A Cyber Risk Assessment Approach to Federated Identity Management Framework-Based Digital Healthcare System | JoVE Visualize

Area of Science:

Cybersecurity in Healthcare
Medical Device Security
Digital Health Systems

Background:

Collaborative digital healthcare systems using Medical Cyber Physical Systems (MCPS) and Internet-of-Medical Devices (IoMT) offer benefits but introduce significant security challenges.
Vulnerabilities in Federated Identity Management (FIM) and inherent weaknesses in IoMT devices create critical risks for sensitive healthcare data and patient safety.
The interconnected nature of these systems necessitates a robust approach to cyber-risk assessment to prevent potentially life-threatening cyber attacks.

Purpose of the Study:

To propose a novel, comprehensive, and evidence-based cyber-risk assessment approach tailored for FIM-enabled MCPS and IoMT healthcare systems.
To address the unique security challenges posed by the convergence of IT infrastructure, medical devices, and FIM protocols in digital healthcare.
To provide a framework for prioritizing and mitigating cyber risks to enhance the overall resilience of digital healthcare systems.

Main Methods:

A three-dimensional attack landscape analysis was employed, examining IT infrastructure, medical devices, and FIM protocols.
The approach integrates established standards such as Cyber Resilience Review (CRR) for asset management and NIST SP 800-30 for risk assessment.
Validation was performed using threat modeling techniques, including attack trees and detailed attack sequence diagrams on diverse IoMT and MCPS devices.

Main Results:

The developed approach provides evidence-based cyber-risk assessments by analyzing interconnected vulnerabilities across healthcare IT, medical devices, and FIM.
Tailored security controls are recommended to effectively prioritize and mitigate identified critical risks, thereby enhancing system resilience.
Threat modeling and attack sequence diagrams demonstrated the practical application and validation of the assessment methodology on various vendor devices.

Conclusions:

The proposed cyber-risk assessment approach offers a structured method for safeguarding digital healthcare systems against sophisticated cyber threats.
Implementing the recommended security controls supports healthcare providers in improving patient safety and medical device security management.
This research contributes to building more resilient and secure FIM-enabled healthcare ecosystems, crucial for modern digital health delivery.