Critical Medical Devices Unable to Support PQC Transition
Forescout found that just 6% of Internet of Medical Things (IoMT) and 16% of medical OT are capable of supporting post quantum cryptography
Nenhum outro meio seguido pelo Zonactu publicou ainda esta notícia.
Most medical devices cannot be upgraded to post-quantum cryptography (PQC), leaving sensitive healthcare data vulnerable to future quantum-enabled attacks, an investigation by Forescout has found.
An analysis of more than 2.5 million devices across more than 50 healthcare delivery organizations (HDOs) observed that just 6% of Internet of Medical Things (IoMT) devices and 16% of medical operational technology (OT) devices use Secure Shell (SSH) implementations capable of supporting a transition to PQC.
This is significantly below the 50% of traditional IT devices that can support PQC implementation.
PQC refers to new cryptographic algorithms designed to protect data from attacks launched from quantum computers, which are predicted to be capable of breaking existing encryption methods in the next five years.
The Forescout report , published on October 6, highlighted that healthcare environments are highly dependent on IoMT, OT and IoT devices. Many of these systems are directly involved in patient care, such as infusion pumps, patient monitors, imaging systems, and laboratory equipment.
Yet these devices often have long lifecycles, limited upgrade paths and slower adoption of modern cryptographic standards.
Daniel dos Santos, VP of research at Forescout, warned: “Our research shows that the devices least prepared for the transition are often the same devices healthcare organizations depend on most for delivering patient care. Visibility into those assets and the data they handle is essential for building a practical migration strategy.”
Across the devices analyzed, the researchers identified more than 5500 internet-exposed systems.
These included platforms containing sensitive healthcare data, including electronic medical records (EMRs) and picture archiving and communication systems (PACs).
Of these exposed systems, just 31% support TLS 1.3, the only TLS version capable of supporting standardized PQC.
The researchers warned that these systems are particularly vulnerable to harvest now, decrypt later attacks, in which threat actors steal encrypted data today with the intent of decrypting it in the future when quantum computers become powerful enough.
This is because medical histories, diagnostic images, laboratory results, prescription records and other healthcare data retains its value and sensitivity for decades, unlike other types of information.
Forescout urged healthcare organizations to start preparing for quantum-enabled attacks now to ensure sensitive patient data is secure. It recommended a number of actions, including:
