Thanks to John Yun, Head of Marketing at ZingBox for sharing his insights on the needs of IoT security in healthcare:
Q: How are you involved in healthcare IoT?
A: ZingBox was founded to specifically address the security needs of IoT devices. The healthcare vertical, in particular, relies heavily on IoT devices with multiple connected medical devices deployed per patient bed. The ramifications of malfunction, hijack, or malicious manipulation of these devices can obviously have catastrophic consequences. Many healthcare organizations are exploring ways to secure their connected medical devices with a nonintrusive security approach.
Q: What are the keys to a successful healthcare IoT security strategy?
A: A successful healthcare IoT security strategy must be reimagined from the ground up taking into consideration the unique characteristics of connected medical devices. Carrying over assumptions from the IT security approach is the highest cause of failure of any IoT security strategy. For example, typical vulnerability scanning solutions deployed for IT devices when aimed at IoT devices can often render the device inoperative. Any attempt to install AV engines or other clients can cause malfunctions. Simply blocking what appears to be unrelated ports or protocols at the firewall can also cause unexpected results. A successful strategy must start with the assumption that the best approach is to start with an out-of-band solution ensuring no operational impact of the device. The security capabilities must also be architected to be non-disruptive every step of the way.
Q: How has healthcare IoT security changed in the past year?
A: The past year brought a new level of awareness and focus on IoT security. Starting from the Mirai attack which turned many IoT devices to bots, the recent ransomware and wiperware turned IoT devices into very expensive paper weights. What had been considered as a possible future scenario became very real in a matter of months.
Q: What are the technical solutions for healthcare IT, especially with respect to IoT?
A: Applying traditional IT security solutions such NAC or AV often fails since these devices cannot support end-point clients or agents. The only security solution applicable for IoT devices must be out-of-band network analytics solution ensuring no disruption to IoT devices. Our solution is the only offering in the market today specifically designed for IoT devices and in particular, connected medical devices causing no disruption and no endpoint agent installation. All analytics are performed via network traffic analysis and behavior analysis.
Q: What are some real-world problems you are helping your clients solve?
A: Healthcare organizations cannot install traditional security clients on IoT devices nor can they employ other monitoring solutions designed to secure IT devices. These organizations also cannot install patches as recommended by many vendors. Lacking the ability to update the device and the inability to employ traditional IT security solutions, organizations have no choice but to take the device out of circulation or simply live with the risk that a vulnerable device in use.
Q: What are the most common issues you see with healthcare IoT security?
A: The most common issue with healthcare IoT security is the lack of visibility. Many organizations do not have clear visibility into the number and type of IoT devices that are deployed in the organization's network. Without this visibility, you simply cannot assess the overall risk or vulnerability of the environment.
Q: Where do you see the greatest opportunities to succeed in healthcare IoT security?
A: The greatest opportunity to succeed in healthcare IoT security is to bring the traditional IT groups together with the clinical/biomedical engineering team. Our solution provides the integration with traditional IT solutions such as SIEM and Firewalls while ensuring non-disruptive security sought after by clinical/biomedical engineers.
Q: What skills do developers need to ensure the healthcare IoT devices they are working on are secure?
A: Developers working on healthcare IoT devices are limited by the architecture of the devices to incorporate security. At a device level, it is very difficult to keep pace with the rapidly changing market and threat vectors. While developers need follow general best practices, they should ensure interoperability with security solutions designed specifically for IoT devices.