# Health IoT Threats: Survey of Risks and Vulnerabilities
## 4 Results
### Overview of IoT Security and Privacy in Healthcare
#### 4.1.2 The Network Layer  
The network layer, responsible for data transmission between devices, presents unique security challenges in healthcare IoT systems. The very flexibility and scalability of IoT networks [115] along with the mobility of devices complicate securing this layer [77]. The vast array of IoT devices often utilizes diverse network protocols for data transmission [92] This heterogeneity makes it challenging to implement a single, unified security protocol that caters to all network types (wired and wireless). Even existing security models have inherent flaws [77]. Establishing robust security standards across various networks, including cellular (4/5G), ad hoc, and Wi-Fi networks, is crucial [36]. It is important to note that security vulnerabilities in this layer can resemble conventional network security challenges. The network layer is susceptible to attacks like Trojan horses, viruses, spam, packet spoofing, route falsification, and flooding attacks, potentially leading to information disclosure [116]. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Issue or Attack** & **Explanation and Highlight** & **Countermeasure** \\ \hline Side-Channel & This occurs when an attacker uses information obtained from the physical operation of an IoT device to exploit security vulnerabilities, potentially compromising the security and privacy of patient information [92]. In 2020, researchers disclosed a side-channel attack on a popular medical device, showing how an attacker could use information obtained from the physical operation of the device to compromise patient information [111]. & Secure coding practices, such as constant-time coding [54], should be employed. \\ \hline Eavesdropping & An attacker intercepts and listens to the communication between an IoT device and the network, potentially stealing sensitive information [87]. & Encryption should be used for communication between IoT devices and the network [54]. Secure authentication methods like certificates or tokens can also be used to protect against eavesdropping [90]. \\ \hline Tampering Attacks & This occurs when an attacker modifies the data or configuration of an IoT device, potentially compromising the security and privacy of patient information [87]. & Digital signatures can be used to verify the integrity of data [112]. Secure software update mechanisms [113] can also prevent tampering. \\ \hline \hline \multirow{7}{*}{
\begin{tabular}{c} Inssufficient \\ Cryptographic \\ Algorithms \\ \end{tabular} } & The insufficient protection of sensitive data transmitted between IoT devices and networks due to the use of weak encryption protocols or lack of encryption altogether [114]. & Secure encryption protocols should be used for communication between IoT devices and the network. \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \cline{1-1}  & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: _Cont._The widespread use of wireless networks in healthcare IoT makes data inherently more vulnerable to eavesdropping due to the open nature of wireless communication [117]. Another significant security concern lies in the use of insecure communication protocols. Many healthcare IoT devices rely on unencrypted protocols like HTTP, which attackers can exploit to compromise patient data confidentiality and integrity [118]. Unencrypted data transmissions expose information to interception, modification, or deletion during transfer. The network layer is also susceptible to various threats such as packet spoofing, route falsification, and flooding attacks [60]. A prevalent issue is the lack of encryption within the network layer [119]. Encryption is a crucial security measure that helps protect patient data as they are transmitted over the network [120]. Without encryption, sensitive patient data can be intercepted and read by cybercriminals, compromising patient privacy and confidentiality [114].