Cybersecurity of Smart Sensing Insole Systems: A Threat Modelling Approach to Understanding Security Vulnerabilities

Embedded medical devices are being increasingly used to monitor and treat patients. The monitoring is especially important as in the UK’s 10-year health plan released in 2025, there is a push to both increase the use of digital technologies and to undertake a more proactive and preventative approach to healthcare. For patients with diabetes, having access to data provided by a smart insole can be used to supplement a loss of sensation and reduce the likelihood of further harm. However, as this involves digital technology, there is the potential for malicious adversaries to take advantage of these embedded medical devices to achieve various objectives.

Importance

When developing a healthcare product there are strict regulatory requirements that these products must meet, with different requirements depending on the potential for the product to cause harm to a patient. While the NHS offers cyber security guidance, this focuses on organisation security and security of IT networks. There is guidance for medical devices, but this is at a high level. As such, there is a need to understand in detail what goals adversaries may seek to achieve by attacking embedded medical devices and what potential paths could be taken to do so. With this information developers of medical devices such as smart insoles have a better understanding of the specific threat model they need to consider when securing their device.