1
00:00:00,000 --> 00:00:02,360
I just dropped it in the private chat.

2
00:00:17,780 --> 00:00:20,080
And we're not streaming.

3
00:00:20,080 --> 00:00:23,400
We host DEF CON music and it takes a hot second to switch away from it.

4
00:00:33,060 --> 00:00:34,900
There we go.

5
00:00:35,540 --> 00:00:37,420
And you guys are live.

6
00:00:39,660 --> 00:00:42,360
Welcome DEF CON safe mode.

7
00:00:42,360 --> 00:00:46,560
We're here at the DEF CON 28 safe mode.

8
00:00:46,560 --> 00:00:52,180
Do no harm, a healthcare security conversation Q&A.

9
00:00:52,660 --> 00:00:57,780
If you haven't had an opportunity to check out our pre-recorded video, it's on the media server and it's also on YouTube.

10
00:00:57,780 --> 00:01:03,440
We go for about an hour talking about some various topics that we'll probably touch on again tonight.

11
00:01:03,440 --> 00:01:10,040
Your opportunity here is to ask us questions in the Discord text channel and then see us live on Twitch.

12
00:01:10,040 --> 00:01:15,760
If you have any questions or anything, go ahead and feel free to put them in there and we'll get them in no particular order.

13
00:01:15,760 --> 00:01:19,040
All right, I'm going to kick it off and let everyone introduce themselves briefly.

14
00:01:19,040 --> 00:01:21,300
And then we're going to go ahead and get to the first question.

15
00:01:21,300 --> 00:01:22,420
I'll start with myself.

16
00:01:22,420 --> 00:01:23,440
Hey, I'm Quadi.

17
00:01:25,180 --> 00:01:25,820
Replicant here.

18
00:01:25,820 --> 00:01:27,400
Hope everyone is safe and healthy.

19
00:01:29,440 --> 00:01:30,980
Hi, my name is Ash Luft.

20
00:01:30,980 --> 00:01:35,780
I'm an embedded software developer from Starfish Medical.

21
00:01:40,920 --> 00:01:42,440
I have no idea what order we're going in.

22
00:01:42,440 --> 00:01:43,460
So I'm Jessica Wilkerson.

23
00:01:43,460 --> 00:01:46,120
I'm from the FDA and I'm a cyber policy advisor.

24
00:01:51,920 --> 00:01:53,100
Hey, I'm Vidya.

25
00:01:53,100 --> 00:01:55,560
I am from MedCorp.

26
00:01:55,560 --> 00:01:58,640
We are a cybersecurity solution targeting medical devices.

27
00:01:58,640 --> 00:02:00,280
And V, I'll turn it to you.

28
00:02:01,160 --> 00:02:02,280
It's Ivy.

29
00:02:02,440 --> 00:02:03,740
I'm a goon.

30
00:02:03,740 --> 00:02:06,440
I am a patient, a hacker, and a researcher.

31
00:02:06,600 --> 00:02:08,400
And that's about all about me.

32
00:02:08,400 --> 00:02:09,620
Back to you, Quadi.

33
00:02:10,200 --> 00:02:10,880
Awesome.

34
00:02:10,880 --> 00:02:13,620
So I'm accepting some fantastic questions tonight.

35
00:02:13,620 --> 00:02:22,060
We're going to go ahead and kick off the first one with a user called Raziz, which has a multi-part question, but I think the heart of it is at the end here.

36
00:02:22,060 --> 00:02:24,900
And it's a question to everybody.

37
00:02:24,900 --> 00:02:27,020
Please don't be shy.

38
00:02:27,100 --> 00:02:35,160
Do we have the resources to adequately detect and respond to attacks against internet-connected medical devices?

39
00:02:35,160 --> 00:02:41,910
So right now, in the status quo, can we even detect these attacks as they're happening, specifically on the devices?

40
00:02:43,360 --> 00:02:45,440
Who wants to take it first?

41
00:02:45,500 --> 00:02:46,800
So I'll take a first pass.

42
00:02:46,800 --> 00:03:00,660
I think while there are several solutions that exist in the IoT space, their application to healthcare is what creates this problematic scenario where we're relatively inadequately equipped to sufficiently respond right now.

43
00:03:00,660 --> 00:03:10,620
I think we think about what's the worst thing that could happen when you put security on a thermostat, and we don't really think about, well, what's the worst that can happen when something happens to a medical device that's attached to a patient?

44
00:03:10,720 --> 00:03:21,940
And so being cognizant that while there is a potential to detect this from a technical perspective, there are ramifications for implementing that for real patient safety and actual patient care.

45
00:03:24,800 --> 00:03:30,420
I totally have to agree there, and it becomes even more complicated when we talk about implant tools.

46
00:03:30,420 --> 00:03:38,300
So to do any detection on those devices is very hard and not very robust at the moment.

47
00:03:38,700 --> 00:03:51,740
But the problem is, as well as Lydia said, the implementation of traditional cybersecurity tools in the healthcare space is problematic due to the fact that this is not your traditional cybersecurity space.

48
00:03:52,300 --> 00:03:56,440
Each hospital or healthcare institution faces their own challenges.

49
00:03:57,280 --> 00:04:04,520
So it's almost about having something that caters to your hospital and your healthcare institution.

50
00:04:09,900 --> 00:04:24,020
Yeah, I just want to chime in here for a second and say, yeah, I don't think many hospitals, under-resourced hospitals, have robust detection methods.

51
00:04:24,020 --> 00:04:30,180
You'll be surprised how many of them lack intrusion detection systems or have good endpoint security.

52
00:04:30,180 --> 00:04:35,020
You'd be surprised how many of them get regularly penetration tested or go through that entire process.

53
00:04:35,020 --> 00:04:48,960
And just to plug again, HHS and the FDA, the 2017 Health and Human Services Task Force report estimated that a good majority of hospitals in the United States lack a single full-time security professional on staff.

54
00:04:48,960 --> 00:04:56,280
So that's like a perfect storm to have a lot of attacks probably go undetected.

55
00:04:56,420 --> 00:04:59,860
The other little part of that, and I just want to just reflect on what Vee said, I completely agree.

56
00:04:59,860 --> 00:05:04,180
The home space is this complete black box.

57
00:05:04,180 --> 00:05:13,760
A lot of people who get medical devices, especially in the era of COVID, are given home monitoring equipment or they get an implantable and it has an accompanying base station.

58
00:05:13,760 --> 00:05:17,540
And when they're discharged from the hospital, they say, go plug this into your router at home.

59
00:05:17,820 --> 00:05:21,520
And there's really not a lot of work done to secure their home environments.

60
00:05:21,520 --> 00:05:23,440
And we don't know much about that space.

61
00:05:23,440 --> 00:05:25,860
It could be fine, or it could be a nightmare.

62
00:05:25,860 --> 00:05:32,160
I think what we lack is the ability to collect that information and then share it with people.

63
00:05:33,120 --> 00:05:35,960
I think that's a perfect point to raise around ownership, right?

64
00:05:35,960 --> 00:05:38,060
Like who is actually responsible for securing this?

65
00:05:38,060 --> 00:05:47,240
Is it really reasonable to ask someone to go home and secure their home network, not knowing their technical skillset or whether that's really part of getting care, right?

66
00:05:47,240 --> 00:05:52,400
And then you think about hospitals, is their core competency really going to become cybersecurity?

67
00:05:52,580 --> 00:06:02,380
And to the point of not even having resources, we have to really think about how we can think about where the ownership really needs to originate and what is most efficient and effective.

68
00:06:05,810 --> 00:06:25,430
One thing that I would say on this, I think is like the token government person on this panel, is I do have to plug all of the work that is happening at some of the national level policy issues, because I promise we are aware that these things are issues and they are being worked on.

69
00:06:25,550 --> 00:06:36,290
And so there are a lot of industry bodies, industry bodies, government bodies, and then bodies where the two come together, that have documented and just general conversations about this on a recurring basis.

70
00:06:36,290 --> 00:06:47,750
So I know as little respect as everybody can have for the myriad best practices guides and other things that, you know, white papers that the government puts out that sometimes just sit on shelves and never get used.

71
00:06:48,130 --> 00:06:57,630
But these are things that have been looked at and things like the medical device sectors, joint security plan, they've been looked at for healthcare delivery organizations, something called the HICUP.

72
00:06:57,630 --> 00:07:02,050
And if you paid me money right now, I could not actually tell you what that acronym stands for.

73
00:07:02,050 --> 00:07:06,550
But it's like the healthcare version, the hospital version of their best practices guide.

74
00:07:07,650 --> 00:07:19,330
And in the HICUP in particular, I want to say it is, or maybe it's the JSP, one of the two, they actually have like, it's separated out into what large organizations can do, and then what small and medium sized organizations can do.

75
00:07:19,330 --> 00:07:22,830
And they do different things for both or recommend different things for both.

76
00:07:22,910 --> 00:07:27,170
So this is an ongoing conversation that is happening at that national level.

77
00:07:27,610 --> 00:07:31,230
But we certainly don't claim to have all of those answers.

78
00:07:34,940 --> 00:07:40,700
Another thing that I think is important is we're moving into a thing where we want to do early detection and monitoring.

79
00:07:40,700 --> 00:07:45,860
But most of the instances where there has been hospital breaches, we've been left on the back foot, right?

80
00:07:46,380 --> 00:07:50,720
We needed to become aware of the breach before we could actually act on the breach.

81
00:07:50,900 --> 00:07:56,000
So I don't think there is that early... within healthcare at the moment.

82
00:07:56,160 --> 00:08:03,720
I can use an example of a healthcare attack in South Africa itself, they only became aware of it once the systems were encrypted.

83
00:08:03,720 --> 00:08:05,860
And once you know, the damage has been done.

84
00:08:06,460 --> 00:08:13,780
So often, we have to rely on the cyber criminals to make us aware of their presence in our networks.

85
00:08:14,920 --> 00:08:17,700
It would be awesome if we could detect it early and stop it.

86
00:08:17,700 --> 00:08:19,060
I mean, that is the golden standard.

87
00:08:19,060 --> 00:08:20,180
That is the dream.

88
00:08:20,180 --> 00:08:21,880
But I don't think we're there yet.

89
00:08:22,880 --> 00:08:31,860
I think the real dream is being proactive about this, and getting the security on the device so it doesn't even get to the point of there being a vulnerability that has to be detected.

90
00:08:31,860 --> 00:08:38,400
If we can just reduce the end of things that need to be detected, there's a better probability of actually coming up with it.

91
00:08:39,160 --> 00:08:43,260
But is that going to actually be something that we're going to get?

92
00:08:43,260 --> 00:08:45,060
Because I mean, these devices last for long.

93
00:08:45,060 --> 00:08:48,040
So inevitably, there is going to be vulnerabilities always.

94
00:08:48,940 --> 00:08:57,220
It's going to be there because as time progresses, research is done, and libraries become vulnerable, or hardware becomes vulnerable.

95
00:08:57,440 --> 00:09:00,740
Also, it's about the threat landscape, right?

96
00:09:00,860 --> 00:09:02,380
We're talking about risk here.

97
00:09:02,380 --> 00:09:05,560
And just like everything in life, there's nothing, there's no such thing as risk-free.

98
00:09:05,560 --> 00:09:08,800
We can't just have a device that has security or doesn't.

99
00:09:08,940 --> 00:09:10,240
There's always pros and cons.

100
00:09:10,240 --> 00:09:12,480
We can't think of every possible thing.

101
00:09:13,000 --> 00:09:22,060
So it's always, it's this combination, right, of, you know, building the devices and making them as secure as we can in a reasonable amount of time with the resources we have.

102
00:09:22,060 --> 00:09:34,800
And then once they're out into, you know, the healthcare ecosystem or the consumer ecosystem, in the case of, you know, medical devices that maybe have to be on a home network, there's so many pieces to that threat landscape, right?

103
00:09:34,800 --> 00:09:40,560
I don't, like, I'm not sure how we can fully secure it.

104
00:09:40,560 --> 00:09:45,720
Like, there's no, there's no perfectly secure network, right?

105
00:09:47,320 --> 00:09:57,160
I also want to throw one other wrinkle into this, which is that there's actually some systemic, systematic issues when it comes to healthcare.

106
00:09:57,380 --> 00:10:09,360
Usually in hospitals, what's traditionally been the paradigm is that the network's owned by IT, and that's where all the security folks live, and they're able to detect kind of the attacks that they're used to, and they can control some of that.

107
00:10:09,360 --> 00:10:19,840
But as soon as it comes to the medical device side of it, they kind of wash their hands or are told, don't go there, that's bioengineering, and they handle all the medical devices.

108
00:10:19,880 --> 00:10:26,220
And so what you often have is a dearth of cybersecurity knowledge in the bioengineering space.

109
00:10:26,340 --> 00:10:40,460
By no fault of their own, they have a lot of other things, they're fantastic people, but what we have as a result of that is this something we call the discovery dilemma, where if you don't have people thinking about these issues, and you have malfunctioning medical devices,

110
00:10:40,460 --> 00:10:49,840
you are unlikely to find a problem, even if there was some random malware that spread over your network, it affected some of your medical devices, and as a consequence they stopped working.

111
00:10:49,840 --> 00:11:00,860
Unless you are thinking about that as a potential etiology of your problem, you're not going to go and look the one and two steps further to figure out if that was the issue.

112
00:11:01,000 --> 00:11:05,060
So we talked a little bit before this panel started about the discipline of forensics.

113
00:11:05,060 --> 00:11:19,420
I've asked many bioengineering organizations and groups and hospitals across the country and asked how many of them do that type of forensic work on malfunctioning devices that are just really out of the ordinary, and none of them said that they did.

114
00:11:19,420 --> 00:11:20,920
It's something we have to change.

115
00:11:20,920 --> 00:11:35,820
So it's because the structure of these healthcare systems in such a way where there's a bright line between who handles medical devices and who handles the network, and because those two groups don't co-mingle and have equitable cybersecurity knowledge where we might have this problem,

116
00:11:35,820 --> 00:11:39,660
where this might be a very common thing, but just we're not detecting it.

117
00:11:40,120 --> 00:11:55,900
So I don't know if you want to, if we're like looking to move on to the next question here, but one thing that I would point out on that, that I've certainly experienced, especially over the last couple of months, is we're, we have experienced, I would say,

118
00:11:55,900 --> 00:12:03,060
less and less medical device specific vulnerabilities where it's like the pacemaker has a vulnerability or the MRI has a vulnerability.

119
00:12:03,220 --> 00:12:06,940
What we're now seeing are like higher level protocol vulnerabilities.

120
00:12:08,300 --> 00:12:09,920
Swintooth was a great example.

121
00:12:09,920 --> 00:12:13,580
There was the, all of the, the whole run of Bluetooth vulnerabilities.

122
00:12:14,060 --> 00:12:15,580
There was the Ripple 20.

123
00:12:15,580 --> 00:12:22,940
There was the Trek, which I think was, was the one part or Trek TCP IP was one part of Ripple 20 or whatever it was.

124
00:12:23,020 --> 00:12:25,680
But anyway, these are things that are not medical device specific.

125
00:12:26,520 --> 00:12:30,400
But what we're starting to see, and it goes to the detection point.

126
00:12:30,400 --> 00:12:32,840
And then I wanted to hit on something that Vidya had said.

127
00:12:34,560 --> 00:12:46,800
The, the, almost the nice thing that's happening about the fact that we have general IT vulnerabilities that are now making their way into the medical device space or becoming relevant to the medical device space is other sectors are detecting them for us.

128
00:12:46,800 --> 00:12:56,840
So even though there's maybe a little bit of a lag in detection and in, I don't know, identification capability within the sector itself, because that expertise may exist in other sectors.

129
00:12:56,840 --> 00:13:02,520
And because we're all relying on the same software, the software that's in a medical device is the same that's in a consumer product.

130
00:13:02,520 --> 00:13:09,540
We're ending up still being notified and still being able to notify others because it's happening in other sectors.

131
00:13:09,780 --> 00:13:14,500
But the other thing, you know, Vidya had a good point about like, we need to, we need to lessen essentially the attack space.

132
00:13:14,800 --> 00:13:20,340
And certainly acknowledging the fact that V and Ash are both right, like things are always going to be vulnerable.

133
00:13:20,600 --> 00:13:27,480
Another thing that we've noticed is that we have an increasing number of manufacturers who will tell them about vulnerabilities.

134
00:13:27,780 --> 00:13:38,460
And especially with the Bluetooth ones, we have certain manufacturers who are like, oh yeah, but like the way we architected our system, like our device doesn't trust the Bluetooth that's built into the device.

135
00:13:38,460 --> 00:13:42,300
So all of these Bluetooth vulnerabilities don't impact us.

136
00:13:42,500 --> 00:13:50,320
And I think that that's sort of what Vidya was getting at is like, we can build systems that are not impacted by certain types of vulnerabilities.

137
00:13:50,320 --> 00:13:53,160
We just have to actually put in the work to do that.

138
00:13:55,060 --> 00:14:02,120
And I think, sorry, Ash and I had this conversation, right?

139
00:14:02,160 --> 00:14:13,420
Security, the way that you change security and manufacturing Ash was, right, we said it needs to be cheap and it needs to be easy and it needs to be accessible and it should be the easiest thing to do.

140
00:14:13,420 --> 00:14:17,040
It shouldn't be the hardest thing to do and it shouldn't be the most expensive thing to do.

141
00:14:17,040 --> 00:14:30,940
And when I refer to expensive, I don't necessarily mean in terms of cost, it could be time, it could be design, it could be research, it could be CPU, it could be battery life, right?

142
00:14:30,960 --> 00:14:46,280
But the thing is at this point, I don't think, you know, at that end of the pipeline, that is very easily accessible for the smaller companies, I'm not talking about your big companies, but your smaller ones that are doing some innovative work.

143
00:14:49,930 --> 00:14:53,450
All right, we have a new question from Judo.

144
00:14:53,450 --> 00:14:56,790
And I think that this is going to be one we can all kind of chime in on.

145
00:14:56,990 --> 00:15:08,630
It's, I think, boiled down to what are the steps that industry and I'm going to add regulators in the space are taking to formalize stricter risk and controls around device development that we use in patients.

146
00:15:08,790 --> 00:15:17,290
They assume that a larger device manufacturer formalized basic security features, just like the payment brands have done, and set standards for the rest of the industry.

147
00:15:17,290 --> 00:15:19,470
So I think there's a lot that's already been done.

148
00:15:19,470 --> 00:15:25,990
I just want to quickly reflect on that to say, you know, the conversations that we were having 10 years in this space, we're asking for this.

149
00:15:25,990 --> 00:15:31,130
And I feel like so much has changed between now and then where we, we do have a lot more standards.

150
00:15:31,270 --> 00:15:34,570
And I think that the industry is moving forward in a lot of ways.

151
00:15:34,570 --> 00:15:36,910
And we can still talk about some of the criticisms.

152
00:15:36,910 --> 00:15:43,870
But what I really think is a lot of people that have been paying close attention will say, yes, we saw the problem of legacy devices.

153
00:15:43,870 --> 00:16:00,050
But we, you know, I said it in the video, we don't have this year, to my knowledge, and there's still some time left, a story of a device manufacturer threatening to sue a security researcher, for example, or something like that, like WannaCry happened in 2017.

154
00:16:00,050 --> 00:16:03,870
So can everyone reflect on kind of what the industry has been doing ?

155
00:16:03,870 --> 00:16:12,350
And we can take it back a few years and give examples of some of the landmark documents and guidance that has come from the industry as well as the regulation space.

156
00:16:21,120 --> 00:16:23,820
Well, I can kick us off as the regulator.

157
00:16:24,980 --> 00:16:44,080
So I, you know, I think I was not at FDA, let me preface this by saying, when some of these documents came out, but the two in 2014, I want to say, there was, you know, one of the first drafts of a cybersecurity guidance, particularly cybersecurity guidance came out at FDA.

158
00:16:44,540 --> 00:16:47,960
A few years later, there was the postmarket cybersecurity guidance.

159
00:16:47,960 --> 00:16:55,400
And then in 2018, the most recent one, you know, there was the new postmarket draft.

160
00:16:55,400 --> 00:17:09,440
And this was the one that talked about coordinated disclosure, talked about cybersecurity bill of materials, it talked about a lot of the advancements that had been made in the sector over the past couple of years from the time that the guidance had been most recently updated.

161
00:17:09,700 --> 00:17:21,460
And actually, let me just really quickly, for those of you who don't know, is essentially how FDA tells industry, the best way to meet the regulations, because if you try and read FDA's regulations, they're pretty bare bones.

162
00:17:21,460 --> 00:17:23,900
It's pretty much like you must do risk assessments.

163
00:17:23,900 --> 00:17:27,780
But then like that, that's the end of the sentence, and it doesn't have any other detail.

164
00:17:27,780 --> 00:17:33,960
So the guidance allows FDA to elaborate a little bit more on what precisely that means in given contexts.

165
00:17:34,220 --> 00:17:37,740
And so, you know, credit to to Suzanne Schwartz and Dr.

166
00:17:37,740 --> 00:17:42,880
Seth Harmony, who was worked on a lot of this when he was still with the agency.

167
00:17:43,360 --> 00:17:50,680
You know, they actually like fought the good fight and got cybersecurity specific guidance out from the FDA to industry.

168
00:17:50,680 --> 00:18:00,680
And I think, you know, obviously, I'm biased here, but that was just a huge leap forward, I think, in many ways for, for not only us, but for the industry.

169
00:18:05,660 --> 00:18:23,940
Yeah, I think, to that point, I think there, the the conversation that's come from all of that initiative, right, you you have, you have this relationship that I think didn't exist before, even if we go back four or five years, like there wasn't such a collaboration or willingness to have manufacturers work with security researchers work with security vendors,

170
00:18:23,940 --> 00:18:24,180
right?

171
00:18:24,180 --> 00:18:26,760
It was more of Okay, who can get what off of eBay?

172
00:18:26,920 --> 00:18:31,400
What can we prove doesn't work and then try to try to get the best headline that we can get out of it.

173
00:18:31,400 --> 00:18:43,960
And I think the if you listen to the recorded version of this, there's a lot of hope that we all have for where this conversation is going, and that there are going to be solutions coming out of this, I think on on all sides that are actually sustainable and efficient.

174
00:18:45,920 --> 00:18:47,860
So I can add a positive story.

175
00:18:47,860 --> 00:18:57,020
So three years ago, I had my first DEF CON, came as a patient, had some concerns about my own device, it was, as I would say, beautifully broken and wonderfully flawed.

176
00:18:57,760 --> 00:19:00,440
And I made Suzanne Schwartz at that one.

177
00:19:00,440 --> 00:19:09,040
But except for that, before coming to DEF CON, I actually reached out to my manufacturer and had a discussion with him and I was met with legal.

178
00:19:09,760 --> 00:19:12,020
You know, it was like running into a wall.

179
00:19:12,060 --> 00:19:15,580
It was a cold, unloving situation.

180
00:19:16,300 --> 00:19:22,760
Three years later, I'm working with that same manufacturer on things that I bought to them three years ago.

181
00:19:23,420 --> 00:19:29,080
It took us since December to find a footing where, you know, the discussion is not incriminating.

182
00:19:29,080 --> 00:19:30,440
It's not me pointing a finger.

183
00:19:30,440 --> 00:19:31,640
It's not them pointing a finger.

184
00:19:31,640 --> 00:19:38,320
It's finding a unison and what they bring to the table, what I bring to the table and working together.

185
00:19:38,320 --> 00:19:41,400
But except for that, I mean, we had conversations.

186
00:19:41,400 --> 00:19:42,920
I've been on the patient.

187
00:19:44,360 --> 00:19:55,480
I don't know what the word is that you guys, that Jessica, that gave patients the opportunity to give their experiences, right?

188
00:19:56,660 --> 00:20:01,140
So generally in three years that I've been involved in this, we've made leaps and bounds.

189
00:20:01,700 --> 00:20:04,460
Is that necessarily enough yet?

190
00:20:04,460 --> 00:20:06,420
No, I don't think we should lose momentum.

191
00:20:06,420 --> 00:20:08,480
I think we should kick ass and keep going.

192
00:20:08,480 --> 00:20:10,140
I think we should push the envelope.

193
00:20:10,140 --> 00:20:12,420
I think we should have the hard conversations.

194
00:20:12,640 --> 00:20:14,660
And I don't think we should stop now.

195
00:20:19,200 --> 00:20:21,140
Yeah, I would agree.

196
00:20:21,140 --> 00:20:25,620
I think that the landscape is shifting really quickly.

197
00:20:25,940 --> 00:20:34,840
When I started working on medical devices, which was over five years ago, already the technology has changed so much.

198
00:20:34,840 --> 00:20:46,520
Even in the last 15 years, if you think about, you know, smartphones and, you know, 20 years ago, I don't think most of us would have predicted that ubiquitousness of it and the impact that it would have on our daily lives.

199
00:20:46,520 --> 00:21:01,760
And so, you know, historically medical devices were electromechanical and, you know, as medical device manufacturers, we come, we have a system about approaching things from a risk and from a safety perspective, like how do we make sure that people are safe?

200
00:21:01,900 --> 00:21:04,820
And a lot of medical devices didn't have software in them.

201
00:21:04,820 --> 00:21:10,080
And then we started putting software in and then we started connecting that software to the internet.

202
00:21:10,080 --> 00:21:21,340
And then all of a sudden the risk just blew open because now we can, we have , we have IOT devices, we have clinical IOT devices, we have medical IOT devices, we have implantable IOT devices.

203
00:21:21,600 --> 00:21:23,600
And so everything has been changing so fast.

204
00:21:23,600 --> 00:21:30,340
And I think, you know, getting regulatory and getting standards in place takes time.

205
00:21:30,540 --> 00:21:34,540
And, you know, especially from a software perspective, how many standards exist?

206
00:21:34,540 --> 00:21:39,000
Like we have so many standards in software that are competing standards.

207
00:21:39,000 --> 00:21:42,340
If everyone would just follow my standard, it would all be fine.

208
00:21:42,340 --> 00:21:47,160
But then there's 20 other people who also have a standard that they want everyone to follow.

209
00:21:47,160 --> 00:21:48,300
And so it's, you know, it's tough.

210
00:21:48,300 --> 00:21:51,180
It's like the wild, wild west for software, right?

211
00:21:51,260 --> 00:22:04,640
And so I've seen like a lot of these different groups coming together, you know, obviously FDA is a part of it, but, you know, you know, most of our customers are, they want to serve American markets.

212
00:22:04,640 --> 00:22:07,320
So we actually talk about FDA a lot every single day.

213
00:22:07,900 --> 00:22:10,700
But there is the rest of the world that isn't governed by the FDA.

214
00:22:11,480 --> 00:22:14,700
And so there's a lot of different bodies working together.

215
00:22:14,700 --> 00:22:16,660
And yeah, I see it as hopeful.

216
00:22:17,680 --> 00:22:24,760
I know IEEE is working on international standards for clinical IOT and medical devices and interoperability.

217
00:22:25,460 --> 00:22:30,300
And yeah, I think people are working on it, but I don't think we're there yet.

218
00:22:30,940 --> 00:22:31,740
Certainly.

219
00:22:32,380 --> 00:22:39,500
I actually have to jump on that because I think if I don't, one of my bosses is going to find me at home.

220
00:22:39,620 --> 00:22:46,800
But to the point about international regulation, there is a body called the International Medical Device Regulators Forum.

221
00:22:47,000 --> 00:22:51,300
And speaking of, you can never get government to do anything in any reasonable amount of time.

222
00:22:51,300 --> 00:22:54,180
That's just sort of a default law of the universe.

223
00:22:54,300 --> 00:22:58,500
But that group, which is a group of, it's like a nested group of regulators.

224
00:22:58,500 --> 00:23:01,980
So you would have thought that this would have taken significantly longer than it did.

225
00:23:02,040 --> 00:23:06,980
But they actually just came out with a cybersecurity guidance document.

226
00:23:07,360 --> 00:23:11,440
And so that's another thing that's been really valuable for us.

227
00:23:11,720 --> 00:23:14,040
And I would actually encourage everybody to go look at it.

228
00:23:14,040 --> 00:23:18,180
It's got a really fun definition of legacy that you all might have thoughts on.

229
00:23:18,180 --> 00:23:20,760
So anyway, IMDRF guidance.

230
00:23:25,220 --> 00:23:28,420
The only thing I can add is that we're never going to be done, right?

231
00:23:28,420 --> 00:23:40,080
So as much as we've progressed, and absolutely take a moment to recognize the accomplishments here, there's certainly a path that we need to continue pursuing in order to even maintain a baseline of security across the board.

232
00:23:41,280 --> 00:23:56,860
I think what I want to see, and this would make me like as a patient super happy, is if we had in the manufacturing, we had security standards for secure manufacturing, because it's one thing having a cybersecurity framework, right?

233
00:23:56,860 --> 00:23:58,700
Or a guidance in terms of that.

234
00:23:58,700 --> 00:24:09,280
But it's a different thing and having a standard for, you know, how we are going to securely manufacture these devices, because often than not, you know, hardware is the constraint.

235
00:24:09,300 --> 00:24:15,000
Because when we talk medical devices, we are designing, you know, firmware to run on hardware.

236
00:24:15,720 --> 00:24:26,020
So I think we need to, you know, completely start at the beginning, when they conceptualize the requirements is that we need to build security in there, right?

237
00:24:26,020 --> 00:24:33,660
It shouldn't be this, you know, after the fact, kind of like, let's put it on the end and, you know, hope for the best.

238
00:24:33,860 --> 00:24:42,880
And that's, you know, normally done, because we didn't consider it in the beginning, and it hasn't been in that, you know, that practice.

239
00:24:42,880 --> 00:24:46,300
But there are companies doing that, and that is changing.

240
00:24:46,920 --> 00:24:51,980
But you know, it's also been an industry that's been around for a very, very long time.

241
00:24:51,980 --> 00:24:56,340
And it's got some bad behavior and bad things that it's been doing.

242
00:24:56,340 --> 00:24:58,040
It's also got good things, right?

243
00:24:58,060 --> 00:25:01,140
I mean, how many lives have medical devices saved?

244
00:25:01,140 --> 00:25:02,940
I mean, you're always focusing on the negative.

245
00:25:02,940 --> 00:25:04,700
I mean, I wouldn't be here.

246
00:25:04,960 --> 00:25:06,680
I would have died at 19.

247
00:25:07,300 --> 00:25:14,680
I'm not much older, I'm not going to tell you my age, but you know, so I mean, So Vi, are you saying, are you saying push left?

248
00:25:14,680 --> 00:25:15,980
Is that the summary of what you're saying?

249
00:25:15,980 --> 00:25:19,580
Yes, I think you and I said that, let's push all the way left, right?

250
00:25:19,580 --> 00:25:21,480
Let's not do this at the end.

251
00:25:22,000 --> 00:25:25,380
I've worked with the developers and the engineers, right?

252
00:25:25,380 --> 00:25:27,980
You know, everyone thinks like security is the answer.

253
00:25:27,980 --> 00:25:30,260
You want to change this shit?

254
00:25:30,400 --> 00:25:35,720
Get them to start doing with security in mind, and you know, you're not going to deal with future problems.

255
00:25:35,740 --> 00:25:45,160
I literally have found that security and forensics forms part of hardware engineering and forms part of software development and firmware design.

256
00:25:45,160 --> 00:25:53,380
You know, it just, there's this synergy when we start working as a team and as a collective instead of, you know, silos.

257
00:25:53,460 --> 00:25:59,180
And I know there's people that are going to argue the silos are good because everyone needs to focus on the independent thing.

258
00:25:59,240 --> 00:26:06,820
But when we bring different minds together, that's when we start seeing things come together in a different way.

259
00:26:06,820 --> 00:26:11,620
And I think that's going to be the answer, is working together instead of against each other.

260
00:26:11,820 --> 00:26:14,420
And, you know, that multidisciplinary approach.

261
00:26:14,420 --> 00:26:15,620
Because we're not all experts.

262
00:26:15,620 --> 00:26:19,540
I mean, I shouldn't be doing any hardware design.

263
00:26:19,640 --> 00:26:21,240
It will break.

264
00:26:21,360 --> 00:26:23,140
You know, that's not my speciality.

265
00:26:23,140 --> 00:26:29,520
But I can tell you from a security and a logging perspective or forensics perspective what would work.

266
00:26:30,400 --> 00:26:34,140
So I think we need to get that multidisciplinary approach.

267
00:26:35,040 --> 00:26:36,420
All right.

268
00:26:36,880 --> 00:26:42,880
Iona, go ahead and get our next question kicked off by Ken in the DEF CON Discord.

269
00:26:42,880 --> 00:26:44,660
He says there's been a lot of progress in the last five years.

270
00:26:44,660 --> 00:26:48,700
I think we've all talked about the optimism that we've had, you know, guarded optimism.

271
00:26:48,920 --> 00:26:51,720
But there's still problems with smaller device manufacturers.

272
00:26:51,720 --> 00:26:53,040
There's problems with smaller hospitals.

273
00:26:53,040 --> 00:26:54,360
How do we motivate them?

274
00:26:54,580 --> 00:26:56,180
How do we get them to do the right thing?

275
00:26:56,480 --> 00:27:06,620
And I think, Ash, on the recorded talk, you had, you know, talked about how that's a big part of medical device development are kind of these smaller boutique consultant shops like your own.

276
00:27:08,020 --> 00:27:10,600
Yeah, I wish I had a I think that's a fantastic question.

277
00:27:10,600 --> 00:27:12,220
I have that question every day.

278
00:27:12,360 --> 00:27:14,800
How do we how do we motivate them?

279
00:27:14,800 --> 00:27:18,020
How do we make the how do we get there, right?

280
00:27:18,020 --> 00:27:21,300
Because we've got constraints on lots of sides.

281
00:27:21,340 --> 00:27:34,160
And, you know, at the end of the day, you know, most of the people who are working on this, we are really passionate about the end patients, especially, you know, some of the smaller shops, like everyone that I work with actually cares about the patients.

282
00:27:34,500 --> 00:27:43,340
And a lot of our clients are doctors who have an idea for some medical device that they think will save lives, and they only have so much budget.

283
00:27:43,340 --> 00:27:44,940
So, yeah, how do we motivate them?

284
00:27:44,940 --> 00:27:47,160
I think I think everyone is motivated.

285
00:27:47,780 --> 00:27:51,260
Or at least for some of the smaller ones.

286
00:27:51,620 --> 00:28:10,520
We are motivated how to actually get there, how to implement how to how to communicate to clients, and even to other engineers about what the risks are with software, because sometimes, again, we're so used to see thinking about things as, you know, electromechanical device,

287
00:28:10,520 --> 00:28:22,040
you know, we think about safety is like, the lock on the door, you know, people who aren't in software all the time, people who don't come from a security background, they don't think about all the creative ways, they just kind of think, well, this is secure,

288
00:28:22,040 --> 00:28:23,300
we put a lock on it.

289
00:28:24,380 --> 00:28:29,440
You know, it's like, I put my phone into a little like box, and then I put a lock on it, how could it not be secure?

290
00:28:29,440 --> 00:28:34,940
Well, because I can connect to your phone through Wi Fi, and then exploit it somehow, right?

291
00:28:34,940 --> 00:28:37,700
Like, so it's not actually immediately obvious to a lot of people.

292
00:28:37,700 --> 00:28:49,020
So then, when you're trying to, you know, trying to set up a project and talking about budget, and how much time we allocate, and, you know, what, what sort of security things do care about?

293
00:28:49,040 --> 00:28:51,460
And, you know, everything is pulled in all these directions.

294
00:28:51,460 --> 00:28:56,160
So I, I don't have an answer for how to balance all of those perfectly.

295
00:28:56,160 --> 00:28:58,240
I think we're trying to do that every single day.

296
00:28:58,400 --> 00:29:00,400
But I think it's a really great question.

297
00:29:00,520 --> 00:29:02,460
And I think we should keep asking it.

298
00:29:04,280 --> 00:29:06,460
Yeah, that's what I have to say.

299
00:29:12,330 --> 00:29:14,350
I think the phone's a great analogy.

300
00:29:14,350 --> 00:29:15,950
Sorry, just two seconds here, right?

301
00:29:15,950 --> 00:29:23,270
I think that the fact that you bring up this notion of, okay, people understand security on a phone, and they say, I'm comfortable that my iPhone is going to do this.

302
00:29:23,270 --> 00:29:25,170
And I know Bea and I had this conversation.

303
00:29:25,170 --> 00:29:34,770
But how do we translate that into the expectation that a medical device will be secure in and of itself, independent of how it's going to connect to whatever the clinical care is?

304
00:29:34,770 --> 00:29:48,190
And I think part of it is, we have to be fair to all these clinical innovations that are really trying to bring something to the patient experience and change it for the better, and not try to force them to become cybersecurity experts.

305
00:29:48,190 --> 00:29:54,730
There has to be a way for us to enable them to get there without having to become pros at cybersecurity.

306
00:29:55,330 --> 00:29:57,830
I will say, though, and I have to say it.

307
00:29:57,830 --> 00:29:58,650
Sorry, everyone.

308
00:29:58,650 --> 00:30:00,170
I think I disappeared for a moment.

309
00:30:00,170 --> 00:30:03,130
My computer decided it didn't want to be part of this panel anymore.

310
00:30:05,090 --> 00:30:07,650
So there is pre-market guidance.

311
00:30:07,690 --> 00:30:14,930
And the current version is not nearly as detailed as I think some of the things that we're working on now.

312
00:30:15,210 --> 00:30:21,690
But to get on the market, medical devices have to go through the FDA in most cases.

313
00:30:21,690 --> 00:30:23,510
I'm not going into the class system.

314
00:30:23,510 --> 00:30:24,770
None of us need that.

315
00:30:25,010 --> 00:30:31,190
But if they're going to have software and other things like that, chances are they have to get pre-market approval to even go on the market.

316
00:30:31,190 --> 00:30:42,750
And so to a certain extent, they have to demonstrate through FDA, whatever the device is, however small the manufacturer is, that they have provided reasonable assurance of safety and effectiveness.

317
00:30:42,750 --> 00:30:46,230
And we check for cybersecurity concerns.

318
00:30:46,230 --> 00:30:50,130
I think I made some clever comment about Matt being my elementary school best friend.

319
00:30:50,130 --> 00:30:54,930
But Matt is the lead for a lot of the cybersecurity reviewers at FDA.

320
00:30:54,930 --> 00:30:59,530
And like I said in the recording, we're getting better at that every day.

321
00:30:59,530 --> 00:31:08,830
But this is something where FDA is rightfully by statute, by law, the gatekeeper of what can and can't be put on the market.

322
00:31:08,830 --> 00:31:15,470
And so I think, you know, for better or worse, you can argue whether or not it's good or bad that we're doing what we're doing.

323
00:31:16,730 --> 00:31:19,590
The smaller manufacturers still have to go through us.

324
00:31:19,870 --> 00:31:22,090
So there is still going to be that part of it.

325
00:31:23,930 --> 00:31:31,110
I also just want to say, we had talked multiple times about how you have to make security the easy thing to do.

326
00:31:31,270 --> 00:31:38,890
And for some of these rural access hospitals, smaller organizations, they're just not going to be able to do the job right.

327
00:31:39,070 --> 00:31:47,930
And so I think collaboration, I've said this a couple times, there shouldn't be a competitive advantage in cybersecurity when it comes to hospitals, right?

328
00:31:47,930 --> 00:31:57,490
So you shouldn't see a billboard as you drive down the street that says, you know, when you have your heart attack, come to hospital A because we didn't get hacked last year like hospital B did, right?

329
00:31:57,490 --> 00:31:59,530
So that shouldn't be like that.

330
00:31:59,530 --> 00:32:09,270
And I think, luckily, there's been a lot of momentum towards collaboration, information sharing, through a lot of these organizations and bodies we've already talked about.

331
00:32:09,270 --> 00:32:20,990
But, you know, what was an alien concept to hospitals five years ago is probably not that crazy now, which is, hey, if we get hit with ransomware, you know, we're going to go through our protocol of incident response.

332
00:32:20,990 --> 00:32:21,590
And guess what?

333
00:32:21,590 --> 00:32:27,910
I'm going to call the CISO at competitor hospital B and let them know this happened to us.

334
00:32:27,910 --> 00:32:29,170
And did you see anything?

335
00:32:29,230 --> 00:32:30,030
Collaborate.

336
00:32:30,150 --> 00:32:39,950
What normally was a very, we're not going to share, we're not going to talk, we're not going to collaborate in the space, has clearly gone out the window for some of the more forward thinking organizations.

337
00:32:39,950 --> 00:32:41,590
Now, let's take that information.

338
00:32:41,670 --> 00:32:54,790
For example, all the great work that larger organizations have done, like Mayo, looking at particularly secure devices compared to others, share that information with other rural hospitals, so they don't have to go and reproduce all that work from scratch,

339
00:32:54,790 --> 00:32:56,030
they're doing that.

340
00:32:56,290 --> 00:32:58,810
Being able to share in that space is so, so key.

341
00:32:58,810 --> 00:33:01,710
So let's not reinvent the wheel at every single hospital.

342
00:33:01,710 --> 00:33:09,870
Let's not try to build gigantic teams that do vulnerability testing, penetration testing on every medical device and reproduce that work time and time again.

343
00:33:09,870 --> 00:33:11,390
Instead, it's a community.

344
00:33:11,390 --> 00:33:16,450
We got to recognize that it doesn't follow the same competition that you normally would where you're not sharing.

345
00:33:16,450 --> 00:33:17,390
This is a different world.

346
00:33:17,390 --> 00:33:19,010
This is about patient safety, though.

347
00:33:19,030 --> 00:33:20,650
We all have to be on the same page.

348
00:33:22,210 --> 00:33:26,310
Yeah, but I mean, I'm going to say something that's going to be very unpopular, right?

349
00:33:26,310 --> 00:33:30,510
If you take a medical device, functional requirement is not security.

350
00:33:30,510 --> 00:33:35,150
Functional requirement is keeping someone alive or healthcare, right?

351
00:33:35,150 --> 00:33:41,910
We need to understand that because we are superimposing security onto these devices when that's not their main functionality.

352
00:33:42,250 --> 00:33:46,730
Yes, as they advance, they are connected and they need to be secure.

353
00:33:46,730 --> 00:33:53,590
But I don't think we should solely focus on having such secure devices that might just never see the, market.

354
00:33:53,590 --> 00:33:56,010
They might never save their life.

355
00:33:56,010 --> 00:33:58,610
That one patient's life that they can change.

356
00:33:58,610 --> 00:34:08,950
I think we should never lose sight of what the purpose of these devices are when we try and attempt the security implementations onto them.

357
00:34:14,390 --> 00:34:15,130
Awesome.

358
00:34:15,130 --> 00:34:15,510
All right.

359
00:34:15,510 --> 00:34:19,830
We're going to go to the next question here.

360
00:34:19,830 --> 00:34:23,370
This is from Synapsys.

361
00:34:24,230 --> 00:34:41,510
Questions about where the industry is going insofar as what are the new, and perhaps we can even talk about the pre-market guidance in this regard, like what types of requirements are we going to be putting into some of these new devices as they go for approval to push that forward?

362
00:34:41,510 --> 00:34:48,050
To perhaps, of course, always respect that these devices are security, or sorry, that was not a slip, I promise.

363
00:34:48,090 --> 00:34:51,850
They're medical devices meant to help patients, but they have to be secure.

364
00:34:51,950 --> 00:35:01,190
Are we going to be deploying things like stack protection, ASLR, DEP, and other things like modern, like language changes that have better security kind of baked in from the start?

365
00:35:01,190 --> 00:35:12,270
Are we seeing trends in this space towards utilizing more secure tools and development of these medical devices so that they are less prone to some of the scary vulnerabilities we've seen in legacy devices?

366
00:35:13,250 --> 00:35:18,090
So I think you called me out there a little bit with the cybersecurity guidance.

367
00:35:18,090 --> 00:35:29,270
So yes, you know, I think I had made the comment earlier that the FDA, the actual regulation parts of FDA's regulations are pretty high level.

368
00:35:29,270 --> 00:35:36,890
I really would be amused if any of you were like that motivated to go look at literally the code for federal regulations and go look at our regulations.

369
00:35:36,890 --> 00:35:38,450
They're very dry.

370
00:35:38,830 --> 00:35:45,530
And then you have guidance, and then you have what companies are actually doing to meet the guidance or to meet regulations.

371
00:35:45,890 --> 00:35:56,190
And I think from the FDA standpoint, it would help no one if we picked like the one way of doing security to rule them all and then told all the manufacturers that they have to do that one thing.

372
00:35:56,550 --> 00:36:07,930
So instead, essentially, what we've we have been communicating to them, and we continue to work with manufacturers on and continue to work with our own internal processes on is essentially saying like, you need to have a secure architecture.

373
00:36:08,090 --> 00:36:10,450
We're not going to tell you what the architecture looks like.

374
00:36:10,510 --> 00:36:12,510
But you need to, it needs to be secure.

375
00:36:12,510 --> 00:36:17,150
And you need to be able to produce the documentation to us that proves and validates that it's secure.

376
00:36:17,510 --> 00:36:19,790
You need to have security controls that are the same thing.

377
00:36:19,790 --> 00:36:23,290
You need to be able to not only have them, you need to prove that they work.

378
00:36:24,030 --> 00:36:33,490
And so and then but but then at that point, it's sort of like and it's now the ball is in your courts, manufacturers, you tell us what your security controls are, you tell us what your secure architecture is.

379
00:36:34,890 --> 00:36:51,650
Because I think like going down into the the ASLR level and things like that, to V's and Asher's and videos and some of the other points that have been raised, each individual medical device is very unique, you know, the things that you're going to do to secure drug infusion pump are not going to be the things that you're going to do to secure an MRI.

380
00:36:52,230 --> 00:37:07,670
And so we do need to have that flexibility built into the regulations built into the guidance, so that, you know, we can we can allow the manufacturers to figure out, you know, what is the best, most efficient way to secure the device to V's point that we don't,

381
00:37:07,670 --> 00:37:17,250
you know, impose such rigid constraints on it that certain devices just can never meet them, you know, maybe they can do something else.

382
00:37:17,250 --> 00:37:18,710
So that's what I would say.

383
00:37:23,440 --> 00:37:25,020
Didn't mean to call you out.

384
00:37:25,020 --> 00:37:27,260
I just think it's such a great segue.

385
00:37:27,740 --> 00:37:29,560
All right, who's up on that question?

386
00:37:29,560 --> 00:37:33,420
So I mean, you had mentioned Ash, like how much things are changing?

387
00:37:33,420 --> 00:37:38,760
And do you see trends towards more kind of baking in these controls from the start?

388
00:37:38,760 --> 00:37:40,960
And do you see exciting trends emerging?

389
00:37:42,980 --> 00:37:46,480
I mean, I think I agree with what Jessica said, I think.

390
00:37:48,540 --> 00:37:55,600
I'm not sure, you know, I come from software and engineering development background, and I'm learning more and more about security.

391
00:37:55,600 --> 00:38:00,000
But so traditional security controls, I don't have a huge history with that.

392
00:38:00,000 --> 00:38:02,520
But I think every device is really different.

393
00:38:02,520 --> 00:38:17,700
And from security perspective, or from a safety perspective, we make sure that the device is secure, so that it provides safety, so that patient outcomes are, are successful or positive, right?

394
00:38:17,700 --> 00:38:19,340
Every device is different.

395
00:38:19,340 --> 00:38:26,560
I think that more people are learning more people are like me, there's more engineers who care about the security part.

396
00:38:26,560 --> 00:38:32,180
And, you know, obviously, with FDA and guidances, and with regulatory, we have to meet standards.

397
00:38:32,700 --> 00:38:34,060
That's absolutely correct.

398
00:38:34,060 --> 00:38:38,160
How we choose to meet those standards is up to each manufacturer.

399
00:38:38,160 --> 00:38:41,860
So we have an internal process of how we approach that.

400
00:38:41,860 --> 00:38:47,160
At the end of the day, you know, it's, it's literally different every time we make a device.

401
00:38:47,160 --> 00:38:50,840
So we're different too, because we are a consulting firm.

402
00:38:50,840 --> 00:38:58,300
So we make a lot of different devices, we have no, we have none of our own in house products that we are continually sort of like, building.

403
00:38:59,300 --> 00:39:04,540
So every, every device is unique, and it has a unique solution has unique architecture.

404
00:39:04,820 --> 00:39:12,700
And as technology is changing as Wi Fi's in everything now, more and more and more.

405
00:39:12,800 --> 00:39:14,840
Yeah, I mean, we're using different approaches.

406
00:39:14,840 --> 00:39:20,100
Yes, we have to make more, we have to have a bigger focus on security because of that.

407
00:39:20,100 --> 00:39:27,800
But, but I think it's just we're just following the trends with technology itself.

408
00:39:33,830 --> 00:39:39,850
Yeah, the only thing I'd add there is I think there are there are a variety of ways to approach it.

409
00:39:39,850 --> 00:39:46,750
And we have to absolutely keep patient care at the center of it to make sure we don't introduce new problems by trying to solve the security problem.

410
00:39:47,890 --> 00:40:00,030
But I think there's there's a fundamental expectation now that there is security built into this, it's not something that can be bolted on afterwards, where we're seeing the narrative more and more that it has to be part of the initial requirements discussion,

411
00:40:00,030 --> 00:40:03,210
it has to be part of how the device is going to connect how it's going to be patched.

412
00:40:03,230 --> 00:40:17,110
If we don't think about it from the onset of these fundamental architecture decisions, I think we'll we'll continue to have this problem of trying to solve the quick regulation question that came back and try to get it through so it so it can get to the hospitals.

413
00:40:19,130 --> 00:40:20,270
No, definitely.

414
00:40:20,270 --> 00:40:31,410
I don't think we can get to a granular level that we can start dictating architecture, because again, those things depend on the type of device and the requirements that you need the device to fulfill.

415
00:40:32,010 --> 00:40:35,350
But I am looking forward to better guidances.

416
00:40:35,350 --> 00:40:41,790
And yes, I was that boring person that went and read that because I wanted to understand our pre-market post-market book.

417
00:40:41,790 --> 00:40:56,390
But after some discussions with Jessica and Suzanne, I'm excited to see the new ones coming out and the more robust nature of them because we are moving towards a place where we are going to be enforcing better manufacturing.

418
00:40:59,020 --> 00:41:05,740
So let's transition to our next question into a little bit outside the medical device space and more into the hospital.

419
00:41:05,740 --> 00:41:12,340
Ken brings up another question about who's keeping the hospitals in line?

420
00:41:12,340 --> 00:41:19,720
Meaning the Joint Commission is, and there's a couple other bodies, are the ones that accredit hospitals.

421
00:41:19,720 --> 00:41:27,880
So when you go by a hospital, and they can be a hospital, some type of regulatory body has to make sure that they are to meet certain standards.

422
00:41:27,880 --> 00:41:30,460
The Joint Commission is probably the most famous one of those.

423
00:41:30,460 --> 00:41:36,640
And so a lot of what we talk about on the hospital side actually would never be FDA jurisdiction.

424
00:41:36,640 --> 00:41:38,780
Those are medical devices in their approval.

425
00:41:38,980 --> 00:41:44,700
This is the Joint Commission's probably space or other organizations that accredit hospitals.

426
00:41:44,700 --> 00:41:50,100
So the question that Ken poses is, you know, has the Joint Commission jumped in here?

427
00:41:50,100 --> 00:41:55,980
And how do we make sure that hospitals do what they're supposed to do?

428
00:41:55,980 --> 00:42:07,900
We've talked at length about how we can do better with medical devices, but I think we need to start moving also into the space of, like, hospitals need to be held accountable in some cases, and in accordance to what they're able to do.

429
00:42:07,900 --> 00:42:22,380
But we need to move that needle as well, because we've all heard stories of devices with certain security controls from the manufacturers that get turned off, or aren't deployed appropriately, or deployed on horribly secured networks at hospitals.

430
00:42:22,380 --> 00:42:26,820
And so part of the responsibility has to be this multiple people, right?

431
00:42:26,820 --> 00:42:29,960
How do we get hospitals to do the right thing?

432
00:42:30,020 --> 00:42:36,200
Knowing that, especially in times like COVID, it's not going to be the place they're going to be putting their resources in, right?

433
00:42:36,200 --> 00:42:38,440
They're worried about their ventilators in the ICU.

434
00:42:38,440 --> 00:42:42,440
They're not necessarily worried about this problem right now.

435
00:42:42,440 --> 00:42:47,280
Is there a way that we can move forward and make sure hospitals do the right thing?

436
00:42:51,400 --> 00:42:52,960
To be flippant, but like, do we?

437
00:42:52,960 --> 00:43:00,860
I feel like there's such a burden here that we're trying to historically pass on to hospitals that maybe was unfair, right?

438
00:43:00,860 --> 00:43:08,340
Like, yes, hospitals, if they're told in a user guide that they need to have certain controls in place, and they didn't, sure, there's something there.

439
00:43:08,340 --> 00:43:09,840
There's a flaw there in the plan.

440
00:43:09,840 --> 00:43:19,900
But at the same time, is it a fair expectation for a device vendor to say, okay, we want you to have these 32 different controls in place, times a hospital having a bunch of different vendors?

441
00:43:19,900 --> 00:43:22,380
Like, I think there's a balance there.

442
00:43:22,380 --> 00:43:30,380
So I think, yes, you have to enable hospitals to be more successful in having some of the basic security in place.

443
00:43:30,380 --> 00:43:34,220
But I think it's also somewhat unfair to place the onus on them so much.

444
00:43:36,660 --> 00:43:39,680
Yeah, I mean, I think I could just share something.

445
00:43:39,740 --> 00:43:42,460
You know, we talk all the time about shared responsibility.

446
00:43:42,460 --> 00:43:47,780
And actually, Christian, thank you so much for pointing out that FDA does not actually regulate hospitals.

447
00:43:48,100 --> 00:43:54,320
Because I think sometimes people forget that we actually have a very small slice of the pie.

448
00:43:54,320 --> 00:43:59,820
And we like to think we're very effective, whether or not we are, as I suppose, for debate from others.

449
00:43:59,820 --> 00:44:03,100
But, you know, that's not something we have any control over.

450
00:44:03,360 --> 00:44:09,000
But, you know, there are multiple federal agencies and state-level agencies.

451
00:44:09,000 --> 00:44:19,320
And actually, that's part of the problem, is the sheer number of regulators who are active in this space, who may or may not have harmonized regulatory requirements that hospitals are expected to meet.

452
00:44:19,700 --> 00:44:22,080
You know, that's challenging enough as it is.

453
00:44:22,080 --> 00:44:26,140
But something that Vidya said I wanted to hit on, because we were...

454
00:44:26,940 --> 00:44:43,440
one of these, you know, public-private partnership bodies that I'm a part of, we were recently talking, and one of the core CISOs was like, I have a spreadsheet of 400 different websites that I have to continually check to figure out what updates I need to make to all of the different devices that I have.

455
00:44:44,100 --> 00:44:51,340
And it's not something where, you know, they're not always getting active notification from the vendors as, like, you should go check one of these 400 websites.

456
00:44:51,420 --> 00:45:03,300
And there's just, it seems, you know, almost an infinite variety of procedures that each individual manufacturer can try and impose on a given hospital, and that just can add up so fast.

457
00:45:04,380 --> 00:45:08,480
So, you know, in that sense, like, there are certainly things that we can do better.

458
00:45:10,420 --> 00:45:16,120
I don't know necessarily that punishment is always the way to go with that.

459
00:45:16,120 --> 00:45:28,160
You know, I don't know how many of you know about the Office of Civil Rights wall of shame, but literally if you have a breach of more than 500 people, or at least this was the way that it was a couple of years ago, you go up on a portion of HHS's website with,

460
00:45:28,160 --> 00:45:32,480
like, your name, and how many records were breached, and how you got breached, and etc.

461
00:45:32,480 --> 00:45:33,020
etc.

462
00:45:33,900 --> 00:45:48,620
And it's not exactly the most helpful way to do it, because you also get fined in that case, which is then, that's resources that you have now lost, that you then cannot put towards your security, because you just had to pay it, you know, to somebody else.

463
00:45:48,620 --> 00:46:06,260
And so, you know, there's, I think, and this is, these are conversations that happen at the federal government level all the time, is like, how do we, how do we regulate, holistically, how do we regulate in such a way that, you know, we are, we are helping the industry move forward,

464
00:46:06,260 --> 00:46:11,460
rather than, you know, continuing to perpetuate some of the problems that we see?

465
00:46:13,280 --> 00:46:20,800
I want to touch on that, because this is something that is really near and dear to my heart, is hospitals.

466
00:46:21,180 --> 00:46:28,600
And the one thing that I've realized is we've created this, this shameful thing of finger-pointing when a hospital gets breached, right?

467
00:46:29,500 --> 00:46:35,300
Where we make it this negative connotation that they don't want to come out and say, hey, we've been breached, we need help.

468
00:46:35,320 --> 00:46:44,420
We've made it impossible for them to turn to the security industry and ask for help, because we shame them when they have been breached, right?

469
00:46:44,420 --> 00:46:50,560
When they are having to deal with medical care and then sophisticated attacks from cybercriminals.

470
00:46:50,560 --> 00:46:59,900
You know, and on top of that, implementing different patches and different software updates, different systems, and now how they're going to connect all these things up.

471
00:47:00,060 --> 00:47:06,500
I think we are expecting them to take ownership and accountability for things that aren't theirs to do.

472
00:47:07,000 --> 00:47:11,180
And then still, we punish them for not being able to do it.

473
00:47:11,240 --> 00:47:17,700
It's a very negative connotation to, you know, we need help.

474
00:47:19,960 --> 00:47:21,180
I agree.

475
00:47:21,180 --> 00:47:26,540
I don't think punishment is necessarily the right way, but I think that they're not being punished.

476
00:47:26,540 --> 00:47:34,420
The only hammer that really they pay attention to is HIPAA, because it's tied to a fine and an embarrassment on a wall.

477
00:47:35,080 --> 00:47:42,960
There isn't really, for example, rural hospitals, AIDS gets owned and there isn't a HIPAA breach.

478
00:47:42,960 --> 00:47:44,440
No one knows about that.

479
00:47:44,440 --> 00:47:51,780
And there is likely going to be little remediation efforts, probably because they've been owned for years and they don't even know.

480
00:47:51,780 --> 00:48:06,600
What I'm trying to say is that I don't think we should shame hospitals, but the status quo is likely untenable for a long term, because there is an increasing attack surface.

481
00:48:06,600 --> 00:48:09,360
There's less resources being put into this.

482
00:48:09,360 --> 00:48:27,980
And then on top of it, there's just, it's going to have to be looked at in some way, because we can't have the most secure medical devices on the planet with phenomenal protections, and then put on networks that no one cares about, or that no one's doing a good job at securing because there isn't that pressure.

483
00:48:27,980 --> 00:48:30,000
So how do you incentivize the hospitals?

484
00:48:30,000 --> 00:48:38,240
Do you say, for example, we're going to give you 0.25% more on your Medicaid reimbursement if you meet these cybersecurity requirements, right?

485
00:48:38,240 --> 00:48:45,240
Are you going to say we're going to cut your reimbursement from insurance claims on this if you don't meet these requirements?

486
00:48:45,240 --> 00:48:51,060
Is the joint commission going to say, hey, we're not going to credit your hospital unless you meet these requirements?

487
00:48:51,180 --> 00:48:56,260
These are the questions we should be talking about, whether or not it's a carrot or a stick.

488
00:48:56,260 --> 00:48:57,620
This is how we're going to have to figure it out.

489
00:48:57,620 --> 00:49:08,660
But what I do know is, you can look at many different healthcare organizations across the globe, and know that that's just, we can't keep going in that realm, because the patient information is just too valuable.

490
00:49:08,660 --> 00:49:13,620
And the risks of compromises to these networks are just too great for patient safety.

491
00:49:13,700 --> 00:49:16,740
And so we have to have that conversation sometime.

492
00:49:17,560 --> 00:49:26,320
Again, I don't want to shame anybody, but we have to do better on all fronts of this, because if you just secure one side, our patients are still vulnerable on the other side.

493
00:49:26,320 --> 00:49:28,060
It's really got to circle the wagons.

494
00:49:28,060 --> 00:49:29,440
Everyone's got to get on board.

495
00:49:30,700 --> 00:49:32,080
I think to your point, right?

496
00:49:32,080 --> 00:49:38,640
I think cybersecurity in healthcare was defined as HIPAA for the longest period of time, and nobody ever connected it to patient safety.

497
00:49:38,640 --> 00:49:48,580
So I think that's why there is disincentive, but in absence of an incentive for a hospital to really build security beyond just what the UCR is going to find them for.

498
00:49:50,860 --> 00:49:55,860
It's a change of how they perceive security, right?

499
00:49:56,200 --> 00:50:00,120
Cybersecurity is always the stick that's beating you, that's saying you need to do X, Y, and Z.

500
00:50:00,160 --> 00:50:05,740
It's never the thing, well, if you don't do this, this is what's going to happen, and it's going to impact your patients.

501
00:50:05,920 --> 00:50:08,080
I think we need to change the narrative.

502
00:50:08,640 --> 00:50:17,180
And the way that we approach this is by getting the hospitals to believe that this is the best for their patients.

503
00:50:17,980 --> 00:50:24,060
This is not just something that needs to be done because HIPAA says so, or any other organization says so.

504
00:50:24,060 --> 00:50:30,280
I don't know the Joint Commission, and I'm going to be honest with you, I don't follow that because I'm not from the US.

505
00:50:31,040 --> 00:50:44,940
But I do feel that if you change the way security is perceived within a hospital, and you make it more patient safety, you will see people change the way that they approach the problem.

506
00:50:48,890 --> 00:50:49,570
You're absolutely right.

507
00:50:49,570 --> 00:50:50,950
And I think there's a balance there, right?

508
00:50:50,950 --> 00:50:55,770
We don't want people declining clinical care because they now understand the potential risk.

509
00:50:55,770 --> 00:50:57,610
But I absolutely think you're right.

510
00:50:57,750 --> 00:51:01,990
The focus here should always be about the patient safety that we're trying to ensure collectively.

511
00:51:04,250 --> 00:51:07,090
I mean, COVID's kind of broken the perimeter, right?

512
00:51:07,730 --> 00:51:11,290
It's, I mean, they are sending home monitors.

513
00:51:11,290 --> 00:51:14,170
I mean, which angle do you defend from?

514
00:51:14,250 --> 00:51:16,250
Where is our perimeter at the moment?

515
00:51:16,250 --> 00:51:23,110
I think it's just, we're going to have to rebuild healthcare, I think, after COVID globally.

516
00:51:23,350 --> 00:51:26,750
And that's an opportunity to do things different, right?

517
00:51:26,750 --> 00:51:36,390
We now have a way to move forward positively without having to reinvent the wheel because the wheel's kind of broken down now.

518
00:51:37,510 --> 00:51:40,030
So I see the positive in that as well.

519
00:51:40,990 --> 00:51:43,510
And I'm excited for it, personally.

520
00:51:44,630 --> 00:51:46,730
All right, everybody, we're going to have to wrap up here soon.

521
00:51:46,730 --> 00:51:51,990
But I want to give everyone an opportunity to just say where they're going to go party after this Q&A.

522
00:51:51,990 --> 00:51:53,730
So I'm going to start off with Jeff.

523
00:51:54,130 --> 00:51:55,290
Where are you going to party?

524
00:51:56,110 --> 00:51:58,230
His internet is having a seizure, he told me.

525
00:51:58,230 --> 00:51:59,910
So I'm not sure if he'll be able to respond.

526
00:51:59,910 --> 00:52:01,230
He's going to go party with me, I bet.

527
00:52:01,230 --> 00:52:02,670
Yeah, somewhere with better...

528
00:52:04,590 --> 00:52:07,130
He's going to go to Starbucks and steal some internet.

529
00:52:07,130 --> 00:52:09,510
Ash, where are you going to go party after this Q&A?

530
00:52:10,750 --> 00:52:19,410
I'm going to open the new record player that I got that arrived in the mail today and set it up and probably party here.

531
00:52:19,550 --> 00:52:21,530
V, where are you going to go party after this?

532
00:52:22,170 --> 00:52:25,870
It is 6am, so I am going to go party at Club Duvet.

533
00:52:25,870 --> 00:52:29,050
It is a very, very, very warm, toasty club.

534
00:52:29,050 --> 00:52:31,210
And that's where I'm going to be spending the rest of my morning.

535
00:52:31,970 --> 00:52:32,690
Nice.

536
00:52:32,690 --> 00:52:34,170
Vidya, where are you going to go party?

537
00:52:34,430 --> 00:52:36,970
Going to hit up the beach, all day, every day.

538
00:52:37,110 --> 00:52:38,630
All day, every day.

539
00:52:38,630 --> 00:52:41,370
And Jessica, take us home.

540
00:52:41,610 --> 00:52:46,830
I was going to say I was going to Club BED with DJ Pillow, because that's exactly what I'm going to do.

541
00:52:48,250 --> 00:52:59,810
Well, on that note, we want to say thank you to DEF CON, the CFP board for giving us another shot at this, and everyone out there watching us on Twitch to say thank you for attending our Do No Harm panel.

542
00:52:59,810 --> 00:53:01,810
Again, stay connected with this.

543
00:53:01,810 --> 00:53:02,830
This is really important work.

544
00:53:02,830 --> 00:53:04,330
Let's keep our patients safe.

545
00:53:04,330 --> 00:53:05,410
And everyone, take care.