Nowhere has the impact of the Internet of Things been more profound and personal than on our health and well-being. The rapid expansion of smart health technologies is benefiting patients and practitioners in ways unforeseen in the recent past. The iconic “doctor’s bag” is now filled with sensors, connected devices and mHealth (mobile health) technologies that are reinventing house calls and giving patients in all corners of the world access to life-changing treatments, while reducing hospital visits and improving care and quality of life.

Digital health solutions have revolutionized every aspect of the medical industry, from the creation of health and wellness apps, to enhanced hospital administration systems, to the growth of pharmaceuticals based on personal genomics. These solutions are being developed at bullet train speed, with capabilities so futuristic they would surely impress the most diehard “Trekkie”. The day when a doctor can scan a patient’s genome to identify abnormalities and recommend treatment protocols may not be far off.

Today, tuberculosis patients in remote regions of Mexico are receiving education and treatment via mobile devices, and Kenyan HIV patients receive critical antiretroviral treatment thanks to improved wireless pharmaceutical management systems. At U.S. medical centers and throughout global transportation journeys, sensor-driven cooling chambers keep transplant organs, vaccines, and medications at optimal temperatures. Millions of patients around the world benefit from remaining in close touch with caregivers via connected insulin pumps, pacemakers and heart arrhythmia devices. In all cases, smart health solutions help patients to be active participants in their care, allowing them to keep a pulse on their overall needs.

Smart health is only a small segment of the exploding IoT marketplace, which is expected to grow to 50 billion connections by 2020 up from 16 billion connections today. Industrial grade Machine-to-Machine (M2M) IoT solutions are optimizing operations and improving the bottom line for a huge range of industries and enterprise solutions. As the volume and complexity of mHealth solutions increases, so does the need for bulletproof security controls to assure that our most personal data is kept private. As exciting and promising as these medical breakthroughs are, if your high blood pressure condition is made public, the potential, or threat, of real time medical feedback is enough to raise your blood pressure!

Digital security and privacy issues are a serious concern as the growing incidence of hacks and data breaches expose the vulnerabilities of IoT. In the first half of 2015, there were more than 880 major breaches reported that compromised well over 245 million data records. That’s the equivalent of 16 lost or stolen data records every second or 1.3 million every day. In the race to add IP connectivity to our healthcare, digital security can become an afterthought. And make no mistake; there is no shortage of hackers that will exploit any weakness they discover. Driven by a wide range of motivations including fame, fortune and the simple joy of a challenge, hackers grow more sophisticated everyday.

Security by Design is Essential

It’s been said that “the devil is in the details” and no place is this more true than in securing connected medical devices. Just as one would never build a home without a foundation, IoT solutions must begin with intelligent security architecture as the foundation of trust in the device, the data, the network and the ecosystem. Security needs to be designed in at the beginning of development projects across the entire IoT ecosystem and not bolted on as afterthought. 

The following five guiding principles for data security can guide mHealth developer as they begin new projects:

1. Confidentiality – Assure that data is confidential across the entire ecosystem and access is limited only to authorized stakeholders 
2. Integrity – Secure the integrity of the data, maintaining and assuring the accuracy and consistency of data over its entire life cycle. This is a critical aspect of design, implementation and usage because integrity attacks are difficult to identify and hackers can alter data that is used to make mission critical business decisions
3. Availability – Solution design must ensure that data is easily available at required levels in all situations even when challenging wireless network conditions prevail
4. Accountability – Assure that system users across the ecosystem are accountable for the data they produce and the actions they take
5. Auditability – Design systems that provide a clear and transparent audit trail providing evidence that the data is accurate

Risk Evaluation and Hack Testing

Developers need to work with experienced and trusted security partners to know, identify and understand all potential system vulnerabilities. An early comprehensive risk evaluation is critical to implement security architecture across the entire connected device ecosystem – from the hardware components that enable connectivity, to the software running the device, out to the communication channels it uses and the cloud platforms hosting applications. In the same way that we rely on crash tests to verify the safety of a car, digital security partners can provide security ‘hack tests’ that reliably establish that a given product is secure and safe to use. These best practices help protect the device, the network and the data at rest and in motion.

Trusted Identities: An Important Consideration

Unlike consumer devices that are connected to a single user with a traditional identity device like a SIM card, connected medical devices have multiple identities. Each of them needs to be secured and authenticated in order to secure the entire ecosystem. The ID of a device like a connected heart defibrillator vest needs to be able to authenticate the patient using it, the cardiologist and medical staff responsible for care, other mHealth devices in the patient’s ecosystem that the defibrillator might communicate with, the healthcare provider’s cloud system, the 911 emergency response ecosystem and the device manufacturers backend system. In other words, the smart defibrillator needs to automatically and securely authenticate that the device manufacturer server is who it says it is and not a malicious attacker seeking to download code for nefarious purposes.

Best Practices for Secure IoT Solutions

With decades of experience in virtually all IoT vertical markets, Gemalto has developed field proven best practices for protecting medical devices, the cloud, the communication channel and the ecosystem. The following strategy for implementing end-to-end trust points and countermeasures, including hardware and software elements, can help mitigate threats and defend data when and if attacks occur.

1. Protect the device – Implement tamper-proof hardware solutions and secure software to protect the device. For example, embedded Secure Elements are implemented to add a layer of physical and digital protection against intrusion and to store credentials and device data in a dedicated, secure platform.
2. Encrypt and digitally sign the operating software to protect against attack. Encrypted software is useless without the keys and an electronic signature will ensure that only validated software is running on the IOT device!
3. Implement strong authentication and encryption software solutions to ensure integrity and that only authorized people and applications are granted access to the IOT solution infrastructure
4. Securely manage encryption keys to protect data and manage access to connected systems
5. Protect against attack across the lifecycle of the device by including an interoperable, dedicated platform to deploy security updates and launch new applications over the air without impacting other embedded software

The “Age of the IoT Revolution” has arrived and our world is quickly transforming to a place where ubiquitous connectivity provides the potential to greatly improve the way we live, work and play. Cyber attacks are inevitable. However, we can defend against them and protect data privacy by designing security architecture at the beginning of mHealth development projects and managing the entire trust ecosystem, from the edge to the core, protecting what matters, where it matters and when it matters.