Chapter 4: Security and Privacy

4.1 The IoMT Security Challenge

Medical IoT devices dramatically expand the healthcare attack surface. Each connected device represents a potential entry point for cyber threats, while the data they generate requires stringent privacy protection. The consequences of IoMT security failures range from privacy breaches to patient harm.

Unlike traditional IT systems, IoMT devices often have limited computing resources for security functions, long operational lifespans spanning 10-20 years, and physical deployment in uncontrolled environments. Security must be designed into IoMT systems from the start, not added as an afterthought.

4.2 Threat Landscape

IoMT systems face diverse threat vectors across the device ecosystem:

Threat Categories

Threat Type	Description	IoMT Impact
Ransomware	Encryption of systems for payment	Device unavailability, patient harm
Data Theft	Exfiltration of health data	Privacy breach, regulatory fines
Device Hijacking	Unauthorized device control	Altered therapy, false readings
Man-in-the-Middle	Intercepting communications	Data manipulation, credential theft
Denial of Service	Overwhelming device/network	Service disruption
Supply Chain	Compromised components/updates	Backdoors, malicious code

4.3 Security Framework

A comprehensive IoMT security program addresses multiple layers:

Defense in Depth

Layer	Controls	Technologies
Device	Secure boot, hardening	TPM, secure elements
Communication	Encryption, authentication	TLS 1.3, mTLS, certificates
Network	Segmentation, monitoring	VLANs, firewalls, IDS/IPS
Platform	Access control, audit	IAM, SIEM, logging
Data	Encryption at rest, DLP	AES-256, tokenization
Physical	Tamper detection	Secure enclosures, alerts

4.4 Device Security

Securing devices at the endpoint is foundational to IoMT security:

Device Hardening

• Secure Boot: Verify firmware integrity before execution
• Code Signing: Only execute authenticated firmware
• Minimal Attack Surface: Disable unnecessary services, ports
• Secure Defaults: No default passwords, secure out-of-box
• Physical Security: Tamper-evident seals, secure debug interfaces

Authentication and Authorization

• Device Identity: Unique cryptographic identity per device
• Certificate-Based Auth: X.509 certificates for mutual authentication
• Token-Based Access: OAuth 2.0, JWT for API access
• Role-Based Access Control: Principle of least privilege

4.5 Communication Security

Securing data in transit between devices, gateways, and platforms:

Encryption Requirements

Protocol	Use Case	Minimum Standard
TLS	HTTPS, API calls	TLS 1.2+, prefer 1.3
DTLS	UDP-based protocols	DTLS 1.2+
BLE	Bluetooth devices	LE Secure Connections, AES-CCM
MQTT	IoT messaging	TLS transport, client certs
CoAP	Constrained devices	DTLS, OSCORE

4.6 Privacy Protection

IoMT generates sensitive health data requiring robust privacy protections:

Privacy Controls

• Data Minimization: Collect only necessary data
• Purpose Limitation: Use data only for stated purposes
• Consent Management: Explicit patient consent for data use
• De-identification: Remove identifiers for analytics
• Access Logging: Audit all data access
• Retention Limits: Delete data per policy

Regulatory Compliance

Regulation	Scope	Key Requirements
HIPAA	US covered entities	Privacy Rule, Security Rule, Breach Notification
GDPR	EU residents' data	Consent, data rights, DPO, breach reporting
CCPA/CPRA	California consumers	Disclosure, deletion rights
PIPA (Korea)	Korean data subjects	Consent, localization, breach notification

4.7 Vulnerability Management

Continuous identification and remediation of security weaknesses:

Vulnerability Lifecycle

• Asset Inventory: Know every device on the network
• Vulnerability Scanning: Regular automated scanning
• Risk Assessment: Prioritize by exploitability and impact
• Patch Management: Timely application of security updates
• Compensating Controls: Network isolation when patching impossible

4.8 Incident Response

Preparation for security incidents specific to IoMT environments:

IoMT Incident Response Plan

• Detection: Monitor for anomalous device behavior, network patterns
• Containment: Isolate affected devices without disrupting care
• Investigation: Forensics considering clinical context
• Recovery: Safe restoration with integrity verification
• Post-Incident: Root cause analysis, improvement actions