Healthcare Systems Lag in Post-Quantum Cryptography Readiness, Forescout Finds
Summary
Forescout’s analysis of 2.5 million devices across more than 50 healthcare organizations found limited post-quantum readiness, including thousands of Internet-reachable systems handling medical records or imaging data.
Key points
- Only about half of surveyed IT devices, 16% of OT devices, and 6% of IoMT devices had SSH implementations capable of supporting post-quantum cryptography.
- Researchers found more than 5,500 Internet-reachable healthcare systems containing electronic medical records or medical imaging data; just 31% used TLS 1.3.
- Healthcare data may remain sensitive for decades, creating potential exposure to “harvest now, decrypt later” attacks.
- Legacy medical equipment can be difficult to upgrade because of long lifespans, specialized software, vendor involvement, and regulatory review.
- Forescout recommends prioritizing long-lived sensitive data and Internet-facing systems, improving visibility into data flows, and building a migration roadmap.
Article Details
- Publisher
- Forescout Technologies
- Scope
- Assessment of post-quantum cryptography readiness in healthcare systems and devices across healthcare delivery organizations.
- Sample Size
- Approximately 2.5 million devices across more than 50 healthcare delivery organizations.
- Key Statistics
- About 50% of surveyed IT devices had SSH implementations capable of supporting PQC.
- 16% of surveyed OT devices and 6% of surveyed IoMT devices had SSH implementations capable of supporting PQC.
- More than 5,500 healthcare systems containing electronic medical records and medical imaging data were reachable from the public Internet.
- 31% of those Internet-reachable systems used TLS 1.3.
- Recommendations
- Begin preparing for PQC migration before large-scale quantum attacks become practical.
- Prioritize migration by risk, starting with sensitive, long-lived data such as electronic health records, medical images, lab records, and prescription records.
- Prioritize Internet-facing systems such as patient portals, APIs, and VPN gateways that can be upgraded relatively quickly.
- Improve visibility into where sensitive data resides and travels, and which systems expose it to external networks.
- Coordinate migration among infrastructure, clinical and biomedical engineering, architecture, application, procurement, compliance, and medical-device teams.