# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 1 Introduction  
The latest advances in remote asset management have significantly changed the healthcare industry. Due to low costs and widespread adoption of the Internet-of-Things (IoT), wearable computing has enabled organisations to track and sense patients over secure telecommunication [1]. It is possible to attach devices to vulnerable patients under treatment and monitor essential physiological signs, such as cardiac rates, temperature, movement, and sugar levels, in near real-time [2]. Leveraging these IoT technologies away from hospital premises helps medical doctors make better and more timely decisions. This is due to the availability of important additional data that can then be analysed by automated information systems. Wearable devices can also empower patients to better understand and control their personal data sharing, thus preserving privacy objectives. However, these devices do pose a number of threats and vulnerabilities requiring attention and mitigative actions, and others have dubbed it the Internet of Threats [3]. In the healthcare domain, devices must adhere to additional constraints to ensure the safety and security of stakeholders. They must be compliant with other specifications and not interfere with underlying technologies. These devices are equipment referred to as Medical Internet-of-Things (MIoT), a subclass of IoT. MIoT sits within a broader cyber-physicalsystem (CPS) [4] adding remote management capabilities over distributed assets [5; 6; 7; 8]. Modern infrastructure design has incorporated MIoT into healthcare settings [9], especially after the COVID-19 pandemic [10]. Employing IoT in the patient's environment is highly advantageous; this typically involves IoT sensors monitoring patients and promptly transmitting data to sinks or servers for analysis. Solutions vary and examples include health prescription assistants (HPA), healthcare status monitoring (heartbeat, temperature, CO\({}_{2}\) levels, sensing features), tracking patients' movements, and detecting whether someone has fallen. Since its inception, security has been a key concern [11; 12; 13] and significant research has sought to address the security challenges and develop and deploy hardened solutions. All these inter-connected devices extend the feature set available to end-users; however, this comes with trade-offs between privacy and cyber security objectives. Despite having to comply with regulations by vendors, they must be sufficiently equipped with mechanisms to cope with accidental and deliberate malfunctions. These failures could be caused by flawed designs, poor testing, or active cyber-attacks aiming to exfiltrate personal and identifiable information (PII) [14] from stakeholders. Governments and organisations are enforcing legislation to protect users and patients, for instance, the Health Insurance Portability and Accountability Act (HIPAA), in the US, and the General Data Protection Regulation (GDPR), in the UK and European Union (EU). These efforts signal the need to safeguard and protect data with clear repercussions for violations; this further highlights the importance of secure MIoT systems. Stakeholders employing these technologies are under constant risk (for different meanings of 'risk', please refer to Appendix A.1) arising from different threat sources with varied impacts and occurrence likelihoods. Asset managers sitting on the edge of the infrastructure desire to offer end-users, customers or patients hardened MIoT equipment with protective assurances to ensure seamless interactions. They employ embedded software communicating status and health-related data that feed information systems (IS) so medical doctors can make timely choices to improve care delivery. These platforms, albeit tested widely by vendors before shipping, are not immune to the malicious advances of sophisticated threat actors. One remedy for establishing protections is to perform risk assessment (RA), choosing a methodology [15] with specific considerations for medical-based IoT [16].