WEBVTT 00:00.000 --> 00:02.360 I just dropped it in the private chat. 00:17.780 --> 00:20.080 And we're not streaming. 00:20.080 --> 00:23.400 We host DEF CON music and it takes a hot second to switch away from it. 00:33.060 --> 00:34.900 There we go. 00:35.540 --> 00:37.420 And you guys are live. 00:39.660 --> 00:42.360 Welcome DEF CON safe mode. 00:42.360 --> 00:46.560 We're here at the DEF CON 28 safe mode. 00:46.560 --> 00:52.180 Do no harm, a healthcare security conversation Q&A. 00:52.660 --> 00:57.780 If you haven't had an opportunity to check out our pre-recorded video, it's on the media server and it's also on YouTube. 00:57.780 --> 01:03.440 We go for about an hour talking about some various topics that we'll probably touch on again tonight. 01:03.440 --> 01:10.040 Your opportunity here is to ask us questions in the Discord text channel and then see us live on Twitch. 01:10.040 --> 01:15.760 If you have any questions or anything, go ahead and feel free to put them in there and we'll get them in no particular order. 01:15.760 --> 01:19.040 All right, I'm going to kick it off and let everyone introduce themselves briefly. 01:19.040 --> 01:21.300 And then we're going to go ahead and get to the first question. 01:21.300 --> 01:22.420 I'll start with myself. 01:22.420 --> 01:23.440 Hey, I'm Quadi. 01:25.180 --> 01:25.820 Replicant here. 01:25.820 --> 01:27.400 Hope everyone is safe and healthy. 01:29.440 --> 01:30.980 Hi, my name is Ash Luft. 01:30.980 --> 01:35.780 I'm an embedded software developer from Starfish Medical. 01:40.920 --> 01:42.440 I have no idea what order we're going in. 01:42.440 --> 01:43.460 So I'm Jessica Wilkerson. 01:43.460 --> 01:46.120 I'm from the FDA and I'm a cyber policy advisor. 01:51.920 --> 01:53.100 Hey, I'm Vidya. 01:53.100 --> 01:55.560 I am from MedCorp. 01:55.560 --> 01:58.640 We are a cybersecurity solution targeting medical devices. 01:58.640 --> 02:00.280 And V, I'll turn it to you. 02:01.160 --> 02:02.280 It's Ivy. 02:02.440 --> 02:03.740 I'm a goon. 02:03.740 --> 02:06.440 I am a patient, a hacker, and a researcher. 02:06.600 --> 02:08.400 And that's about all about me. 02:08.400 --> 02:09.620 Back to you, Quadi. 02:10.200 --> 02:10.880 Awesome. 02:10.880 --> 02:13.620 So I'm accepting some fantastic questions tonight. 02:13.620 --> 02:22.060 We're going to go ahead and kick off the first one with a user called Raziz, which has a multi-part question, but I think the heart of it is at the end here. 02:22.060 --> 02:24.900 And it's a question to everybody. 02:24.900 --> 02:27.020 Please don't be shy. 02:27.100 --> 02:35.160 Do we have the resources to adequately detect and respond to attacks against internet-connected medical devices? 02:35.160 --> 02:41.910 So right now, in the status quo, can we even detect these attacks as they're happening, specifically on the devices? 02:43.360 --> 02:45.440 Who wants to take it first? 02:45.500 --> 02:46.800 So I'll take a first pass. 02:46.800 --> 03:00.660 I think while there are several solutions that exist in the IoT space, their application to healthcare is what creates this problematic scenario where we're relatively inadequately equipped to sufficiently respond right now. 03:00.660 --> 03:10.620 I think we think about what's the worst thing that could happen when you put security on a thermostat, and we don't really think about, well, what's the worst that can happen when something happens to a medical device that's attached to a patient? 03:10.720 --> 03:21.940 And so being cognizant that while there is a potential to detect this from a technical perspective, there are ramifications for implementing that for real patient safety and actual patient care. 03:24.800 --> 03:30.420 I totally have to agree there, and it becomes even more complicated when we talk about implant tools. 03:30.420 --> 03:38.300 So to do any detection on those devices is very hard and not very robust at the moment. 03:38.700 --> 03:51.740 But the problem is, as well as Lydia said, the implementation of traditional cybersecurity tools in the healthcare space is problematic due to the fact that this is not your traditional cybersecurity space. 03:52.300 --> 03:56.440 Each hospital or healthcare institution faces their own challenges. 03:57.280 --> 04:04.520 So it's almost about having something that caters to your hospital and your healthcare institution. 04:09.900 --> 04:24.020 Yeah, I just want to chime in here for a second and say, yeah, I don't think many hospitals, under-resourced hospitals, have robust detection methods. 04:24.020 --> 04:30.180 You'll be surprised how many of them lack intrusion detection systems or have good endpoint security. 04:30.180 --> 04:35.020 You'd be surprised how many of them get regularly penetration tested or go through that entire process. 04:35.020 --> 04:48.960 And just to plug again, HHS and the FDA, the 2017 Health and Human Services Task Force report estimated that a good majority of hospitals in the United States lack a single full-time security professional on staff. 04:48.960 --> 04:56.280 So that's like a perfect storm to have a lot of attacks probably go undetected. 04:56.420 --> 04:59.860 The other little part of that, and I just want to just reflect on what Vee said, I completely agree. 04:59.860 --> 05:04.180 The home space is this complete black box. 05:04.180 --> 05:13.760 A lot of people who get medical devices, especially in the era of COVID, are given home monitoring equipment or they get an implantable and it has an accompanying base station. 05:13.760 --> 05:17.540 And when they're discharged from the hospital, they say, go plug this into your router at home. 05:17.820 --> 05:21.520 And there's really not a lot of work done to secure their home environments. 05:21.520 --> 05:23.440 And we don't know much about that space. 05:23.440 --> 05:25.860 It could be fine, or it could be a nightmare. 05:25.860 --> 05:32.160 I think what we lack is the ability to collect that information and then share it with people. 05:33.120 --> 05:35.960 I think that's a perfect point to raise around ownership, right? 05:35.960 --> 05:38.060 Like who is actually responsible for securing this? 05:38.060 --> 05:47.240 Is it really reasonable to ask someone to go home and secure their home network, not knowing their technical skillset or whether that's really part of getting care, right? 05:47.240 --> 05:52.400 And then you think about hospitals, is their core competency really going to become cybersecurity? 05:52.580 --> 06:02.380 And to the point of not even having resources, we have to really think about how we can think about where the ownership really needs to originate and what is most efficient and effective. 06:05.810 --> 06:25.430 One thing that I would say on this, I think is like the token government person on this panel, is I do have to plug all of the work that is happening at some of the national level policy issues, because I promise we are aware that these things are issues and they are being worked on. 06:25.550 --> 06:36.290 And so there are a lot of industry bodies, industry bodies, government bodies, and then bodies where the two come together, that have documented and just general conversations about this on a recurring basis. 06:36.290 --> 06:47.750 So I know as little respect as everybody can have for the myriad best practices guides and other things that, you know, white papers that the government puts out that sometimes just sit on shelves and never get used. 06:48.130 --> 06:57.630 But these are things that have been looked at and things like the medical device sectors, joint security plan, they've been looked at for healthcare delivery organizations, something called the HICUP. 06:57.630 --> 07:02.050 And if you paid me money right now, I could not actually tell you what that acronym stands for. 07:02.050 --> 07:06.550 But it's like the healthcare version, the hospital version of their best practices guide. 07:07.650 --> 07:19.330 And in the HICUP in particular, I want to say it is, or maybe it's the JSP, one of the two, they actually have like, it's separated out into what large organizations can do, and then what small and medium sized organizations can do. 07:19.330 --> 07:22.830 And they do different things for both or recommend different things for both. 07:22.910 --> 07:27.170 So this is an ongoing conversation that is happening at that national level. 07:27.610 --> 07:31.230 But we certainly don't claim to have all of those answers. 07:34.940 --> 07:40.700 Another thing that I think is important is we're moving into a thing where we want to do early detection and monitoring. 07:40.700 --> 07:45.860 But most of the instances where there has been hospital breaches, we've been left on the back foot, right? 07:46.380 --> 07:50.720 We needed to become aware of the breach before we could actually act on the breach. 07:50.900 --> 07:56.000 So I don't think there is that early... within healthcare at the moment. 07:56.160 --> 08:03.720 I can use an example of a healthcare attack in South Africa itself, they only became aware of it once the systems were encrypted. 08:03.720 --> 08:05.860 And once you know, the damage has been done. 08:06.460 --> 08:13.780 So often, we have to rely on the cyber criminals to make us aware of their presence in our networks. 08:14.920 --> 08:17.700 It would be awesome if we could detect it early and stop it. 08:17.700 --> 08:19.060 I mean, that is the golden standard. 08:19.060 --> 08:20.180 That is the dream. 08:20.180 --> 08:21.880 But I don't think we're there yet. 08:22.880 --> 08:31.860 I think the real dream is being proactive about this, and getting the security on the device so it doesn't even get to the point of there being a vulnerability that has to be detected. 08:31.860 --> 08:38.400 If we can just reduce the end of things that need to be detected, there's a better probability of actually coming up with it. 08:39.160 --> 08:43.260 But is that going to actually be something that we're going to get? 08:43.260 --> 08:45.060 Because I mean, these devices last for long. 08:45.060 --> 08:48.040 So inevitably, there is going to be vulnerabilities always. 08:48.940 --> 08:57.220 It's going to be there because as time progresses, research is done, and libraries become vulnerable, or hardware becomes vulnerable. 08:57.440 --> 09:00.740 Also, it's about the threat landscape, right? 09:00.860 --> 09:02.380 We're talking about risk here. 09:02.380 --> 09:05.560 And just like everything in life, there's nothing, there's no such thing as risk-free. 09:05.560 --> 09:08.800 We can't just have a device that has security or doesn't. 09:08.940 --> 09:10.240 There's always pros and cons. 09:10.240 --> 09:12.480 We can't think of every possible thing. 09:13.000 --> 09:22.060 So it's always, it's this combination, right, of, you know, building the devices and making them as secure as we can in a reasonable amount of time with the resources we have. 09:22.060 --> 09:34.800 And then once they're out into, you know, the healthcare ecosystem or the consumer ecosystem, in the case of, you know, medical devices that maybe have to be on a home network, there's so many pieces to that threat landscape, right? 09:34.800 --> 09:40.560 I don't, like, I'm not sure how we can fully secure it. 09:40.560 --> 09:45.720 Like, there's no, there's no perfectly secure network, right? 09:47.320 --> 09:57.160 I also want to throw one other wrinkle into this, which is that there's actually some systemic, systematic issues when it comes to healthcare. 09:57.380 --> 10:09.360 Usually in hospitals, what's traditionally been the paradigm is that the network's owned by IT, and that's where all the security folks live, and they're able to detect kind of the attacks that they're used to, and they can control some of that. 10:09.360 --> 10:19.840 But as soon as it comes to the medical device side of it, they kind of wash their hands or are told, don't go there, that's bioengineering, and they handle all the medical devices. 10:19.880 --> 10:26.220 And so what you often have is a dearth of cybersecurity knowledge in the bioengineering space. 10:26.340 --> 10:40.460 By no fault of their own, they have a lot of other things, they're fantastic people, but what we have as a result of that is this something we call the discovery dilemma, where if you don't have people thinking about these issues, and you have malfunctioning medical devices, 10:40.460 --> 10:49.840 you are unlikely to find a problem, even if there was some random malware that spread over your network, it affected some of your medical devices, and as a consequence they stopped working. 10:49.840 --> 11:00.860 Unless you are thinking about that as a potential etiology of your problem, you're not going to go and look the one and two steps further to figure out if that was the issue. 11:01.000 --> 11:05.060 So we talked a little bit before this panel started about the discipline of forensics. 11:05.060 --> 11:19.420 I've asked many bioengineering organizations and groups and hospitals across the country and asked how many of them do that type of forensic work on malfunctioning devices that are just really out of the ordinary, and none of them said that they did. 11:19.420 --> 11:20.920 It's something we have to change. 11:20.920 --> 11:35.820 So it's because the structure of these healthcare systems in such a way where there's a bright line between who handles medical devices and who handles the network, and because those two groups don't co-mingle and have equitable cybersecurity knowledge where we might have this problem, 11:35.820 --> 11:39.660 where this might be a very common thing, but just we're not detecting it. 11:40.120 --> 11:55.900 So I don't know if you want to, if we're like looking to move on to the next question here, but one thing that I would point out on that, that I've certainly experienced, especially over the last couple of months, is we're, we have experienced, I would say, 11:55.900 --> 12:03.060 less and less medical device specific vulnerabilities where it's like the pacemaker has a vulnerability or the MRI has a vulnerability. 12:03.220 --> 12:06.940 What we're now seeing are like higher level protocol vulnerabilities. 12:08.300 --> 12:09.920 Swintooth was a great example. 12:09.920 --> 12:13.580 There was the, all of the, the whole run of Bluetooth vulnerabilities. 12:14.060 --> 12:15.580 There was the Ripple 20. 12:15.580 --> 12:22.940 There was the Trek, which I think was, was the one part or Trek TCP IP was one part of Ripple 20 or whatever it was. 12:23.020 --> 12:25.680 But anyway, these are things that are not medical device specific. 12:26.520 --> 12:30.400 But what we're starting to see, and it goes to the detection point. 12:30.400 --> 12:32.840 And then I wanted to hit on something that Vidya had said. 12:34.560 --> 12:46.800 The, the, almost the nice thing that's happening about the fact that we have general IT vulnerabilities that are now making their way into the medical device space or becoming relevant to the medical device space is other sectors are detecting them for us. 12:46.800 --> 12:56.840 So even though there's maybe a little bit of a lag in detection and in, I don't know, identification capability within the sector itself, because that expertise may exist in other sectors. 12:56.840 --> 13:02.520 And because we're all relying on the same software, the software that's in a medical device is the same that's in a consumer product. 13:02.520 --> 13:09.540 We're ending up still being notified and still being able to notify others because it's happening in other sectors. 13:09.780 --> 13:14.500 But the other thing, you know, Vidya had a good point about like, we need to, we need to lessen essentially the attack space. 13:14.800 --> 13:20.340 And certainly acknowledging the fact that V and Ash are both right, like things are always going to be vulnerable. 13:20.600 --> 13:27.480 Another thing that we've noticed is that we have an increasing number of manufacturers who will tell them about vulnerabilities. 13:27.780 --> 13:38.460 And especially with the Bluetooth ones, we have certain manufacturers who are like, oh yeah, but like the way we architected our system, like our device doesn't trust the Bluetooth that's built into the device. 13:38.460 --> 13:42.300 So all of these Bluetooth vulnerabilities don't impact us. 13:42.500 --> 13:50.320 And I think that that's sort of what Vidya was getting at is like, we can build systems that are not impacted by certain types of vulnerabilities. 13:50.320 --> 13:53.160 We just have to actually put in the work to do that. 13:55.060 --> 14:02.120 And I think, sorry, Ash and I had this conversation, right? 14:02.160 --> 14:13.420 Security, the way that you change security and manufacturing Ash was, right, we said it needs to be cheap and it needs to be easy and it needs to be accessible and it should be the easiest thing to do. 14:13.420 --> 14:17.040 It shouldn't be the hardest thing to do and it shouldn't be the most expensive thing to do. 14:17.040 --> 14:30.940 And when I refer to expensive, I don't necessarily mean in terms of cost, it could be time, it could be design, it could be research, it could be CPU, it could be battery life, right? 14:30.960 --> 14:46.280 But the thing is at this point, I don't think, you know, at that end of the pipeline, that is very easily accessible for the smaller companies, I'm not talking about your big companies, but your smaller ones that are doing some innovative work. 14:49.930 --> 14:53.450 All right, we have a new question from Judo. 14:53.450 --> 14:56.790 And I think that this is going to be one we can all kind of chime in on. 14:56.990 --> 15:08.630 It's, I think, boiled down to what are the steps that industry and I'm going to add regulators in the space are taking to formalize stricter risk and controls around device development that we use in patients. 15:08.790 --> 15:17.290 They assume that a larger device manufacturer formalized basic security features, just like the payment brands have done, and set standards for the rest of the industry. 15:17.290 --> 15:19.470 So I think there's a lot that's already been done. 15:19.470 --> 15:25.990 I just want to quickly reflect on that to say, you know, the conversations that we were having 10 years in this space, we're asking for this. 15:25.990 --> 15:31.130 And I feel like so much has changed between now and then where we, we do have a lot more standards. 15:31.270 --> 15:34.570 And I think that the industry is moving forward in a lot of ways. 15:34.570 --> 15:36.910 And we can still talk about some of the criticisms. 15:36.910 --> 15:43.870 But what I really think is a lot of people that have been paying close attention will say, yes, we saw the problem of legacy devices. 15:43.870 --> 16:00.050 But we, you know, I said it in the video, we don't have this year, to my knowledge, and there's still some time left, a story of a device manufacturer threatening to sue a security researcher, for example, or something like that, like WannaCry happened in 2017. 16:00.050 --> 16:03.870 So can everyone reflect on kind of what the industry has been doing ? 16:03.870 --> 16:12.350 And we can take it back a few years and give examples of some of the landmark documents and guidance that has come from the industry as well as the regulation space. 16:21.120 --> 16:23.820 Well, I can kick us off as the regulator. 16:24.980 --> 16:44.080 So I, you know, I think I was not at FDA, let me preface this by saying, when some of these documents came out, but the two in 2014, I want to say, there was, you know, one of the first drafts of a cybersecurity guidance, particularly cybersecurity guidance came out at FDA. 16:44.540 --> 16:47.960 A few years later, there was the postmarket cybersecurity guidance. 16:47.960 --> 16:55.400 And then in 2018, the most recent one, you know, there was the new postmarket draft. 16:55.400 --> 17:09.440 And this was the one that talked about coordinated disclosure, talked about cybersecurity bill of materials, it talked about a lot of the advancements that had been made in the sector over the past couple of years from the time that the guidance had been most recently updated. 17:09.700 --> 17:21.460 And actually, let me just really quickly, for those of you who don't know, is essentially how FDA tells industry, the best way to meet the regulations, because if you try and read FDA's regulations, they're pretty bare bones. 17:21.460 --> 17:23.900 It's pretty much like you must do risk assessments. 17:23.900 --> 17:27.780 But then like that, that's the end of the sentence, and it doesn't have any other detail. 17:27.780 --> 17:33.960 So the guidance allows FDA to elaborate a little bit more on what precisely that means in given contexts. 17:34.220 --> 17:37.740 And so, you know, credit to to Suzanne Schwartz and Dr. 17:37.740 --> 17:42.880 Seth Harmony, who was worked on a lot of this when he was still with the agency. 17:43.360 --> 17:50.680 You know, they actually like fought the good fight and got cybersecurity specific guidance out from the FDA to industry. 17:50.680 --> 18:00.680 And I think, you know, obviously, I'm biased here, but that was just a huge leap forward, I think, in many ways for, for not only us, but for the industry. 18:05.660 --> 18:23.940 Yeah, I think, to that point, I think there, the the conversation that's come from all of that initiative, right, you you have, you have this relationship that I think didn't exist before, even if we go back four or five years, like there wasn't such a collaboration or willingness to have manufacturers work with security researchers work with security vendors, 18:23.940 --> 18:24.180 right? 18:24.180 --> 18:26.760 It was more of Okay, who can get what off of eBay? 18:26.920 --> 18:31.400 What can we prove doesn't work and then try to try to get the best headline that we can get out of it. 18:31.400 --> 18:43.960 And I think the if you listen to the recorded version of this, there's a lot of hope that we all have for where this conversation is going, and that there are going to be solutions coming out of this, I think on on all sides that are actually sustainable and efficient. 18:45.920 --> 18:47.860 So I can add a positive story. 18:47.860 --> 18:57.020 So three years ago, I had my first DEF CON, came as a patient, had some concerns about my own device, it was, as I would say, beautifully broken and wonderfully flawed. 18:57.760 --> 19:00.440 And I made Suzanne Schwartz at that one. 19:00.440 --> 19:09.040 But except for that, before coming to DEF CON, I actually reached out to my manufacturer and had a discussion with him and I was met with legal. 19:09.760 --> 19:12.020 You know, it was like running into a wall. 19:12.060 --> 19:15.580 It was a cold, unloving situation. 19:16.300 --> 19:22.760 Three years later, I'm working with that same manufacturer on things that I bought to them three years ago. 19:23.420 --> 19:29.080 It took us since December to find a footing where, you know, the discussion is not incriminating. 19:29.080 --> 19:30.440 It's not me pointing a finger. 19:30.440 --> 19:31.640 It's not them pointing a finger. 19:31.640 --> 19:38.320 It's finding a unison and what they bring to the table, what I bring to the table and working together. 19:38.320 --> 19:41.400 But except for that, I mean, we had conversations. 19:41.400 --> 19:42.920 I've been on the patient. 19:44.360 --> 19:55.480 I don't know what the word is that you guys, that Jessica, that gave patients the opportunity to give their experiences, right? 19:56.660 --> 20:01.140 So generally in three years that I've been involved in this, we've made leaps and bounds. 20:01.700 --> 20:04.460 Is that necessarily enough yet? 20:04.460 --> 20:06.420 No, I don't think we should lose momentum. 20:06.420 --> 20:08.480 I think we should kick ass and keep going. 20:08.480 --> 20:10.140 I think we should push the envelope. 20:10.140 --> 20:12.420 I think we should have the hard conversations. 20:12.640 --> 20:14.660 And I don't think we should stop now. 20:19.200 --> 20:21.140 Yeah, I would agree. 20:21.140 --> 20:25.620 I think that the landscape is shifting really quickly. 20:25.940 --> 20:34.840 When I started working on medical devices, which was over five years ago, already the technology has changed so much. 20:34.840 --> 20:46.520 Even in the last 15 years, if you think about, you know, smartphones and, you know, 20 years ago, I don't think most of us would have predicted that ubiquitousness of it and the impact that it would have on our daily lives. 20:46.520 --> 21:01.760 And so, you know, historically medical devices were electromechanical and, you know, as medical device manufacturers, we come, we have a system about approaching things from a risk and from a safety perspective, like how do we make sure that people are safe? 21:01.900 --> 21:04.820 And a lot of medical devices didn't have software in them. 21:04.820 --> 21:10.080 And then we started putting software in and then we started connecting that software to the internet. 21:10.080 --> 21:21.340 And then all of a sudden the risk just blew open because now we can, we have , we have IOT devices, we have clinical IOT devices, we have medical IOT devices, we have implantable IOT devices. 21:21.600 --> 21:23.600 And so everything has been changing so fast. 21:23.600 --> 21:30.340 And I think, you know, getting regulatory and getting standards in place takes time. 21:30.540 --> 21:34.540 And, you know, especially from a software perspective, how many standards exist? 21:34.540 --> 21:39.000 Like we have so many standards in software that are competing standards. 21:39.000 --> 21:42.340 If everyone would just follow my standard, it would all be fine. 21:42.340 --> 21:47.160 But then there's 20 other people who also have a standard that they want everyone to follow. 21:47.160 --> 21:48.300 And so it's, you know, it's tough. 21:48.300 --> 21:51.180 It's like the wild, wild west for software, right? 21:51.260 --> 22:04.640 And so I've seen like a lot of these different groups coming together, you know, obviously FDA is a part of it, but, you know, you know, most of our customers are, they want to serve American markets. 22:04.640 --> 22:07.320 So we actually talk about FDA a lot every single day. 22:07.900 --> 22:10.700 But there is the rest of the world that isn't governed by the FDA. 22:11.480 --> 22:14.700 And so there's a lot of different bodies working together. 22:14.700 --> 22:16.660 And yeah, I see it as hopeful. 22:17.680 --> 22:24.760 I know IEEE is working on international standards for clinical IOT and medical devices and interoperability. 22:25.460 --> 22:30.300 And yeah, I think people are working on it, but I don't think we're there yet. 22:30.940 --> 22:31.740 Certainly. 22:32.380 --> 22:39.500 I actually have to jump on that because I think if I don't, one of my bosses is going to find me at home. 22:39.620 --> 22:46.800 But to the point about international regulation, there is a body called the International Medical Device Regulators Forum. 22:47.000 --> 22:51.300 And speaking of, you can never get government to do anything in any reasonable amount of time. 22:51.300 --> 22:54.180 That's just sort of a default law of the universe. 22:54.300 --> 22:58.500 But that group, which is a group of, it's like a nested group of regulators. 22:58.500 --> 23:01.980 So you would have thought that this would have taken significantly longer than it did. 23:02.040 --> 23:06.980 But they actually just came out with a cybersecurity guidance document. 23:07.360 --> 23:11.440 And so that's another thing that's been really valuable for us. 23:11.720 --> 23:14.040 And I would actually encourage everybody to go look at it. 23:14.040 --> 23:18.180 It's got a really fun definition of legacy that you all might have thoughts on. 23:18.180 --> 23:20.760 So anyway, IMDRF guidance. 23:25.220 --> 23:28.420 The only thing I can add is that we're never going to be done, right? 23:28.420 --> 23:40.080 So as much as we've progressed, and absolutely take a moment to recognize the accomplishments here, there's certainly a path that we need to continue pursuing in order to even maintain a baseline of security across the board. 23:41.280 --> 23:56.860 I think what I want to see, and this would make me like as a patient super happy, is if we had in the manufacturing, we had security standards for secure manufacturing, because it's one thing having a cybersecurity framework, right? 23:56.860 --> 23:58.700 Or a guidance in terms of that. 23:58.700 --> 24:09.280 But it's a different thing and having a standard for, you know, how we are going to securely manufacture these devices, because often than not, you know, hardware is the constraint. 24:09.300 --> 24:15.000 Because when we talk medical devices, we are designing, you know, firmware to run on hardware. 24:15.720 --> 24:26.020 So I think we need to, you know, completely start at the beginning, when they conceptualize the requirements is that we need to build security in there, right? 24:26.020 --> 24:33.660 It shouldn't be this, you know, after the fact, kind of like, let's put it on the end and, you know, hope for the best. 24:33.860 --> 24:42.880 And that's, you know, normally done, because we didn't consider it in the beginning, and it hasn't been in that, you know, that practice. 24:42.880 --> 24:46.300 But there are companies doing that, and that is changing. 24:46.920 --> 24:51.980 But you know, it's also been an industry that's been around for a very, very long time. 24:51.980 --> 24:56.340 And it's got some bad behavior and bad things that it's been doing. 24:56.340 --> 24:58.040 It's also got good things, right? 24:58.060 --> 25:01.140 I mean, how many lives have medical devices saved? 25:01.140 --> 25:02.940 I mean, you're always focusing on the negative. 25:02.940 --> 25:04.700 I mean, I wouldn't be here. 25:04.960 --> 25:06.680 I would have died at 19. 25:07.300 --> 25:14.680 I'm not much older, I'm not going to tell you my age, but you know, so I mean, So Vi, are you saying, are you saying push left? 25:14.680 --> 25:15.980 Is that the summary of what you're saying? 25:15.980 --> 25:19.580 Yes, I think you and I said that, let's push all the way left, right? 25:19.580 --> 25:21.480 Let's not do this at the end. 25:22.000 --> 25:25.380 I've worked with the developers and the engineers, right? 25:25.380 --> 25:27.980 You know, everyone thinks like security is the answer. 25:27.980 --> 25:30.260 You want to change this shit? 25:30.400 --> 25:35.720 Get them to start doing with security in mind, and you know, you're not going to deal with future problems. 25:35.740 --> 25:45.160 I literally have found that security and forensics forms part of hardware engineering and forms part of software development and firmware design. 25:45.160 --> 25:53.380 You know, it just, there's this synergy when we start working as a team and as a collective instead of, you know, silos. 25:53.460 --> 25:59.180 And I know there's people that are going to argue the silos are good because everyone needs to focus on the independent thing. 25:59.240 --> 26:06.820 But when we bring different minds together, that's when we start seeing things come together in a different way. 26:06.820 --> 26:11.620 And I think that's going to be the answer, is working together instead of against each other. 26:11.820 --> 26:14.420 And, you know, that multidisciplinary approach. 26:14.420 --> 26:15.620 Because we're not all experts. 26:15.620 --> 26:19.540 I mean, I shouldn't be doing any hardware design. 26:19.640 --> 26:21.240 It will break. 26:21.360 --> 26:23.140 You know, that's not my speciality. 26:23.140 --> 26:29.520 But I can tell you from a security and a logging perspective or forensics perspective what would work. 26:30.400 --> 26:34.140 So I think we need to get that multidisciplinary approach. 26:35.040 --> 26:36.420 All right. 26:36.880 --> 26:42.880 Iona, go ahead and get our next question kicked off by Ken in the DEF CON Discord. 26:42.880 --> 26:44.660 He says there's been a lot of progress in the last five years. 26:44.660 --> 26:48.700 I think we've all talked about the optimism that we've had, you know, guarded optimism. 26:48.920 --> 26:51.720 But there's still problems with smaller device manufacturers. 26:51.720 --> 26:53.040 There's problems with smaller hospitals. 26:53.040 --> 26:54.360 How do we motivate them? 26:54.580 --> 26:56.180 How do we get them to do the right thing? 26:56.480 --> 27:06.620 And I think, Ash, on the recorded talk, you had, you know, talked about how that's a big part of medical device development are kind of these smaller boutique consultant shops like your own. 27:08.020 --> 27:10.600 Yeah, I wish I had a I think that's a fantastic question. 27:10.600 --> 27:12.220 I have that question every day. 27:12.360 --> 27:14.800 How do we how do we motivate them? 27:14.800 --> 27:18.020 How do we make the how do we get there, right? 27:18.020 --> 27:21.300 Because we've got constraints on lots of sides. 27:21.340 --> 27:34.160 And, you know, at the end of the day, you know, most of the people who are working on this, we are really passionate about the end patients, especially, you know, some of the smaller shops, like everyone that I work with actually cares about the patients. 27:34.500 --> 27:43.340 And a lot of our clients are doctors who have an idea for some medical device that they think will save lives, and they only have so much budget. 27:43.340 --> 27:44.940 So, yeah, how do we motivate them? 27:44.940 --> 27:47.160 I think I think everyone is motivated. 27:47.780 --> 27:51.260 Or at least for some of the smaller ones. 27:51.620 --> 28:10.520 We are motivated how to actually get there, how to implement how to how to communicate to clients, and even to other engineers about what the risks are with software, because sometimes, again, we're so used to see thinking about things as, you know, electromechanical device, 28:10.520 --> 28:22.040 you know, we think about safety is like, the lock on the door, you know, people who aren't in software all the time, people who don't come from a security background, they don't think about all the creative ways, they just kind of think, well, this is secure, 28:22.040 --> 28:23.300 we put a lock on it. 28:24.380 --> 28:29.440 You know, it's like, I put my phone into a little like box, and then I put a lock on it, how could it not be secure? 28:29.440 --> 28:34.940 Well, because I can connect to your phone through Wi Fi, and then exploit it somehow, right? 28:34.940 --> 28:37.700 Like, so it's not actually immediately obvious to a lot of people. 28:37.700 --> 28:49.020 So then, when you're trying to, you know, trying to set up a project and talking about budget, and how much time we allocate, and, you know, what, what sort of security things do care about? 28:49.040 --> 28:51.460 And, you know, everything is pulled in all these directions. 28:51.460 --> 28:56.160 So I, I don't have an answer for how to balance all of those perfectly. 28:56.160 --> 28:58.240 I think we're trying to do that every single day. 28:58.400 --> 29:00.400 But I think it's a really great question. 29:00.520 --> 29:02.460 And I think we should keep asking it. 29:04.280 --> 29:06.460 Yeah, that's what I have to say. 29:12.330 --> 29:14.350 I think the phone's a great analogy. 29:14.350 --> 29:15.950 Sorry, just two seconds here, right? 29:15.950 --> 29:23.270 I think that the fact that you bring up this notion of, okay, people understand security on a phone, and they say, I'm comfortable that my iPhone is going to do this. 29:23.270 --> 29:25.170 And I know Bea and I had this conversation. 29:25.170 --> 29:34.770 But how do we translate that into the expectation that a medical device will be secure in and of itself, independent of how it's going to connect to whatever the clinical care is? 29:34.770 --> 29:48.190 And I think part of it is, we have to be fair to all these clinical innovations that are really trying to bring something to the patient experience and change it for the better, and not try to force them to become cybersecurity experts. 29:48.190 --> 29:54.730 There has to be a way for us to enable them to get there without having to become pros at cybersecurity. 29:55.330 --> 29:57.830 I will say, though, and I have to say it. 29:57.830 --> 29:58.650 Sorry, everyone. 29:58.650 --> 30:00.170 I think I disappeared for a moment. 30:00.170 --> 30:03.130 My computer decided it didn't want to be part of this panel anymore. 30:05.090 --> 30:07.650 So there is pre-market guidance. 30:07.690 --> 30:14.930 And the current version is not nearly as detailed as I think some of the things that we're working on now. 30:15.210 --> 30:21.690 But to get on the market, medical devices have to go through the FDA in most cases. 30:21.690 --> 30:23.510 I'm not going into the class system. 30:23.510 --> 30:24.770 None of us need that. 30:25.010 --> 30:31.190 But if they're going to have software and other things like that, chances are they have to get pre-market approval to even go on the market. 30:31.190 --> 30:42.750 And so to a certain extent, they have to demonstrate through FDA, whatever the device is, however small the manufacturer is, that they have provided reasonable assurance of safety and effectiveness. 30:42.750 --> 30:46.230 And we check for cybersecurity concerns. 30:46.230 --> 30:50.130 I think I made some clever comment about Matt being my elementary school best friend. 30:50.130 --> 30:54.930 But Matt is the lead for a lot of the cybersecurity reviewers at FDA. 30:54.930 --> 30:59.530 And like I said in the recording, we're getting better at that every day. 30:59.530 --> 31:08.830 But this is something where FDA is rightfully by statute, by law, the gatekeeper of what can and can't be put on the market. 31:08.830 --> 31:15.470 And so I think, you know, for better or worse, you can argue whether or not it's good or bad that we're doing what we're doing. 31:16.730 --> 31:19.590 The smaller manufacturers still have to go through us. 31:19.870 --> 31:22.090 So there is still going to be that part of it. 31:23.930 --> 31:31.110 I also just want to say, we had talked multiple times about how you have to make security the easy thing to do. 31:31.270 --> 31:38.890 And for some of these rural access hospitals, smaller organizations, they're just not going to be able to do the job right. 31:39.070 --> 31:47.930 And so I think collaboration, I've said this a couple times, there shouldn't be a competitive advantage in cybersecurity when it comes to hospitals, right? 31:47.930 --> 31:57.490 So you shouldn't see a billboard as you drive down the street that says, you know, when you have your heart attack, come to hospital A because we didn't get hacked last year like hospital B did, right? 31:57.490 --> 31:59.530 So that shouldn't be like that. 31:59.530 --> 32:09.270 And I think, luckily, there's been a lot of momentum towards collaboration, information sharing, through a lot of these organizations and bodies we've already talked about. 32:09.270 --> 32:20.990 But, you know, what was an alien concept to hospitals five years ago is probably not that crazy now, which is, hey, if we get hit with ransomware, you know, we're going to go through our protocol of incident response. 32:20.990 --> 32:21.590 And guess what? 32:21.590 --> 32:27.910 I'm going to call the CISO at competitor hospital B and let them know this happened to us. 32:27.910 --> 32:29.170 And did you see anything? 32:29.230 --> 32:30.030 Collaborate. 32:30.150 --> 32:39.950 What normally was a very, we're not going to share, we're not going to talk, we're not going to collaborate in the space, has clearly gone out the window for some of the more forward thinking organizations. 32:39.950 --> 32:41.590 Now, let's take that information. 32:41.670 --> 32:54.790 For example, all the great work that larger organizations have done, like Mayo, looking at particularly secure devices compared to others, share that information with other rural hospitals, so they don't have to go and reproduce all that work from scratch, 32:54.790 --> 32:56.030 they're doing that. 32:56.290 --> 32:58.810 Being able to share in that space is so, so key. 32:58.810 --> 33:01.710 So let's not reinvent the wheel at every single hospital. 33:01.710 --> 33:09.870 Let's not try to build gigantic teams that do vulnerability testing, penetration testing on every medical device and reproduce that work time and time again. 33:09.870 --> 33:11.390 Instead, it's a community. 33:11.390 --> 33:16.450 We got to recognize that it doesn't follow the same competition that you normally would where you're not sharing. 33:16.450 --> 33:17.390 This is a different world. 33:17.390 --> 33:19.010 This is about patient safety, though. 33:19.030 --> 33:20.650 We all have to be on the same page. 33:22.210 --> 33:26.310 Yeah, but I mean, I'm going to say something that's going to be very unpopular, right? 33:26.310 --> 33:30.510 If you take a medical device, functional requirement is not security. 33:30.510 --> 33:35.150 Functional requirement is keeping someone alive or healthcare, right? 33:35.150 --> 33:41.910 We need to understand that because we are superimposing security onto these devices when that's not their main functionality. 33:42.250 --> 33:46.730 Yes, as they advance, they are connected and they need to be secure. 33:46.730 --> 33:53.590 But I don't think we should solely focus on having such secure devices that might just never see the, market. 33:53.590 --> 33:56.010 They might never save their life. 33:56.010 --> 33:58.610 That one patient's life that they can change. 33:58.610 --> 34:08.950 I think we should never lose sight of what the purpose of these devices are when we try and attempt the security implementations onto them. 34:14.390 --> 34:15.130 Awesome. 34:15.130 --> 34:15.510 All right. 34:15.510 --> 34:19.830 We're going to go to the next question here. 34:19.830 --> 34:23.370 This is from Synapsys. 34:24.230 --> 34:41.510 Questions about where the industry is going insofar as what are the new, and perhaps we can even talk about the pre-market guidance in this regard, like what types of requirements are we going to be putting into some of these new devices as they go for approval to push that forward? 34:41.510 --> 34:48.050 To perhaps, of course, always respect that these devices are security, or sorry, that was not a slip, I promise. 34:48.090 --> 34:51.850 They're medical devices meant to help patients, but they have to be secure. 34:51.950 --> 35:01.190 Are we going to be deploying things like stack protection, ASLR, DEP, and other things like modern, like language changes that have better security kind of baked in from the start? 35:01.190 --> 35:12.270 Are we seeing trends in this space towards utilizing more secure tools and development of these medical devices so that they are less prone to some of the scary vulnerabilities we've seen in legacy devices? 35:13.250 --> 35:18.090 So I think you called me out there a little bit with the cybersecurity guidance. 35:18.090 --> 35:29.270 So yes, you know, I think I had made the comment earlier that the FDA, the actual regulation parts of FDA's regulations are pretty high level. 35:29.270 --> 35:36.890 I really would be amused if any of you were like that motivated to go look at literally the code for federal regulations and go look at our regulations. 35:36.890 --> 35:38.450 They're very dry. 35:38.830 --> 35:45.530 And then you have guidance, and then you have what companies are actually doing to meet the guidance or to meet regulations. 35:45.890 --> 35:56.190 And I think from the FDA standpoint, it would help no one if we picked like the one way of doing security to rule them all and then told all the manufacturers that they have to do that one thing. 35:56.550 --> 36:07.930 So instead, essentially, what we've we have been communicating to them, and we continue to work with manufacturers on and continue to work with our own internal processes on is essentially saying like, you need to have a secure architecture. 36:08.090 --> 36:10.450 We're not going to tell you what the architecture looks like. 36:10.510 --> 36:12.510 But you need to, it needs to be secure. 36:12.510 --> 36:17.150 And you need to be able to produce the documentation to us that proves and validates that it's secure. 36:17.510 --> 36:19.790 You need to have security controls that are the same thing. 36:19.790 --> 36:23.290 You need to be able to not only have them, you need to prove that they work. 36:24.030 --> 36:33.490 And so and then but but then at that point, it's sort of like and it's now the ball is in your courts, manufacturers, you tell us what your security controls are, you tell us what your secure architecture is. 36:34.890 --> 36:51.650 Because I think like going down into the the ASLR level and things like that, to V's and Asher's and videos and some of the other points that have been raised, each individual medical device is very unique, you know, the things that you're going to do to secure drug infusion pump are not going to be the things that you're going to do to secure an MRI. 36:52.230 --> 37:07.670 And so we do need to have that flexibility built into the regulations built into the guidance, so that, you know, we can we can allow the manufacturers to figure out, you know, what is the best, most efficient way to secure the device to V's point that we don't, 37:07.670 --> 37:17.250 you know, impose such rigid constraints on it that certain devices just can never meet them, you know, maybe they can do something else. 37:17.250 --> 37:18.710 So that's what I would say. 37:23.440 --> 37:25.020 Didn't mean to call you out. 37:25.020 --> 37:27.260 I just think it's such a great segue. 37:27.740 --> 37:29.560 All right, who's up on that question? 37:29.560 --> 37:33.420 So I mean, you had mentioned Ash, like how much things are changing? 37:33.420 --> 37:38.760 And do you see trends towards more kind of baking in these controls from the start? 37:38.760 --> 37:40.960 And do you see exciting trends emerging? 37:42.980 --> 37:46.480 I mean, I think I agree with what Jessica said, I think. 37:48.540 --> 37:55.600 I'm not sure, you know, I come from software and engineering development background, and I'm learning more and more about security. 37:55.600 --> 38:00.000 But so traditional security controls, I don't have a huge history with that. 38:00.000 --> 38:02.520 But I think every device is really different. 38:02.520 --> 38:17.700 And from security perspective, or from a safety perspective, we make sure that the device is secure, so that it provides safety, so that patient outcomes are, are successful or positive, right? 38:17.700 --> 38:19.340 Every device is different. 38:19.340 --> 38:26.560 I think that more people are learning more people are like me, there's more engineers who care about the security part. 38:26.560 --> 38:32.180 And, you know, obviously, with FDA and guidances, and with regulatory, we have to meet standards. 38:32.700 --> 38:34.060 That's absolutely correct. 38:34.060 --> 38:38.160 How we choose to meet those standards is up to each manufacturer. 38:38.160 --> 38:41.860 So we have an internal process of how we approach that. 38:41.860 --> 38:47.160 At the end of the day, you know, it's, it's literally different every time we make a device. 38:47.160 --> 38:50.840 So we're different too, because we are a consulting firm. 38:50.840 --> 38:58.300 So we make a lot of different devices, we have no, we have none of our own in house products that we are continually sort of like, building. 38:59.300 --> 39:04.540 So every, every device is unique, and it has a unique solution has unique architecture. 39:04.820 --> 39:12.700 And as technology is changing as Wi Fi's in everything now, more and more and more. 39:12.800 --> 39:14.840 Yeah, I mean, we're using different approaches. 39:14.840 --> 39:20.100 Yes, we have to make more, we have to have a bigger focus on security because of that. 39:20.100 --> 39:27.800 But, but I think it's just we're just following the trends with technology itself. 39:33.830 --> 39:39.850 Yeah, the only thing I'd add there is I think there are there are a variety of ways to approach it. 39:39.850 --> 39:46.750 And we have to absolutely keep patient care at the center of it to make sure we don't introduce new problems by trying to solve the security problem. 39:47.890 --> 40:00.030 But I think there's there's a fundamental expectation now that there is security built into this, it's not something that can be bolted on afterwards, where we're seeing the narrative more and more that it has to be part of the initial requirements discussion, 40:00.030 --> 40:03.210 it has to be part of how the device is going to connect how it's going to be patched. 40:03.230 --> 40:17.110 If we don't think about it from the onset of these fundamental architecture decisions, I think we'll we'll continue to have this problem of trying to solve the quick regulation question that came back and try to get it through so it so it can get to the hospitals. 40:19.130 --> 40:20.270 No, definitely. 40:20.270 --> 40:31.410 I don't think we can get to a granular level that we can start dictating architecture, because again, those things depend on the type of device and the requirements that you need the device to fulfill. 40:32.010 --> 40:35.350 But I am looking forward to better guidances. 40:35.350 --> 40:41.790 And yes, I was that boring person that went and read that because I wanted to understand our pre-market post-market book. 40:41.790 --> 40:56.390 But after some discussions with Jessica and Suzanne, I'm excited to see the new ones coming out and the more robust nature of them because we are moving towards a place where we are going to be enforcing better manufacturing. 40:59.020 --> 41:05.740 So let's transition to our next question into a little bit outside the medical device space and more into the hospital. 41:05.740 --> 41:12.340 Ken brings up another question about who's keeping the hospitals in line? 41:12.340 --> 41:19.720 Meaning the Joint Commission is, and there's a couple other bodies, are the ones that accredit hospitals. 41:19.720 --> 41:27.880 So when you go by a hospital, and they can be a hospital, some type of regulatory body has to make sure that they are to meet certain standards. 41:27.880 --> 41:30.460 The Joint Commission is probably the most famous one of those. 41:30.460 --> 41:36.640 And so a lot of what we talk about on the hospital side actually would never be FDA jurisdiction. 41:36.640 --> 41:38.780 Those are medical devices in their approval. 41:38.980 --> 41:44.700 This is the Joint Commission's probably space or other organizations that accredit hospitals. 41:44.700 --> 41:50.100 So the question that Ken poses is, you know, has the Joint Commission jumped in here? 41:50.100 --> 41:55.980 And how do we make sure that hospitals do what they're supposed to do? 41:55.980 --> 42:07.900 We've talked at length about how we can do better with medical devices, but I think we need to start moving also into the space of, like, hospitals need to be held accountable in some cases, and in accordance to what they're able to do. 42:07.900 --> 42:22.380 But we need to move that needle as well, because we've all heard stories of devices with certain security controls from the manufacturers that get turned off, or aren't deployed appropriately, or deployed on horribly secured networks at hospitals. 42:22.380 --> 42:26.820 And so part of the responsibility has to be this multiple people, right? 42:26.820 --> 42:29.960 How do we get hospitals to do the right thing? 42:30.020 --> 42:36.200 Knowing that, especially in times like COVID, it's not going to be the place they're going to be putting their resources in, right? 42:36.200 --> 42:38.440 They're worried about their ventilators in the ICU. 42:38.440 --> 42:42.440 They're not necessarily worried about this problem right now. 42:42.440 --> 42:47.280 Is there a way that we can move forward and make sure hospitals do the right thing? 42:51.400 --> 42:52.960 To be flippant, but like, do we? 42:52.960 --> 43:00.860 I feel like there's such a burden here that we're trying to historically pass on to hospitals that maybe was unfair, right? 43:00.860 --> 43:08.340 Like, yes, hospitals, if they're told in a user guide that they need to have certain controls in place, and they didn't, sure, there's something there. 43:08.340 --> 43:09.840 There's a flaw there in the plan. 43:09.840 --> 43:19.900 But at the same time, is it a fair expectation for a device vendor to say, okay, we want you to have these 32 different controls in place, times a hospital having a bunch of different vendors? 43:19.900 --> 43:22.380 Like, I think there's a balance there. 43:22.380 --> 43:30.380 So I think, yes, you have to enable hospitals to be more successful in having some of the basic security in place. 43:30.380 --> 43:34.220 But I think it's also somewhat unfair to place the onus on them so much. 43:36.660 --> 43:39.680 Yeah, I mean, I think I could just share something. 43:39.740 --> 43:42.460 You know, we talk all the time about shared responsibility. 43:42.460 --> 43:47.780 And actually, Christian, thank you so much for pointing out that FDA does not actually regulate hospitals. 43:48.100 --> 43:54.320 Because I think sometimes people forget that we actually have a very small slice of the pie. 43:54.320 --> 43:59.820 And we like to think we're very effective, whether or not we are, as I suppose, for debate from others. 43:59.820 --> 44:03.100 But, you know, that's not something we have any control over. 44:03.360 --> 44:09.000 But, you know, there are multiple federal agencies and state-level agencies. 44:09.000 --> 44:19.320 And actually, that's part of the problem, is the sheer number of regulators who are active in this space, who may or may not have harmonized regulatory requirements that hospitals are expected to meet. 44:19.700 --> 44:22.080 You know, that's challenging enough as it is. 44:22.080 --> 44:26.140 But something that Vidya said I wanted to hit on, because we were... 44:26.940 --> 44:43.440 one of these, you know, public-private partnership bodies that I'm a part of, we were recently talking, and one of the core CISOs was like, I have a spreadsheet of 400 different websites that I have to continually check to figure out what updates I need to make to all of the different devices that I have. 44:44.100 --> 44:51.340 And it's not something where, you know, they're not always getting active notification from the vendors as, like, you should go check one of these 400 websites. 44:51.420 --> 45:03.300 And there's just, it seems, you know, almost an infinite variety of procedures that each individual manufacturer can try and impose on a given hospital, and that just can add up so fast. 45:04.380 --> 45:08.480 So, you know, in that sense, like, there are certainly things that we can do better. 45:10.420 --> 45:16.120 I don't know necessarily that punishment is always the way to go with that. 45:16.120 --> 45:28.160 You know, I don't know how many of you know about the Office of Civil Rights wall of shame, but literally if you have a breach of more than 500 people, or at least this was the way that it was a couple of years ago, you go up on a portion of HHS's website with, 45:28.160 --> 45:32.480 like, your name, and how many records were breached, and how you got breached, and etc. 45:32.480 --> 45:33.020 etc. 45:33.900 --> 45:48.620 And it's not exactly the most helpful way to do it, because you also get fined in that case, which is then, that's resources that you have now lost, that you then cannot put towards your security, because you just had to pay it, you know, to somebody else. 45:48.620 --> 46:06.260 And so, you know, there's, I think, and this is, these are conversations that happen at the federal government level all the time, is like, how do we, how do we regulate, holistically, how do we regulate in such a way that, you know, we are, we are helping the industry move forward, 46:06.260 --> 46:11.460 rather than, you know, continuing to perpetuate some of the problems that we see? 46:13.280 --> 46:20.800 I want to touch on that, because this is something that is really near and dear to my heart, is hospitals. 46:21.180 --> 46:28.600 And the one thing that I've realized is we've created this, this shameful thing of finger-pointing when a hospital gets breached, right? 46:29.500 --> 46:35.300 Where we make it this negative connotation that they don't want to come out and say, hey, we've been breached, we need help. 46:35.320 --> 46:44.420 We've made it impossible for them to turn to the security industry and ask for help, because we shame them when they have been breached, right? 46:44.420 --> 46:50.560 When they are having to deal with medical care and then sophisticated attacks from cybercriminals. 46:50.560 --> 46:59.900 You know, and on top of that, implementing different patches and different software updates, different systems, and now how they're going to connect all these things up. 47:00.060 --> 47:06.500 I think we are expecting them to take ownership and accountability for things that aren't theirs to do. 47:07.000 --> 47:11.180 And then still, we punish them for not being able to do it. 47:11.240 --> 47:17.700 It's a very negative connotation to, you know, we need help. 47:19.960 --> 47:21.180 I agree. 47:21.180 --> 47:26.540 I don't think punishment is necessarily the right way, but I think that they're not being punished. 47:26.540 --> 47:34.420 The only hammer that really they pay attention to is HIPAA, because it's tied to a fine and an embarrassment on a wall. 47:35.080 --> 47:42.960 There isn't really, for example, rural hospitals, AIDS gets owned and there isn't a HIPAA breach. 47:42.960 --> 47:44.440 No one knows about that. 47:44.440 --> 47:51.780 And there is likely going to be little remediation efforts, probably because they've been owned for years and they don't even know. 47:51.780 --> 48:06.600 What I'm trying to say is that I don't think we should shame hospitals, but the status quo is likely untenable for a long term, because there is an increasing attack surface. 48:06.600 --> 48:09.360 There's less resources being put into this. 48:09.360 --> 48:27.980 And then on top of it, there's just, it's going to have to be looked at in some way, because we can't have the most secure medical devices on the planet with phenomenal protections, and then put on networks that no one cares about, or that no one's doing a good job at securing because there isn't that pressure. 48:27.980 --> 48:30.000 So how do you incentivize the hospitals? 48:30.000 --> 48:38.240 Do you say, for example, we're going to give you 0.25% more on your Medicaid reimbursement if you meet these cybersecurity requirements, right? 48:38.240 --> 48:45.240 Are you going to say we're going to cut your reimbursement from insurance claims on this if you don't meet these requirements? 48:45.240 --> 48:51.060 Is the joint commission going to say, hey, we're not going to credit your hospital unless you meet these requirements? 48:51.180 --> 48:56.260 These are the questions we should be talking about, whether or not it's a carrot or a stick. 48:56.260 --> 48:57.620 This is how we're going to have to figure it out. 48:57.620 --> 49:08.660 But what I do know is, you can look at many different healthcare organizations across the globe, and know that that's just, we can't keep going in that realm, because the patient information is just too valuable. 49:08.660 --> 49:13.620 And the risks of compromises to these networks are just too great for patient safety. 49:13.700 --> 49:16.740 And so we have to have that conversation sometime. 49:17.560 --> 49:26.320 Again, I don't want to shame anybody, but we have to do better on all fronts of this, because if you just secure one side, our patients are still vulnerable on the other side. 49:26.320 --> 49:28.060 It's really got to circle the wagons. 49:28.060 --> 49:29.440 Everyone's got to get on board. 49:30.700 --> 49:32.080 I think to your point, right? 49:32.080 --> 49:38.640 I think cybersecurity in healthcare was defined as HIPAA for the longest period of time, and nobody ever connected it to patient safety. 49:38.640 --> 49:48.580 So I think that's why there is disincentive, but in absence of an incentive for a hospital to really build security beyond just what the UCR is going to find them for. 49:50.860 --> 49:55.860 It's a change of how they perceive security, right? 49:56.200 --> 50:00.120 Cybersecurity is always the stick that's beating you, that's saying you need to do X, Y, and Z. 50:00.160 --> 50:05.740 It's never the thing, well, if you don't do this, this is what's going to happen, and it's going to impact your patients. 50:05.920 --> 50:08.080 I think we need to change the narrative. 50:08.640 --> 50:17.180 And the way that we approach this is by getting the hospitals to believe that this is the best for their patients. 50:17.980 --> 50:24.060 This is not just something that needs to be done because HIPAA says so, or any other organization says so. 50:24.060 --> 50:30.280 I don't know the Joint Commission, and I'm going to be honest with you, I don't follow that because I'm not from the US. 50:31.040 --> 50:44.940 But I do feel that if you change the way security is perceived within a hospital, and you make it more patient safety, you will see people change the way that they approach the problem. 50:48.890 --> 50:49.570 You're absolutely right. 50:49.570 --> 50:50.950 And I think there's a balance there, right? 50:50.950 --> 50:55.770 We don't want people declining clinical care because they now understand the potential risk. 50:55.770 --> 50:57.610 But I absolutely think you're right. 50:57.750 --> 51:01.990 The focus here should always be about the patient safety that we're trying to ensure collectively. 51:04.250 --> 51:07.090 I mean, COVID's kind of broken the perimeter, right? 51:07.730 --> 51:11.290 It's, I mean, they are sending home monitors. 51:11.290 --> 51:14.170 I mean, which angle do you defend from? 51:14.250 --> 51:16.250 Where is our perimeter at the moment? 51:16.250 --> 51:23.110 I think it's just, we're going to have to rebuild healthcare, I think, after COVID globally. 51:23.350 --> 51:26.750 And that's an opportunity to do things different, right? 51:26.750 --> 51:36.390 We now have a way to move forward positively without having to reinvent the wheel because the wheel's kind of broken down now. 51:37.510 --> 51:40.030 So I see the positive in that as well. 51:40.990 --> 51:43.510 And I'm excited for it, personally. 51:44.630 --> 51:46.730 All right, everybody, we're going to have to wrap up here soon. 51:46.730 --> 51:51.990 But I want to give everyone an opportunity to just say where they're going to go party after this Q&A. 51:51.990 --> 51:53.730 So I'm going to start off with Jeff. 51:54.130 --> 51:55.290 Where are you going to party? 51:56.110 --> 51:58.230 His internet is having a seizure, he told me. 51:58.230 --> 51:59.910 So I'm not sure if he'll be able to respond. 51:59.910 --> 52:01.230 He's going to go party with me, I bet. 52:01.230 --> 52:02.670 Yeah, somewhere with better... 52:04.590 --> 52:07.130 He's going to go to Starbucks and steal some internet. 52:07.130 --> 52:09.510 Ash, where are you going to go party after this Q&A? 52:10.750 --> 52:19.410 I'm going to open the new record player that I got that arrived in the mail today and set it up and probably party here. 52:19.550 --> 52:21.530 V, where are you going to go party after this? 52:22.170 --> 52:25.870 It is 6am, so I am going to go party at Club Duvet. 52:25.870 --> 52:29.050 It is a very, very, very warm, toasty club. 52:29.050 --> 52:31.210 And that's where I'm going to be spending the rest of my morning. 52:31.970 --> 52:32.690 Nice. 52:32.690 --> 52:34.170 Vidya, where are you going to go party? 52:34.430 --> 52:36.970 Going to hit up the beach, all day, every day. 52:37.110 --> 52:38.630 All day, every day. 52:38.630 --> 52:41.370 And Jessica, take us home. 52:41.610 --> 52:46.830 I was going to say I was going to Club BED with DJ Pillow, because that's exactly what I'm going to do. 52:48.250 --> 52:59.810 Well, on that note, we want to say thank you to DEF CON, the CFP board for giving us another shot at this, and everyone out there watching us on Twitch to say thank you for attending our Do No Harm panel. 52:59.810 --> 53:01.810 Again, stay connected with this. 53:01.810 --> 53:02.830 This is really important work. 53:02.830 --> 53:04.330 Let's keep our patients safe. 53:04.330 --> 53:05.410 And everyone, take care.