Iot Security Risk Management Model for Healthcare Industry

Abstract

Internet of Things (IoT) is predicted as one of the biggest emerging environments in the future that creates simultaneous smart communication between machines or a variety of digital devices. Besides improving how data can be controlled, monitored and collected, IoT also allows us to generate revenue through the identifying of new business opportunities and deployment of advanced analytics processes for decision-making purposes. IoT enables us to accelerate changes in the healthcare environment in improving patient engagement and outcome, as well as transforming healthcare from reactive to proactive accessibility. Nevertheless, IoT’s expansion brings new vulnerabilities, risk and security challenges for healthcare practitioners and their patients. However, there is still a lack of study focusing on IoT risk management in healthcare. Existing researches tend to focus only on the implementation of IoT peripherals in a healthcare environment and tend to embed the secured applications solution with it. Since healthcare information and data are highly confidential, it is important to ensure that a secured health IoT application is in place. Thus, the aim of this study is to investigate the IoT risk management aspects in a healthcare environment with particular attention to proposing a step-by-step process of an IoT risk management model. The proposed IoT risk management model was developed leveraging on DEMATEL IoT Risk Assessment Procedure. This study was conducted based on a case study of one hospital in Sudan which has recently invested in IoT technologies in their operation. Interviews were conducted with selected respondents from the hospital and findings suggested that the selected case study does not have an established IoT risk management mechanism due to the ad-hoc IoT implementation approach. The case study also lacks of protection for health data and information with several unclear work process. As a solution, this study proposes an enhanced IoT risk management model for healthcare with consideration of three risk categories; 1) Secured Technology, 2) Human Privacy and 3) Trustable Process and Data. The proposed model was then evaluated by three IoT experts and two IT healthcare practitioners based on System Usability Score (SUS) and received Good Usability score which means the model is usable as a healthcare IoT risk management model.

Exploration of Mobile Device Behavior for Mitigating Advanced Persistent Threats (APT): A Systematic Literature Review and Conceptual Framework

“…This section presents a general overview of risk management approaches against cyber-attacks. This study identified 23 primary studies, of which two focused on mobile [153,154], six focused on IoT devices [107,[155][156][157][158]181], two focused on cyber-physical systems [168,169], four focused on either fog computing [111,160], the 5G edge-cloud ecosystem [167], or connected and autonomous vehicle (CAV) [159], and eight in general [61,93,[161][162][163][164][165][166]. Furthermore, four primary studies focused on APT [93,107,111,160], while the others are focused on either specific attacks such as DDOS attacks [181], DOS [167], SQL injections attacks [181], or privilege-induced attacks [154], or non-specific attacks [60,61,140,[155][156][157][158][159][161][162][163][164][165][166]…”

“…As shown in Figure 9, the existing studies either proposed risk management approaches [93,[154][155][156]158,159,161,[165][166][167][168][169] or were integrated with other approaches such as access control [161,164], situational awareness [61], and game theory [107,111,160,162].…”

“…As shown in Figure 9, the existing studies either proposed risk management approaches [93,[154][155][156]158,159,161,[165][166][167][168][169] or were integrated with other approaches such as access control [161,164], situational awareness [61], and game theory [107,111,160,162]. Many researchers have proposed different risk management approaches to minimize the threats and risks to IoT [158,181], computers [170], cyber-physical systems (CPS) [168,169], the 5G edge-cloud ecosystem [167], connected and autonomous vehicles (CAV) [159], and others [89,156,160,169]. Other researchers [154][155][156] have proposed guided frameworks that aim to support practitioners to formulate or reframe their IoT security risk management strategies.…”

“…Many researchers have proposed different risk management approaches to minimize the threats and risks to IoT [158,181], computers [170], cyber-physical systems (CPS) [168,169], the 5G edge-cloud ecosystem [167], connected and autonomous vehicles (CAV) [159], and others [89,156,160,169]. Other researchers [154][155][156] have proposed guided frameworks that aim to support practitioners to formulate or reframe their IoT security risk management strategies.…”

“…In addition, risk management can be used with other approaches such as access control, SA, and game theory to support the decision-making process. Based on the work done by [153,164], the authors proposed risk management with access control to support Many researchers have proposed different risk management approaches to minimize the threats and risks to IoT [158,181], computers [170], cyber-physical systems (CPS) [168,169], the 5G edge-cloud ecosystem [167], connected and autonomous vehicles (CAV) [159], and others [89,156,160,169]. Other researchers [154][155][156] have proposed guided frameworks that aim to support practitioners to formulate or reframe their IoT security risk management strategies.…”