Cyber Physical Security in Healthcare

Introduction

The integration of connected medical devices into modern healthcare systems is transforming patient care by providing unprecedented opportunities for diagnosis, treatment, and monitoring. However, this digital transformation brings with it new, urgent and growing risk of cyberattacks as healthcare delivery organizations (HDOs) expand their networks.

According to the U.S. Department of Health and Human Services, large healthcare data breaches surged by 93% from 2018 to 2022. Research from Claroty, a leading cyber-physical systems security firm, found that 99% of healthcare organizations surveyed had devices with confirmed known exploited vulnerabilities (KEVs). Alarmingly, 20% of hospital information systems—critical for patient care and operations—contained KEVs linked to ransomware and were insecurely connected to the internet. Imaging systems such as X-rays, CT scans, and MRIs are especially vulnerable, with 8% carrying ransomware-related KEVs and 85% of organizations impacted.

In this article, we will explore the evolving landscape of cyber-physical security for medical devices, examining the risks, real-world impacts, and emerging solutions for safeguarding patient safety and healthcare operations in an increasingly connected world.

Why is Cyber Security Important for Medical Devices?

Yes, terrorists could have hacked Dick Cheney’s heart.” The former vice president’s heart implant, with its wireless functionality, could have resulted in an assassination.

This is just one example of the risk of deadly cybersecurity attacks on connected medical devices. Researchers have shown that a hacker can remotely kill a person by causing an implanted insulin pump to release a deadly dose of insulin or by making a pacemaker release a heart-stopping electric charge. Another example is Ascension, a large private Catholic healthcare system (140 hospitals in 19 states) disclosed a breach in May 2024 that affected critical systems, forced the diversion of patients to other facilities, and resulted in $1.8 billion in losses. The attack has been attributed to Black Basta. Such issues are of critical concern for providers and patients because security lapses in these devices have the potential to put lives at risk or expose sensitive patient data.

The Unit 42 researchers at Palo Alto Networks published findings showing an alarming 75% of infusion pumps scanned had known security gaps that put them at heightened risk of being compromised by attackers. These shortcomings included exposure to one or more of 40 known cybersecurity vulnerabilities. Alerts showed they had one or more of 70 additional types of known security shortcomings for IoT devices.

Clearly, healthcare is a prime target for attackers. This heightens the concern around connected medical devices, because any exploited vulnerability enables cybercriminals to take malicious actions posing risk to healthcare organizations and their patients.

Architecture of an IoMT System.

An IoMT system comprises four distinct layers:

1. The perception layer:
   1. Internet of Medical Things (IoMT) architecture carries data from medical devices and sensors, including wearables, implanted devices, and traditional medical equipment.
   2. These devices communicate with the gateway layer using various protocols like ****MQTT, CoAP, Bluetooth Low Energy (BLE), Zigbee, and LoRaWAN.
2. The gateway layer:
   1. It is responsible for aggregating the data that has been collected from the medical devices in the perception layer and serving as a bridge between the cloud and medical devices, ensuring safe data transmission.
   2. Protocols like Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP) to enable efficient data transmission.
3. The cloud layer:
   1. Gives us the ability to ingest, store and analyze increasingly growing amounts of data from edge devices using HTTPS REST APIs.
   2. Allows us to create and run analytical pipelines on the ingested data.
4. The application layer:
   1. End user’s interact with the system in this layer. It supports applications like remote patient monitoring and health management tools to improve healthcare delivery through processed data from the cloud layer.

Key Risks and Vulnerabilities

1. Inadequate Encryption:
   1. One major flaw with IoMT devices is inadequate encryption mechanisms, which could allow unwanted access to private patient data.
   2. Antiquated encryption techniques make devices more susceptible to hacker manipulation and interception.
   3. The protection of patient data has been compromised by weak encryption in pandemic healthcare monitoring systems.
2. Weak Authentication Mechanisms:
   1. Many IoMT devices have antiquated or basic authentication techniques, which are highly vulnerable to intrusions.
   2. Attackers may take advantage of weak security measures to obtain illegal access, thereby jeopardizing the device and the data it controls.
3. Limited Processing Power:
   1. The limited processing power constrains the adoption of more advanced security measures rendering these devices appealing targets for attackers.
   2. Numerous IoMT ecosystems exhibit vulnerabilities resulting from delayed updates and insufficient hardware capabilities.
4. Expanded Attack Surface:
   1. The proliferation of connected medical devices (IoMT) increases the number of potential entry points for cybercriminals. Each device, from infusion pumps to implantable pacemakers, can be targeted
5. Interconnected Ecosystems:
   1. Devices are now part of complex hospital IT environments. A compromise in one device can provide a pathway to broader network attacks, including ransomware or data breaches
6. Malware and DDoS Attacks:
   1. Malware poses a significant threat to IoMT devices due to delayed updates and inadequate hardware capabilities. In many cases, attackers exploit vulnerabilities in outdated or unpatched devices by installing malware that can exfiltrate sensitive healthcare data and services.
   2. One such example is the infamous Mirai malware, which transformed IoMT devices into bots to launch large-scale DDoS attacks. According to recent studies, over 70% of IoMT devices currently in use are vulnerable to known malware attacks in exposing healthcare providers and patients to significant risks.

Managing Risk

The State of CPS security report suggests the following 5 step procedure:

1. Scoping: Account for critical processes by device type and department.
2. Discovery: Identify devices, granular attributes, and communication.
3. Prioritization: Follow a cybersecurity framework that considers the business impact and exploitability of exposures.
4. Validation: Validate that a full spectrum of exposures are real and externally reachable.
5. Mobilization: Reduce risk and secure operations with actionable mitigations and remediations.

Conclusion

Cyber-physical security for medical devices is no longer optional—it is a matter of patient safety and operational continuity. As connectivity grows, so do the risks, requiring a proactive, multi-layered security approach that combines technical controls, regulatory compliance, and cross-sector collaboration

References:

Health Care Sector Cybersecurity

CPSSEC | Homeland Security

laweconcenter.org

New Research from Claroty’s Team82 Highlights Riskiest Medical Device Exposures in Healthcare Environments

State of Medical Device Security: Cyber Risks and Solutions

State of CPS Security: Healthcare Exposures 2025

Yes, terrorists could have hacked Dick Cheney’s heart

A Review on the Security Vulnerabilities of the IoMT against...

infusion pump vulnerabilities

Claroty reports alarming IoMT, OT device risks as critical vulnerabilities found in 99% of healthcare networks

web-assets.claroty.com