start	end	text
0	2360	I just dropped it in the private chat.
17780	20080	And we're not streaming.
20080	23400	We host DEF CON music and it takes a hot second to switch away from it.
33060	34900	There we go.
35540	37420	And you guys are live.
39660	42360	Welcome DEF CON safe mode.
42360	46560	We're here at the DEF CON 28 safe mode.
46560	52180	Do no harm, a healthcare security conversation Q&A.
52660	55560	If you haven't had an opportunity to check out our pre-recorded video,
55560	57780	it's on the media server and it's also on YouTube.
57780	61280	We go for about an hour talking about some various topics that
61280	63440	we'll probably touch on again tonight.
63440	67660	Your opportunity here is to ask us questions in the Discord text channel
67660	70040	and then see us live on Twitch.
70040	72900	If you have any questions or anything, go ahead and feel free to put them in there
72900	75760	and we'll get them in no particular order.
75760	79040	All right, I'm going to kick it off and let everyone introduce themselves briefly.
79040	81300	And then we're going to go ahead and get to the first question.
81300	82420	I'll start with myself.
82420	83440	Hey, I'm Quadi.
85180	85820	Replicant here.
85820	87400	Hope everyone is safe and healthy.
89440	90980	Hi, my name is Ash Luft.
90980	95780	I'm an embedded software developer from Starfish Medical.
100920	102440	I have no idea what order we're going in.
102440	103460	So I'm Jessica Wilkerson.
103460	106120	I'm from the FDA and I'm a cyber policy advisor.
111920	113100	Hey, I'm Vidya.
113100	115560	I am from MedCorp.
115560	118640	We are a cybersecurity solution targeting medical devices.
118640	120280	And V, I'll turn it to you.
121160	122280	It's Ivy.
122440	123740	I'm a goon.
123740	126440	I am a patient, a hacker, and a researcher.
126600	128400	And that's about all about me.
128400	129620	Back to you, Quadi.
130200	130880	Awesome.
130880	133620	So I'm accepting some fantastic questions tonight.
133620	137360	We're going to go ahead and kick off the first one with a user called Raziz,
137360	142060	which has a multi-part question, but I think the heart of it is at the end here.
142060	144900	And it's a question to everybody.
144900	147020	Please don't be shy.
147100	154020	Do we have the resources to adequately detect and respond to attacks against internet-connected
154020	155160	medical devices?
155160	160340	So right now, in the status quo, can we even detect these attacks as they're happening,
160340	161910	specifically on the devices?
163360	165440	Who wants to take it first?
165500	166800	So I'll take a first pass.
166800	173080	I think while there are several solutions that exist in the IoT space, their application
173080	178500	to healthcare is what creates this problematic scenario where we're relatively inadequately
178500	180660	equipped to sufficiently respond right now.
180660	184740	I think we think about what's the worst thing that could happen when you put security on
184840	187460	a thermostat, and we don't really think about, well, what's the worst that can happen when
187460	190620	something happens to a medical device that's attached to a patient?
190720	195460	And so being cognizant that while there is a potential to detect this from a technical
195460	200300	perspective, there are ramifications for implementing that for real patient safety
200300	201940	and actual patient care.
204800	209600	I totally have to agree there, and it becomes even more complicated when we talk about implant
209600	218300	tools. So to do any detection on those devices is very hard and not very robust at the moment.
218700	224600	But the problem is, as well as Lydia said, the implementation of traditional cybersecurity
224600	229880	tools in the healthcare space is problematic due to the fact that this is not your traditional
229880	231740	cybersecurity space.
232300	236440	Each hospital or healthcare institution faces their own challenges.
237280	242980	So it's almost about having something that caters to your hospital and your healthcare
242980	244520	institution.
249900	259020	Yeah, I just want to chime in here for a second and say, yeah, I don't think many hospitals,
259020	265800	under-resourced hospitals, have robust detection methods. You'll be surprised how many of them
266380	271220	lack intrusion detection systems or have good endpoint security. You'd be surprised how many
271220	275020	of them get regularly penetration tested or go through that entire process.
275020	281480	And just to plug again, HHS and the FDA, the 2017 Health and Human Services Task Force report
281480	287360	estimated that a good majority of hospitals in the United States lack a single full-time
287360	294580	security professional on staff. So that's like a perfect storm to have a lot of attacks probably
294580	296280	go undetected.
296420	299420	The other little part of that, and I just want to just reflect on what Vee said, I completely
299420	306060	agree. The home space is this complete black box. A lot of people who get medical devices,
306060	311620	especially in the era of COVID, are given home monitoring equipment or they get an implantable
311620	315020	and it has an accompanying base station. And when they're discharged from the hospital,
315020	319660	they say, go plug this into your router at home. And there's really not a lot of work
319660	323620	done to secure their home environments. And we don't know much about that space. It could
323620	329580	be fine, or it could be a nightmare. I think what we lack is the ability to collect that
329580	332160	information and then share it with people.
333120	337160	I think that's a perfect point to raise around ownership, right? Like who is actually responsible
337160	341100	for securing this? Is it really reasonable to ask someone to go home and secure their
341100	345900	home network, not knowing their technical skillset or whether that's really part of
345900	350280	getting care, right? And then you think about hospitals, is their core competency really
350280	355120	going to become cybersecurity? And to the point of not even having resources, we have
355120	359920	to really think about how we can think about where the ownership really needs to originate
359920	362380	and what is most efficient and effective.
365810	370970	One thing that I would say on this, I think is like the token government person on this
370970	377050	panel, is I do have to plug all of the work that is happening at some of the national
377050	383510	level policy issues, because I promise we are aware that these things are issues and
383510	388170	they are being worked on. And so there are a lot of industry bodies, industry bodies,
388170	393030	government bodies, and then bodies where the two come together, that have documented and
393030	398810	just general conversations about this on a recurring basis. So I know as little respect
398810	403090	as everybody can have for the myriad best practices guides and other things that, you
403090	406470	know, white papers that the government puts out that sometimes just sit on shelves and
406470	410670	never get used. But these are things that have been looked at and things like the medical
410670	416610	device sectors, joint security plan, they've been looked at for healthcare delivery organizations,
416610	420410	something called the HICUP. And if you paid me money right now, I could not actually tell
420410	423830	you what that acronym stands for. But it's like the healthcare version, the hospital
423830	430890	version of their best practices guide. And in the HICUP in particular, I want to say
430890	434870	it is, or maybe it's the JSP, one of the two, they actually have like, it's separated out
434870	438510	into what large organizations can do, and then what small and medium sized organizations
438510	443110	can do. And they do different things for both or recommend different things for both. So
443110	449170	this is an ongoing conversation that is happening at that national level. But we certainly don't
449170	457020	claim to have all of those answers. Another thing that I think is important is
457020	461140	we're moving into a thing where we want to do early detection and monitoring. But most
461140	465220	of the instances where there has been hospital breaches, we've been left on the back foot,
465220	470720	right? We needed to become aware of the breach before we could actually act on the breach.
470900	477460	So I don't think there is that early... within healthcare at the moment. I can use an example
477460	482800	of a healthcare attack in South Africa itself, they only became aware of it once the systems
482800	488160	were encrypted. And once you know, the damage has been done. So often, we have to rely on
488160	495600	the cyber criminals to make us aware of their presence in our networks. It would be awesome
495600	500180	if we could detect it early and stop it. I mean, that is the golden standard. That is the dream.
500180	506320	But I don't think we're there yet. I think the real dream is being proactive about this,
506320	510180	and getting the security on the device so it doesn't even get to the point of there being
510300	514600	a vulnerability that has to be detected. If we can just reduce the end of things that need to
514600	520180	be detected, there's a better probability of actually coming up with it. But is that going
520180	525200	to actually be something that we're going to get? Because I mean, these devices last for long. So
525200	531380	inevitably, there is going to be vulnerabilities always. It's going to be there because as time
531380	537220	progresses, research is done, and libraries become vulnerable, or hardware becomes vulnerable.
537440	542720	Also, it's about the threat landscape, right? We're talking about risk here. And just like
542720	546040	everything in life, there's nothing, there's no such thing as risk-free. We can't just
546040	550780	have a device that has security or doesn't. There's always pros and cons. We can't think
550780	557640	of every possible thing. So it's always, it's this combination, right, of, you know,
557640	561040	building the devices and making them as secure as we can in a reasonable amount of time with
561040	566800	the resources we have. And then once they're out into, you know, the healthcare ecosystem or the
566800	571100	consumer ecosystem, in the case of, you know, medical devices that maybe have to be on a home
571100	577660	network, there's so many pieces to that threat landscape, right? I don't, like, I'm not sure how
577660	585720	we can fully secure it. Like, there's no, there's no perfectly secure network, right?
587320	591980	I also want to throw one other wrinkle into this, which is that there's actually some
592720	598980	systemic, systematic issues when it comes to healthcare. Usually in hospitals, what's
598980	603300	traditionally been the paradigm is that the network's owned by IT, and that's where all
603300	607680	the security folks live, and they're able to detect kind of the attacks that they're used to,
607680	611620	and they can control some of that. But as soon as it comes to the medical device side of it,
611620	617960	they kind of wash their hands or are told, don't go there, that's bioengineering, and they
617960	623480	handle all the medical devices. And so what you often have is a dearth of cybersecurity knowledge
623480	628560	in the bioengineering space. By no fault of their own, they have a lot of other things,
628560	633220	they're fantastic people, but what we have as a result of that is this something we call the
633220	638480	discovery dilemma, where if you don't have people thinking about these issues, and you have
638480	644620	malfunctioning medical devices, you are unlikely to find a problem, even if there was some random
644620	648560	malware that spread over your network, it affected some of your medical devices, and as a consequence
648560	654900	they stopped working. Unless you are thinking about that as a potential etiology of your problem,
654900	660860	you're not going to go and look the one and two steps further to figure out if that was the issue.
661000	665500	So we talked a little bit before this panel started about the discipline of forensics. I've
665500	671360	asked many bioengineering organizations and groups and hospitals across the country and asked how many
671360	676440	of them do that type of forensic work on malfunctioning devices that are just really
676440	681040	out of the ordinary, and none of them said that they did. It's something we have to change. So
681040	685900	it's because the structure of these healthcare systems in such a way where there's a bright line
685900	691040	between who handles medical devices and who handles the network, and because those two groups don't
691040	695820	co-mingle and have equitable cybersecurity knowledge where we might have this problem,
695820	699660	where this might be a very common thing, but just we're not detecting it.
700120	703900	So I don't know if you want to, if we're like looking to move on to the next question here,
703900	708380	but one thing that I would point out on that, that I've certainly experienced,
708380	715900	especially over the last couple of months, is we're, we have experienced, I would say,
715900	720460	less and less medical device specific vulnerabilities where it's like the pacemaker
720460	725440	has a vulnerability or the MRI has a vulnerability. What we're now seeing are like higher level
725440	731980	protocol vulnerabilities. Swintooth was a great example. There was the, all of the, the whole run
731980	737660	of Bluetooth vulnerabilities. There was the Ripple 20. There was the Trek, which I think was, was the
738320	743640	one part or Trek TCP IP was one part of Ripple 20 or whatever it was. But anyway, these are
743640	749020	things that are not medical device specific. But what we're starting to see, and it goes to
749020	755880	the detection point. And then I wanted to hit on something that Vidya had said. The, the, almost
755880	759880	the nice thing that's happening about the fact that we have general IT vulnerabilities that are
759880	764000	now making their way into the medical device space or becoming relevant to the medical device space
764000	769580	is other sectors are detecting them for us. So even though there's maybe a little bit of a lag
769580	775260	in detection and in, I don't know, identification capability within the sector itself, because that
775260	779500	expertise may exist in other sectors. And because we're all relying on the same software, the software
779500	784240	that's in a medical device is the same that's in a consumer product. We're ending up still being
784240	789940	notified and still being able to notify others because it's happening in other sectors. But the
789940	793580	other thing, you know, Vidya had a good point about like, we need to, we need to lessen essentially
793580	798100	the attack space. And certainly acknowledging the fact that V and Ash are both right, like
798100	803140	things are always going to be vulnerable. Another thing that we've noticed is that we have an
803140	808360	increasing number of manufacturers who will tell them about vulnerabilities. And especially with
808360	813380	the Bluetooth ones, we have certain manufacturers who are like, oh yeah, but like the way we
813380	818460	architected our system, like our device doesn't trust the Bluetooth that's built into the device.
818460	824000	So all of these Bluetooth vulnerabilities don't impact us. And I think that that's sort of what
824000	829560	Vidya was getting at is like, we can build systems that are not impacted by certain types
829560	838580	of vulnerabilities. We just have to actually put in the work to do that. And I think, sorry,
839240	845720	Ash and I had this conversation, right? Security, the way that you change security and manufacturing
845720	851120	Ash was, right, we said it needs to be cheap and it needs to be easy and it needs to be accessible
851120	854860	and it should be the easiest thing to do. It shouldn't be the hardest thing to do and it
854860	859720	shouldn't be the most expensive thing to do. And when I refer to expensive, I don't necessarily
861640	868860	mean in terms of cost, it could be time, it could be design, it could be research, it could be CPU,
868860	873540	it could be battery life, right? But the thing is at this point, I don't think,
873540	880240	you know, at that end of the pipeline, that is very easily accessible for the smaller companies,
880240	886280	I'm not talking about your big companies, but your smaller ones that are doing some innovative work.
889930	895390	All right, we have a new question from Judo. And I think that this is going to be one we can all
895390	900730	kind of chime in on. It's, I think, boiled down to what are the steps that industry and I'm going to
900730	906630	add regulators in the space are taking to formalize stricter risk and controls around device development
906630	912350	that we use in patients. They assume that a larger device manufacturer formalized basic
912350	916750	security features, just like the payment brands have done, and set standards for the rest of the
916750	920590	industry. So I think there's a lot that's already been done. I just want to quickly reflect on that
920590	925770	to say, you know, the conversations that we were having 10 years in this space, we're asking for
925770	930710	this. And I feel like so much has changed between now and then where we, we do have a lot more
930710	935530	standards. And I think that the industry is moving forward in a lot of ways. And we can still talk
935530	939870	about some of the criticisms. But what I really think is a lot of people that have been paying
939870	945630	close attention will say, yes, we saw the problem of legacy devices. But we, you know, I said it in
945630	952710	the video, we don't have this year, to my knowledge, and there's still some time left, a story of a
952710	958610	device manufacturer threatening to sue a security researcher, for example, or something like that,
958610	963850	like WannaCry happened in 2017. So can everyone reflect on kind of what the industry has been
963850	967810	doing? And we can take it back a few years and give examples of some of the landmark documents
967810	972350	and guidance that has come from the industry as well as the regulation space.
981120	989220	Well, I can kick us off as the regulator. So I, you know, I think I was not at FDA,
989220	995380	let me preface this by saying, when some of these documents came out, but the two in 2014,
995900	1001820	I want to say, there was, you know, one of the first drafts of a cybersecurity guidance,
1001820	1005900	particularly cybersecurity guidance came out at FDA. A few years later, there was the
1006340	1012740	postmarket cybersecurity guidance. And then in 2018, the most recent one, you know, there was
1012740	1018000	the new postmarket draft. And this was the one that talked about coordinated disclosure,
1018000	1023500	talked about cybersecurity bill of materials, it talked about a lot of the advancements that
1023500	1027940	had been made in the sector over the past couple of years from the time that the guidance had been
1027940	1031800	most recently updated. And actually, let me just really quickly, for those of you who don't know,
1031820	1038520	is essentially how FDA tells industry, the best way to meet the regulations, because if you try
1038520	1042900	and read FDA's regulations, they're pretty bare bones. It's pretty much like you must do risk
1042900	1047000	assessments. But then like that, that's the end of the sentence, and it doesn't have any other
1047000	1052680	detail. So the guidance allows FDA to elaborate a little bit more on what precisely that means in
1052680	1058640	given contexts. And so, you know, credit to to Suzanne Schwartz and Dr. Seth Harmony, who
1059500	1064600	was worked on a lot of this when he was still with the agency. You know, they actually like
1064600	1070680	fought the good fight and got cybersecurity specific guidance out from the FDA to industry.
1070680	1075520	And I think, you know, obviously, I'm biased here, but that was just a huge leap forward,
1075520	1080680	I think, in many ways for, for not only us, but for the industry.
1085660	1090880	Yeah, I think, to that point, I think there, the the conversation that's come from all of
1090880	1095080	that initiative, right, you you have, you have this relationship that I think didn't exist before,
1095080	1098540	even if we go back four or five years, like there wasn't such a collaboration or willingness
1098540	1103940	to have manufacturers work with security researchers work with security vendors,
1103940	1108780	right? It was more of Okay, who can get what off of eBay? What can we prove doesn't work and then
1108780	1113620	try to try to get the best headline that we can get out of it. And I think the if you listen to
1113620	1117560	the recorded version of this, there's a lot of hope that we all have for where this conversation
1117560	1121120	is going, and that there are going to be solutions coming out of this, I think on
1121120	1123960	on all sides that are actually sustainable and efficient.
1125920	1131060	So I can add a positive story. So three years ago, I had my first DEF CON, came as a patient,
1131060	1136100	had some concerns about my own device, it was, as I would say, beautifully broken and wonderfully
1136100	1143040	flawed. And I made Suzanne Schwartz at that one. But except for that, before coming to DEF CON,
1143040	1147960	I actually reached out to my manufacturer and had a discussion with him and I was met with
1147960	1155580	legal. You know, it was like running into a wall. It was a cold, unloving situation.
1156300	1161480	Three years later, I'm working with that same manufacturer on things that I bought to them
1161480	1167140	three years ago. It took us since December to find a footing where, you know, the discussion
1167140	1171700	is not incriminating. It's not me pointing a finger. It's not them pointing a finger. It's
1171700	1175580	finding a unison and what they bring to the table, what I bring to the table
1177020	1182920	and working together. But except for that, I mean, we had conversations. I've been on the patient.
1184360	1187620	I don't know what the word is that you guys, that Jessica,
1189420	1195480	that gave patients the opportunity to give their experiences, right?
1196660	1201140	So generally in three years that I've been involved in this, we've made leaps and bounds.
1201700	1207180	Is that necessarily enough yet? No, I don't think we should lose momentum. I think we should kick
1207180	1211300	ass and keep going. I think we should push the envelope. I think we should have the hard
1211300	1222820	conversations. And I don't think we should stop now. Yeah, I would agree. I think that the
1222820	1228620	landscape is shifting really quickly. When I started working on medical devices, which was
1228620	1236360	over five years ago, already the technology has changed so much. Even in the last 15 years,
1236360	1240980	if you think about, you know, smartphones and, you know, 20 years ago, I don't think most of us
1240980	1246520	would have predicted that ubiquitousness of it and the impact that it would have on our daily lives.
1246520	1253920	And so, you know, historically medical devices were electromechanical and, you know, as medical
1253920	1259340	device manufacturers, we come, we have a system about approaching things from a risk and from a
1259340	1263940	safety perspective, like how do we make sure that people are safe? And a lot of medical devices
1263940	1268600	didn't have software in them. And then we started putting software in and then we started connecting
1268600	1274920	that software to the internet. And then all of a sudden the risk just blew open because now we can,
1274920	1279120	we have, we have IOT devices, we have clinical IOT devices, we have medical IOT devices,
1279120	1284300	we have implantable IOT devices. And so everything has been changing so fast. And I think,
1284300	1291720	you know, getting regulatory and getting standards in place takes time. And, you know,
1291720	1296140	especially from a software perspective, how many standards exist? Like we have so many standards
1296140	1301360	in software that are competing standards. If everyone would just follow my standard,
1301360	1306340	it would all be fine. But then there's 20 other people who also have a standard that they want
1306340	1310520	everyone to follow. And so it's, you know, it's tough. It's like the wild, wild west for software,
1310520	1316520	right? And so I've seen like a lot of these different groups coming together, you know,
1317320	1323360	obviously FDA is a part of it, but, you know, you know, most of our customers are,
1323360	1327320	they want to serve American markets. So we actually talk about FDA a lot every single day.
1327900	1333520	But there is the rest of the world that isn't governed by the FDA. And so there's a lot of
1333520	1339000	different bodies working together. And yeah, I see it as hopeful. I know IEEE is working on
1340000	1344760	international standards for clinical IOT and medical devices and interoperability.
1345460	1351740	And yeah, I think people are working on it, but I don't think we're there yet. Certainly.
1352380	1358320	I actually have to jump on that because I think if I don't, one of my bosses is going to find me
1358320	1364180	at home. But to the point about international regulation, there is a body called the
1364180	1369520	International Medical Device Regulators Forum. And speaking of, you can never get government to
1369520	1374180	do anything in any reasonable amount of time. That's just sort of a default law of the universe.
1374300	1379060	But that group, which is a group of, it's like a nested group of regulators. So you would have
1379060	1384620	thought that this would have taken significantly longer than it did. But they actually just came
1384620	1390060	out with a cybersecurity guidance document. And so that's another thing that's been really
1390060	1394520	valuable for us. And I would actually encourage everybody to go look at it. It's got a really
1394520	1400760	fun definition of legacy that you all might have thoughts on. So anyway, IMDRF guidance.
1405220	1409120	The only thing I can add is that we're never going to be done, right? So as much as we've
1409120	1412640	progressed, and absolutely take a moment to recognize the accomplishments here,
1412640	1415280	there's certainly a path that we need to continue pursuing
1415280	1420080	in order to even maintain a baseline of security across the board.
1421280	1426620	I think what I want to see, and this would make me like as a patient super happy, is if we had
1428300	1434760	in the manufacturing, we had security standards for secure manufacturing, because it's one thing
1434760	1439280	having a cybersecurity framework, right? Or a guidance in terms of that. But it's a different
1439280	1445760	thing and having a standard for, you know, how we are going to securely manufacture these devices,
1445760	1451420	because often than not, you know, hardware is the constraint. Because when we talk medical devices,
1451420	1457520	we are designing, you know, firmware to run on hardware. So I think we need to, you know,
1457520	1463100	completely start at the beginning, when they conceptualize the requirements is that we need
1463100	1469640	to build security in there, right? It shouldn't be this, you know, after the fact, kind of like,
1469640	1476180	let's put it on the end and, you know, hope for the best. And that's, you know, normally done,
1476180	1482880	because we didn't consider it in the beginning, and it hasn't been in that, you know, that practice.
1482880	1488940	But there are companies doing that, and that is changing. But you know, it's also been an industry
1488940	1495620	that's been around for a very, very long time. And it's got some bad behavior and bad things that
1495620	1501140	it's been doing. It's also got good things, right? I mean, how many lives have medical devices saved?
1501140	1506680	I mean, you're always focusing on the negative. I mean, I wouldn't be here. I would have died at 19.
1507300	1510400	I'm not much older, I'm not going to tell you my age, but you know,
1511720	1512580	so I mean,
1512580	1515980	So Vi, are you saying, are you saying push left? Is that the summary of what you're saying?
1515980	1521480	Yes, I think you and I said that, let's push all the way left, right? Let's not do this at the end.
1522000	1527260	I've worked with the developers and the engineers, right? You know, everyone thinks like security is
1527260	1533540	the answer. You want to change this shit? Get them to start doing with security in mind, and you know,
1533540	1538680	you're not going to deal with future problems. I literally have found that security and forensics
1539340	1545160	forms part of hardware engineering and forms part of software development and firmware design.
1545160	1551180	You know, it just, there's this synergy when we start working as a team and as a collective
1551180	1556020	instead of, you know, silos. And I know there's people that are going to argue the silos are good
1556020	1562200	because everyone needs to focus on the independent thing. But when we bring different minds together,
1562200	1567600	that's when we start seeing things come together in a different way. And I think that's going to
1567600	1573180	be the answer, is working together instead of against each other. And, you know, that
1573180	1578140	multidisciplinary approach. Because we're not all experts. I mean, I shouldn't be doing any hardware
1578140	1585960	design. It will break. You know, that's not my speciality. But I can tell you from a security
1585960	1592200	and a logging perspective or forensics perspective what would work. So I think we need to get that
1592200	1600060	multidisciplinary approach. All right. Iona, go ahead and get our next question kicked off by
1600060	1604780	Ken in the DEF CON Discord. He says there's been a lot of progress in the last five years. I think
1604780	1609660	we've all talked about the optimism that we've had, you know, guarded optimism. But there's still
1609660	1613660	problems with smaller device manufacturers. There's problems with smaller hospitals. How do we motivate
1613660	1619220	them? How do we get them to do the right thing? And I think, Ash, on the recorded talk, you had,
1619220	1623680	you know, talked about how that's a big part of medical device development are kind of these
1623680	1630040	smaller boutique consultant shops like your own. Yeah, I wish I had a I think that's a fantastic
1630040	1636060	question. I have that question every day. How do we how do we motivate them? How do we make the
1636560	1642400	how do we get there, right? Because we've got constraints on lots of sides. And, you know, at
1642400	1646840	the end of the day, you know, most of the people who are working on this, we are really passionate
1646840	1651820	about the end patients, especially, you know, some of the smaller shops, like everyone that I work
1651820	1658640	with actually cares about the patients. And a lot of our clients are doctors who have an idea for
1658640	1663820	some medical device that they think will save lives, and they only have so much budget. So,
1663820	1669980	yeah, how do we motivate them? I think I think everyone is motivated. Or at least for some of
1669980	1676120	the smaller ones. We are motivated how to actually get there, how to implement how to how to
1676120	1683340	communicate to clients, and even to other engineers about what the risks are with software,
1683340	1688540	because sometimes, again, we're so used to see thinking about things as, you know,
1689600	1694240	electromechanical device, you know, we think about safety is like, the lock on the door,
1694240	1697240	you know, people who aren't in software all the time, people who don't come from a security
1697240	1701540	background, they don't think about all the creative ways, they just kind of think, well,
1701540	1706840	this is secure, we put a lock on it. You know, it's like, I put my phone into a little like box,
1706840	1711000	and then I put a lock on it, how could it not be secure? Well, because I can connect to your phone
1711820	1717240	through Wi Fi, and then exploit it somehow, right? Like, so it's not actually immediately obvious to
1717340	1724020	a lot of people. So then, when you're trying to, you know, trying to set up a project and talking
1724020	1728120	about budget, and how much time we allocate, and, you know, what, what sort of security things do
1728120	1734040	care about? And, you know, everything is pulled in all these directions. So I, I don't have an
1734040	1738240	answer for how to balance all of those perfectly. I think we're trying to do that every single day.
1738400	1742460	But I think it's a really great question. And I think we should keep asking it.
1744280	1746460	Yeah, that's what I have to say.
1752330	1757210	I think the phone's a great analogy. Sorry, just two seconds here, right? I think that the fact
1757210	1761050	that you bring up this notion of, okay, people understand security on a phone, and they say,
1761050	1765170	I'm comfortable that my iPhone is going to do this. And I know Bea and I had this conversation.
1765170	1770590	But how do we translate that into the expectation that a medical device will be secure in and of
1770590	1775230	itself, independent of how it's going to connect to whatever the clinical care is? And I think
1775230	1780630	part of it is, we have to be fair to all these clinical innovations that are really trying to
1780630	1786110	bring something to the patient experience and change it for the better, and not try to force
1786110	1791150	them to become cybersecurity experts. There has to be a way for us to enable them to get there
1791150	1798150	without having to become pros at cybersecurity. I will say, though, and I have to say it. Sorry,
1798150	1801850	everyone. I think I disappeared for a moment. My computer decided it didn't want to be part
1801850	1809790	of this panel anymore. So there is pre-market guidance. And the current version is not nearly
1809790	1818190	as detailed as I think some of the things that we're working on now. But to get on the market,
1818190	1823510	medical devices have to go through the FDA in most cases. I'm not going into the class system.
1823510	1827770	None of us need that. But if they're going to have software and other things like that,
1827770	1832270	chances are they have to get pre-market approval to even go on the market. And so to a certain
1832270	1838110	extent, they have to demonstrate through FDA, whatever the device is, however small the
1838110	1842750	manufacturer is, that they have provided reasonable assurance of safety and effectiveness.
1842750	1848910	And we check for cybersecurity concerns. I think I made some clever comment about Matt being my
1848910	1854250	elementary school best friend. But Matt is the lead for a lot of the cybersecurity reviewers at
1854250	1859970	FDA. And like I said in the recording, we're getting better at that every day. But this is
1859970	1867570	something where FDA is rightfully by statute, by law, the gatekeeper of what can and can't be
1867570	1872950	put on the market. And so I think, you know, for better or worse, you can argue whether or not
1873390	1877870	it's good or bad that we're doing what we're doing. The smaller manufacturers
1877870	1882090	still have to go through us. So there is still going to be that part of it.
1883930	1888190	I also just want to say, we had talked multiple times about how you have to make security
1889270	1894690	the easy thing to do. And for some of these rural access hospitals, smaller organizations,
1894690	1902170	they're just not going to be able to do the job right. And so I think collaboration,
1902170	1906650	I've said this a couple times, there shouldn't be a competitive advantage in cybersecurity when
1906650	1910730	it comes to hospitals, right? So you shouldn't see a billboard as you drive down the street that
1910730	1914990	says, you know, when you have your heart attack, come to hospital A because we didn't get hacked
1914990	1921210	last year like hospital B did, right? So that shouldn't be like that. And I think, luckily,
1921210	1925430	there's been a lot of momentum towards collaboration, information sharing,
1926250	1930150	through a lot of these organizations and bodies we've already talked about. But, you know, what
1930150	1936210	was an alien concept to hospitals five years ago is probably not that crazy now, which is,
1936210	1940170	hey, if we get hit with ransomware, you know, we're going to go through our protocol of
1940170	1946030	incident response. And guess what? I'm going to call the CISO at competitor hospital B and let
1946030	1952070	them know this happened to us. And did you see anything? Collaborate. What normally was a very,
1952670	1955930	we're not going to share, we're not going to talk, we're not going to collaborate in the space,
1955930	1960050	has clearly gone out the window for some of the more forward thinking organizations. Now,
1960050	1964570	let's take that information. For example, all the great work that larger organizations have
1964570	1970490	done, like Mayo, looking at particularly secure devices compared to others, share that information
1970490	1974790	with other rural hospitals, so they don't have to go and reproduce all that work from scratch,
1974790	1979870	they're doing that. Being able to share in that space is so, so key. So let's not reinvent the
1979870	1986270	wheel at every single hospital. Let's not try to build gigantic teams that do vulnerability testing,
1986270	1990290	penetration testing on every medical device and reproduce that work time and time again. Instead,
1990290	1994930	it's a community. We got to recognize that it doesn't follow the same competition that you
1994930	1998410	normally would where you're not sharing. This is a different world. This is about patient safety,
1998410	2003970	though. We all have to be on the same page. Yeah, but I mean, I'm going to say something
2003970	2009590	that's going to be very unpopular, right? If you take a medical device, functional requirement is
2009590	2015690	not security. Functional requirement is keeping someone alive or healthcare, right? We need to
2015690	2020490	understand that because we are superimposing security onto these devices when that's not
2020490	2026730	their main functionality. Yes, as they advance, they are connected and they need to be secure.
2026730	2032330	But I don't think we should solely focus on having such secure devices that might just never see the,
2032330	2038610	market. They might never save their life. That one patient's life that they can change.
2038610	2042350	I think we should never lose sight of what the purpose of these devices are
2043530	2048950	when we try and attempt the security implementations onto them.
2054390	2063370	Awesome. All right. We're going to go to the next question here. This is from Synapsys.
2064230	2069950	Questions about where the industry is going insofar as what are the new, and perhaps we can
2069950	2073910	even talk about the pre-market guidance in this regard, like what types of requirements
2073910	2078270	are we going to be putting into some of these new devices as they go for approval
2079270	2084710	to push that forward? To perhaps, of course, always respect that these devices are security,
2084710	2090250	or sorry, that was not a slip, I promise. They're medical devices meant to help patients,
2090250	2094430	but they have to be secure. Are we going to be deploying things like stack protection,
2094430	2099810	ASLR, DEP, and other things like modern, like language changes that have better security
2099810	2104410	kind of baked in from the start? Are we seeing trends in this space towards utilizing more
2104410	2109710	secure tools and development of these medical devices so that they are less prone to some
2109710	2115990	of the scary vulnerabilities we've seen in legacy devices? So I think you called me out there a
2115990	2123010	little bit with the cybersecurity guidance. So yes, you know, I think I had made the comment
2123010	2129270	earlier that the FDA, the actual regulation parts of FDA's regulations are pretty high level. I
2129270	2133850	really would be amused if any of you were like that motivated to go look at literally the code
2133850	2140230	for federal regulations and go look at our regulations. They're very dry. And then you have
2140230	2144710	guidance, and then you have what companies are actually doing to meet the guidance or to meet
2144710	2151370	regulations. And I think from the FDA standpoint, it would help no one if we picked like the one way
2151370	2155250	of doing security to rule them all and then told all the manufacturers that they have to do that
2155250	2161130	one thing. So instead, essentially, what we've we have been communicating to them, and we continue
2161130	2164950	to work with manufacturers on and continue to work with our own internal processes on is essentially
2164950	2169130	saying like, you need to have a secure architecture. We're not going to tell you what the
2169130	2173750	architecture looks like. But you need to, it needs to be secure. And you need to be able to produce
2173750	2178450	the documentation to us that proves and validates that it's secure. You need to have security
2178450	2182330	controls that are the same thing. You need to be able to not only have them, you need to prove that
2182330	2187570	they work. And so and then but but then at that point, it's sort of like and it's now the ball
2187570	2192010	is in your courts, manufacturers, you tell us what your security controls are, you tell us what your
2192010	2200090	secure architecture is. Because I think like going down into the the ASLR level and things like that,
2200090	2203830	to V's and Asher's and videos and some of the other points that have been raised,
2203830	2207570	each individual medical device is very unique, you know, the things that you're going to do
2207570	2211650	to secure drug infusion pump are not going to be the things that you're going to do to secure an MRI.
2212230	2217130	And so we do need to have that flexibility built into the regulations built into the guidance,
2217130	2222990	so that, you know, we can we can allow the manufacturers to figure out, you know,
2222990	2228590	what is the best, most efficient way to secure the device to V's point that we don't, you know,
2228590	2235690	impose such rigid constraints on it that certain devices just can never meet them,
2235690	2238710	you know, maybe they can do something else. So that's what I would say.
2243440	2249080	Didn't mean to call you out. I just think it's such a great segue. All right, who's up on that
2249080	2254340	question? So I mean, you had mentioned Ash, like how much things are changing? And do you see
2254340	2259700	trends towards more kind of baking in these controls from the start? And do you see exciting
2259700	2266480	trends emerging? I mean, I think I agree with what Jessica said, I think.
2268540	2273700	I'm not sure, you know, I come from software and engineering development background,
2273700	2278720	and I'm learning more and more about security. But so traditional security controls, I don't
2278720	2282820	have a huge history with that. But I think every device is really different. And from
2282820	2288880	security perspective, or from a safety perspective, we make sure that the device is secure,
2288880	2293300	so that it provides safety, so that patient outcomes are,
2295040	2302080	are successful or positive, right? Every device is different. I think that more people are
2302080	2306860	learning more people are like me, there's more engineers who care about the security part. And,
2306860	2312180	you know, obviously, with FDA and guidances, and with regulatory, we have to meet standards.
2312700	2318560	That's absolutely correct. How we choose to meet those standards is up to each manufacturer. So
2318560	2323340	we have an internal process of how we approach that. At the end of the day,
2323920	2328620	you know, it's, it's literally different every time we make a device. So we're different too,
2328620	2333440	because we are a consulting firm. So we make a lot of different devices, we have no, we have
2333440	2340440	none of our own in house products that we are continually sort of like, building. So every,
2340440	2346660	every device is unique, and it has a unique solution has unique architecture. And as technology
2346660	2354020	is changing as Wi Fi's in everything now, more and more and more. Yeah, I mean, we're using
2354020	2359380	different approaches. Yes, we have to make more, we have to have a bigger focus on security because
2359380	2367800	of that. But, but I think it's just we're just following the trends with technology itself.
2373830	2379650	Yeah, the only thing I'd add there is I think there are there are a variety of ways to approach
2379650	2383790	it. And we have to absolutely keep patient care at the center of it to make sure we don't introduce
2383790	2390230	new problems by trying to solve the security problem. But I think there's there's a fundamental
2391290	2395230	expectation now that there is security built into this, it's not something that can be bolted on
2395230	2398790	afterwards, where we're seeing the narrative more and more that it has to be part of the
2398790	2402310	initial requirements discussion, it has to be part of how the device is going to connect how
2402310	2405870	it's going to be patched. If we don't think about it from the onset of these fundamental
2405870	2410410	architecture decisions, I think we'll we'll continue to have this problem of trying to
2410410	2415830	solve the quick regulation question that came back and try to get it through so it so it can
2415830	2423050	get to the hospitals. No, definitely. I don't think we can get to a granular level that we can start
2423050	2428590	dictating architecture, because again, those things depend on the type of device and the
2428590	2435450	requirements that you need the device to fulfill. But I am looking forward to better guidances. And
2435450	2439530	yes, I was that boring person that went and read that because I wanted to understand
2439530	2445030	our pre-market post-market book. But after some discussions with Jessica and Suzanne,
2445030	2450570	I'm excited to see the new ones coming out and the more robust nature of them because
2450570	2456390	we are moving towards a place where we are going to be enforcing better manufacturing.
2459020	2463940	So let's transition to our next question into a little bit outside the medical device space and
2463940	2470000	more into the hospital. Ken brings up another question about who's keeping the hospitals
2471500	2477360	in line? Meaning the Joint Commission is, and there's a couple other bodies,
2477360	2482300	are the ones that accredit hospitals. So when you go by a hospital, and they can be a hospital,
2482300	2487940	some type of regulatory body has to make sure that they are to meet certain standards. The
2487940	2492740	Joint Commission is probably the most famous one of those. And so a lot of what we talk about on
2492740	2497860	the hospital side actually would never be FDA jurisdiction. Those are medical devices in their
2497860	2503940	approval. This is the Joint Commission's probably space or other organizations that accredit
2503940	2510100	hospitals. So the question that Ken poses is, you know, has the Joint Commission jumped in here?
2510100	2517000	And how do we make sure that hospitals do what they're supposed to do? We've talked at length
2517000	2521400	about how we can do better with medical devices, but I think we need to start moving also into the
2521400	2526240	space of, like, hospitals need to be held accountable in some cases, and in accordance
2526240	2530200	to what they're able to do. But we need to move that needle as well, because we've all heard
2530200	2537260	stories of devices with certain security controls from the manufacturers that get turned off,
2537260	2542380	or aren't deployed appropriately, or deployed on horribly secured networks at hospitals.
2542380	2548540	And so part of the responsibility has to be this multiple people, right? How do we get hospitals
2548540	2554280	to do the right thing? Knowing that, especially in times like COVID, it's not going to be the
2554280	2557380	place they're going to be putting their resources in, right? They're worried about their ventilators
2557380	2563660	in the ICU. They're not necessarily worried about this problem right now. Is there a way that we can
2564120	2567280	move forward and make sure hospitals do the right thing?
2571400	2576960	To be flippant, but like, do we? I feel like there's such a burden here that we're trying to
2576960	2582540	historically pass on to hospitals that maybe was unfair, right? Like, yes, hospitals,
2582540	2587080	if they're told in a user guide that they need to have certain controls in place, and they didn't,
2587080	2591040	sure, there's something there. There's a flaw there in the plan. But at the same time,
2591040	2596200	is it a fair expectation for a device vendor to say, okay, we want you to have these 32 different
2596200	2600500	controls in place, times a hospital having a bunch of different vendors? Like, I think
2601260	2606720	there's a balance there. So I think, yes, you have to enable hospitals to be
2606960	2611020	more successful in having some of the basic security in place. But I think it's also
2611020	2618840	somewhat unfair to place the onus on them so much. Yeah, I mean, I think I could just share
2618840	2623120	something. You know, we talk all the time about shared responsibility. And actually,
2623120	2627780	Christian, thank you so much for pointing out that FDA does not actually regulate hospitals.
2628100	2634500	Because I think sometimes people forget that we actually have a very small slice of the pie. And
2634500	2639820	we like to think we're very effective, whether or not we are, as I suppose, for debate from others.
2639820	2646740	But, you know, that's not something we have any control over. But, you know, there are multiple
2646740	2650460	federal agencies and state-level agencies. And actually, that's part of the problem,
2650460	2656560	is the sheer number of regulators who are active in this space, who may or may not have harmonized
2656560	2660800	regulatory requirements that hospitals are expected to meet. You know, that's challenging
2660800	2666140	enough as it is. But something that Vidya said I wanted to hit on, because we were...
2666940	2670160	one of these, you know, public-private partnership bodies that I'm a part of,
2670160	2675720	we were recently talking, and one of the core CISOs was like, I have a spreadsheet of 400
2675720	2680940	different websites that I have to continually check to figure out what updates I need to make
2680940	2685780	to all of the different devices that I have. And it's not something where, you know, they're not
2685780	2689760	always getting active notification from the vendors as, like, you should go check one of
2689760	2696480	these 400 websites. And there's just, it seems, you know, almost an infinite variety of procedures
2696480	2701460	that each individual manufacturer can try and impose on a given hospital, and that just can add
2701460	2708480	up so fast. So, you know, in that sense, like, there are certainly things that we can do better.
2710420	2716480	I don't know necessarily that punishment is always the way to go with that. You know,
2716480	2720320	I don't know how many of you know about the Office of Civil Rights wall of shame,
2720320	2723980	but literally if you have a breach of more than 500 people, or at least this was the way that
2723980	2729260	it was a couple of years ago, you go up on a portion of HHS's website with, like, your name,
2729260	2735880	and how many records were breached, and how you got breached, and etc. etc. And it's not exactly
2735880	2741960	the most helpful way to do it, because you also get fined in that case, which is then, that's
2741960	2746500	resources that you have now lost, that you then cannot put towards your security, because you
2746500	2752200	just had to pay it, you know, to somebody else. And so, you know, there's, I think, and this is,
2752200	2757900	these are conversations that happen at the federal government level all the time, is like, how do we,
2757900	2763640	how do we regulate, holistically, how do we regulate in such a way that, you know, we are,
2763640	2770000	we are helping the industry move forward, rather than, you know, continuing to perpetuate some of
2770000	2777580	the problems that we see? I want to touch on that, because this is something that is really
2777580	2784220	near and dear to my heart, is hospitals. And the one thing that I've realized is we've created this,
2784220	2788600	this shameful thing of finger-pointing when a hospital gets breached, right?
2789500	2793620	Where we make it this negative connotation that they don't want to come out and say, hey, we've
2793620	2798920	been breached, we need help. We've made it impossible for them to turn to the security industry and ask
2798920	2806020	for help, because we shame them when they have been breached, right? When they are having to deal
2806020	2811860	with medical care and then sophisticated attacks from cybercriminals. You know, and on top of that,
2811860	2817000	implementing different patches and different software updates, different systems, and now
2817000	2822980	how they're going to connect all these things up. I think we are expecting them to take ownership
2822980	2829700	and accountability for things that aren't theirs to do. And then still, we punish them for not
2829700	2837700	being able to do it. It's a very negative connotation to, you know, we need help.
2839960	2844780	I agree. I don't think punishment is necessarily the right way, but I think
2844780	2849940	that they're not being punished. The only hammer that really they pay attention to is HIPAA,
2849940	2857840	because it's tied to a fine and an embarrassment on a wall. There isn't really, for example,
2857840	2864980	rural hospitals, AIDS gets owned and there isn't a HIPAA breach. No one knows about that. And there
2864980	2870560	is likely going to be little remediation efforts, probably because they've been owned for years and
2870560	2874820	they don't even know. What I'm trying to say is that I don't think we should shame hospitals,
2874820	2884640	but the status quo is likely untenable for a long term, because there is an increasing
2885380	2891420	attack surface. There's less resources being put into this. And then on top of it, there's just,
2891420	2897200	it's going to have to be looked at in some way, because we can't have the most secure medical
2897200	2903640	devices on the planet with phenomenal protections, and then put on networks that no one cares about,
2903640	2907140	or that no one's doing a good job at securing because there isn't that
2907140	2911900	pressure. So how do you incentivize the hospitals? Do you say, for example,
2911900	2916760	we're going to give you 0.25% more on your Medicaid reimbursement if you meet these
2916760	2921460	cybersecurity requirements, right? Are you going to say we're going to cut your reimbursement from
2922760	2926680	insurance claims on this if you don't meet these requirements? Is the joint commission going to
2926680	2931600	say, hey, we're not going to credit your hospital unless you meet these requirements? These are the
2931600	2936780	questions we should be talking about, whether or not it's a carrot or a stick. This is how we're
2936780	2940360	going to have to figure it out. But what I do know is, you can look at many different healthcare
2940360	2945360	organizations across the globe, and know that that's just, we can't keep going in that realm,
2945360	2950660	because the patient information is just too valuable. And the risks of compromises to these
2950660	2956740	networks are just too great for patient safety. And so we have to have that conversation sometime.
2957560	2962220	Again, I don't want to shame anybody, but we have to do better on all fronts of this,
2962220	2966320	because if you just secure one side, our patients are still vulnerable on the other side.
2966320	2969440	It's really got to circle the wagons. Everyone's got to get on board.
2970700	2975740	I think to your point, right? I think cybersecurity in healthcare was defined as HIPAA for the
2975740	2980460	longest period of time, and nobody ever connected it to patient safety. So I think that's why there
2980460	2986120	is disincentive, but in absence of an incentive for a hospital to really build security beyond
2986120	2995180	just what the UCR is going to find them for. It's a change of how they perceive security,
2995180	2999620	right? Cybersecurity is always the stick that's beating you, that's saying you need to do X, Y,
2999620	3003840	and Z. It's never the thing, well, if you don't do this, this is what's going to happen,
3003840	3008080	and it's going to impact your patients. I think we need to change the narrative.
3008640	3014560	And the way that we approach this is by getting the hospitals to believe that this is
3014560	3021560	the best for their patients. This is not just something that needs to be done because HIPAA
3021560	3026220	says so, or any other organization says so. I don't know the Joint Commission, and I'm going
3026220	3032580	to be honest with you, I don't follow that because I'm not from the US. But I do feel
3032580	3039040	that if you change the way security is perceived within a hospital, and you make it more patient
3039040	3044940	safety, you will see people change the way that they approach the problem.
3048890	3051650	You're absolutely right. And I think there's a balance there, right? We don't want people
3051650	3056530	declining clinical care because they now understand the potential risk. But I absolutely
3056530	3060850	think you're right. The focus here should always be about the patient safety that we're trying
3060850	3067090	to ensure collectively. I mean, COVID's kind of broken the perimeter, right?
3067730	3074170	It's, I mean, they are sending home monitors. I mean, which angle do you defend from?
3074250	3080790	Where is our perimeter at the moment? I think it's just, we're going to have to rebuild healthcare,
3080790	3086750	I think, after COVID globally. And that's an opportunity to do things different, right?
3086750	3093930	We now have a way to move forward positively without having to reinvent the wheel because
3093930	3100030	the wheel's kind of broken down now. So I see the positive in that as well.
3100990	3105830	And I'm excited for it, personally. All right, everybody, we're going to have
3105830	3109290	to wrap up here soon. But I want to give everyone an opportunity to just say
3109690	3113730	where they're going to go party after this Q&A. So I'm going to start off with Jeff.
3114130	3118710	Where are you going to party? His internet is having a seizure, he told me. So I'm not
3118710	3121230	sure if he'll be able to respond. He's going to go party with me, I bet.
3121230	3122670	Yeah, somewhere with better...
3124590	3127130	He's going to go to Starbucks and steal some internet.
3127130	3129510	Ash, where are you going to go party after this Q&A?
3130750	3135890	I'm going to open the new record player that I got that arrived in the mail today
3135890	3139410	and set it up and probably party here.
3139550	3141530	V, where are you going to go party after this?
3142170	3149050	It is 6am, so I am going to go party at Club Duvet. It is a very, very, very warm, toasty club.
3149050	3151210	And that's where I'm going to be spending the rest of my morning.
3151970	3154170	Nice. Vidya, where are you going to go party?
3154430	3156970	Going to hit up the beach, all day, every day.
3157110	3161370	All day, every day. And Jessica, take us home.
3161610	3166830	I was going to say I was going to Club BED with DJ Pillow, because that's exactly what I'm going to do.
3168250	3174910	Well, on that note, we want to say thank you to DEF CON, the CFP board for giving us another
3174910	3178830	shot at this, and everyone out there watching us on Twitch to say thank you for attending our
3178830	3182830	Do No Harm panel. Again, stay connected with this. This is really important work.
3182830	3185410	Let's keep our patients safe. And everyone, take care.