Secure SDLC for IoT Based Health Monitor

Internet of Things(loT) has found various applications in healthcare systems with the capabilities of connecting embedded devices in various systems to the internet providing immediate readings, remote monitoring and enabling enhanced decision making. Researchers have found critical vulnerabilities such as compromise of private health data, hackers monitoring private conversations via a baby monitor, compromise of a moving internet enabled car or shutting it down altogether while in motion. Attention to security is not increasing at the same rapid pace as the number of IoT devices. Hence, security is beginning to be a major concern with the advent of IoT, connecting numerous devices introducing new attack vectors. This paper is intended to focus on the benefits of integrating security in IoT. The paper begins with design and implementation of a basic Health Monitor for remote monitoring and tracking of pulse rate and body temperature of patients treated in hospitals. While developing the Health Monitor, security is integrated in the Software Development Lifecycle (SDLC). This integration intends to demonstrate identification and mitigation of the critical known security vulnerabilities thereby producing a much secure end product. Additional security assurance is provided by testing the IoT Health Monitor for applicable five of the Open Web Application Security Project (OWASP) top 10 IoT vulnerabilities: (1) Insecure Web Interface, (2) Insufficient Authentication/Authorization, (3) Lack of Transport Encryption, (4) Privacy Concerns, and (5) Insufficient Security Configurability. OWASP is a prominent neutral global charitable association with a sole objective to develop software security standards and necessary tools.