore's health service data breach, affecting 1.5 million patients, or the ransomware attack that disabled IT systems at a French hospital. As IoMT matures, and concerns about security grow, manufacturers need to rethink their approach to design. But what happens in the meantime? Healthcare's IT support sparse and jumbled Looking at data from seven years of running projects with hospitals, Sensato found 60 percent of medical devices are at their end of life with no patches available. Just months before Microsoft support for Windows 7, 2008 and Mobile were to expire, security firm Forescout found 71 percent of Windows devices in healthcare used those outdated operating systems. "They're managing complicated infrastructure with hundreds of servers and applications that communicate with other healthcare organizations," Gomez says. "The problem exponentially grows when adding IoT or IoMT devices," he adds. "IT staff may not even have visibility into them because their management falls to other departments, such as facilities or clinical care." Gomez continues, "You're trying to secure an environment where you don't even know everything because it's not part of the IT department. It's a daunting task to lock down the devices." Healthcare data is attractive to cybercriminals. It has a high dark market value. Healthcare organizations may also be more inclined to pay out in ransomware attacks to avoid disrupting patient care. "Many healthcare organizations are still struggling to understand the risks. Growing device connectivity makes safeguarding data a bigger challenge. Connected medical devices not visible to IT are still visible to attackers," says Oleg Gorobets, Kaspersky's Senior Global Product Marketing Manager. Fast-growing awareness, slow improvement A few years ago, there was little conversation outside of the information security community about the risks of connected devices in healthcare. Todd Weber, Chief Technology Officer for security solutions integrator Optiv Security, notes there's also the mindset among healthcare leaders that hospitals are safe places. "Healthcare organizations have more of an open environment, which makes them vulnerable," Weber says. "It's a huge mindset to get over, to understand that hospitals are being purposefully attacked." But awareness of security problems with IoMT is growing. "For security, we like to say that awareness is 90 percent of the battle, and we have that," Jenik of Beyond Security says. "Everybody involved wants IoMT to be secure, so there's no conflict." Regulation may be helping Regulatory agencies around the world – like the US Food and Drug Administration (FDA) and the China Food and Drug Administration (CFDA) – have started pushing for better security. The FDA publishes security guidelines for manufacturers and issues advisories when vulnerabilities are discovered. This action ripples worldwide because eight of the world's top ten medical device companies are US-based, and about half their sales go offshore. While the FDA guidelines are non-binding, China took a more assertive stance, including mandatory security assessment and registration of networked devices, with fines for those who don't comply. The European Commission brought in sweeping changes in 2020: The Medical Device Regulation (MDR). As the regulation impacts all manufacturers selling in the European Union, it will have global effects. Like many in security, Gomez of Sensato isn't fond of regulation. But in healthcare, he thinks it could catalyze change. "Security in healthcare is behind, so you get a domino effect," he says. "At some point, only regulation or something like a terrorist attack will be a wake-up call." Cybersecurity risk taken to heart Awareness may be growing, but the pace of change in healthcare is slow. "It's for good reason because the stakes are different. You're impacting human lives," Weber says. Potentially vulnerable devices include implantable cardiac defibrillators (ICDs) and pacemakers. These use a wireless communication protocol so physicians can collect data and change therapy. In 2007, US Vice President Dick Cheney had his pacemaker's wireless communication disabled to avoid attack. Still, in 2016, researchers found a "weak adversary" could reverse-engineer a proprietary protocol used in 10 products with inexpensive, off-the-shelf equipment. Attacks on medical devices in the wild So far, cybercriminals haven't taken advantage of known vulnerabilities in cardiac devices, but security experts think risks will grow as many security holes open new opportunities for attack. That open environment in hospitals Weber noted means other weaknesses. Medical equipment is not only easily accessible, it often connects to the same network as hospital computers. "Even with a segregated IoMT network, cyberattackers can use one device to get to others," Kaspersky's Gorobets adds. Is 5G a symptom or treatment? A lot of buzz surrounds the emerging technology 5G, even though it's a few years away from its full potential. Telecommunications multinational Ericsson forecasts cellular IoT connections will quadruple to five billion by 2025. Weber says for security, 5G is another way to attack. "IoT devices will be able to communicate with networks in different ways. With 5G, many become easier to exploit because access is outside corporate governance." But Gomez speculates 5G may improve security. 5G has higher encryption levels because of its greater bandwidth capacity. Some leaders of new hospital projects may decide 5G makes financial sense. They could reduce their wireless infrastructure and use 5G providers for direct cloud access from every device. "5G also allows for software-defined networking, where you can put in place a powerful set of tools and lockdowns for the user and access controls based on traffic," Gomez says. The path to hospital-grade IoMT security Beyond Security's Jenik says after awareness, the next step is to work out how to secure devices. Consumers could also have a voice. "We should all push manufacturers and healthcare providers to meet security standards," he says. Kaspersky's Gorobets says healthcare institutions should take immediate action. "Implement better IT practices, like segmenting networks and controlling access, cybersecurity awareness training and using specialized solutions to lock down what can be secured now." Healthcare providers can't sit and wait for manufacturers to take action. But they can do something now to safeguard patients' lives in the future.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries