Lt General (Dr.) Rajesh Pant is an internationally recognized Cyber Security expert, presently tenanting the prestigious appointment of National Cyber Security Coordinator at the Prime Minister’s Office, India. General Pant brings to the table an interesting mix of military operations, academic excellence, corporate governance, and cybersecurity wisdom. Prior to this, he was the Head of the Army’s Cyber Training establishment for three years. He served in the Army Signals Corps for 41 years wherein he was awarded three times by the President of India for distinguished service of the highest order. He also served as the Chairman of Precision Electronics Ltd as a Governing Council Member of IETE (India). Sachin Gaur interviewed him on his viewpoint on India’s vision for cybersecurity.

Q. On behalf of InnoHEALTH Magazine, we congratulate you on your new assignment. For our readers, we would like you to share your short-term and long-term vision for Cybersecurity from national security perspective.
Short-term vision is to issue National Cyber Security Strategy 2020-25 early next year. Task force is working overtime on this by consulting all stakeholders. Long-term vision is to create an all-encompassing cyber vertical at the national level, to handle incident response, cybercrimes, legal issues and capacity building.

---

Q. We know that there are some fundamental technological shifts waiting to happen like 5G, and along-with it massive (Internet of Things) IoT deployments and especially use cases of connected healthcare. Can you share your views on the cybersecurity implications of the connected devices?
IoT security is a priority topic world over and this is because the limited security capabilities of these devices are also an afterthought. We need to work on a framework, to bring baselinesecurity through the manufacturers and developers of these devices. These devices are omnipresent in our lives, we find them in our home environment to industrial environments including hospitals. We have seen attacks in the past, where such devices are compromised to launch massive denial of service attacks to manipulate the workings of critical infrastructure.
Also, the issue of IoT security is multidimensional, from data security, privacy to device security. As we discuss this, there are multiple acts and bills pending in the Parliament on these topics. While the bills and acts will provide a framework, we need to also create awareness on both sides, supplier and consumer on the possible risks and mitigation strategies.

---

Q. What steps can be taken to improve the security in such connected devices?
When I say baseline security framework, it can be achieved in multiple ways.
As of today, most devices that we use including mobile phones, do not have a security testing certification. So, we can agree with the industry and look at important test cases and if they can do self-certification on such test cases.
For example: the device should not have weak default login credentials, it is sending data to a remote server and can be operated remotely. So, we can come up like a 5-star rating framework like that of the energy consumption but for the security of IoT devices basis what kind of tests they clear.
Industry bodies can agree on various levels of security and what it takes to achieve that level. Such a framework, when implemented, can provide confidence to consumers and users on the kind of device they are using vis-a-visthe use case they have at hand. So, they might use a higher security rating device in a use case where the stakes are high.
The other approach is to get the security testing done with notified agencies. Department of Telecom for example has announced mandatory security testing of network elements for telecom given telecom is a part of the critical infrastructure and security issuescannot be taken lightly.
Also, some of the emerging concepts in connected devices are missing in the various governing acts of the industrial connected devices. So, we also need to update our legal frameworks to cover software-based tempering of such devices and make the manufacturers and service providers accountable and proactive towards the security of the systems they provide.

---

Q. What are the threats that you foresee for the health sector?
There are three areas we see where health sector can be impacted:
First is the data breaches and ransomware attacks on healthcare data. As we know, among all the data, healthcare is the most sensitive and sought after by malicious actors. Outside of India, we have seen umpteen cases where ransomware has crippled the health system and it is only after paying the ransom the hospitals can start operation again. Timely backups and encryption of healthcare data during storage is a preventive measure that clinical establishments can take to mitigate the breach and ransomware attacks.
Second is the manipulation of connected devices. The topic of IoT and connected devices security, as discussed in the above sections, directly apply to the medical devices. Healthcare is a domain where attacks on such devices can be life threatening, especially when there are implantable devices. As we have the new Medical Device Regulation Act in India since 2018, we should also consider cyber security aspect in the devices which have a communication interface. For example, a pacemaker which has a communication interface can be manipulated remotely and the patient’s life is at risk.
Third is the manipulation of health system including the building management. We are probably not very far from the days when sophisticated attacks, as we see in the movies, on high security establishments by manipulating the building controls. The building management systems are very weak when it comes to security. Every hospital is a building and imagine what a false fire alarm would mean to patients in Intensive Care Unit. Or even loss of air conditioning or sudden spikes in electrical power.
There is a proposed act DISHA, Digital Information Security Healthcare Act, which might address some of the legal aspects of security in the healthcare setting. A lot needs to be done in this area, and we are on our way.

---

Q. Our readership consists of health experts all over the world. Any message for them?
We are at the cusp of a new age where we look to take advantage of Artificial Intelligence to Internet of Things. For such a knowledge economy to take off, health sector is at the center of it and health experts need to pay attention on what they are buying and how such systems are managed and operated. Through intervention of Ministry of Health & Family Welfare and responsible bodies such as National Accreditation Board of Hospitals & Healthcare Providers (NABH) of Quality Council of India, we plan to recommend a cyber audit and increased awareness of information security.
We would not want our hospitals and clinical establishments to be a prey for malicious actors. Rather we would want our experts to leverage technology to take the country to the next level in providing care to a wider population at a lower cost and of the highest quality.

There is no doubt AI and IoT are big help in radiology and early diagnosis of cancer etc. but can never replace human intervention. India is also fast changing to adopt new technologies. As per a recent estimate, AI has potential of bringing $957 billion to the Indian economy by 2035. This may be the cause for luring young professionals to this new domain.

AI, as described by the domain experts – application of AI in healthcare, can be classified into Descriptive, Predictive, and Prescriptive. Our effort here is to learn and share newer knowledge by various initiatives taken by us through our annual conference, magazines, training programs, club meetings, webinars and the most recent delegation to Sweden under InnoBRIDGE 2019 to learn the best practices and explore synergies. On the request of our stakeholders, the next planned initiative is InnoBRIDGE USA 2020.

This issue is based on the theme of AI & IoT in Healthcare. The next one would be on Unmet Needs in Healthcare: Leading to Innovation. Do share your views and research for the benefit of all who believe in change through innovation. Let us think more on the basic issues of healthcare and how we can use technology to improve healthcare for common man at an optimum cost.

Ideate, Innovate and Incubate for the Bottom of Pyramid. Let us strive together to make India a developed economy from an emerging economy. The population of1.3 billion should be an asset and not a liability for the nation. A healthy India only can make wealthy India.

The meeting witnessed some very eminent and influential speakers from around the healthcare sector. The former Enforcement Director (ED) Karnal Singh who has investigated many high- profile cases graced the meeting as the Chief Guest.

Innovation is exciting and there are more innovations happening in the private sector, and with increasing technology come increased risks. With the rapidly growing technology, ranging from wireless devices such as mobile phones, tablets, and laptops to smart refrigerators, cars, and even medical devices like pacemakers, etc., it seems that the growing connections around us are difficult to detect. Therefore, the risk that comes together in operating within this brave, new and a connected world is high.

Shri Karnal Singh shared his expert viewpoint on the impact and importance of artificial intelligence, connected healthcare and need for cybersecurity in healthcare. How the digitization of healthcare is important and the rural and urban divide of same. He also insisted on the improvement of infrastructure and facilities available in the rural healthcare industry. In addition, he discussed the gap between the medical industry and government institutions where the research is needed and that we adopt mostly from our partnering and supporting foreign countries and how a change in mindset and adoption of new and improved technology can enhance the Indian healthcare. The future of healthcare is on the Internet and the Internet is vulnerable. Technology is the solution and it will come whether we want it or not. Therefore, the need of the hour is OUR PREPAREDNESS. We should welcome and be prepared for the connected network of healthcare.

An interesting session on the basic concepts of AI was the icing on the cake. It acquainted the participants with AI emphasizing on the fact that one should not get bogged down by the technology. Instead, one should focus on the use cases of it and there lies the innovation.

Often, the terms “digital health” evoke images of smartwatches or apps that can process the health data and can give a readout of parameters like heart rate, blood pressure, etc. That is a part of digital health, to be sure, but today we also focus on a newer aspect called “Precision Health” and the session “Prerequisite and journey of India to offer (precision) healthcare to all: Powered by Digital, Genetics, and AI” offered a far more expansive vision for digital health technologies, genetics and AI.

Precision medicine is an emerging approach of medicine which focuses on the cause of an illness, and not addressing the symptoms alone. Precision medicine may not be very well- known as Personalized Medicine. But they are the same. It takes into consideration individual variability in genes, environment, and lifestyle for each person.

Precision healthcare improves efficiency and accuracy to healthcare treatments. With precision healthcare, doctors can potentially develop targeted and precise treatment and therapies for masses as well as for an individual. This can improve patient treatment to large populations in countries like ours.

It’s based on evidence and data which comes from a series of medical tests on a patient. Thus, the data is its most important aspect. Very soon, along with genome sequencing and health sensors data coupled with the growing amount of Big Data, patient data will create large data sets of valuable information which can be used for more tailored treatments. But as an individual, a physician is not equipped to manually analyze these newly available data sets, which is where the advanced technologies such as AI come into picture.

The challenge that the clinicians see in the adoption of AI is the gap between the technical person and a clinician in regard to understanding the implementation of “normal reference values”. For example: If the normal value of hemoglobin for a person staying at planes (say Delhi NCR) is 13.5, the value 17.5 is perfectly normal at Ladakh. Is that incorporated in the AI system? Something that works in the USA might not work in India. The doctor or a clinician will have a great role to play in case of developing the AI as he/she can only give the correct inputs for the training sets.

With the new wave of digitization, medical records have seen a paradigm shift in the healthcare industry. As a result, the healthcare industry is witnessing an increase in the absolute volume of data in terms of complexity, diversity, and timeliness. Since the healthcare experts look for every possible way to lower the costs while improving the care process, delivery and management, and so is the aim of InnovatioCuris (IC), big data emerges as a persuasive solution with a promise to transform the healthcare industry. This paradigm shift from reactive to proactive healthcare may result in an overall reduction in healthcare costs and gradually may lead to economic growth. The above-stated and many more discussion points were there that became the part of the very interactive and interesting second session on “Mitigating data security and privacy challenges for digital healthcare in India”.

Data transmission is also an important aspect of implementing technology and safeguarding it. The Digital Information Security in Healthcare Act (DISHA) is one such step taken by the Indian Government in the long journey to securing the healthcare data of patients in India.

One of the biggest challenges is the lack of availability of data in a democratic manner and it’s all in silos in short data interoperability is a huge challenge. The major concerns that the clinicians have at the moment regarding the implementation of DISHA act are that it says that no court shall entertain any complaint unless made by the Central Government or central data authority, state data authority or the person affected and there would be times when PIL (public interest litigation) is there on the data security as well. The challenges will always pertain but what we need to do is to have trust in the law and protection by it. Major challenges regarding data security or cybersecurity, in hospitals or the clinical establishments, is that we do not have implemented laws that may protect our data. With the hope that they are definitely going to come, we can only stay prepared with our changed mindsets.