Prof Awais Rashid, University of Lancaster: secure IoT use in digital health – Prof Rashid is a world expert on this topic which has become particularly important since the FDA recently withdrew approval from an infusion pump because it was too easy to hack. He will explain the critical importance of IoT security, how to assess it and how best to achieve secure solutions. http://dhaca.org.uk/dhaca-day-vi-presentations-and-brief-summary/

1. Secure&IoT&use&in&Digital&Health&
Professor&Awais&Rashid&
(Director,&Security&Lancaster&Research&Centre)&

2. Yes,&you&can!&

3. IoT&use&in&Digital&Health&
• Implantable&Medical&Devices&
• Body&Area&Networks&
• Assisted&Living&
• …&

4. Cyber&Security&Threats&in&&
Health&IoT&
• Telemetry&interface&
– Eavesdropping&
– Jamming&
– Replay&aMacks&
– Forging&aMacks&
• Malware&
– Altering&the&soOware&on&the&device&
– InjecQng&command&and&control&soOware&on&to&the&device&
• Compromising&trust&
– Forcing&sensor/actuator&failure&through&denial&of&service&
– Remotely&acQvaQng&or&deacQvaQng&sensors&and&actuators&
– Malicious&data&injecQon&

5. Cyber&Security&Threats&in&&
Health&IoT&
• Data&ExfiltraQon&
– Intellectual&Property&
• Resource&HarvesQng&
– E.g.,&use&in&Botnets&

6. AMackers&are&not&always&external&
&
Malicious&insiders&across&the&chain&–&from&manufacturers&and&
suppliers&through&to&primary&and&second&care&professionals&
&
The&problem&of&Contextual&Access&

7. We&have&been&here&before!&
• Ease&of&use&and&interoperability&vs.&Security&
Security)
)
Confiden'ality-
Integrity-
Availability-
Non5repudia'on-
Resilience)
-
Safety-
Reliability-
Availability-

8. What&needs&to&be&done?&
• Much&stronger&regulatory&environment&
– If)it)is)not)secure,)it)is)not)safe)
– Needs&to&be&coupled&with&effecQve&cyber&security&metrics&for&
Health&IoT&and&clearly&traceable&means&to&measure&those&metrics&
– BeMer&means&to&translate&from&technical&measures&to&high&level&
securityZsafety&goals&
• Understanding&cyber&risk&across&the&chain&
– How&various&enQQes&across&the&chain&assess&and&respond&to&cyber&
risk&
• The&problem&of&boundaries&

9. What&needs&to&be&done?&
• Technology&only&protects&technology&not&informaQon&flow.&
– What&is&the&informaQon&network,&how&does&informaQon&flow?&
This&includes&people!&
– New&security&models&for&protecQng&informaQon&flow&in&such&
se]ngs.&

10. ParQal&Trust&
Security&and&
Safety&
Intertwined&
CrossZ
boundary&
Security&
Secure)
Health)IoT)
By)Design)

11. A&useful&resource&
• Michael&Rushanan,&Aviel&D.&Rubin,&Denis&Foo&Kune,&Colleen&M.&
Swanson:&SoK:)Security)and)Privacy)in)Implantable)Medical)
Devices)and)Body)Area)Networks.&IEEE-Symposium-on-Security-
and-Privacy-2014:-5245539.-

12. Argumentum Ad Ignorantiam&&
&
Absence-of-evidence-is-not-evidence-
of-absence&