Medical Devices Critical to Care Lag in Quantum‑Resistant Cryptography, Exposing Future Data Decryption Risk
What Happened — Forescout’s “Post‑Quantum Cryptography in Healthcare” report examined more than 2.5 million devices across 50+ health‑care delivery networks. Only 6 % of connected medical devices and 16 % of OT devices run SSH software capable of supporting quantum‑ready (PQC) algorithms, versus 50 % of IT devices. The study warns that patient data captured today could be harvested now and decrypted once practical quantum computers emerge.
Why It Matters for Trust & Control Assurance
- Continuous control‑assurance programs must inventory cryptographic posture across all IoMT/OT assets to prove protection against future quantum threats.
- Vendor oversight is essential; upgrade cycles, recertification, and hardware replacement dictate when PQC can be deployed.
- Documented compensating controls (segmentation, monitoring) provide defensible evidence for audit readiness on cryptographic‑protection objectives.
Who Is Affected – Hospitals, health‑system networks, medical‑device manufacturers, and any organization that relies on IoMT or OT for patient care.
Recommended Actions –
- Build a detailed inventory of all medical‑device and OT assets, tagging cryptographic capabilities.
- Engage vendors for PQC roadmaps and embed timelines into risk‑management processes.
- Apply compensating controls (network segmentation, strict access monitoring) for devices that cannot be upgraded promptly.
Source: Help Net Security article
Technical Notes – The threat model is “harvest‑now, decrypt‑later”: adversaries collect encrypted patient data now, intending to decrypt it once quantum computers can break current algorithms. SSH is the primary remote‑access protocol examined; lack of PQC‑capable SSH leaves the data exposed. Source: same as above