Table 3.

Security and Privacy–Threats and Actions for Smart Healthcare Systems.

Type of Threats, Attacks	Requirements	Description	Possible Actions
Eavesdropping, Evil-twin access point, Man in the Middle	Confidentiality	Intended users (patients, medical staff or even devices) may only access confidential data. Confidentiality aims to secure this access. Smart Healthcare devices must be able to safely transfer their sensitive data.	Privacy is at risk when confidentiality is bridged. Early detection of such threats is crucial. To mitigate these threats, it is necessary to employ cryptographic techniques for preventing eavesdroppers from intercepting data transmissions between legitimate users.
Insider attack, Replay attack, Frame injection attack	Integrity	Any type of attack that can alter medical data can be catastrophic for a Smart Healthcare system such as a Hospital Information System. Integrity aims to guarantee the accuracy of the transmitted information without any falsification [66].	Detect such attacks as early as possible. All data values must satisfy semantic standards while unauthorized tampering is eliminated [72]. Employ techniques such as digest, digital signatures or watermarking in the case of multi-media data [73].
DoS, Beacon flood, Authentication flood	Availability	In a complex Smart Healthcare system, only authorized users and perhaps other systems should be able to access wireless network resources anytime and anywhere upon request.	Techniques such as spread spectrum techniques, direct-sequence spread spectrum, frequency-hopping spread spectrum can be employed [66] to mitigate such threats for IoT medical devices.
Impersonation, Password, Dictionary, Brute-force, Sniffer, Spoofing, Access aggregation	Authenticity	Specified to differentiate authorized users from unauthorized users. In Smart Healthcare systems authentication is crucial for all participating entities (patients, medical staff point, devices, etc.)	Use medium access control (MAC) address for authentication purposes. Also use network-layer authentication, transport-layer authentication and application layer authentication [66].