Security risk assessment of internet of things health devices using DREAD and STRIDE models

A high volume of IoT devices used in healthcare is not regulated for security, which can allow attacks to occur that endanger healthcare organizations based on the value of patient data. Such devices are primarily implemented in a way that prioritizes usability and cost. Security is rarely prioritized due to a lack of universal security standards. The threats are constantly evolving, and strengthening device security has become a high-priority task. We conducted a qualitative and quantitative risk assessment of the twenty-three top IoT-based health devices using the qualitative STRIDE model for threat identification, and the quantitative DREAD model for threat prioritization. Specific countermeasures are proposed for each risk, which, if properly implemented, can considerably reduce vulnerabilities. We also present a prototype web platform for interactive, user-friendly risk assessment and security awareness in healthcare IoT, designed to enable improved protection for patients from the inefficient provision of security through unsafe technologies.