Work

Security risk assessment of internet of things health devices using DREAD and STRIDE models

Year: 2025

Type: article

Abstract: A high volume of IoT devices used in healthcare is not regulated for security, which can allow attacks to occur that endanger healthcare organizations based on the value of patient data. Such devices are primarily implemented in a way that prioritizes usability and cost. Security is rarely prioritized due to a lack of universal security standards. The threats are constantly evolving, and strengthening device security has become a high-priority task. We conducted a qualitative and quantitative risk assessment of the twenty-three top IoT-based health devices using the qualitative STRIDE model for threat identification, and the quantitative DREAD model for threat prioritization. Specific countermeasures are proposed for each risk, which, if properly implemented, can considerably reduce vulnerabilities. We also present a prototype web platform for interactive, user-friendly risk assessment and security awareness in healthcare IoT, designed to enable improved protection for patients from the inefficient provision of security through unsafe technologies.

Source: Ain Shams Engineering Journal

DOI: 10.1016/j.asej.2025.103721

Authors: Buhang Zhai, Oluwatobi Noah Akande, Saurabh Agarwal, Wooguil Pak

Institutions: Tiangong University, Nile University of Nigeria, Yeungnam University

Language: English

Topic: IoT and Edge/Fog Computing

Subfield: Computer Networks and Communications

Field: Computer Science

Domain: Physical Sciences

SDG: Good health and well-being

Open Access status: gold

Estimated APC paid: $1,200