# Health IoT Threats: Survey of Risks and Vulnerabilities
## 4 Results
### Overview of IoT Security and Privacy in Healthcare
#### 4.1.3 The Application Layer
Malware attacks on healthcare IoT systems are also a concern. Malware can infect healthcare IoT devices, allowing attackers to steal sensitive patient data, disrupt device operations, and compromise patient safety [124]. To prevent malware attacks, healthcare organizations should ensure that all IoT devices have up-to-date security patches and conduct vulnerability assessments and penetration testing regularly [149]. Another challenge is that healthcare IoT systems often rely on third-party software and services [150], which can introduce additional security risks. Many of these software and services may have vulnerabilities or may not be configured securely, which can allow attackers to exploit them and gain unauthorized access to the system. Healthcare organizations should perform a thorough security assessment of all third-party software and services before integrating them into their IoT systems. Table 6 presents a variety of security issues in the application layer. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Issue or Attack** & **Explanation and Highlight** & **Countermeasure** \\ \hline DDOS Attacks & \begin{tabular}{c} It can be targeted at medical \\ systems, disrupting access to \\ critical medical information and \\ services [147]. \\ \end{tabular} & \begin{tabular}{c} Healthcare organizations can \\ implement anti-DDoS measures \\ such as traffic filtering, rate \\ limiting, and network traffic \\ monitoring. They can also \\ consider using cloud-based \\ anti-DDoS services, which can \\ provide additional protection \\ against DDoS attacks [147; 148]. \\ \end{tabular} \\ \hline Insider Threats & \begin{tabular}{c} Employees or contractors in \\ clinical settings can intentionally \\ or accidentally cause a data \\ breach or steal \\ information [86; 151]. \\ \end{tabular} & \begin{tabular}{c} To mitigate the risk of insider \\ threats, healthcare organizations \\ can implement access controls \\ and monitor user activity [151]. \\ \end{tabular} \\ \hline Remote Access & \begin{tabular}{c} Remote access to medical systems \\ can introduce security \\ vulnerabilities if the access is not \\ properly secured [54]. \\ In 2019, a healthcare \\ organization’s remote access \\ system was hacked, exposing the \\ PHI of over 2 million \\ patients [152]. \\ \end{tabular} & \begin{tabular}{c} To secure remote access to \\ medical systems, healthcare \\ organizations can implement \\ secure authentication methods, \\ such as multifactor authentication, \\ and regularly update remote \\ access software and systems [54]. \\ \end{tabular} \\ \hline Outdated Software & \begin{tabular}{c} Outdated software \\ and Systems \\ \end{tabular} & \
\begin{tabular}{c} Outdated software \\ organization’s outdated software \\ was found to have a vulnerability \\ that allowed hackers to access \\ sensitive medical \\ information [153]. \\ \end{tabular} &
\begin{tabular}{c} To mitigate the risk of outdated \\ software and systems, healthcare \\ organizations should regularly \\ review and update their \\ technology, including software, \\ hardware, and systems [54]. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Security and Privacy Challenges of the IoT Application Layer. To mitigate these risks, healthcare organizations must implement appropriate security controls in the application layer, including data encryption, authentication, and access control mechanisms. Healthcare organizations should also use up-to-date software and security patches, conduct regular security assessments and testing, and ensure that default or weak credentials are not used in their IoT systems. Additionally, organizations should provide their employees with cybersecurity training to increase awareness of the importance of security and best practices in IoT security. In summary, healthcare IoT systems present several security and privacy challenges, particularly at the application layer.