# Towards Design and Development of Security Assessment Framework for Internet of Medical Things
## 1 Introduction  
In the medical profession, technological advancements have brought both opportunities and obstacles. Medical devices and healthcare data have progressed from stand-alone to networked arrangements [1, 2]. In the healthcare industry, the ever-expanding web of linked devices is increasing at a rapid pace and across a wide range of industries. Nowadays, the normal hospital room has 15 to 20 linked pieces of health equipment, with large hospitals having up to 85,000 [3]. Integrating a healthcare Cyber-Physical System (CPS) might significantly reduce clinical mistakes as well as expenses, enhance patient care as well as intervention quality, strengthen workflow productivity, and lower the workload of healthcare workers. Moreover, it reveals flaws that could make healthcare systems vulnerable to cyberattacks [4]. The proliferation of networked equipment is altering the cyber threat environment. Threats are becoming more prevalent and complex. A malicious user may use wireless techniques to inject instructions that change the capabilities of gadgets or jam wireless indicators to prevent device accessibility as well as therapeutic delivery [5]. Medical supplies can be used in cyber warfare to target public officials who use them, as well as potentially trigger significant health issues or fatalities [6]. Medical equipment cybersecurity weaknesses cause approximately 100 patients to be affected each year. Susceptible public healthcare big data are stored in healthcare network systems, which are guarded by security and privacy regulations. Moreover, network-connected healthcare systems are often highly susceptible to privacy and security threats than general-purpose network servers as well as end devices due to the wide range of equipment. The calibration and maintenance of medical equipment are normally the responsibility of biomedical or clinical engineering departments. Security, healthcare data protection, and cleanup are tough for them because they are not IT organizations. Medical devices have extensive product life cycles and rely on operating systems from previous generations. Fixing and updating such systems is not always feasible, and when it is, configuration can be challenging, possibly requiring acceptance testing. Medical device manufacturers, not device owners, ought to be responsible for security fixes for system control as well as setup validation [7]. Manufacturers' lack of access limits security and data protection improvements, as well as quick solutions. Because embedded devices have limited memory, manufacturers frequently employ modified versions of standard operating systems. As a result, applying software patches and security solutions is difficult. To decrease training costs, most healthcare professionals prefer to employ a single model and manufacturer. As a result, a uniform environment will be formed, allowing security breaches to spread quickly throughout systems. Vulnerabilities in medical devices pose a threat to both data and patients. In the healthcare industry, the utilization, as well as the incorporation, of wired and wireless networked electronic devices has raised the danger of cyberattacks. The majorities of these devices have open TCP/UDP docks and enable protocols such as TFTP, FTP, and Telnet, which are susceptible to assaults by default [8]. Techniques such as ICMP and NMAP should be used to request device profiles, but they will quit functioning if they are exposed to multipath network activity produced by worms, viruses, and other malware. Medical tools are also very seldom modified or retired from service. The four categories of cyberattacks on medical equipment are remote, physical by authorized individuals, physical by unauthorized individuals, and physical by criminal activities [9]. Wireless-based attacks such as jamming, eavesdropping, replay, and injection can compromise medical devices [10]. The likelihood of software vulnerabilities has increased as a result of the large number of software applications in medical equipment [11].