An IoT Security Risk Assessment Framework for Healthcare Environment

Risk Assessment for IoT is important for analyzing the risks associated with deploying and using IoT technologies. A risk assessment framework helps organizations identify, assess, and manage the risks of IoT, which can range from data privacy and confidentiality to system integrity, availability, and performance. The significance of risk assessment in medical sectors, particularly in emergency rooms, is more imperative due to the criticality of the service. This paper presents an IoT risk assessment framework for the healthcare environment, in which we have improved upon existing methodologies. The proposed framework dynamically calculates the risk score for different device profiles, considering their population and other parameters, such as network protocols, device heterogeneity, device security updates, device physical security status, device history status, layer history status, and device criticality. We validate our proposed framework by simulating an emergency room environment, considering a variety of devices and parameters. The results show that our framework provides more insight into the overall risk assessment, as it takes into account the number of IoT devices and their relation to a threshold we introduce, which can be tuned by the security expert.