Magazine menu Close Magazine menu

safety technologies

Latest stories

what happens internet stops

What if the internet stops?

  • min read
    • We've all fired up our laptop and been stopped in our tracks by an irritating 'no internet connection' message. We've fiddled with the router, called our provider or just waited, and all was well. But what if the internet didn't come back? How would we manage, as people, businesses and nations? Internet outages happen. On June 8, 2021, thousands of websites, including the BBC, New York Times and even the UK government, were offline for up to an hour. Millions experienced disruption because of technical issues at US-based internet infrastructure provider Fastly, who blamed a configuration error. The COVID-19 pandemic revealed our unpreparedness for a global 'black swan event:' An unforeseen event with extreme consequences. With everyday life revolving around an internet connection, are we failing to consider and plan for the end of the internet? Reliance on the online world "We now rely on the internet for everyday tasks, from banking to communicating," said Matt Shanahan, founder and CEO of independent internet service provider Stream Networks. "Businesses and society rely financially on the internet." During the pandemic, billions were forced to rely on internet connectivity to work. Attitudes to working from home changed overnight. Many now question the need for commuting to physical workplaces, with large employers like Amazon, PayPal and Twitter now adopting permanent work from home arrangements. While the information connection offers have transformed society, has it dulled the resourcefulness we'd need to get along without it? "There are many more ways to access the information we need," says Dr. Paul Sant, Head of School of Computer Science and Technology at University of Bedfordshire. "I think we've become tuned to using the internet first and so have lost some information-finding skills." Back to before the internet? The internet's date of birth is said to be March 12, 1989. It's roughly when computer scientist Tim Berners-Lee proposed a 'web' of hypertext documents, viewed with a 'browser.' Rustic as it was, this was the first working internet. The next three decades saw an information revolution. If we didn't have the internet, would we go back to a pre-March 1989 technological world? Bingham continues, "We'll likely see the greatest impact in commerce. Most of our economy uses the internet to transact business. We may have serious problems making or receiving payments, online or in-person. That can have severe economic ramifications." David Savage is Group Executive Chairman at Excelerate Technology, a firm that provides resiliency support for businesses and emergency services if an internet blackout happens. "What matters for our clients is to have internet, or 'always on' connectivity, where coverage is low or non-existent. "Emergency services vehicles must use multiple networks for a reliable internet connection, known as hybrid connectivity. Hybrid connectivity lets the user and on-board devices connect to the internet over cellular, satellite WIFI or any other way." Planning for internet blackouts Fastly's June 2021 blackout was, by the company's admission, a basic mistake. But many nations' defense systems now integrated with internet connectivity could be a focus for cyber warfare. An armed force could use an electromagnetic pulse (EMP) to knock out its enemy's power, preventing them logging on. An 'internet kill switch' has become a topic of discussion for many governments. "Whether it's an EMP blast, a fire or a terrorist attack on infrastructure, the risks go beyond just that of internet connectivity. It could cut off society," says Savage. "Fire caused this scenario in a small town in Australia: People couldn't communicate, withdraw cash or fill up with fuel because payment systems were down." Clive Evans, Chair of the Professional and Technical Forum for merchant navy union Nautilus International, wrote: "There doesn't seem to be any fall back for ships at sea, in the event of no satellites and any warlike operations ... The [UK] government seems to let this slip. If they don't do something about this, there could be communications blackouts with ships." It's an area where Savage and his team provide additional support. His firm provides internet resilience for coastguards and other emergency services along the Dorset coast in Southeast England as part of a UK government-funded project. "It involves 'smart buoys' that can monitor sea and surf conditions, digital signage giving real-time safety information to the public and a network for first responders, lifeboats and Coast Guard in areas that would normally be without connectivity," explains Savage. AI keeping businesses online Cybersecurity has become a big part of business risk management. Protecting a business online means more than restricting unauthorized access: Keeping a business operational. Artificial intelligence (AI) is emerging as a way to keep businesses working. "The major innovation in internet infrastructure is using AI to detect and protect networks from long-term outages. It's an exciting area of development," said Stream Networks' Shanahan. Shanahan explains how Stream is using AI to give business users a more reliable service. "AI can automatically re-route application traffic along back-up paths if a primary path is unresponsive. The potential is huge in pre-empting, detecting and fixing everything from human error to cyberattacks to faults in core infrastructure." Invisible until it stops Dr. Emmanouil Tranos, Reader in quantitative human geography at University of Bristol, has studied the impact the internet has on society. He points out how infrastructure is invisible until it stops working. "We could have had the same discussion years ago about aviation. It was taken as a given that aviation was working – then an Icelandic volcano erupted in 2010, grounding all flights in Europe." If the internet stops, life goes on. There are communities and whole cities around the world with little to no internet connectivity. Just 19 percent of people in Ethiopia have internet access. But generations who grew up with this technology may not know a life without it and could be vulnerable. Dr. Sant argues, "We need to improve awareness and reduce reliance on one way of accessing and finding information. We should be teaching youngsters to be fault-tolerant: There is more than one way of finding information, so teaching to look for alternative sources, so they're not subject to a single-point-of-failure, would be beneficial." A world without the internet may sound novel or even bizarre, but it's worth considering. And it's worth considering before such a 'black swan' blackout happens – when we cannot Google the answer.

Three worker health wins for a successful return to the office

  • min read
    • There's no hope of returning to 'business as usual' anytime soon – Europe's economy is not forecast to return to pre-pandemic levels until 2022. And the pandemic's economic impact has affected countries as unevenly as their recovery prospects. Wherever you are, government health policy plays a critical role in the national recovery and how and when businesses can open their doors. All businesses face hard decisions on how to protect employee health best. If you're in the market for innovative options, here are three ideas to consider. Clearing the office air Advice in many countries says building managers should consider installing plexiglass between workstations and in front of high traffic areas like counters. Dr. Niket Sonpal, Adjunct Assistant Professor of Clinical Medicine at New York's Touro College of Osteopathic Medicine, points out it's not easy to create optimal working conditions. Space is also an issue. "There are a lot of bottlenecks when it comes to entering a corporate building. When you get to the front desk, you have to scan in or show ID, so social distancing gets diminished." Even when circumstances are not ideal, there's a lot businesses can do. Organizations who own their building could upgrade the heating, ventilation and air-conditioning (HVAC) systems to hospital-grade standards. High-efficiency filters and Ultraviolet germicidal irradiation (UVGI) disinfection can limit virus spread, although it's challenging to add UVGI to an existing system. Air filtering can be highly effective with the right type of filter. High-efficiency particulate absorbing (HEPA) air filters can capture over 99 percent of virus particles. These filters, used in labs and industrial clean rooms, need higher air pressure than typical commercial systems. Using the Minimum Efficiency Reporting Value (MERV) scale to measure filter effectiveness, trade bodies like the American Society of Heating, Refrigerating and Air-Conditioning Engineers recommend air filters with a MERV 13 rating or higher. The World Health Organization (WHO) also recommends some less costly steps to thwart coronavirus spread. But in its November 2020 report, the European Centre for Disease Prevention and Control notes many countries recommend building owners run their HVAC systems continuously, including evenings and weekends. Reduced working hours suit businesses and staff If your business is facing having to let some staff go, make sure you've considered all the options first – for your company's good and the wellbeing of your staff. German businesses have been encouraged to reduce workers' hours rather than making them redundant, with the government making up 60 percent of their pay for their lost hours. People are not forced onto welfare, and employers can avoid expensive, time-consuming hiring when they restart operations. Olaf Scholz, Germany's Financial Minister and Vice-Chancellor, described the scheme, known as Kurzabeit, as "Germany's greatest economic and socio-political act." While most countries don't have this kind of state support available, businesses could still consider whether they can keep employees on the payroll but reduce their hours. On top of not having to re-hire when business picks up, Employees in challenging, salaried jobs on average wish they had the option to work fewer hours. Reduced working hours are also linked with higher productivity and improved employee psychological wellbeing. Educate carefully around vaccines and testing As vaccine distribution rolls out globally, WHO and national health organizations like the US's Food and Drug Administration (FDA) and the Centers for Disease Control and Prevention (CDC) decide who goes first. According to Dr. Sonpal, "A vaccine doesn't mean that we're in the clear because we don't know for how long it's going to be effective." Organizations may be able to sponsor COVID-19 vaccination clinics, like some sponsor flu vaccination clinics. Sonpal warns, "When people get the vaccine, they need to be educated that this doesn't mean you can run around without a mask. You're not protected until you have a concentration of antibodies and their protective properties have kicked in. It's going to have to be well planned and carefully crafted for every corporate structure that's going to do this." Sonpal is not keen on using tests to determine whether someone should be allowed back to work. "The problem with tests is that it's all dependent upon risks, exposures and time. It's very pricey and not accurate. Tests are useful to determine who's positive. However, if you're negative, that doesn't necessarily mean that you weren't exposed and are not incubating. Continuous testing doesn't make sense." Finding the best of both worlds Sonpal thinks bringing workers back requires a hybrid model with people working in the office and remotely. In the building, take temperatures and have strict screening in which workers are asked to verify they don't have any symptoms, haven't been exposed to anybody with symptoms and haven't traveled. He goes on to say, "Prudence is key. 2020 has shown people can work remotely. To bring people back may seem like a good idea to get the gears of industry moving, but it could also cause more damage to the business." Be conservative and remain vigilant, he advises. Scale things back and accept that for now, we still don't have all the answers.
non surgical technologies

Surgery has risks. Medication has side effects. Is technology healthcare’s ‘third way?’

  • min read
    • In 2017, a research team from a Finnish university did a controlled trial on a common shoulder surgery technique. One group of patients had 'sham' surgery, where the surgeon simply made an incision then stitched it up again, while another group received the actual surgery. The team found the real surgery performed no better than sham surgery. This was no obscure operation being performed by rogue surgeons: "Nearly 21,000 decompression surgeries [were] done in the UK every year, and ten times that many in the United States," said adjunct professor Simo Taimela, University of Helsinki research director. Their research findings highlight an alarming fact: As many as half of common operations are not supported by reliable evidence that they work. While some surgeons still perform this operation (the placebo effect gives patients a better chance of recovery than no treatment,) is it rational to expose these patients to the risks of surgery? One in six patients develop post-surgical complications, and one in 35 patients die after surgery worldwide. The people that died might've been already seriously ill, but then again, the most common post-surgery complication is something preventable: Infection. Surgery is not the only way to treat illness that carries inherent risk. For the many benefits, medications come with downsides. If it's effective, it probably has side effects too. Side effects and their likelihood depends on the medication, but in general, they range from tolerable but annoying (rashes, dry mouth, itching) to life-changing (seizures, migraines) to life-threatening (allergic reaction, cytokine storm.) Technology is increasingly providing ways to prevent and treat illness that mean patients don't need to take the risk of surgery or face medication side effects. These recent examples show technology helping us live longer, more pain-free lives. Brain surgery without scalpels Stereotactic radiosurgery uses light beams to target cancer cells in brain tumors without making any incisions. The light beams break down malignant cell DNA and create an inhospitable environment for the tumor. For some cancers, it's as effective as surgery, but without the pain and recovery time. TED Medical guide to stereotactic radiosurgery As well as brain tumors, the technology has been successfully used on some lung, pancreatic and liver cancers. It treats animal cancers too. Unashamedly evoking visions of the future with its spaceship-like design, gyroscopic radiosurgery further refines the technique, using gyroscopic motion to more accurately direct light beams at the tumor. Flagging errors in prescribing medicines Doctors are busy. Errors in prescribing medication – such as wrong dosage or not noticing a patient's medication allergy – are behind a surprising number of hospital admissions. Around 1 in 10 hospital prescriptions and 1 in 20 general practice prescriptions contain potentially harmful errors. After deep-diving into the reasons behind prescribing failures and what other countries have tried to improve practice, the UK started implementing software that's making a big difference. Pharmacist-led Information Technology Intervention (PINCER) scans patient records and flags risky prescribing. Since its introduction in 2018, risky prescribing has fallen by nearly 15 percent. The biggest successes of PINCER might be ahead, with roll-outs where most prescribing errors happen: On hospital wards and in emergency departments. Diagnosis and treatment by artificial intelligence In 2019, The Lancet published a systematic review and meta-analysis (grouping data from many studies to make for more dependable analysis) showing artificial intelligence (AI) has become reliable enough to be considered an accurate source of diagnosis. This may mean more accurate and earlier diagnoses, avoiding the need for surgery or medication. Pharmaceutical company Bayer is also working on software that uses AI to help diagnose complex and rare conditions and develop medications to treat them. The software could help identify more quickly whether medication works. "We're looking at how we can identify the right patients and sites to run our clinical trials. We would be able to run shorter studies and show where the medication is the right one for those patients earlier," said Bayer's head of AI projects, Angeli Moeller. Some AI-enabled diagnostic innovations haven't gone so well. Since 2017, the UK's National Health Service (NHS) has trialed an AI-enabled chatbot and remote consultation app, GP at Hand. Its implementation was plagued with claims that the app's AI was making mistakes. One doctor wrote to the British Medical Journal (BMJ) to point out that safety and effectiveness claims were based on shaky evidence. To answer concerns, one council commissioned an independent study. The study found the app was viewed positively by users and doctors but was unlikely to benefit the most vulnerable patients because users tended to be young, affluent and in good health. High numbers of users were choosing to stop using the service, but one potentially positive outcome: When connecting with patients through the app, GPs were less likely to prescribe medication. With known over-prescribing problems around antibiotics and antidepressants, less prescribing could be a good thing for our health. 'Delocalizing' care with technology COVID-19 has meant many are now familiar with over-the-phone or video consultations with doctors and specialists. A raft of innovations alongside this shift are helping make remote patient care more effective. One example we recently covered is the StethoMe digital stethoscope. It lets doctors receive digital waveforms of a patient's breathing and heartbeat over the internet. Then there's Ochsner's iHealth Ease Cuff, a blood pressure-measuring arm cuff that connects to a patients' smartphone over Bluetooth, sending results straight to their doctor. The theory was that frequent monitoring and feedback would help patients manage their condition better and let professionals intervene in problems earlier. Trial results seem to back this up, with double the number of patients in a group that received the cuff achieving their health goals compared with the group receiving conventional care. Recently approved by the US's Food and Drug Administration (FDA,) Clarius technology enables faster ultrasound scanning in a wider range of settings. The wireless ultrasound scanner connects to an app on tablet or smartphone, making high-quality ultrasound more portable. Paramedics and non-specialists can transmit live scans to a specialist who can review them in real time. The app also uses AI to adjust scanning parameters, reducing user error and the time taken to get results. All this means faster, more accurate diagnosis, and no need to take the patient to the equipment. There is constant development of new technologies that can improve patient health without surgery or medication. Greater investment in healthcare research and innovation thanks to COVID-19 may further speed the arrival of these new ways of doing medicine at a hospital or clinic near you. In the laudable rush to do everything we can to save and improve lives, we must not lose sight of the data security and privacy implications of these new technologies. Technologies often do most good in the hands of people who've traditionally had less access to healthcare, like older patients and those in isolated areas. This, in itself, makes the need for cybersecurity awareness among patients and practitioners all the more acute. There is no need to hold back innovation, but there is a need to involve the right people in testing and design, and when it comes to cybersecurity, educate, educate, educate.
motorsports business

Win at business leadership with wisdom from motorsport racing

  • min read
    • The more I speak with business leaders in technology, the more common ground I find with my work, as a racing driver for AF Corse (the Ferrari privateer team), specializing in endurance races of up to 24 hours. I'd like to tell you about the preparation, technology and mindset I use to win races. I hope you'll find it useful in your work too. How to win depends on the kind of race you're in Before I started endurance racing, I first raced in sprint. With sprint racing, you must give 100 percent all the time. In endurance, with just one mistake, your plan is gone. For the first part, you have to stick to the race strategy agreed with your crew. Then once you're through the night – the most challenging time – and if your team decides it's right, you attack at 100 percent. Prepare for success I'm an Italian from Rome, and I'm superstitious. When I put on my racing shoes, it's always the left then the right. Thirty minutes before the race, I meditate. I listen to music that means something to me; classic tunes like The Final Countdown get me in the zone! I use disco for adrenaline, letting my heart rate move up with the beats, then channeling my breath to reduce my heartbeat. I also use visualization. I imagine I'm in the car and plan what I'll do. I'll envision finishing the perfect race. To think of my success as the success of the team gives me strength. Teamwork wins the race We learn to speak the same language. Once I'm in the car, my team makes me stronger, safer and more focused because we must all perform at our peak. In an endurance race, once you're in the car, you know you're doing your best, but you may not be the fastest. The drivers ahead may be on new tires. Getting information from the crew tells you how you're performing. Share, share and share with your team My team and I share our hopes and fears. All the time, we're sharing ideas about how to make the next race better. We don't just win races because of superb performance. Analyzing details matters. Not noticing a small problem can cause you to lose. Everyone can play a part, even the cook in the kitchen may notice if someone's sick. It's happened – a food allergy turns into a crisis during the race. Don't just use technology, use technology well It's a marriage: the technology and the team need to work together. The technology helps balance performance and risk. If you're too slow, it's safe, but you won't win. Too fast, you may crash. If something changes, you need to manage and adapt to succeed. You can work with the engineer to improve the technology step by step, but it's got to be used in the right way. We raise our game by managing these steps. Treat your data like a diamond In our industry, competition is fierce. To win, you have to try new technologies that could make you faster and safer. The car's data is a diamond, so data theft is always a risk. If someone hacks our data records or email conversations, they could use that information for advantage. Even the simulator drivers use at home holds essential data about how we're preparing. It's a relief to know Kaspersky is always protecting Ferrari's data. Trust your team members to do their job My crew is like my second family. We're real friends. We share our hopes and fears. Working closely together, we share pressure but also our achievements. We understand each other. Together, we achieve more. Everyone in the team is super professional and highly skilled. You need to understand the potential of each person and trust their expertise. I never say to anyone, "do this" or "do that." I explain what I want to achieve and let them find the best way. They know how to do their job. If they're involved, they'll give more. To reduce risk, ask questions, follow the plan and adapt For me, there's only one risk – ruining the race. I can't think about crashing or ending up in a hospital. If I start to feel fear, I ask my crew for the information I need that will give me confidence. Then I think about our plan and our goals. Focusing on these reduces pressure. There's been significant safety progress in motorsports. If one thing goes wrong, you'll probably be OK. But if two things fail, you could be in trouble. When you crash, or there's a fire, you need to stay calm and follow the drill. We train on how to respond to problems, but not everything can be simulated. Two years ago, the engine ignited when I stopped in the grass. I tried to get out, but the plastic to open the door was on fire, so I had to get out through the other side and kick. You have to adapt. Data analysis shows the way forward We use data to raise our game. We use it to develop our plan. There's also real-time data on my car's dashboard. It allows me to make quick decisions when I need to. My dashboard is vital when radio communication fails. It's enough information that I can keep going. The engineer can see what's happening, but they may need you to check in the car and from your gut feeling. We're in constant contact. If something doesn't work, they tell you how to check it on your dashboard, like the temperature of your exhaust. You have to multitask while you're racing! After each race, we have a technical meeting. We analyze the race performance and decide what to do differently, for example, upgrading software. If the race hasn't gone our way, the mood may be tense and silent. But when we know the solution, the mood improves. It gives us hope we will make the next race safer and better.
picking right tech

When there’s too much choice in tech, get your focus right

  • min read
    • We have too much tech and too much choice. Many of tech's challenges are in choosing the product, and only afterward realizing its limitations and the consequences of our choice. I understood this only recently, after working in tech nearly 40 years. I don't know why it's taken me so long to make this brilliant deduction. I enjoy helping others make these choices. Almost every day, I'm either writing, researching or discussing tech choices for others. But just as the shoemaker's children go barefoot, my own tech choices are often fraught with indecision, or worse, no decision. It all rests on human foibles Yesterday, I was on a phone call with a friend who is as technical as they come. He helped create some of the internet's early protocols – ways transferring data between networks that more or less create the internet. We were commiserating about the quirkiness of the video conferencing application Webex when trying to support a hundred-person conference call. It's fine for the video conference itself. The video and audio quality are usually solid. But the 'soft support' rests on the foibles of how humans use tech, like holding a practice session for the conference, notifying everyone of the call and sending out the slide deck. It's real work to explain what to do to organizers and how to create standards to make the call go smoothly. Learn from the 1980s' portable PC wars Let's draw a dotted line back to when I worked in the bowels of the end-user IT support department of Gigantic Insurance in the early 1980s. We bought PCs by the truckload to place on the desks of thousands of IT staff who, until then, had a telephone and, if they were lucky, a mainframe terminal. We bought IBM PCs because back then because that was the only choice for corporate USA. Then Compaq came along with something IBM didn't yet have: a portable PC. Well, sort of portable. It was enormous. It weighed about 30 pounds (14 kilograms) and didn't quite fit into airplane overhead lockers. When Compaq announced their portable PC, selling for more than $5000, our executives felt conflicted. Our IBM sales reps, who had invested many years in golf games with them, were trying to convince us to wait for a year until the IBM portable PC would come to market. But once we got our hands on the IBM prototype, we could see the Compaq was superior. It was already available. It was lighter, smaller and ran the same apps. We recommended Compaq and started buying them in droves. That was the start of the 'clone wars' that unleashed a new era of technology choices on the corporate world. By the time IBM finally came out with their portable PC, Compaq had improved theirs again, so they kept ahead of IBM. It's why we get frustrated when we finally choose our technology and then live with the consequences. Knowing which questions to ask How does this apply to buying business cybersecurity products? Many of us are still looking at the wrong things when deciding what to buy, or don't know which questions to ask. Know what problem you want to solve, and you'll choose your tech differently. Here are some common examples. Have you picked an email encryption product or VPN based on something other than ease of use? Don't be surprised when your staff rebel against using them. Are you running regular phishing awareness programs and cybersecurity training across your business? Phishing is one of the most destructive attacks, and getting users to understand their behavior is risky is the best prevention. Have you recently tested your disaster recovery procedures to find out why your backups don't protect key data elements? Don't wait until you have a ransomware situation to find out you missed a collection of files. Spend the time now to find these and ensure they're well protected. Can you find out if your cloud storage is secure enough? Do you even know which clouds you're using? Do the hard work now rather than waiting for something bad to happen. Have you examined your whole software supply chain? It's easy to overlook a few spots and then suffer data loss, ransomware or denial of service attacks. You might find personal Github pages, or resellers running tools whose security you can't easily verify. The time to work this out is now. Going beyond the specs means taking a step back and throwing out assumptions. Before you start looking at solutions, do the hard work of understanding the problem you really need to solve. This article reflects the opinion of the author.
smart healthcare internet of medical things

Security in smart healthcare must make a fast recovery

  • min read
    • Wilhelm Conrad Röntgen's accidental discovery of the X-ray 125 years ago launched a new era of medical breakthroughs. Without the X-ray, we wouldn't have CT scans and MRIs. Now, the internet of things (IoT,) alongside big data and cloud computing, bring another new age – one of 'smart' healthcare that drastically improves patient care and operational efficiency. These technologies also bring new risks. IoT medical devices connect to each other, to the network and to public internet. Many weren't designed with cybersecurity in mind from the beginning. What might this mean for protecting patient privacy? Poor prognosis for patching and updates Information security veteran and entrepreneur Aviram Jenik believes healthcare faces a perfect storm. He's co-founder and CEO of US-based Beyond Security, a company that assesses and manages network vulnerability. "IoT devices use common web browsing engineers and operating systems. If there's a security hole one of these platforms, the device is vulnerable," he says. Unlike those common platforms, it's harder – sometimes impossible – to patch devices for vulnerabilities. Medical devices tend to have a life cycle of 15 to 20 years, so it's more likely they're running on outdated or unsupported operating systems. "Just because the operating system is at the end of life, it doesn't mean medical manufacturers can swap it out," says John Gomez, CEO of Sensato, a US company providing cybersecurity for medical devices. "It's a quandary for everybody, financially as well as technically." The rise of the internet of medical things The dilemma of weighing the risks vulnerabilities pose against the cost of patching or replacing devices will intensify as the market grows. Healthcare's adoption of the internet of medical things (IoMT) is in its infancy, but moving fast. Healthcare is the third fastest-growing sector for IoT globally, according to market analysis company IDC. Global accounting and audit giant Deloitte forecasts the medical device market will more than triple between 2017 and 2022, reaching a value of 52 billion US dollars. A 2019 IBM study found data breaches are most costly in healthcare, averaging nearly 6.5 million US dollars. Healthcare is a constant target, as seen in incidents like Singapore's health service data breach, affecting 1.5 million patients, or the ransomware attack that disabled IT systems at a French hospital. As IoMT matures, and concerns about security grow, manufacturers need to rethink their approach to design. But what happens in the meantime? Healthcare's IT support sparse and jumbled Looking at data from seven years of running projects with hospitals, Sensato found 60 percent of medical devices are at their end of life with no patches available. Just months before Microsoft support for Windows 7, 2008 and Mobile were to expire, security firm Forescout found 71 percent of Windows devices in healthcare used those outdated operating systems. "They're managing complicated infrastructure with hundreds of servers and applications that communicate with other healthcare organizations," Gomez says. "The problem exponentially grows when adding IoT or IoMT devices," he adds. "IT staff may not even have visibility into them because their management falls to other departments, such as facilities or clinical care." Gomez continues, "You're trying to secure an environment where you don't even know everything because it's not part of the IT department. It's a daunting task to lock down the devices." Healthcare data is attractive to cybercriminals. It has a high dark market value. Healthcare organizations may also be more inclined to pay out in ransomware attacks to avoid disrupting patient care. "Many healthcare organizations are still struggling to understand the risks. Growing device connectivity makes safeguarding data a bigger challenge. Connected medical devices not visible to IT are still visible to attackers," says Oleg Gorobets, Kaspersky's Senior Global Product Marketing Manager. Fast-growing awareness, slow improvement A few years ago, there was little conversation outside of the information security community about the risks of connected devices in healthcare. Todd Weber, Chief Technology Officer for security solutions integrator Optiv Security, notes there's also the mindset among healthcare leaders that hospitals are safe places. "Healthcare organizations have more of an open environment, which makes them vulnerable," Weber says. "It's a huge mindset to get over, to understand that hospitals are being purposefully attacked." But awareness of security problems with IoMT is growing. "For security, we like to say that awareness is 90 percent of the battle, and we have that," Jenik of Beyond Security says. "Everybody involved wants IoMT to be secure, so there's no conflict." Regulation may be helping Regulatory agencies around the world – like the US Food and Drug Administration (FDA) and the China Food and Drug Administration (CFDA) – have started pushing for better security. The FDA publishes security guidelines for manufacturers and issues advisories when vulnerabilities are discovered. This action ripples worldwide because eight of the world's top ten medical device companies are US-based, and about half their sales go offshore. While the FDA guidelines are non-binding, China took a more assertive stance, including mandatory security assessment and registration of networked devices, with fines for those who don't comply. The European Commission brought in sweeping changes in 2020: The Medical Device Regulation (MDR). As the regulation impacts all manufacturers selling in the European Union, it will have global effects. Like many in security, Gomez of Sensato isn't fond of regulation. But in healthcare, he thinks it could catalyze change. "Security in healthcare is behind, so you get a domino effect," he says. "At some point, only regulation or something like a terrorist attack will be a wake-up call." Cybersecurity risk taken to heart Awareness may be growing, but the pace of change in healthcare is slow. "It's for good reason because the stakes are different. You're impacting human lives," Weber says. Potentially vulnerable devices include implantable cardiac defibrillators (ICDs) and pacemakers. These use a wireless communication protocol so physicians can collect data and change therapy. In 2007, US Vice President Dick Cheney had his pacemaker's wireless communication disabled to avoid attack. Still, in 2016, researchers found a "weak adversary" could reverse-engineer a proprietary protocol used in 10 products with inexpensive, off-the-shelf equipment. Attacks on medical devices in the wild So far, cybercriminals haven't taken advantage of known vulnerabilities in cardiac devices, but security experts think risks will grow as many security holes open new opportunities for attack. That open environment in hospitals Weber noted means other weaknesses. Medical equipment is not only easily accessible, it often connects to the same network as hospital computers. "Even with a segregated IoMT network, cyberattackers can use one device to get to others," Kaspersky's Gorobets adds. Is 5G a symptom or treatment? A lot of buzz surrounds the emerging technology 5G, even though it's a few years away from its full potential. Telecommunications multinational Ericsson forecasts cellular IoT connections will quadruple to five billion by 2025. Weber says for security, 5G is another way to attack. "IoT devices will be able to communicate with networks in different ways. With 5G, many become easier to exploit because access is outside corporate governance." But Gomez speculates 5G may improve security. 5G has higher encryption levels because of its greater bandwidth capacity. Some leaders of new hospital projects may decide 5G makes financial sense. They could reduce their wireless infrastructure and use 5G providers for direct cloud access from every device. "5G also allows for software-defined networking, where you can put in place a powerful set of tools and lockdowns for the user and access controls based on traffic," Gomez says. The path to hospital-grade IoMT security Beyond Security's Jenik says after awareness, the next step is to work out how to secure devices. Consumers could also have a voice. "We should all push manufacturers and healthcare providers to meet security standards," he says. Kaspersky's Gorobets says healthcare institutions should take immediate action. "Implement better IT practices, like segmenting networks and controlling access, cybersecurity awareness training and using specialized solutions to lock down what can be secured now." Healthcare providers can't sit and wait for manufacturers to take action. But they can do something now to safeguard patients' lives in the future.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries