Cybersecurity risk assessment and management framework for medically implanted devices (MIDs)

Abstract

Medically Implanted Devices (MIDs) are advanced devices, such as pacemakers, brain stimulators, and insulin pumps, surgically implanted to transmit data to external readers. While MIDs improve patient health, they present significant health and privacy risks, as potential attacks could jeopardize patient safety and compromise sensitive medical data. Although no documented cases of MIDs being hacked exist, experts like Professor Kevin Fu and the late Barnaby Jack have shown that vulnerabilities exist, suggesting tampering is possible. To mitigate these risks, implementing security measures like mutual authentication and integrity protection is essential to ensure data confidentiality and accuracy. Research on the cybersecurity risks of MIDs is limited, highlighting the need for awareness and mitigation strategies. This research examines the security risks and threats associated explicitly with MIDs. It presents the security risk control measures required to secure MIDs, including threats specific to data transmission modes such as Radio Frequency (RF) telemetry, wireless and Bluetooth. It also investigates medical professionals' awareness of these risks through online Zoom interviews to examine if they are aware of the security threats that may endanger patients. The study also evaluates the cybersecurity risks and management framework for MIDs, developing best practice guidelines for raising cybersecurity awareness among medical professionals. It also explores whether healthcare organisations, such as hospitals, offer training on MID cybersecurity risks and whether medical device manufacturers provide cybersecurity materials to regulatory authorities before releasing MIDs. The research introduces the Unified Novel Model (UNM), an innovative framework that integrates the Threat Model and the Technology Acceptance Model (TAM). This model helps provide a more comprehensive understanding of how individuals assess and adopt technological innovations amid perceived threats, risks, and benefits.

Date of Thesis submission	2025
Original language	English
Awarding Institution	Western Sydney University
Supervisor	Alana Maurushat (Supervisor) & Abubakar Bello (Supervisor)