I just dropped it in the private chat.
And we're not streaming.
We host DEF CON music and it takes a hot second to switch away from it.
There we go.
And you guys are live.
Welcome DEF CON safe mode.
We're here at the DEF CON 28 safe mode.
Do no harm, a healthcare security conversation Q&A.
If you haven't had an opportunity to check out our pre-recorded video,
it's on the media server and it's also on YouTube.
We go for about an hour talking about some various topics that
we'll probably touch on again tonight.
Your opportunity here is to ask us questions in the Discord text channel
and then see us live on Twitch.
If you have any questions or anything, go ahead and feel free to put them in there
and we'll get them in no particular order.
All right, I'm going to kick it off and let everyone introduce themselves briefly.
And then we're going to go ahead and get to the first question.
I'll start with myself.
Hey, I'm Quadi.
Replicant here.
Hope everyone is safe and healthy.
Hi, my name is Ash Luft.
I'm an embedded software developer from Starfish Medical.
I have no idea what order we're going in.
So I'm Jessica Wilkerson.
I'm from the FDA and I'm a cyber policy advisor.
Hey, I'm Vidya.
I am from MedCorp.
We are a cybersecurity solution targeting medical devices.
And V, I'll turn it to you.
It's Ivy.
I'm a goon.
I am a patient, a hacker, and a researcher.
And that's about all about me.
Back to you, Quadi.
Awesome.
So I'm accepting some fantastic questions tonight.
We're going to go ahead and kick off the first one with a user called Raziz,
which has a multi-part question, but I think the heart of it is at the end here.
And it's a question to everybody.
Please don't be shy.
Do we have the resources to adequately detect and respond to attacks against internet-connected
medical devices?
So right now, in the status quo, can we even detect these attacks as they're happening,
specifically on the devices?
Who wants to take it first?
So I'll take a first pass.
I think while there are several solutions that exist in the IoT space, their application
to healthcare is what creates this problematic scenario where we're relatively inadequately
equipped to sufficiently respond right now.
I think we think about what's the worst thing that could happen when you put security on
a thermostat, and we don't really think about, well, what's the worst that can happen when
something happens to a medical device that's attached to a patient?
And so being cognizant that while there is a potential to detect this from a technical
perspective, there are ramifications for implementing that for real patient safety
and actual patient care.
I totally have to agree there, and it becomes even more complicated when we talk about implant
tools. So to do any detection on those devices is very hard and not very robust at the moment.
But the problem is, as well as Lydia said, the implementation of traditional cybersecurity
tools in the healthcare space is problematic due to the fact that this is not your traditional
cybersecurity space.
Each hospital or healthcare institution faces their own challenges.
So it's almost about having something that caters to your hospital and your healthcare
institution.
Yeah, I just want to chime in here for a second and say, yeah, I don't think many hospitals,
under-resourced hospitals, have robust detection methods. You'll be surprised how many of them
lack intrusion detection systems or have good endpoint security. You'd be surprised how many
of them get regularly penetration tested or go through that entire process.
And just to plug again, HHS and the FDA, the 2017 Health and Human Services Task Force report
estimated that a good majority of hospitals in the United States lack a single full-time
security professional on staff. So that's like a perfect storm to have a lot of attacks probably
go undetected.
The other little part of that, and I just want to just reflect on what Vee said, I completely
agree. The home space is this complete black box. A lot of people who get medical devices,
especially in the era of COVID, are given home monitoring equipment or they get an implantable
and it has an accompanying base station. And when they're discharged from the hospital,
they say, go plug this into your router at home. And there's really not a lot of work
done to secure their home environments. And we don't know much about that space. It could
be fine, or it could be a nightmare. I think what we lack is the ability to collect that
information and then share it with people.
I think that's a perfect point to raise around ownership, right? Like who is actually responsible
for securing this? Is it really reasonable to ask someone to go home and secure their
home network, not knowing their technical skillset or whether that's really part of
getting care, right? And then you think about hospitals, is their core competency really
going to become cybersecurity? And to the point of not even having resources, we have
to really think about how we can think about where the ownership really needs to originate
and what is most efficient and effective.
One thing that I would say on this, I think is like the token government person on this
panel, is I do have to plug all of the work that is happening at some of the national
level policy issues, because I promise we are aware that these things are issues and
they are being worked on. And so there are a lot of industry bodies, industry bodies,
government bodies, and then bodies where the two come together, that have documented and
just general conversations about this on a recurring basis. So I know as little respect
as everybody can have for the myriad best practices guides and other things that, you
know, white papers that the government puts out that sometimes just sit on shelves and
never get used. But these are things that have been looked at and things like the medical
device sectors, joint security plan, they've been looked at for healthcare delivery organizations,
something called the HICUP. And if you paid me money right now, I could not actually tell
you what that acronym stands for. But it's like the healthcare version, the hospital
version of their best practices guide. And in the HICUP in particular, I want to say
it is, or maybe it's the JSP, one of the two, they actually have like, it's separated out
into what large organizations can do, and then what small and medium sized organizations
can do. And they do different things for both or recommend different things for both. So
this is an ongoing conversation that is happening at that national level. But we certainly don't
claim to have all of those answers. Another thing that I think is important is
we're moving into a thing where we want to do early detection and monitoring. But most
of the instances where there has been hospital breaches, we've been left on the back foot,
right? We needed to become aware of the breach before we could actually act on the breach.
So I don't think there is that early... within healthcare at the moment. I can use an example
of a healthcare attack in South Africa itself, they only became aware of it once the systems
were encrypted. And once you know, the damage has been done. So often, we have to rely on
the cyber criminals to make us aware of their presence in our networks. It would be awesome
if we could detect it early and stop it. I mean, that is the golden standard. That is the dream.
But I don't think we're there yet. I think the real dream is being proactive about this,
and getting the security on the device so it doesn't even get to the point of there being
a vulnerability that has to be detected. If we can just reduce the end of things that need to
be detected, there's a better probability of actually coming up with it. But is that going
to actually be something that we're going to get? Because I mean, these devices last for long. So
inevitably, there is going to be vulnerabilities always. It's going to be there because as time
progresses, research is done, and libraries become vulnerable, or hardware becomes vulnerable.
Also, it's about the threat landscape, right? We're talking about risk here. And just like
everything in life, there's nothing, there's no such thing as risk-free. We can't just
have a device that has security or doesn't. There's always pros and cons. We can't think
of every possible thing. So it's always, it's this combination, right, of, you know,
building the devices and making them as secure as we can in a reasonable amount of time with
the resources we have. And then once they're out into, you know, the healthcare ecosystem or the
consumer ecosystem, in the case of, you know, medical devices that maybe have to be on a home
network, there's so many pieces to that threat landscape, right? I don't, like, I'm not sure how
we can fully secure it. Like, there's no, there's no perfectly secure network, right?
I also want to throw one other wrinkle into this, which is that there's actually some
systemic, systematic issues when it comes to healthcare. Usually in hospitals, what's
traditionally been the paradigm is that the network's owned by IT, and that's where all
the security folks live, and they're able to detect kind of the attacks that they're used to,
and they can control some of that. But as soon as it comes to the medical device side of it,
they kind of wash their hands or are told, don't go there, that's bioengineering, and they
handle all the medical devices. And so what you often have is a dearth of cybersecurity knowledge
in the bioengineering space. By no fault of their own, they have a lot of other things,
they're fantastic people, but what we have as a result of that is this something we call the
discovery dilemma, where if you don't have people thinking about these issues, and you have
malfunctioning medical devices, you are unlikely to find a problem, even if there was some random
malware that spread over your network, it affected some of your medical devices, and as a consequence
they stopped working. Unless you are thinking about that as a potential etiology of your problem,
you're not going to go and look the one and two steps further to figure out if that was the issue.
So we talked a little bit before this panel started about the discipline of forensics. I've
asked many bioengineering organizations and groups and hospitals across the country and asked how many
of them do that type of forensic work on malfunctioning devices that are just really
out of the ordinary, and none of them said that they did. It's something we have to change. So
it's because the structure of these healthcare systems in such a way where there's a bright line
between who handles medical devices and who handles the network, and because those two groups don't
co-mingle and have equitable cybersecurity knowledge where we might have this problem,
where this might be a very common thing, but just we're not detecting it.
So I don't know if you want to, if we're like looking to move on to the next question here,
but one thing that I would point out on that, that I've certainly experienced,
especially over the last couple of months, is we're, we have experienced, I would say,
less and less medical device specific vulnerabilities where it's like the pacemaker
has a vulnerability or the MRI has a vulnerability. What we're now seeing are like higher level
protocol vulnerabilities. Swintooth was a great example. There was the, all of the, the whole run
of Bluetooth vulnerabilities. There was the Ripple 20. There was the Trek, which I think was, was the
one part or Trek TCP IP was one part of Ripple 20 or whatever it was. But anyway, these are
things that are not medical device specific. But what we're starting to see, and it goes to
the detection point. And then I wanted to hit on something that Vidya had said. The, the, almost
the nice thing that's happening about the fact that we have general IT vulnerabilities that are
now making their way into the medical device space or becoming relevant to the medical device space
is other sectors are detecting them for us. So even though there's maybe a little bit of a lag
in detection and in, I don't know, identification capability within the sector itself, because that
expertise may exist in other sectors. And because we're all relying on the same software, the software
that's in a medical device is the same that's in a consumer product. We're ending up still being
notified and still being able to notify others because it's happening in other sectors. But the
other thing, you know, Vidya had a good point about like, we need to, we need to lessen essentially
the attack space. And certainly acknowledging the fact that V and Ash are both right, like
things are always going to be vulnerable. Another thing that we've noticed is that we have an
increasing number of manufacturers who will tell them about vulnerabilities. And especially with
the Bluetooth ones, we have certain manufacturers who are like, oh yeah, but like the way we
architected our system, like our device doesn't trust the Bluetooth that's built into the device.
So all of these Bluetooth vulnerabilities don't impact us. And I think that that's sort of what
Vidya was getting at is like, we can build systems that are not impacted by certain types
of vulnerabilities. We just have to actually put in the work to do that. And I think, sorry,
Ash and I had this conversation, right? Security, the way that you change security and manufacturing
Ash was, right, we said it needs to be cheap and it needs to be easy and it needs to be accessible
and it should be the easiest thing to do. It shouldn't be the hardest thing to do and it
shouldn't be the most expensive thing to do. And when I refer to expensive, I don't necessarily
mean in terms of cost, it could be time, it could be design, it could be research, it could be CPU,
it could be battery life, right? But the thing is at this point, I don't think,
you know, at that end of the pipeline, that is very easily accessible for the smaller companies,
I'm not talking about your big companies, but your smaller ones that are doing some innovative work.
All right, we have a new question from Judo. And I think that this is going to be one we can all
kind of chime in on. It's, I think, boiled down to what are the steps that industry and I'm going to
add regulators in the space are taking to formalize stricter risk and controls around device development
that we use in patients. They assume that a larger device manufacturer formalized basic
security features, just like the payment brands have done, and set standards for the rest of the
industry. So I think there's a lot that's already been done. I just want to quickly reflect on that
to say, you know, the conversations that we were having 10 years in this space, we're asking for
this. And I feel like so much has changed between now and then where we, we do have a lot more
standards. And I think that the industry is moving forward in a lot of ways. And we can still talk
about some of the criticisms. But what I really think is a lot of people that have been paying
close attention will say, yes, we saw the problem of legacy devices. But we, you know, I said it in
the video, we don't have this year, to my knowledge, and there's still some time left, a story of a
device manufacturer threatening to sue a security researcher, for example, or something like that,
like WannaCry happened in 2017. So can everyone reflect on kind of what the industry has been
doing? And we can take it back a few years and give examples of some of the landmark documents
and guidance that has come from the industry as well as the regulation space.
Well, I can kick us off as the regulator. So I, you know, I think I was not at FDA,
let me preface this by saying, when some of these documents came out, but the two in 2014,
I want to say, there was, you know, one of the first drafts of a cybersecurity guidance,
particularly cybersecurity guidance came out at FDA. A few years later, there was the
postmarket cybersecurity guidance. And then in 2018, the most recent one, you know, there was
the new postmarket draft. And this was the one that talked about coordinated disclosure,
talked about cybersecurity bill of materials, it talked about a lot of the advancements that
had been made in the sector over the past couple of years from the time that the guidance had been
most recently updated. And actually, let me just really quickly, for those of you who don't know,
is essentially how FDA tells industry, the best way to meet the regulations, because if you try
and read FDA's regulations, they're pretty bare bones. It's pretty much like you must do risk
assessments. But then like that, that's the end of the sentence, and it doesn't have any other
detail. So the guidance allows FDA to elaborate a little bit more on what precisely that means in
given contexts. And so, you know, credit to to Suzanne Schwartz and Dr. Seth Harmony, who
was worked on a lot of this when he was still with the agency. You know, they actually like
fought the good fight and got cybersecurity specific guidance out from the FDA to industry.
And I think, you know, obviously, I'm biased here, but that was just a huge leap forward,
I think, in many ways for, for not only us, but for the industry.
Yeah, I think, to that point, I think there, the the conversation that's come from all of
that initiative, right, you you have, you have this relationship that I think didn't exist before,
even if we go back four or five years, like there wasn't such a collaboration or willingness
to have manufacturers work with security researchers work with security vendors,
right? It was more of Okay, who can get what off of eBay? What can we prove doesn't work and then
try to try to get the best headline that we can get out of it. And I think the if you listen to
the recorded version of this, there's a lot of hope that we all have for where this conversation
is going, and that there are going to be solutions coming out of this, I think on
on all sides that are actually sustainable and efficient.
So I can add a positive story. So three years ago, I had my first DEF CON, came as a patient,
had some concerns about my own device, it was, as I would say, beautifully broken and wonderfully
flawed. And I made Suzanne Schwartz at that one. But except for that, before coming to DEF CON,
I actually reached out to my manufacturer and had a discussion with him and I was met with
legal. You know, it was like running into a wall. It was a cold, unloving situation.
Three years later, I'm working with that same manufacturer on things that I bought to them
three years ago. It took us since December to find a footing where, you know, the discussion
is not incriminating. It's not me pointing a finger. It's not them pointing a finger. It's
finding a unison and what they bring to the table, what I bring to the table
and working together. But except for that, I mean, we had conversations. I've been on the patient.
I don't know what the word is that you guys, that Jessica,
that gave patients the opportunity to give their experiences, right?
So generally in three years that I've been involved in this, we've made leaps and bounds.
Is that necessarily enough yet? No, I don't think we should lose momentum. I think we should kick
ass and keep going. I think we should push the envelope. I think we should have the hard
conversations. And I don't think we should stop now. Yeah, I would agree. I think that the
landscape is shifting really quickly. When I started working on medical devices, which was
over five years ago, already the technology has changed so much. Even in the last 15 years,
if you think about, you know, smartphones and, you know, 20 years ago, I don't think most of us
would have predicted that ubiquitousness of it and the impact that it would have on our daily lives.
And so, you know, historically medical devices were electromechanical and, you know, as medical
device manufacturers, we come, we have a system about approaching things from a risk and from a
safety perspective, like how do we make sure that people are safe? And a lot of medical devices
didn't have software in them. And then we started putting software in and then we started connecting
that software to the internet. And then all of a sudden the risk just blew open because now we can,
we have, we have IOT devices, we have clinical IOT devices, we have medical IOT devices,
we have implantable IOT devices. And so everything has been changing so fast. And I think,
you know, getting regulatory and getting standards in place takes time. And, you know,
especially from a software perspective, how many standards exist? Like we have so many standards
in software that are competing standards. If everyone would just follow my standard,
it would all be fine. But then there's 20 other people who also have a standard that they want
everyone to follow. And so it's, you know, it's tough. It's like the wild, wild west for software,
right? And so I've seen like a lot of these different groups coming together, you know,
obviously FDA is a part of it, but, you know, you know, most of our customers are,
they want to serve American markets. So we actually talk about FDA a lot every single day.
But there is the rest of the world that isn't governed by the FDA. And so there's a lot of
different bodies working together. And yeah, I see it as hopeful. I know IEEE is working on
international standards for clinical IOT and medical devices and interoperability.
And yeah, I think people are working on it, but I don't think we're there yet. Certainly.
I actually have to jump on that because I think if I don't, one of my bosses is going to find me
at home. But to the point about international regulation, there is a body called the
International Medical Device Regulators Forum. And speaking of, you can never get government to
do anything in any reasonable amount of time. That's just sort of a default law of the universe.
But that group, which is a group of, it's like a nested group of regulators. So you would have
thought that this would have taken significantly longer than it did. But they actually just came
out with a cybersecurity guidance document. And so that's another thing that's been really
valuable for us. And I would actually encourage everybody to go look at it. It's got a really
fun definition of legacy that you all might have thoughts on. So anyway, IMDRF guidance.
The only thing I can add is that we're never going to be done, right? So as much as we've
progressed, and absolutely take a moment to recognize the accomplishments here,
there's certainly a path that we need to continue pursuing
in order to even maintain a baseline of security across the board.
I think what I want to see, and this would make me like as a patient super happy, is if we had
in the manufacturing, we had security standards for secure manufacturing, because it's one thing
having a cybersecurity framework, right? Or a guidance in terms of that. But it's a different
thing and having a standard for, you know, how we are going to securely manufacture these devices,
because often than not, you know, hardware is the constraint. Because when we talk medical devices,
we are designing, you know, firmware to run on hardware. So I think we need to, you know,
completely start at the beginning, when they conceptualize the requirements is that we need
to build security in there, right? It shouldn't be this, you know, after the fact, kind of like,
let's put it on the end and, you know, hope for the best. And that's, you know, normally done,
because we didn't consider it in the beginning, and it hasn't been in that, you know, that practice.
But there are companies doing that, and that is changing. But you know, it's also been an industry
that's been around for a very, very long time. And it's got some bad behavior and bad things that
it's been doing. It's also got good things, right? I mean, how many lives have medical devices saved?
I mean, you're always focusing on the negative. I mean, I wouldn't be here. I would have died at 19.
I'm not much older, I'm not going to tell you my age, but you know,
so I mean,
So Vi, are you saying, are you saying push left? Is that the summary of what you're saying?
Yes, I think you and I said that, let's push all the way left, right? Let's not do this at the end.
I've worked with the developers and the engineers, right? You know, everyone thinks like security is
the answer. You want to change this shit? Get them to start doing with security in mind, and you know,
you're not going to deal with future problems. I literally have found that security and forensics
forms part of hardware engineering and forms part of software development and firmware design.
You know, it just, there's this synergy when we start working as a team and as a collective
instead of, you know, silos. And I know there's people that are going to argue the silos are good
because everyone needs to focus on the independent thing. But when we bring different minds together,
that's when we start seeing things come together in a different way. And I think that's going to
be the answer, is working together instead of against each other. And, you know, that
multidisciplinary approach. Because we're not all experts. I mean, I shouldn't be doing any hardware
design. It will break. You know, that's not my speciality. But I can tell you from a security
and a logging perspective or forensics perspective what would work. So I think we need to get that
multidisciplinary approach. All right. Iona, go ahead and get our next question kicked off by
Ken in the DEF CON Discord. He says there's been a lot of progress in the last five years. I think
we've all talked about the optimism that we've had, you know, guarded optimism. But there's still
problems with smaller device manufacturers. There's problems with smaller hospitals. How do we motivate
them? How do we get them to do the right thing? And I think, Ash, on the recorded talk, you had,
you know, talked about how that's a big part of medical device development are kind of these
smaller boutique consultant shops like your own. Yeah, I wish I had a I think that's a fantastic
question. I have that question every day. How do we how do we motivate them? How do we make the
how do we get there, right? Because we've got constraints on lots of sides. And, you know, at
the end of the day, you know, most of the people who are working on this, we are really passionate
about the end patients, especially, you know, some of the smaller shops, like everyone that I work
with actually cares about the patients. And a lot of our clients are doctors who have an idea for
some medical device that they think will save lives, and they only have so much budget. So,
yeah, how do we motivate them? I think I think everyone is motivated. Or at least for some of
the smaller ones. We are motivated how to actually get there, how to implement how to how to
communicate to clients, and even to other engineers about what the risks are with software,
because sometimes, again, we're so used to see thinking about things as, you know,
electromechanical device, you know, we think about safety is like, the lock on the door,
you know, people who aren't in software all the time, people who don't come from a security
background, they don't think about all the creative ways, they just kind of think, well,
this is secure, we put a lock on it. You know, it's like, I put my phone into a little like box,
and then I put a lock on it, how could it not be secure? Well, because I can connect to your phone
through Wi Fi, and then exploit it somehow, right? Like, so it's not actually immediately obvious to
a lot of people. So then, when you're trying to, you know, trying to set up a project and talking
about budget, and how much time we allocate, and, you know, what, what sort of security things do
care about? And, you know, everything is pulled in all these directions. So I, I don't have an
answer for how to balance all of those perfectly. I think we're trying to do that every single day.
But I think it's a really great question. And I think we should keep asking it.
Yeah, that's what I have to say.
I think the phone's a great analogy. Sorry, just two seconds here, right? I think that the fact
that you bring up this notion of, okay, people understand security on a phone, and they say,
I'm comfortable that my iPhone is going to do this. And I know Bea and I had this conversation.
But how do we translate that into the expectation that a medical device will be secure in and of
itself, independent of how it's going to connect to whatever the clinical care is? And I think
part of it is, we have to be fair to all these clinical innovations that are really trying to
bring something to the patient experience and change it for the better, and not try to force
them to become cybersecurity experts. There has to be a way for us to enable them to get there
without having to become pros at cybersecurity. I will say, though, and I have to say it. Sorry,
everyone. I think I disappeared for a moment. My computer decided it didn't want to be part
of this panel anymore. So there is pre-market guidance. And the current version is not nearly
as detailed as I think some of the things that we're working on now. But to get on the market,
medical devices have to go through the FDA in most cases. I'm not going into the class system.
None of us need that. But if they're going to have software and other things like that,
chances are they have to get pre-market approval to even go on the market. And so to a certain
extent, they have to demonstrate through FDA, whatever the device is, however small the
manufacturer is, that they have provided reasonable assurance of safety and effectiveness.
And we check for cybersecurity concerns. I think I made some clever comment about Matt being my
elementary school best friend. But Matt is the lead for a lot of the cybersecurity reviewers at
FDA. And like I said in the recording, we're getting better at that every day. But this is
something where FDA is rightfully by statute, by law, the gatekeeper of what can and can't be
put on the market. And so I think, you know, for better or worse, you can argue whether or not
it's good or bad that we're doing what we're doing. The smaller manufacturers
still have to go through us. So there is still going to be that part of it.
I also just want to say, we had talked multiple times about how you have to make security
the easy thing to do. And for some of these rural access hospitals, smaller organizations,
they're just not going to be able to do the job right. And so I think collaboration,
I've said this a couple times, there shouldn't be a competitive advantage in cybersecurity when
it comes to hospitals, right? So you shouldn't see a billboard as you drive down the street that
says, you know, when you have your heart attack, come to hospital A because we didn't get hacked
last year like hospital B did, right? So that shouldn't be like that. And I think, luckily,
there's been a lot of momentum towards collaboration, information sharing,
through a lot of these organizations and bodies we've already talked about. But, you know, what
was an alien concept to hospitals five years ago is probably not that crazy now, which is,
hey, if we get hit with ransomware, you know, we're going to go through our protocol of
incident response. And guess what? I'm going to call the CISO at competitor hospital B and let
them know this happened to us. And did you see anything? Collaborate. What normally was a very,
we're not going to share, we're not going to talk, we're not going to collaborate in the space,
has clearly gone out the window for some of the more forward thinking organizations. Now,
let's take that information. For example, all the great work that larger organizations have
done, like Mayo, looking at particularly secure devices compared to others, share that information
with other rural hospitals, so they don't have to go and reproduce all that work from scratch,
they're doing that. Being able to share in that space is so, so key. So let's not reinvent the
wheel at every single hospital. Let's not try to build gigantic teams that do vulnerability testing,
penetration testing on every medical device and reproduce that work time and time again. Instead,
it's a community. We got to recognize that it doesn't follow the same competition that you
normally would where you're not sharing. This is a different world. This is about patient safety,
though. We all have to be on the same page. Yeah, but I mean, I'm going to say something
that's going to be very unpopular, right? If you take a medical device, functional requirement is
not security. Functional requirement is keeping someone alive or healthcare, right? We need to
understand that because we are superimposing security onto these devices when that's not
their main functionality. Yes, as they advance, they are connected and they need to be secure.
But I don't think we should solely focus on having such secure devices that might just never see the,
market. They might never save their life. That one patient's life that they can change.
I think we should never lose sight of what the purpose of these devices are
when we try and attempt the security implementations onto them.
Awesome. All right. We're going to go to the next question here. This is from Synapsys.
Questions about where the industry is going insofar as what are the new, and perhaps we can
even talk about the pre-market guidance in this regard, like what types of requirements
are we going to be putting into some of these new devices as they go for approval
to push that forward? To perhaps, of course, always respect that these devices are security,
or sorry, that was not a slip, I promise. They're medical devices meant to help patients,
but they have to be secure. Are we going to be deploying things like stack protection,
ASLR, DEP, and other things like modern, like language changes that have better security
kind of baked in from the start? Are we seeing trends in this space towards utilizing more
secure tools and development of these medical devices so that they are less prone to some
of the scary vulnerabilities we've seen in legacy devices? So I think you called me out there a
little bit with the cybersecurity guidance. So yes, you know, I think I had made the comment
earlier that the FDA, the actual regulation parts of FDA's regulations are pretty high level. I
really would be amused if any of you were like that motivated to go look at literally the code
for federal regulations and go look at our regulations. They're very dry. And then you have
guidance, and then you have what companies are actually doing to meet the guidance or to meet
regulations. And I think from the FDA standpoint, it would help no one if we picked like the one way
of doing security to rule them all and then told all the manufacturers that they have to do that
one thing. So instead, essentially, what we've we have been communicating to them, and we continue
to work with manufacturers on and continue to work with our own internal processes on is essentially
saying like, you need to have a secure architecture. We're not going to tell you what the
architecture looks like. But you need to, it needs to be secure. And you need to be able to produce
the documentation to us that proves and validates that it's secure. You need to have security
controls that are the same thing. You need to be able to not only have them, you need to prove that
they work. And so and then but but then at that point, it's sort of like and it's now the ball
is in your courts, manufacturers, you tell us what your security controls are, you tell us what your
secure architecture is. Because I think like going down into the the ASLR level and things like that,
to V's and Asher's and videos and some of the other points that have been raised,
each individual medical device is very unique, you know, the things that you're going to do
to secure drug infusion pump are not going to be the things that you're going to do to secure an MRI.
And so we do need to have that flexibility built into the regulations built into the guidance,
so that, you know, we can we can allow the manufacturers to figure out, you know,
what is the best, most efficient way to secure the device to V's point that we don't, you know,
impose such rigid constraints on it that certain devices just can never meet them,
you know, maybe they can do something else. So that's what I would say.
Didn't mean to call you out. I just think it's such a great segue. All right, who's up on that
question? So I mean, you had mentioned Ash, like how much things are changing? And do you see
trends towards more kind of baking in these controls from the start? And do you see exciting
trends emerging? I mean, I think I agree with what Jessica said, I think.
I'm not sure, you know, I come from software and engineering development background,
and I'm learning more and more about security. But so traditional security controls, I don't
have a huge history with that. But I think every device is really different. And from
security perspective, or from a safety perspective, we make sure that the device is secure,
so that it provides safety, so that patient outcomes are,
are successful or positive, right? Every device is different. I think that more people are
learning more people are like me, there's more engineers who care about the security part. And,
you know, obviously, with FDA and guidances, and with regulatory, we have to meet standards.
That's absolutely correct. How we choose to meet those standards is up to each manufacturer. So
we have an internal process of how we approach that. At the end of the day,
you know, it's, it's literally different every time we make a device. So we're different too,
because we are a consulting firm. So we make a lot of different devices, we have no, we have
none of our own in house products that we are continually sort of like, building. So every,
every device is unique, and it has a unique solution has unique architecture. And as technology
is changing as Wi Fi's in everything now, more and more and more. Yeah, I mean, we're using
different approaches. Yes, we have to make more, we have to have a bigger focus on security because
of that. But, but I think it's just we're just following the trends with technology itself.
Yeah, the only thing I'd add there is I think there are there are a variety of ways to approach
it. And we have to absolutely keep patient care at the center of it to make sure we don't introduce
new problems by trying to solve the security problem. But I think there's there's a fundamental
expectation now that there is security built into this, it's not something that can be bolted on
afterwards, where we're seeing the narrative more and more that it has to be part of the
initial requirements discussion, it has to be part of how the device is going to connect how
it's going to be patched. If we don't think about it from the onset of these fundamental
architecture decisions, I think we'll we'll continue to have this problem of trying to
solve the quick regulation question that came back and try to get it through so it so it can
get to the hospitals. No, definitely. I don't think we can get to a granular level that we can start
dictating architecture, because again, those things depend on the type of device and the
requirements that you need the device to fulfill. But I am looking forward to better guidances. And
yes, I was that boring person that went and read that because I wanted to understand
our pre-market post-market book. But after some discussions with Jessica and Suzanne,
I'm excited to see the new ones coming out and the more robust nature of them because
we are moving towards a place where we are going to be enforcing better manufacturing.
So let's transition to our next question into a little bit outside the medical device space and
more into the hospital. Ken brings up another question about who's keeping the hospitals
in line? Meaning the Joint Commission is, and there's a couple other bodies,
are the ones that accredit hospitals. So when you go by a hospital, and they can be a hospital,
some type of regulatory body has to make sure that they are to meet certain standards. The
Joint Commission is probably the most famous one of those. And so a lot of what we talk about on
the hospital side actually would never be FDA jurisdiction. Those are medical devices in their
approval. This is the Joint Commission's probably space or other organizations that accredit
hospitals. So the question that Ken poses is, you know, has the Joint Commission jumped in here?
And how do we make sure that hospitals do what they're supposed to do? We've talked at length
about how we can do better with medical devices, but I think we need to start moving also into the
space of, like, hospitals need to be held accountable in some cases, and in accordance
to what they're able to do. But we need to move that needle as well, because we've all heard
stories of devices with certain security controls from the manufacturers that get turned off,
or aren't deployed appropriately, or deployed on horribly secured networks at hospitals.
And so part of the responsibility has to be this multiple people, right? How do we get hospitals
to do the right thing? Knowing that, especially in times like COVID, it's not going to be the
place they're going to be putting their resources in, right? They're worried about their ventilators
in the ICU. They're not necessarily worried about this problem right now. Is there a way that we can
move forward and make sure hospitals do the right thing?
To be flippant, but like, do we? I feel like there's such a burden here that we're trying to
historically pass on to hospitals that maybe was unfair, right? Like, yes, hospitals,
if they're told in a user guide that they need to have certain controls in place, and they didn't,
sure, there's something there. There's a flaw there in the plan. But at the same time,
is it a fair expectation for a device vendor to say, okay, we want you to have these 32 different
controls in place, times a hospital having a bunch of different vendors? Like, I think
there's a balance there. So I think, yes, you have to enable hospitals to be
more successful in having some of the basic security in place. But I think it's also
somewhat unfair to place the onus on them so much. Yeah, I mean, I think I could just share
something. You know, we talk all the time about shared responsibility. And actually,
Christian, thank you so much for pointing out that FDA does not actually regulate hospitals.
Because I think sometimes people forget that we actually have a very small slice of the pie. And
we like to think we're very effective, whether or not we are, as I suppose, for debate from others.
But, you know, that's not something we have any control over. But, you know, there are multiple
federal agencies and state-level agencies. And actually, that's part of the problem,
is the sheer number of regulators who are active in this space, who may or may not have harmonized
regulatory requirements that hospitals are expected to meet. You know, that's challenging
enough as it is. But something that Vidya said I wanted to hit on, because we were...
one of these, you know, public-private partnership bodies that I'm a part of,
we were recently talking, and one of the core CISOs was like, I have a spreadsheet of 400
different websites that I have to continually check to figure out what updates I need to make
to all of the different devices that I have. And it's not something where, you know, they're not
always getting active notification from the vendors as, like, you should go check one of
these 400 websites. And there's just, it seems, you know, almost an infinite variety of procedures
that each individual manufacturer can try and impose on a given hospital, and that just can add
up so fast. So, you know, in that sense, like, there are certainly things that we can do better.
I don't know necessarily that punishment is always the way to go with that. You know,
I don't know how many of you know about the Office of Civil Rights wall of shame,
but literally if you have a breach of more than 500 people, or at least this was the way that
it was a couple of years ago, you go up on a portion of HHS's website with, like, your name,
and how many records were breached, and how you got breached, and etc. etc. And it's not exactly
the most helpful way to do it, because you also get fined in that case, which is then, that's
resources that you have now lost, that you then cannot put towards your security, because you
just had to pay it, you know, to somebody else. And so, you know, there's, I think, and this is,
these are conversations that happen at the federal government level all the time, is like, how do we,
how do we regulate, holistically, how do we regulate in such a way that, you know, we are,
we are helping the industry move forward, rather than, you know, continuing to perpetuate some of
the problems that we see? I want to touch on that, because this is something that is really
near and dear to my heart, is hospitals. And the one thing that I've realized is we've created this,
this shameful thing of finger-pointing when a hospital gets breached, right?
Where we make it this negative connotation that they don't want to come out and say, hey, we've
been breached, we need help. We've made it impossible for them to turn to the security industry and ask
for help, because we shame them when they have been breached, right? When they are having to deal
with medical care and then sophisticated attacks from cybercriminals. You know, and on top of that,
implementing different patches and different software updates, different systems, and now
how they're going to connect all these things up. I think we are expecting them to take ownership
and accountability for things that aren't theirs to do. And then still, we punish them for not
being able to do it. It's a very negative connotation to, you know, we need help.
I agree. I don't think punishment is necessarily the right way, but I think
that they're not being punished. The only hammer that really they pay attention to is HIPAA,
because it's tied to a fine and an embarrassment on a wall. There isn't really, for example,
rural hospitals, AIDS gets owned and there isn't a HIPAA breach. No one knows about that. And there
is likely going to be little remediation efforts, probably because they've been owned for years and
they don't even know. What I'm trying to say is that I don't think we should shame hospitals,
but the status quo is likely untenable for a long term, because there is an increasing
attack surface. There's less resources being put into this. And then on top of it, there's just,
it's going to have to be looked at in some way, because we can't have the most secure medical
devices on the planet with phenomenal protections, and then put on networks that no one cares about,
or that no one's doing a good job at securing because there isn't that
pressure. So how do you incentivize the hospitals? Do you say, for example,
we're going to give you 0.25% more on your Medicaid reimbursement if you meet these
cybersecurity requirements, right? Are you going to say we're going to cut your reimbursement from
insurance claims on this if you don't meet these requirements? Is the joint commission going to
say, hey, we're not going to credit your hospital unless you meet these requirements? These are the
questions we should be talking about, whether or not it's a carrot or a stick. This is how we're
going to have to figure it out. But what I do know is, you can look at many different healthcare
organizations across the globe, and know that that's just, we can't keep going in that realm,
because the patient information is just too valuable. And the risks of compromises to these
networks are just too great for patient safety. And so we have to have that conversation sometime.
Again, I don't want to shame anybody, but we have to do better on all fronts of this,
because if you just secure one side, our patients are still vulnerable on the other side.
It's really got to circle the wagons. Everyone's got to get on board.
I think to your point, right? I think cybersecurity in healthcare was defined as HIPAA for the
longest period of time, and nobody ever connected it to patient safety. So I think that's why there
is disincentive, but in absence of an incentive for a hospital to really build security beyond
just what the UCR is going to find them for. It's a change of how they perceive security,
right? Cybersecurity is always the stick that's beating you, that's saying you need to do X, Y,
and Z. It's never the thing, well, if you don't do this, this is what's going to happen,
and it's going to impact your patients. I think we need to change the narrative.
And the way that we approach this is by getting the hospitals to believe that this is
the best for their patients. This is not just something that needs to be done because HIPAA
says so, or any other organization says so. I don't know the Joint Commission, and I'm going
to be honest with you, I don't follow that because I'm not from the US. But I do feel
that if you change the way security is perceived within a hospital, and you make it more patient
safety, you will see people change the way that they approach the problem.
You're absolutely right. And I think there's a balance there, right? We don't want people
declining clinical care because they now understand the potential risk. But I absolutely
think you're right. The focus here should always be about the patient safety that we're trying
to ensure collectively. I mean, COVID's kind of broken the perimeter, right?
It's, I mean, they are sending home monitors. I mean, which angle do you defend from?
Where is our perimeter at the moment? I think it's just, we're going to have to rebuild healthcare,
I think, after COVID globally. And that's an opportunity to do things different, right?
We now have a way to move forward positively without having to reinvent the wheel because
the wheel's kind of broken down now. So I see the positive in that as well.
And I'm excited for it, personally. All right, everybody, we're going to have
to wrap up here soon. But I want to give everyone an opportunity to just say
where they're going to go party after this Q&A. So I'm going to start off with Jeff.
Where are you going to party? His internet is having a seizure, he told me. So I'm not
sure if he'll be able to respond. He's going to go party with me, I bet.
Yeah, somewhere with better...
He's going to go to Starbucks and steal some internet.
Ash, where are you going to go party after this Q&A?
I'm going to open the new record player that I got that arrived in the mail today
and set it up and probably party here.
V, where are you going to go party after this?
It is 6am, so I am going to go party at Club Duvet. It is a very, very, very warm, toasty club.
And that's where I'm going to be spending the rest of my morning.
Nice. Vidya, where are you going to go party?
Going to hit up the beach, all day, every day.
All day, every day. And Jessica, take us home.
I was going to say I was going to Club BED with DJ Pillow, because that's exactly what I'm going to do.
Well, on that note, we want to say thank you to DEF CON, the CFP board for giving us another
shot at this, and everyone out there watching us on Twitch to say thank you for attending our
Do No Harm panel. Again, stay connected with this. This is really important work.
Let's keep our patients safe. And everyone, take care.