[Paper Review] A Survey on Security and Privacy Issues in Modern Healthcare Systems: Attacks and Defenses

Akm Iqridar Newaz, Amit Kumar Sikder+2 more|arXiv (Cornell University)|May 15, 2020

Wireless Body Area Networks187 references62 citations

TL;DR

This survey analyzes security and privacy threats across modern healthcare systems, categorizes attacks, and reviews existing defenses and future research directions.

ABSTRACT

The recent advancements in computing systems and wireless communications have made healthcare systems more efficient than before. Modern healthcare devices can monitor and manage different health conditions of the patients automatically without any manual intervention from medical professionals. Additionally, the use of implantable medical devices (IMDs), body area networks (BANs), and Internet of Things (IoT) technologies in healthcare systems improve the overall patient monitoring and treatment process. However, these systems are complex in software and hardware, and optimizing between security, privacy, and treatment is crucial for healthcare systems as any security or privacy violation can lead to severe effects on patients' treatments and overall health conditions. Indeed, the healthcare domain is increasingly facing security challenges and threats due to numerous design flaws and the lack of proper security measures in healthcare devices and applications. In this paper, we explore various security and privacy threats to healthcare systems and discuss the consequences of these threats. We present a detailed survey of different potential attacks and discuss their impacts. Furthermore, we review the existing security measures proposed for healthcare systems and discuss their limitations. Finally, we conclude the paper with future research directions toward securing healthcare systems against common vulnerabilities.

Motivation & Objective

• Provide a detailed overview of a typical healthcare system and its components.
• Identify security and privacy goals and adversarial models in healthcare settings.
• Present a taxonomy of attacks on healthcare systems and assess their impacts using CVSS metrics.
• Summarize existing defense mechanisms and highlight limitations and open challenges.
• Offer future research directions to mitigate common vulnerabilities in healthcare systems.

Proposed method

• Describe a typical healthcare system architecture with its five components (medical devices, sensors, networking, data processing, and healthcare provider).
• Define security and privacy goals including authentication, confidentiality, integrity, non-repudiation, availability, and various anonymity properties.
• Develop a formal attack model classifying attacker goals, capabilities, and attack types (passive/active, hardware/software threats, side-channel, etc.).
• Survey and categorize reported attacks on healthcare devices and applications with impact assessments based on CVSS metrics.
• Review existing security and privacy defenses proposed for healthcare systems and discuss their limitations.
• Outline open challenges and future directions for securing healthcare systems.

Experimental results

Research questions

• RQ1 What are the main components and architecture of modern healthcare systems and their security/privacy implications?
• RQ2 What are the primary security and privacy goals and how can they be achieved in healthcare environments?
• RQ3 What attacks have been observed against healthcare devices and networks, and how severe are their impacts according to CVSS?
• RQ4 What defenses exist against these attacks, and what gaps remain to be addressed?
• RQ5 What future research directions could close the identified security and privacy gaps in healthcare systems?

Key findings

• The paper presents a three-tier healthcare system architecture (medical devices, personal devices, health servers/providers) and discusses authentication, confidentiality, integrity, non-repudiation, availability, and privacy requirements.
• A formal attack model is provided, detailing attacker goals (hardware modification, unavailability, data sniffing/modification, information leakage) and capabilities (physical/remote access, protocol knowledge, third-party devices).
• A taxonomy of attacks is offered, including hardware trojans, malware, ransomware, outdated systems, counterfeit firmware, weak authentication, privilege escalation, side-channel and spoofing threats, with CVSS-based impact assessments.
• The survey notes limitations in current defenses, highlighting privacy-preserving communications, encrypted databases, and the need for broader, end-to-end security solutions across healthcare ecosystems.
• Future directions emphasize comprehensive end-to-end security, standardization, continuous authentication, and robust privacy-preserving mechanisms across devices, networks, and providers.