Cybersecurity of healthcare IoT-based systems: Regulation and case-oriented assessment

Medical Internet of Things: A Survey of the Current Threat and Vulnerability Landscape

“…Patient privacy and safety must be preserved while data transfers to medical personnel remain easy to manage [51]. Data transfers should be encrypted from end to end during the transfer of configurations, commands, and private health data [52].…”

Security and privacy issues of data-over-sound technologies used in IoT healthcare devices

“…There are some U.S regulations like Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act, centred in healthcare data regulation but they usually do not present any clear indications on how to protect private information or cybersecurity measures to be taken into account. This establishes the necessity of new cybersecurity industry standards like the proposed by Strielkina et al [10]. These standards should be included in mandatory healthcare regulations, independent of novel technological solutions, forcing new IoT healthcare devices to be cybersecurity compliant.…”

Security assurance cases—state of the art of an emerging approach

“…While SACs are usually used to establish evidence-based security assurance for a given system, researchers have reported cases where SAC could be used to achieve dif- External forces Comply with security requirements of safety-critical systems Cyra et al [18] External forces Comply with standards and regulation Finnegan et al [20] External forces Comply with regulation and maintain confidence in the product in question Finnegan et al ( 2) [21] External forces Comply with regulation He et al [35] External forces Reason about cybersecurity policies and procedures Mohammadi et al [47] External forces Learn from the safety domain where it is a proven approach Ray et al [56] External forces Comply with regulation and internal needs from cyber-physical systems' manufacturers Sklyar et al ( 2) [63,65,64] External forces Comply with standards Sljivo et al [66] External forces Comply with standards and regulation Strielkina et al [69] External forces Comply with security regulation Goodger et al [28] Knowledge transfer Learn from the safety domain to integrate oversight for safety and security Ionita et al [38] Knowledge transfer Learn from the safety domain where it is a proven approach Netkachova et al ( 2) [49] Knowledge transfer Learn from the safety domain where it is a proven approach Poreddy et al [55] Knowledge transfer Learn from the safety domain, where it is a proven approach Sklyar et al [62] Knowledge transfer Learn from the safety domain, where it is a proven in-use approach Ben Othmane et al [7] Process improvement Trace security requirements and assure security during iterative development. Ben Othmane et al [8] Process improvement Assure security during iterative development Cheah et al [14] Process improvement Cope with the increasing connectivity of systems Cockram et al [16] Process improvement Reduces both technical and program risks through process improvement Gallo et al [26] Process improvement Factor analytical and implementation work per component, requisite, technology, or life-cycle Lipson et al [42] Process improvement Help analyzing complex systems Netkachova et al [50] Process improvement Tackle security issues which have intensified challenges of engineering safety-critical sys...…”

“…Ben Othmane et al [8] Process improvement Assure security during iterative development Cheah et al [14] Process improvement Cope with the increasing connectivity of systems Cockram et al [16] Process improvement Reduces both technical and program risks through process improvement Gallo et al [26] Process improvement Factor analytical and implementation work per component, requisite, technology, or life-cycle Lipson et al [42] Process improvement Help analyzing complex systems Netkachova et al [50] Process improvement Tackle security issues which have intensified challenges of engineering safety-critical systems. Weinstock et al [75] Process improvement Include people and processes in security assurance in addition to technology Alexander et al [4] Security assessment Help security evaluators to focus their attention on critical parts of the system Bloomfield et al [11] Security assessment Ensure the fulfillment of security requirements Finnegan et al [21] Security assessment Improve overall security practices and demonstrate confidence in security Hawkins et al [34] Security assessment Justify and assess confidence in critical properties Knight [41] Security assessment Spot security related weaknesses in the system Poreddy et al [55] Security assessment Assist in identifying security loopholes while changing the system Rodes et al [57] Security assessment Measure software security Strielkina et al [69] Security assessment Acquire an input for decision making of requirement conformity Vivas et al [74] Security assessment Acquire confidence that the security of the system meets the requirements Agudo et al [3] Structure & documentation Incorporate certifications and evaluation methods in an evidence-based structure Alexander et al [4] Structure & documentation Summarize security thinking when vendors are involved Finnegan et al [22] Structure & documentation Communicate and report achieved security level Knight [41] Structure & documentation Document rational for security claims Netkachova et al [51] Structure & documentation Aid in communication as it provides a summary of issues and their interrelationship Patu et al [54] Structure & documentation Aid in the survival of modern system, with respect to security challenges Ray et al [56] Structure & documentation Comply with internal needs from cyber-physical systems' manufacturers ferent goals. We looked into...…”