THANK YOU FOR SUBSCRIBING
× 
Enterprise Security Mag Weekly Brief
Be first to read the latest tech news, Industry Leader's Insights, and CIO interviews of medium and large enterprises exclusively from Enterprise Security Mag
How Do Healthcare CIOs Address IIoT Threats?
Enterprise Security Magazine | Friday, October 04, 2019
IIoT has enormous potential to transform the healthcare industry, although it is surrounded by threats in different forms and has to be addressed adequately.
Fremont, CA: The necessity to save human lives elevates beyond limits with the onset of new diseases. This urge is driving technologies to develop groundbreaking innovations in the delivery of state-of-the-art treatment services. Like in many other sectors, the industrial internet of things (IIoT) has rapidly transformed the work and data infrastructure in health and medicine. IIoT enables easy access to medical data and information, thus making remote monitoring of patients seamless. IIoT has vast potential, especially in healthcare, to connect to the internet enabling ordinary medical equipment to collect and share essential data that gives healthcare providers and medical practitioners more significant insights into symptoms and treatment trends.
However, healthcare stakeholders should understand that IIoT adoption is prone to massive threats. Here's how CIOs address the associated IIoT threats in different healthcare areas to.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Medical Devices
There are many medical devices, each performing specific functions such as infusion pumps, anesthesia machines, dialysis machines, and respiratory ventilators, primarily used to monitor the patient’s vital signs. Updated versions of these devices can be connected to the internet allowing these devices to be linked wirelessly to remote areas and transfer collected information, such as the amount of medication a patient has taken to hospital information system (HIS). These medical devices can be attacked for patient information leading to inaccurate readings that can harm them under care. Researchers have uncovered a recent vulnerability in a brand of anesthesia machine, which could allow an attacker to remotely modify equipment parameters such as altering the composition of aspired gases that can put the patient at risk.
It is the responsibility of the manufacturers, distributors, and healthcare facilities to ensure that these devices remain safe for use. Stakeholders should be aware of impending threats and vulnerabilities so that they can be agile in mitigating possible risks. Government agencies like US food and drug administration (FDA) and the Department of Homeland Security to offer guidance through some medical device safety action plan. These plans can help mitigate the risks brought about by oversights in device safety and bring stakeholders together in addressing the oversights. Also, healthcare facilities can use virtual patching to manage vulnerabilities.
Hospital Information System (HIS)
Patient care does not only involve medical but also administrative, financial, and legal aspects. The associated information is integrated and maintained on a single platform, the Hospital Information System (HIS). This information includes medical history, legal, and others needed in a hospital’s daily operation. Thus safeguarding the integrity of such information is vital because of the critical information it holds. HIS presents a crucial target for any potential cybercriminal, such as personally identifiable information (PII) for patients, and it can be used for extortion. Further, HIS is susceptible to threats that include distributed denial of service (DDoS), ransomware, phishing attacks, and other threats from malicious actors. These malicious actors can manipulate data, steal information, and disrupt the hospital’s reputation.
Securing an HIS depends on network security. Splitting a network into sub-networks, a process called network segmentation, can reduce the risk of lateral movement. Encryption software also helps mitigate the consequences of data theft and loss.
Healthcare Systems Software
Medical institutions need software to control several systems they use to run and transfer information within institutions that hold the control for critical functions or information like patients’ PII. Even a slight exposure of the interface of such systems is a danger because a recent study revealed that among the exposed systems were software for record maintenance, pharmacy management, and patient scheduling. Even though the number of exposed medical systems is small, they contain valuable information that can be infected by potential attackers using ransomware. Also, the attackers gain access to other devices by using the compromised software as an entry point.
Medical institutions should ensure these software systems are not exposed online by preventing using careful configuration of these devices and systems, most importantly, those that contain PII of both patients and hospital staff.
Legacy Systems
It is evident that many medical institutions use legacy systems despite employing IoT devices in their facilities. They find it miserable to replace their legacy systems leading to extensive downtime that is impossible in a healthcare facility. But this puts them with severe consequences and danger. If medical institutions do not opt to replace their legacy systems, they should find some alternatives to strengthen their defenses through application security architecture. Employing solutions like virtual patching can mitigate the vulnerabilities that legacy systems face.
Wearables and Portable Medical Equipment
Wearables are mostly used by patients who have just been discharged from the hospital, and they are monitored continuously through IoT remote devices. These wearables provide necessary, real-time information, including heart rate, sleep duration, and blood pressure that are help users make healthier decisions. For example, glucose monitors periodically take blood samples to alert diabetic patients to take insulin, and heart rate monitors signal the onset of heart attack or stroke. However, these devices are also prone to risks. FDA has recently issued a warning against a specific brand of insulin pumps that replace pancreas functioning by releasing insulin and keeping the blood sugar levels within range. Attackers can send radiofrequency and change the nearby pumps’ setting. In such cases, the insulin pumps have to be replaced. These devices work remotely, and attacks on these devices could result in life-threatening situations.
Such portable devices that patients bring home or wear illustrate how users and patients share the responsibility of securing these devices. Patients who use such devices have to be careful in sharing the information about their devices by physically securing these devices and keeping it close to the user.
Other IoT applications
RFID technology, an IoT component can help hospital staff to quickly locate and identify equipment that will be used to treat a patient. Although they do not have direct effects on adding medical value, they ease the burden of staff while enhancing their focus on patients. However, integrators should map and manage their connected devices because they are the entry points for bigger targets. Deploying virtual fencing features will disable the devices when they are out of range.
IoT in healthcare has not attained full maturity and is still brimming with possibilities. Healthcare stakeholders must first understand the dangers IoT brings to the field when haphazardly implemented that could cause cascading problems to a broader community and take effective measures to secure it.
See Also: Top Healthcare Technology Companies
More in News
Outdoor properties can change faster than a surveillance plan. Fences shift, gates get left open, materials move and work schedules change. A system built around static rules or queued alerts can become less useful precisely as a site changes. For executives buying remote video monitoring, the central question is not whether video exists. It is whether someone can interpret what is happening while there is still time to intervene. The cost of delayed judgment is greatest where equipment is exposed and boundaries are temporary.
Response speed is inseparable from how video is reviewed. An alert delivered after playback sits in a queue may document an event but miss the chance to interrupt it. Outdoor sites also produce ambiguous activity. Legitimate crews may arrive outside normal hours, pedestrians may pass nearby, animals may enter view or an intruder may test a fence. Live monitoring earns its cost when reviewers can distinguish routine movement from a developing incident without forcing every anomaly into the same escalation path. Recorded evidence has value, but it cannot substitute for intervention during the event.
Staffing ratios deserve scrutiny because human monitoring can fail when attention is divided across too many feeds. A lower camera-to-agent ratio can shorten the distance between observation and decision, especially when multiple events surface at once. Managers should look past camera count and ask how many feeds each specialist handles, what happens when uncertainty rises, how incident context is preserved and how work is elevated to a supervisor. Those mechanics say more about response quality than the number of cameras deployed. Workload design therefore belongs in the buying discussion, not merely in vendor staffing detail.
False-alarm control is tied to context, not detection alone. A useful service should verify activity before calling police and remain involved after dispatch if conditions change. Two-way voice communication matters here because it allows monitoring staff to challenge a person and request identification. Visible strobes or warnings can create a second intervention before police response. That graduated approach can reduce unnecessary calls while preserving escalation when a person refuses to leave or cannot be verified. Escalation should stay proportional to what the operator can actually verify in the moment.
Site design and service terms also shape performance. Camera placement should reflect perimeter exposure and activity patterns, while installation crews need to adapt as construction or property use changes. Buyers should expect a clear proposal that shows where equipment will sit and what it will cover. Contract structure deserves equal attention. Month-to-month options or reasonable cancellation terms make performance easier to judge on continued service rather than sunk commitment.
LiveGuardTech fits this buying logic through a service model centered on live human review and direct intervention. Its monitoring specialists watch live feeds with a low camera-to-agent ratio, then use two-way communication and activated strobe lights to challenge suspicious activity before police escalation. Site assessments inform camera placement, while LiveGuardTech's field technicians handle installation and service. Its proprietary monitoring software supports movement of video between agents and supervisors, and its teams can provide police with secure access to a live feed during an active response. The company also offers standard night-and-weekend monitoring or 24/7 coverage, with remote camera access through its CamView platform. For buyers that prioritize fast human judgment over alert-only monitoring, LiveGuardTech warrants close consideration. ...Read more
Cybersecurity has become a business concern that extends beyond IT departments. A security breach can interrupt services, expose customer information and damage trust. Managed security services give organizations access to external security specialists who monitor systems, investigate suspicious activity and respond to potential threats. For businesses across APAC, these services offer a practical way to strengthen cyber defense without building every capability in-house.
The role of managed security services is also changing. Businesses once relied heavily on external teams to monitor alerts and maintain security tools. Today, they expect providers to investigate threats, explain risks and work closely with internal teams when incidents occur. The focus is shifting from monitoring systems to helping organizations make better security decisions.
A Changing Cybersecurity Landscape
Managed security services cover a range of functions, including network monitoring, endpoint protection, cloud security, vulnerability management and incident response. Some providers also offer managed detection and response, which combines continuous monitoring with threat investigation and action to contain suspicious activity.
Demand is growing as organizations adopt cloud applications, support remote work and connect more business systems. Each new connection can create another point of entry for attackers. Internal security teams must keep track of these environments while managing everyday IT responsibilities, making specialist external support an attractive option.
The APAC market presents its own challenges. Businesses operate in countries with different levels of digital maturity, infrastructure and cybersecurity expertise. Large enterprises may have dedicated security departments but still need outside specialists for advanced threat detection or incident investigation. Mid-sized organizations may depend more heavily on external providers because maintaining a full security team can be difficult.
The business case extends beyond preventing attacks. Effective security monitoring can help limit disruption, protect sensitive information and give leadership teams a clearer picture of potential risks. For organizations that rely on digital services to serve customers or manage supply chains, a delayed response to suspicious activity can have consequences well beyond the IT department.
AI And Cloud Security Change The Market
Artificial intelligence is changing how security teams review alerts and investigate unusual activity. AI-assisted tools can identify patterns in large volumes of security data, highlight suspicious behavior and provide analysts with useful context. Automation can also handle repetitive tasks, giving security professionals more time to investigate incidents that require closer attention.
However, these tools are not a substitute for human judgment. Attackers can use AI to create convincing phishing messages, automate malicious activity and adapt their methods. Security teams must also account for risks associated with AI applications used within their own organizations. Managed security services need to address these developments without treating automation as a complete solution.
Cloud adoption is creating another area of demand. Many businesses now operate across private infrastructure, public cloud environments and applications managed by external providers. Security teams need visibility into these different systems to identify suspicious activity and understand whether an incident in one environment could affect another.
Managed detection and response is gaining importance because businesses want more than alerts. They need specialists who can investigate potential threats, determine their significance and take agreed-upon action. The exact scope varies by provider, making it important for buyers to understand whether a service includes active threat hunting, incident containment and recovery coordination.
“Managed Security Services Cannot Remove Every Cybersecurity Risk. Their Value Lies In Giving Organizations Access To Specialist Knowledge, Continuous Monitoring And A Defined Response Process.”
What Buyers Should Look For
Choosing a managed security services provider requires a clear understanding of responsibilities. Buyers should establish which systems the provider will monitor, how incidents will be classified and who has the authority to act when a threat is detected. Unclear responsibilities can delay decisions at the moment when a quick response matters most.
Response procedures deserve particular attention. Organizations should understand how quickly the provider escalates serious incidents, whether analysts are available outside normal business hours and how evidence is preserved for investigation. Reporting should explain what happened, why it matters and what action is needed rather than simply presenting a long list of alerts.
Data handling also requires careful consideration. Businesses operating in APAC may have different requirements for where information is stored, who can access it and how it is transferred between locations. Buyers should examine the provider's data practices and confirm that its service arrangements fit the organization's local obligations.
The difference between a basic service and a mature provider often lies in the quality of its investigations and communication. Experienced teams can connect security events, distinguish routine activity from genuine threats and explain their findings in business terms. They should also share lessons from incidents and identify weaknesses that require attention.
Implementation can still be difficult. Older systems, incomplete asset records and disconnected security tools may prevent providers from seeing the full picture. Organizations also need to prepare internal teams for new escalation procedures and agree on how external specialists will coordinate with IT, legal and business leaders when necessary.
The Future Of Managed Security Services
Managed security services are likely to become more closely connected with identity protection, cloud security and broader risk management. AI will play a larger role in analyzing activity and prioritizing alerts, but human expertise will remain important for complex investigations and decisions involving business risk.
Buyers are also likely to place greater emphasis on clear reporting and evidence of service quality. The number of alerts handled offers limited insight on its own. Organizations need to understand whether threats are being investigated effectively, whether response procedures work and whether recurring weaknesses are being addressed.
Managed security services cannot remove every cybersecurity risk. Their value lies in giving organizations access to specialist knowledge, continuous monitoring and a defined response process. For APAC businesses, choosing the right service will depend on how well the provider understands their systems, communicates risk and works with internal teams to protect essential business activities. ...Read more
Cybersecurity and regulatory compliance have been interwoven business disciplines as organizations rely increasingly on digital systems. Organizations have to take care of their customer information, finances, intellectual property, operations, and technology infrastructures in ever-more distributed environments. Cyber protection of these assets goes beyond individual security controls.
There should be an effective solution to the coordination between the operations of cybersecurity and compliance that integrates all aspects, such as risk management, monitoring, governance, and regulations, within a real-world framework. An effectively structured process will assist organizations in ensuring secure processes.
Strengthening Security through Integrated Operations
The traditional areas of cybersecurity operations have been to detect malicious activity, investigate security incidents, manage vulnerabilities, and safeguard important systems. The areas of compliance operations include adherence to laws, regulations, contracts, and policies. Operating these two areas of operations separately will lead to inefficiencies where duplication may occur, or the link between the two may be overlooked.
The first step in achieving a unified operating model is to assess the information resources of the organization, business processes, technology infrastructure, and the corresponding requirements. The security team will then be able to create controls that take into consideration both the operational risk and the compliance needs. Controls such as access control, endpoint protection, network monitoring, encryption, vulnerability management, and security awareness can all be in line with policies and governance goals.
Continual monitoring is yet another important aspect. Threats and technologies are always changing, and compliance obligations might have additional expectations in terms of the evidence to be provided, reporting obligations, and control effectiveness. Through continual monitoring, businesses are able to detect any discrepancies and investigate them before they turn into major business issues. Automated notifications, central dashboards, and workflows can help prioritize activities based on business impact.
Improving Governance, Risk and Compliance Coordination
An effective process of cybersecurity and compliance relies on good governance. The organizations require well-defined roles of security leaders, the IT department, compliance officials, risk managers, and business representatives. Governance processes ensure that everyone knows whose responsibility it is to evaluate the controls, escalate incidents, or provide the regulatory evidence. Moreover, the governance framework helps to define the processes of policy approval and risk assessment.
Risk assessments offer the basis for these practices. Instead of using the same control measures in all systems, companies have the ability to assess their risks based on asset importance, data sensitivity, exposure, dependence, and business impact. This method assists in focusing efforts in places where implementing security measures is more beneficial. It is necessary to revisit risk assessments from time to time due to the fact that risks may change in light of new developments.
Centralized documentation and evidence will further enhance the compliance management process. It is common for organizations to have to provide evidence of policy approval, control functioning, monitoring of employee activities, and resolution of problems. Documenting the evidence in a systematic way will lessen the work needed during internal audits, customer audits, and regulatory inspections. It will also increase visibility on the part of management as far as controls and corrective actions are concerned.
Building Sustainable Cybersecurity Operations
Sustainability in cybersecurity demands that an organization integrate its technology, people, and processes. The security tools may be able to detect possible threats, but achieving successful results requires individuals who are well-trained and comprehend the business objectives and procedures in place. Training can allow workers to see their security roles, and exercises can assess whether these teams react effectively.
A final topic worth noting is that of third-party risk. Third parties such as suppliers, technology partners, and even service providers could have access to organizational systems or even confidential data, and therefore become dependent upon the organization for security and compliance. Diligence, assessments, monitoring, and contract stipulations can all assist organizations in recognizing and managing their third-party relationships and any associated risks. Additionally, an organized third-party program can ensure that third parties meet certain security expectations.
Incident response must be built within the larger compliance program. There must be established procedures for detecting, containing, investigating, resolving, and reporting any security incident. Established communication methods and assigned roles will help in reducing any delay during the incident response process. It will also make it easier to find out weak controls in the process.
As the regulatory standards keep changing, firms would have to ensure that they have cybersecurity strategies that can be adjusted without creating any operational overhead. Compliance operations solutions that are scalable could help organizations create control standards, measure performance, organize evidence, and find gaps. The aim is not only to meet different regulatory standards but also to create security and compliance standards for effective trade operations. This integrative approach will also allow leaders to assess security investments based on concrete results of operation, finance, and regulation.
Cybersecurity and compliance should be seen as integral elements of business management. Companies that incorporate monitoring, governance, risk management, documentation, and responses gain increased visibility of their technological environment and greater accountability. Through the integration of their security processes with their management objectives, companies can address their digital risks in a more systematic way, make decisions based on facts, and establish a solid foundation for future growth. ...Read more
When the threat of a security incident occurs, businesses usually identify their response in the short term, but they have to rely on digital forensic services to help them understand what happened and take appropriate action. The growing role of digital forensic services in incident response is directly related to the organization’s need to document and analyze data to find out the nature of the security violation, which requires time.
The role of digital forensics in incident response management covers a wide range of activities, from analyzing compromised digital media to examining all relevant factors and circumstances related to the incident in order to reconstruct the sequence of events leading up to it. The organization’s internal security team and external digital forensic experts collaborate during this process, with each party focusing on tasks in accordance with their responsibilities.
However, the involvement of digital forensic experts goes further, as the analysis includes collecting and recording evidence, which helps to determine the consequences of the incident for the business. At the same time, the timing of the intervention is also relevant since the digital evidence is often dynamic and therefore requires a timely analysis.
During the incident response, forensic experts are often involved in investigations at the earliest stages, which demonstrates the relevance of turning to them as soon as possible after the incident. Companies often rely on digital forensics to preserve the integrity of the evidentiary data set, which is critical to the investigation. Internally, the security team handles the response while external experts handle the evidence collection and analysis. The two sides are in constant communication, and the experts are responsible for providing the security team with specific evidence, which allows them to perform their tasks efficiently.
Documentation is a key part of digital forensics. Organizations pay close attention to how accurately and completely evidence is recorded. Proper documentation allows businesses to review specific cases later if needed. Because of this, companies often select incident response experts who can record evidence in a clear and structured way.
During an investigation, businesses also have to think about how preserving evidence might affect business continuity. This means finding a balance. Experts help companies choose the best way to preserve evidence so that operations can keep running with as little disruption as possible.
As a result, it is necessary to understand that the role of digital forensics in incident response covers various aspects of the security breach investigation. Companies are increasingly relying on external experts to support internal teams and help document and analyze evidence, leading to the identification of the causes of the security incident. ...Read more
ON THE DECK
