{'fraction_non_alphanumeric': 0.024944514136832963, 'fraction_numerical': 0.006947795040046318, 'mean_word_length': 5.1927098894532415, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
The internet of things in healthcare: anoverview, challenges and model plan for security risks management process

Received Dec 12, 2018 Revised Feb 10, 2019 Accepted Mar 2, 2019 The Internet of Things (IoT) has not been around for very long. However, since the notion of IoT introduced, most of IoT studies focused on a strategic level such as planning, architectures, standardization, and latest technologies, however, studies of risk management plan of IoT are still lacking. IoT has been widely used to link existing medical resources and provide reliable, effective and smart healthcare services to elderly and patients with chronic illnesses. However, a systematic process is missing when managing and anticipating the risk of IoT usage in healthcare. For this purpose, this paper extensively explores various IoT technologies used in health care services and its security challenges. As a result, IoT Security Risk Model for Healthcare is introduced to cater a complete process of risk management based on ISO/IEC 27005:2018 standard. It is believed that by having this model, it will emphasize on iterative IoT risk management process as it may increase the depth and detail of the assessment at each iteration.


INTRODUCTION
It was in 1999, the term Internet of Things (IoT) firstly introduced in the EPC Global standards [1]. The aim is to expand the Internet from the network computer to a matter (or object) network. The IoT is a concept that reflects a relevant group of anything, anytime, anywhere, any service, and any network. The main underlying components of IoT are Hardware, Middleware and Presentation [2]. The hardware consists of sensors and actuators, while the middleware is referring to data storage and computing tools for data analytics. Finally, the presentation is the visualization and interpretation of the data via an online interface or web-based platform [2,3] The IoT is megatrend in next-generation technology, which affects the entire spectrum of businesses due to the ability to interconnected smart objects and any unique devices. Thus, it brings extended benefits to the existing internet infrastructure such as advanced extensions of devices, systems, and services of machineto-machine (M2M) scenarios [4]. In reality, the IoT provides appropriate solutions for a wide range of applications for example in smart cities, healthcare, security, traffic management, emergency services, logistics, retails, waste management and industrial control.
The usage of IoT in the healthcare industry has increased dramatically. Thus far, most of the IoT's application in healthcare initiatives revolve around enhancement of care such as remote monitoring and telemonitoring of patient's health condition [1]. In addition, there are also IoT initiatives on tracking, monitoring and maintaining assets such as the inventory of medical equipment, healthcare assets, and the level of non-medical assets (e.g. facilities and building assets) [5]. The IoT-based healthcare services are expected to reduce costs, improve quality of life, and enrich the user experience [6]. IoT can correctly identify the optimal time to add supply to various devices for their smooth and continuous operation. Figure 1 explains the recent health care trends.

Figure 1. Healthcare trends
The cost-effective interaction facility through seamless and secure connections across patients, clinics, and individual healthcare organizations is the most important aim in any healthcare services. The latest healthcare network driven by wireless technology is expected to support chronic illnesses, early diagnosis, real-time monitoring, and medical emergencies [7][8]. Therefore, IT architects, medical servers and healthcare databases play an important role in creating health records to deliver on-demand health services to authorized stakeholders.
However, these innovations can also put a big risk on healthcare security efforts. In this hyperconnected, technology-driven world, data breaches and cyber-attacks remain a significant threat to organizations, and a lack of awareness of the risks is often to blame. As stated by several studies [9][10][11], there are so benefits that come with these new connected devices but they also present new unexpected risks and vulnerabilities. For example, the average cost of a healthcare organization data breach has exceeding USD 3.6 million, which is almost USD 380 per individual data record [12]. Therefore, looking at this loss, this paper aims to investigate what are the challenges and risk of IoT in the healthcare industry, followed by proposing a security risk model plan for healthcare IoT ecosystem.

ISSUES AND CHALLENGES IN HEALTHCARE IOT AND ENTERPRISE RISK MANAGEMENT
In recent years, there has been an increasing amount of studies on IoT as well as on ICT Security Risk. This section will explain those areas in details by focusing on the issues and challenges in health IoT implementation and security risk management in an enterprise.

Challenges in Healthcare IoT Implementation
The most ccommon problem in bringing IoT to the enterprise is about their security issues. As a healthcare organization rushing to adopt and implement this next-generation technology, the priority for security has turned toward convenience and ease of use to eliminate the company's downtime. Unfortunately, this means that security is usually much lower on the priority list than it should be. With more innovations, difficult challenges arise. Following are the several challenges identified when implementing IoT in the healthcare enterprise.
Privacy in Healthcare Application: Healthcare application contains lots of sensitive information, including personal details, medical condition, prescriptions, and medical history. If the hacker has ever held this information, they will be able to make a fake ID to purchase medicines or medical equipment for resale. In certain cases, the attacker may have direct control over IoT equipment, which results in potentially fatal results. For example, Johnson & Johnson warned patients about unsuspected insulin pumps that allow hackers to inject insulin injections without permission [13].
Asset Security Management: In most cases, security leaders use the same strategy that preceded the proliferation of IoT devices but implemented them in new ways. It is always being a matter of knowing where the device is located, and what they are doing on the network and its implementation within a facility [14][15]. Most IoT devices do not include controls to protect their connected network from threats should an emergency scenario occur [16]. Hence, this becomes a challenge to the health care provider in managing and ensuring the security of their asset including the IoT asset.
Data and analytics complexity: The usual practice seen in this industry is that they send their sensor data directly to the cloud or datacenter [17][18]. This is not always the best option as it can make latency, drive costs, and unlock security risks. Those risks also include harm to the patient's safety and health. The huge amount of data collected via IoT devices also require more processing time as it requires a massive Extract-Transform-Load (ETL) process.
BYOD Trend: Bring Your Own Device (BYOD) is a nowadays trend. Despite the benefit imposed such as flexibility and own personalization of application usage, however, it became one of the threat in IoT environment [19][20]. For example, the control mechanism of all the devices entering hospitals become more complicated because it can consist of an extensive range of channels and devices. It becoming harder to recognize and monitor the device operation. Beyond that, BYOD may introduce additional risks by putting these standalone devices into the hospital's network without the authorization.
Lack of awareness about IoT Security: Lastly is the lack of awareness on IoT security among the healthcare stakeholders. Providing an understanding of IoT security from a user's perspective is not an easy task. Since the use of IoTs is growing and changing, there needs to be a widespread awareness of them within the healthcare ecosystem [20][21]. Only through persistent push and promotion by healthcare authorities, medical and IT providers can assure the secured practice is embedded in IoT implementation.

Security Risk Management in an Enterprise
As of today, there is still no comprehensive security risk management for IoT [22][23]. They still need action call for IoT risk management like IoT devices to require new approaches to security, need further look to the network for better security (e.g. gateways, transport networks, DC / Clouds) and a network virtualization, which brings opportunities for better security, not just an operational savings [9]. To develop an IoT Security Risk Management Model there are three aspects to consider which are 1) IoT Security Technology, 2) IoT Safety and System Security Assurance and 3) IoT Network Infrastructure Safety.
IoT Security Technology a. Creating conditions, developing architecture, basic IoT's basic security structure design, developing information gathering, transmission, processing and technology applications specific to the IoT capabilities introduced b. Performs privacy protection, device/node validation, access control, cryptographic key management, infrastructure update security, intrusion detection and fault tolerance steps IoT Safety and System Security Assurance a. Develop a risk management plan built around NIST and ISO frameworks and government regulatory compliance requirements specific to IoT. This plan should include the establishment of a third-party compliance verification security system established. b. Implementing SDLC and interoperability programs to cover the overall life cycle planning, design, operation and maintenance of the IoT c. Establish service level agreements for IoT outsourcing projects or application development to ensure IoT application security, risk management and system reliability assurance IoT Network Infrastructure Safety a. Design secure integration architecture design for secure integration of IoT devices and applications into existing network architecture. This will ensure the full integration of existing resources with new technology application space, recognizing the smooth and compatible conversion of old and new technologies, and ensuring the safety and security of the IoT infrastructure.

RESEARCH METHOD
IoT in the healthcare ecosystem has become a demanding technology and require an intensive attention to its security aspect. To analyze this situation, this study has selected Hospital Kuala Lumpur (HKL), Malaysia as a case study. It is the largest government hospital located in Kuala Lumpur, which comprises of 53 different departments; including the pharmaceutical department, training and research, clinical departments and clinical support services. Estimated, there are 2300 in-patients in one time in HKL. To date, HKL has partially implemented IoT infrastructures to cater customers need. However, it is still at the infancy stage. This is due to the lack of technical capability in supporting the IoT operation, as well as HKL, still, do not possess any strong risk management system. Their current practice on risk management totally relays on staffs' daily monitoring activities while the IT Department monitors IT-related threats. This brings strong justification why it is best to adopt HKL as a case study as their Healthcare IoT initiative is still at infancy level, thus it provides more flexibility in developing their IoT Security Risk Management Model.

RESULTS AND ANALYSIS
Looking at the HKL unique case study, which is a massive healthcare with a sophisticated ecosystem, it is predicted that HKL has many types of IoT devices and technology, various type of data and process as well as multiple stakeholders need and request. Thus, to cater to these varieties of requirements this study proposes that HKL should adopt the newly revised ISO/IEC 27005:2018, Information technology -Security techniques -Information security risk management [24]. This standard will provide guidance for organizations on how to wade through it all by providing a framework for effectively managing the risks, which in this case is IoT technology. This standard will assist on establishing the risk management context (e.g. the scope, compliance obligations, approaches/methods to be used and relevant policies and criteria such as the organization's risk tolerance or appetite). This standard also can quantitatively or qualitatively assess (i.e. identify, analyze and evaluate) relevant information risks by taking into account the information assets, threats, existing controls and vulnerabilities to determine the likelihood of incidents or incident scenarios, and the predicted business consequences if they were to occur, to determine a 'level of risk.
Once the threat is identified, the guideline provided in this standard shall suggest either to modify [use information security controls], retain [accept], avoid and/or share [with third parties]) the risks appropriately by using those 'levels of risk' to prioritize them. Finally, this standard also emphasizes keeping stakeholders informed throughout the process; as well as monitor and review risks, risk treatments, obligations and criteria on an ongoing basis and responding appropriately to significant changes.
Given the ISO/IEC 27005:2018 in place, this means different data source interoperability needs to be addressed and all connected devices need to communicate with each other. When the patient's data goes in, the health system should have the infrastructure, resources and processes to take the expected picture of the party that the guard can use. Finally, when cyber-attacks are increasingly threatening, their health systems and partners must ensure their network protection by investing in viable features and capabilities. Since IoT devices capture and transmit data in real-time, the infrastructure for receiving and processing and storing this data from millions of devices should be planned and built to scale. Figure 2 shows the proposed model about the security risk management to address the IoT security challenges or risks in the healthcare enterprise based on ISO/IEC 27005:2018.
This IoT Security Risk Model for Healthcare cater a complete process of risk management as stated in ISO/IEC 27005:2018. ISO/IEC 27005:2018. It is designed to be an iterative process as it may increase the depth and detail of the assessment at each iteration. Firstly, is to establish the context, which is IoT in healthcare (HKL). Then a risk assessment is conducted. If this provides sufficient information to effectively determine the actions required to modify the risks to an acceptable level, then the task is complete and the risk treatment follows. However, if the information is insufficient, another iteration of the risk assessment with revised context such as risk evaluation criteria and risk acceptance criteria is conducted perhaps in partly scope. In overall, the effectiveness of the risk treatment largely depends on the results of the risk assessment.
Firstly, is the context establishment whereby in this case is the IoT risk in healthcare. Followed by the risk assessment which consists of risk identification, risk analysis and risk evaluation. Then it reaches at a decision point in determination either it is risk or not. If it is not a risk it will return back to original context establishment with no risk associated with it. However, if it is a risk then the next step is to conduct the risk treatment. Then it will reach another decision point to determine either the risk is successfully treated or not. If it is not, then the process will be iteratively done until it reached the acceptance level. Subsequently, if the risk is successfully treated then the risk is considered acceptable and will be put into a proper communication and monitoring review. The detailed part of the risk assessment is presented in the extended diagram of Figure 2, which highlighted five IoT layers of risk technology assessments starting from the inner layer 1) authentication, 2) encryption, 3) secured boot, 4) intrusion prevention system and firewall, and 5) education and policies. Following are details description of each layer.
Authentication: To ensure the safety of the patient, the hospital must ensure confirmation. A twofactor authentication system (2FA) needs to be installed to access patient records, when users provide additional information to log in (e.g. retinal scans, phone text codes, DNA samples, fingerprints, etc.), not just logins and passwords. IoT devices use a wide variety of protocols and standards, therefore, familiarity with these variations is a must and intimate knowledge of the IoT devices purchased is necessary to ensure that each device is capable of authentication in a secure manner. Some may need a manual update (lacking OTA functionality) and others may have locked settings that cannot be changed from the default. Therefore, it is possible to limit access to gadgets and systems and maintain tight controls over device-to-device to communication devices. Encryption:Another basic safety sanitation practice is encryption. It's very easy to get access to health records through mobile devices, but this procedure also requires security risks. To minimize the risk of data breach and avoid negative results it is important to encrypt data (both during transit and stored). As far as storage encryption is concerned, healthcare institutions should ask their sellers to use hardware level encryption. Unlike software-based encryption solutions for mobile devices that reduce performance by exploiting these resources like CPU cycles and memory, hardware-level encryption, as a rule, has no remarkable effect on performance. Thus, encryption should be at the core of every IoT device in order to reach a state in which data is fully encrypted in storage and transit alike.
Secure boot:A secure boot process prevents the execution of unauthorized code at the time of device power-up and prevents the exposure of embedded boot code and software IP. A secure boot process can be accomplished in many different ways, including using digitally signed binaries, secure and trusted boot loaders, boot file encryption, and security microprocessors. This practice also aims to prevent additional problems and to ensure the safety of IoT devices. With secure boot, it is assured that no configuration has changed when the device is switched on and no one tries to interrupt the device. Intrusion prevention system and firewall: Since that most IoT attacks are delivered over the internet, intrusion prevention systems and firewall are crucial to identify and prevent anomalies from trying to gain access to your network. This means that hackers who try to access or close your IoT equipment will stop before they damage the system. Education and Policies: With the emergence and use of new technologies, it is important to ensure all hospital IoT users are aware of new challenges, risks and know how to overcome them. In addition, patients represent an indispensable part of the healthcare enterprise (they are active users of IoT devices), so, raising awareness through clear and detailed instructions should not be ignored. In addition, it is vital to have a documented policy from the Ministry of Health to serve as a guiding framework in supporting and enforcing the secured IoT used.

CONCLUSIONS
This paper had covered about the description of the IoT, focusing in the healthcare enterprise, the risks of IoT concerns, followed by the proposed model for security risks management process in a healthcare environment. From the previous studies conducted, it is highly suggested that the future of IoT in healthcare are promising with strong potential to grow. Although progress may be slow due to various obstacles, however with good planning and model in place, this issue can be resolved. The IoT has certainly brought many advantages to the healthcare industry and eventually bring benefits to a human being as well.
Given HKL as the case study, this study proposes a new improved model to enhance its IoT Security Risk Management model to suit the complexity of its business. Since this is still at the preliminary and design phases, it is expected that this model shall evolve once it receives the feedback from the IT and business personnel in HKL. In the future, this IoT Security Risk Management Model can be implemented to other hospitals in Malaysia as a way achieving the expected standard of IoT security risk defined.