Forescout Report Details Post-Quantum Crypto Hurdles in Healthcare OT Systems
A new study reveals that upgrading medical devices to quantum-resistant standards is complex due to firmware limits and long-term data risks.
Key points
- Healthcare faces unique post-quantum migration challenges due to long-lived sensitive patient data and rigid OT infrastructure.
- Attackers can harvest encrypted medical traffic today to decrypt later using future quantum computing power.
- Upgrading embedded medical devices requires full firmware updates and potential re-certification, unlike server software patches.
Cybersecurity firm Forescout published a report detailing the significant obstacles healthcare organizations face when migrating to post-quantum cryptography. The study highlights that operational technology devices in medical settings present a particularly difficult path toward quantum readiness compared to standard IT infrastructure.
The research examined more than 2.5 million devices across over 50 organizations. Researchers found that the migration is critical for patient safety, not just data confidentiality. Cryptography currently protects commands sent to medical equipment, diagnostic telemetry, and medication orders.
Technical and Operational Challenges
Standard servers can often adopt quantum-resistant algorithms through simple library upgrades or configuration changes. However, embedded healthcare devices require comprehensive firmware updates from their original manufacturers. These hardware-bound systems cannot simply patch software in the same way live server environments do.
Furthermore, these firmware upgrades must maintain backward compatibility with other systems that may not be updated simultaneously. Certified medical devices may also require re-certification after any cryptographic changes are applied. This regulatory requirement adds significant time and complexity to the migration process for healthcare providers relying on legacy equipment.
The Harvest Now, Decrypt Later Threat
The urgency stems from the “harvest now, decrypt later” threat model. Adversaries can collect encrypted traffic containing sensitive medical histories, diagnostic images, and laboratory results today. They store this data with the intent to decrypt it once sufficiently powerful quantum computers become available in the future.
Medical data retains its sensitivity for decades, making it a prime target for this strategy. If attackers intercept this information now, they can compromise patient privacy years from now. This long-term risk applies to any industry where operational technology handles business-critical or sensitive data that must remain confidential for extended periods.
Who Is Affected
While the Forescout report focuses on healthcare, these issues extend to industrial installations and any sector relying on IoT or OT devices. The G7 Cybersecurity Working Group recently urged governments and organizations to begin migrating to post-quantum cryptography immediately. They warned that the transition will be lengthy and requires preparation before quantum computers capable of breaking current encryption standards emerge.
Quantum threats include unauthorized remote access via exploited public keys, traffic decryption that allows tampering with device-to-device communication, and sophisticated malware that exploits firmware integrity signatures. These vectors highlight the broad scope of risk beyond simple data theft.
What should you do?
Organizations should begin inventorying all operational technology and IoT devices that handle sensitive data. Security leaders need to identify which embedded systems lack the ability to receive firmware updates or cryptographic upgrades.
What to do and how to stay safe: Forescout
- Audit your network to identify all operational technology and IoT devices that process sensitive or long-lived confidential data.
- Determine which embedded systems cannot be updated with standard software patches and require manufacturer firmware releases.
- Monitor vendor announcements for post-quantum cryptography support and compliance requirements for certified devices.
- Implement network segmentation to limit exposure of critical OT devices to potential data harvesting attempts.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why is post-quantum migration harder for healthcare than for standard IT?
Medical devices are embedded systems requiring full firmware updates and potential re-certification, unlike servers that can use library upgrades.
What is the harvest now, decrypt later threat?
Attackers collect encrypted data today to decrypt it in the future using advanced quantum computing capabilities.
Which organizations are most at risk according to Forescout?
Industries dependent on IoT and operational technology, particularly healthcare, where data remains sensitive for many years.
