# Towards Design and Development of Security Assessment Framework for Internet of Medical Things
## 1 Introduction
For example, arbitrary code execution due to a buffer overflow vulnerability, inadequate authentication method, unsuitable credential storage, and unauthorized firmware updates due to improper usage of the Cyclic Redundancy Check were discovered in [PERSON] et al. 's research [12]. Insiders, outsiders, and natural phenomena can all pose a threat to medical devices, which can be inadvertent or intentional. Threats are classed as passive or active, according to [PERSON] et al. Information collection, interception, and the sniffing of network data are examples of passive threats. Intense attacks include functional coverage disturbance, social manipulation, data leakage, spoofing or identity fraud, spoofing, denial of service, harmful programs, theft of intellectual property, physical harm, and backdoors, as well as the possible loss of patient records. The creation of advanced CPSs has shifted the design of medical equipment from passive to active devices, which also include intelligent analytic systems with sensing devices [13,14]. Healthcare equipment consists of implantable medical devices (IMDs) as well as wearable medical equipment with wireless transmission functionality. IoMT (Internet of Medical Things) is also linked to the cloud as well as a CPS. Various communication methods are used in CPS applications, including diverse protocols and wired and wireless technologies. Wireless communication is widely employed in medical devices. Medical Implant Communication Service (MICS) signals are used by IMDs, while body area network (BAN) signals, for example, Bluetooth and ZigBee, are used by wearable devices [15]. Impersonation, eavesdropping, and jamming are the most common security vulnerabilities in wireless communication, all of which can be used to undermine the healthcare CPS [16]. Healthcare-related CPSs, for example, IMDs, BANs, and wearable equipment, play a vital role [5] because of their low processing capability, communication complexity, and limited battery life, privacy, and security. The level of security in any system varies depending on the sensitivity of the information and the control system. Because of insufficient standard interfaces and communication protocols, designing, developing, and implementing a viable CPS in application fields such as healthcare present a number of challenges and limitations [17]. A CPS in the healthcare setting faces issues such as software reliability, medical equipment suitability, data retrieval, technology demonstrator architecture, advanced query processing, privacy and security, and system feedback [18; 19]. During data storage, processing, extraction, and reversal to the CPS, a security threat always persists. Lack of network security, ransomware, device vulnerabilities, applications, fake data generation, unauthorized changes in data, and data cleaning problems are all challenges for healthcare big data. Ransomware, malware, and crypto-jacking are some of the most serious dangers to medical devices and healthcare data [13]. Ransomware is among the highly widespread dangers, compromising healthcare information as well as hindering users' or medical personnel's access to their system unless a large sum of money (a ransom) is paid in exchange for access. If the demanded ransom is not paid in a timely manner, the data may be automatically deleted. More than 78 percent of medical suppliers have been hit by ransomware, spyware, or even both in the last year. Crypto-jacking permits a vulnerable device's computing power to be used to mine cryptocurrency, shortening its lifespan and putting patient as well as medical care information at risk. To avoid or reduce potential cyber threats to medical equipment, vulnerabilities in medical devices and healthcare data generated by the devices must be addressed. As a result, at all stages of the device's data processing lifecycle, a proactive strategy is required. An Attack Surface Reduction technique is presented in this study. The following are the contributions of this research project. 1.