IT and Internet of Things (IoT) systems across the healthcare sector appear largely unprepared for the post-quantum cryptography (PQC) era, leaving sensitive data potentially vulnerable to "harvest now, decrypt later" attacks.
The situation is particularly acute for Internet-exposed healthcare systems, many of which lack support for TLS 1.3, the foundation for deploying standardized post-quantum cryptography.
Researchers from Forescout Technologies recently analyzed some 2.5 million devices deployed across more than 50 healthcare delivery organizations and uncovered significant gaps in readiness for PQC.
Healthcare: A State of General Quantum Unpreparedness
Only half of the IT devices surveyed, for instance, were running SSH implementations capable of supporting PQC. The numbers were significantly lower for operational technology (OT), at 16%, and Internet of Medical Things (IoMT) devices, at just 6%.
Examples of OT/IoT assets in healthcare delivery organizations include VoIP phones, printers, point-of-sale systems, kiosks and physical-security equipment. IoMT devices include patient monitors, insulin pumps, defibrillators, ventilators, and laboratory and imaging equipment many of which handle or transmit highly sensitive patient and clinical information, including medical readings, diagnostic data and treatment-related information.
Forescout also identified more than 5,500 healthcare systems containing electronic medical records and medical imaging data that were reachable from the public Internet. Just 31% of those systems were using TLS 1.3, leaving much of the exposed healthcare infrastructure without support for current PQC standards.