1 00:00:00,640 --> 00:00:01,760 Hi, I'm Bryson. 2 00:00:01,880 --> 00:00:08,680 I'm going to be joined by Nina, who's going to help me transcend ICS and med, which is our medics med ICS talk. 3 00:00:08,680 --> 00:00:14,520 In fact, Nina, you deserve named credit for helping me out on this perilous task. 4 00:00:14,580 --> 00:00:15,000 Thank you. 5 00:00:15,000 --> 00:00:24,720 I also wanted to be noted that I got informed of this like, what, 18 hours ago that I would be on this panel discussion fireside chat with you. 6 00:00:24,720 --> 00:00:26,720 Was it even 18 hours ago? 7 00:00:26,720 --> 00:00:30,200 No, I've been awake for way too long. 8 00:00:30,200 --> 00:00:34,940 So does this mean that I am part of the unicorn tribe now? 9 00:00:35,580 --> 00:00:37,520 You are now part of the herd. 10 00:00:38,480 --> 00:00:39,940 Unicorns are herds. 11 00:00:39,940 --> 00:00:41,020 They get herds. 12 00:00:41,640 --> 00:00:41,980 Yes. 13 00:00:41,980 --> 00:00:43,400 So hear what we have to say. 14 00:00:43,400 --> 00:00:43,640 All right. 15 00:00:43,640 --> 00:00:45,160 We're going to stop at the bad jokes. 16 00:00:45,180 --> 00:00:51,100 Welcome to my med ICS talk with now joined by the illustrious Nina. 17 00:00:51,600 --> 00:00:52,240 All right. 18 00:00:52,240 --> 00:00:54,660 So who am I besides wearing the unicorn stuff? 19 00:00:54,660 --> 00:00:56,180 I founded Scythe and Grimm. 20 00:00:56,180 --> 00:01:00,040 I'm the co-founder of my own village, the ICS village. 21 00:01:00,140 --> 00:01:01,880 I feel like there's a pattern here. 22 00:01:02,880 --> 00:01:08,160 So also check us out at DEF CON 2 to get even more information about ICS. 23 00:01:08,260 --> 00:01:11,800 And of course, all of our talks will be published as well for more detail. 24 00:01:12,640 --> 00:01:13,300 All right. 25 00:01:13,300 --> 00:01:14,260 Let's get started. 26 00:01:14,260 --> 00:01:14,720 All right. 27 00:01:14,720 --> 00:01:15,680 So outline. 28 00:01:15,680 --> 00:01:18,140 We're going to be talking through all things ICS. 29 00:01:18,140 --> 00:01:20,060 Why is it relevant to hospitals? 30 00:01:20,060 --> 00:01:23,000 What are some of the pieces around implementation? 31 00:01:23,320 --> 00:01:26,700 How is ICS different than traditional information technology? 32 00:01:27,020 --> 00:01:33,440 And then specific issues and threats that are organic specifically to industrial control systems. 33 00:01:33,440 --> 00:01:40,580 A quick little note that I got here from yesterday is IBM with Ponemon published their cost of a data breach report. 34 00:01:40,740 --> 00:01:54,780 Comparing the breach lifecycle, so when a breach happens to when it is found and expunged, healthcare is 96 days slower on average compared to the leader of finance. 35 00:01:54,780 --> 00:02:00,340 So we already have seen an industry that, yes, you were like building up for it. 36 00:02:00,340 --> 00:02:02,140 First interruption, first question. 37 00:02:02,140 --> 00:02:07,920 So then what is the time frame of a financial industry breach lifecycle? 38 00:02:07,920 --> 00:02:11,780 And then how does that how does that 96 days get added to that? 39 00:02:11,780 --> 00:02:14,940 Not how, but like what's the normal time frame for one? 40 00:02:15,180 --> 00:02:18,560 Sure, I'm trying to remember what that number was. 41 00:02:18,600 --> 00:02:22,020 I want to say it was either 208 or 280 days. 42 00:02:22,620 --> 00:02:31,760 So 200 and some days is the fastest for an industry on average to find a breach and get rid of it. 43 00:02:31,780 --> 00:02:35,120 And healthcare is 96 days slower on average for that. 44 00:02:35,120 --> 00:02:39,320 So that is over three months longer to eradicate a breach from their systems. 45 00:02:40,320 --> 00:02:42,380 You said 200 days? 46 00:02:42,380 --> 00:02:45,100 That is the fastest, which is finance. 47 00:02:45,100 --> 00:02:47,300 200 plus 96 is approximately a year. 48 00:02:47,320 --> 00:02:47,780 Yes. 49 00:02:47,780 --> 00:02:48,820 You said three months. 50 00:02:49,100 --> 00:02:51,460 No, so 96 days is three months. 51 00:02:51,460 --> 00:02:52,300 Got it, got it. 52 00:02:52,300 --> 00:02:54,160 My math is no good. 53 00:02:54,160 --> 00:02:55,720 Okay, yes. 54 00:02:56,860 --> 00:02:58,600 Do you want to co-found the math village? 55 00:02:58,600 --> 00:02:59,520 Can we do that next? 56 00:03:00,920 --> 00:03:03,140 Making stats literate for everybody. 57 00:03:03,220 --> 00:03:04,880 You know what, that would be great. 58 00:03:04,880 --> 00:03:05,720 I would love that part. 59 00:03:05,720 --> 00:03:08,180 So Nina, you have some notes on why this is important. 60 00:03:10,020 --> 00:03:12,200 I love that you added this in here. 61 00:03:13,240 --> 00:03:17,340 I'm going to let you talk through it so I can just bombard you with questions. 62 00:03:17,340 --> 00:03:18,600 These were literally your notes. 63 00:03:18,600 --> 00:03:19,860 I just didn't take them out. 64 00:03:19,860 --> 00:03:20,960 I know, I get that. 65 00:03:20,960 --> 00:03:22,920 Okay, so then I guess I'm speaking to it. 66 00:03:22,920 --> 00:03:31,480 So I think as we all know at the biohacking village and folks listening, so healthcare is a 365 day entity. 67 00:03:31,960 --> 00:03:38,260 Downtime for any medical devices or AMRs would mean dead time for patients. 68 00:03:39,000 --> 00:03:46,060 What people don't really consider in the medical ecosystem is the electricity, the water, gas. 69 00:03:46,060 --> 00:03:50,920 How are these things affected and does it, can it hurt patient care? 70 00:03:51,360 --> 00:04:02,360 If you go to the dentist, for instance, because I feel like that's something that everybody can more or less relate to, that water flow that they have in your mouth and there's a suction on the other side, that gets treated and then it gets sent out into the world. 71 00:04:02,660 --> 00:04:19,820 Electricity, if a surgical suite was underway and electricity went out, granted there are generators, but let's think about how often the generators are checked and made sure that they are still active and can produce any electricity or whatever the needs of the hospital is. 72 00:04:19,840 --> 00:04:23,240 Negative airflow and filtration, super important. 73 00:04:23,240 --> 00:04:24,740 We're in COVID right now. 74 00:04:24,740 --> 00:04:35,080 We know that it's an airborne disease and just in generalities, that negative airflow that goes from the hospital removes and reduces the nosoclonal diseases. 75 00:04:35,120 --> 00:04:40,320 Nosoclonal diseases are the diseases that you get in the hospital while you're in the hospital. 76 00:04:41,200 --> 00:04:46,160 There are backups to backups in hospitals usually, but again, how often are they checked? 77 00:04:46,160 --> 00:04:47,560 How often are they changed? 78 00:04:47,560 --> 00:04:48,840 Who's checking on these? 79 00:04:55,600 --> 00:05:14,340 Where's I'm a city girl, so one of the problems that happened at NYU during Hurricane Sandy was that their servers and the generators were in the basement and the unfortunate truth is that those were then gone when the hospital itself got flooded by all the waters and they had to move the patients over to nearby hospitals. 80 00:05:14,340 --> 00:05:30,260 And just thinking about how patients are transported from one hospital to another, how are they producing medical notes and medical discharges so that that patient would get treated accurately by that next physician that took care of them? 81 00:05:32,200 --> 00:05:47,100 Healthcare is a great analog for industrial control systems because unlike traditional IT, when we think of the confidentiality, integrity, and availability triad, IT generally goes in that order and it's flipped for industrial control systems because just like healthcare, 82 00:05:47,100 --> 00:05:50,860 we need something where availability is the utmost of importance. 83 00:05:50,860 --> 00:05:56,560 If I lose electricity in the middle of an operation, that can cause patient harm. 84 00:05:57,500 --> 00:06:03,640 Modern society rests on critical infrastructure, electricity, water, finance, transportation. 85 00:06:03,640 --> 00:06:08,520 If those went out, we go to the stone age almost overnight. 86 00:06:08,820 --> 00:06:15,380 The longer it's out, the more damage that's done and there are the statistical models then of understanding what that implication is. 87 00:06:15,380 --> 00:06:20,720 The final piece on industrial control systems is there's two levels of it that's relevant for the hospital setting. 88 00:06:20,720 --> 00:06:29,500 There's of course what we're talking about here, which is the grid, the infrastructure that nominally is providing all of the different resources to the facility. 89 00:06:29,500 --> 00:06:36,300 And then there are industrial control systems embedded inside the facility to help do particular elements. 90 00:06:36,460 --> 00:06:39,140 Nina talked about air filtration and negative airflow. 91 00:06:39,660 --> 00:06:48,180 We will have a slide later on that we talked about in the podcast a couple of months ago where we're going to go into detail on some of those systems and how they interconnect. 92 00:06:48,820 --> 00:06:50,840 I want to add something to my notes. 93 00:06:51,080 --> 00:06:53,140 The wi-fi, right? 94 00:06:53,680 --> 00:06:59,440 Nobody's... we haven't thought about how the internet connectivity, if that went out, would affect all of this. 95 00:06:59,500 --> 00:07:16,580 So again, just if you can't print out a patient record or if you're taking blood and you can't specifically say that this is this patient's because you have to enter it into the EMR and then a thing prints out, a label prints out, there's a lot of flow that continuously in the hospital needs to be contemplated. 96 00:07:16,580 --> 00:07:18,980 And I actually don't think it has been. 97 00:07:18,980 --> 00:07:28,200 So this is... we had this conversation on the podcast, it hasn't been published yet, but this is why Bo and I decided that you would be perfect to give this talk. 98 00:07:29,500 --> 00:07:31,980 Well, thank you for having me on and thank you for helping. 99 00:07:32,800 --> 00:07:34,560 So what is ICS? 100 00:07:34,560 --> 00:07:40,020 Industrial Control Systems, sometimes also known as SCADA or Operational Technology. 101 00:07:40,100 --> 00:07:46,820 There are wonky differences between those three, but fundamentally it's a catch-all for a couple of things. 102 00:07:46,820 --> 00:07:55,460 The biggest thing that separates ICS from what we think of a traditional computer is industrial control systems cause physical effects in the real world. 103 00:07:55,460 --> 00:07:58,480 We're not just talking data that stays on a hard drive. 104 00:07:58,480 --> 00:08:02,160 We're talking about something that actually changes something in the world. 105 00:08:02,160 --> 00:08:03,900 If it's a water pump, right? 106 00:08:03,900 --> 00:08:06,280 Water pressure, water flow is going to change. 107 00:08:06,280 --> 00:08:09,640 If it's airflow, airflow is going to shift and change. 108 00:08:09,640 --> 00:08:12,740 Our environment is actually affected. 109 00:08:13,120 --> 00:08:24,960 The reason I chose this picture is the best joke that I have that I think clearly illustrates both what it is as well as the problems are any computer that's at least 20 years old is an industrial control system. 110 00:08:24,960 --> 00:08:29,900 They were designed to be available and to have a long life cycle. 111 00:08:30,020 --> 00:08:31,500 They were... they're expensive. 112 00:08:31,500 --> 00:08:32,840 Most of them are expensive. 113 00:08:32,840 --> 00:08:38,820 Heavy, heavy capital costs where I want to put this, I want to forget it and I don't have to do anything. 114 00:08:38,820 --> 00:08:46,040 The introduction of cybersecurity is still a relatively new phenomenon as much as cybersecurity is a relatively new phenomenon. 115 00:08:46,040 --> 00:09:02,340 But particularly in industrial control systems, it's a new thing where previously this would be the kind of equipment that was maintained by a safety engineer who was mostly looking at what do I need to maintain the equipment so that it works, not how do I protect it because somebody might try to manipulate or attack it. 116 00:09:03,440 --> 00:09:06,580 So I just want to speak to that on the healthcare side. 117 00:09:06,580 --> 00:09:13,360 So there's so many legacy systems and so many legacy devices because same concept, everybody was imagining all these things to be long lasting. 118 00:09:13,380 --> 00:09:23,320 And when you're in the hospital and you have all of these devices, there's not a lot of funding that... there's not a lot of payment that goes into the hospital. 119 00:09:23,320 --> 00:09:26,880 They're kind of just trying to get to zero and balance themselves out. 120 00:09:26,880 --> 00:09:38,920 So having all of these legacy systems and things like this does create a problem when it comes to us putting security around it because we literally have to build these things in. 121 00:09:38,920 --> 00:09:41,900 We have to build... what's the thing around the castle? 122 00:09:41,900 --> 00:09:42,660 Moats. 123 00:09:44,280 --> 00:09:45,780 Perimeter defense. 124 00:09:45,780 --> 00:09:47,200 Yes, thank you. 125 00:09:47,520 --> 00:09:50,040 You can cut all of my English out. 126 00:09:50,040 --> 00:10:00,420 Right, so we have to build perimeters of defense around all of these legacy devices so that they work and we can continue making sure that the patient and the systems work. 127 00:10:00,840 --> 00:10:12,160 Yeah, so just being specific since perimeter typically means like the outer shell, and a lot of folks think of that as controlling the ingress and egress to a network. 128 00:10:12,440 --> 00:10:29,620 Since a lot of these kinds of systems can't be directly patched, which is a slide that's coming up, typically there is a similar kind of inside, usually we wouldn't use perimeter, but a way to kind of blanket around, control around the traffic to a device. 129 00:10:29,940 --> 00:10:46,460 So this is an example where like software-defined networking has become very popular in ICS environments because if I can't patch or improve the configuration of the device itself to make it not vulnerable, at least I can control the traffic around that and adapt it to those kinds of threats. 130 00:10:48,160 --> 00:10:52,920 So ICS versus IT, workers versus nerds. 131 00:10:53,040 --> 00:11:03,900 We talked about the performance of where I need high availability versus in traditional IT, availability is an issue, but it is not the primary concern. 132 00:11:03,900 --> 00:11:10,560 And then of course, when we're talking about risks here, when we think of IT, we think about patient data, we think about privacy. 133 00:11:10,560 --> 00:11:15,260 On the operational technology side, we're talking about injury or death. 134 00:11:19,040 --> 00:11:21,940 Okay, so some layers of ICS. 135 00:11:22,020 --> 00:11:25,040 At the very bottom layer is the direct control. 136 00:11:25,040 --> 00:11:30,080 Like I talked about, ICS is where I am physically affecting the environment. 137 00:11:30,080 --> 00:11:35,140 And so the most common element for that would be like a programmable logic controller. 138 00:11:35,500 --> 00:11:41,620 Everybody at this point knows what a PLC is, even if you've never seen one, because that's what Stuxnet was. 139 00:11:41,620 --> 00:11:48,740 Stuxnet affected the PLCs where they were changing the speed of the centrifuges that were doing the uranium enrichment. 140 00:11:48,740 --> 00:11:51,820 Again, a device controlling physical effect. 141 00:11:52,160 --> 00:11:58,280 And what we would see in a hospital environment would be a pump, something that is cycling water or air. 142 00:11:58,280 --> 00:12:00,680 And then above that is the supervisory level. 143 00:12:00,680 --> 00:12:06,460 So this is critical to understand these differences because a PLC is not a smart device. 144 00:12:06,460 --> 00:12:12,160 It doesn't necessarily know what's the correct operational parameters to function in. 145 00:12:12,160 --> 00:12:19,700 When we think about hacking a PLC, very rarely am I going to try to build some special code that's going to go onto that PLC to rewrite it. 146 00:12:19,700 --> 00:12:21,220 That does happen. 147 00:12:21,220 --> 00:12:28,960 More likely what we see a lot of is issuing commands to the PLC because one, PLCs generally don't accept authentication. 148 00:12:29,340 --> 00:12:31,460 Two, the traffic is unencrypted. 149 00:12:31,500 --> 00:12:35,680 And three, the PLC itself doesn't know what's good or what's bad. 150 00:12:35,680 --> 00:12:38,460 It just does what the supervisor above tells it to do. 151 00:12:38,460 --> 00:12:40,080 And then it just makes that happen in the world. 152 00:12:40,080 --> 00:12:44,600 And it doesn't always have that feedback loop of understanding if I've gone out of tolerance. 153 00:12:44,700 --> 00:12:48,360 The supervisory level is where you would have like a historian or acquisition. 154 00:12:48,360 --> 00:12:50,460 And this is literally what it sounds like, right? 155 00:12:50,460 --> 00:12:57,960 Like I am monitoring multiple devices that are able to do things and I'm telling them what to do and I'm reading what's happening and then I'm adjusting that. 156 00:12:57,960 --> 00:13:06,300 So examples of where we can see that in a hospital are a doctor's workstation or a PACS, which I forget what PACS stands for. 157 00:13:06,300 --> 00:13:10,600 It's a photo acquisition computer system, I think. 158 00:13:10,600 --> 00:13:11,260 Archiving. 159 00:13:11,260 --> 00:13:12,120 What's that? 160 00:13:12,120 --> 00:13:13,080 Archiving. 161 00:13:13,080 --> 00:13:14,580 Archiving, yes. 162 00:13:14,580 --> 00:13:16,100 So patient archiving. 163 00:13:16,300 --> 00:13:24,640 So keeping track of all of the different images that are coming from x-rays, MRIs, and all those things and time them in. 164 00:13:24,860 --> 00:13:29,680 So I'm going to challenge you on this question on this slide a little bit. 165 00:13:29,760 --> 00:13:39,040 So as healthcare hackers, as healthcare security researchers, we tend to talk a lot about the medical devices. 166 00:13:39,440 --> 00:13:45,700 We tend to... that's a lot of where the focus is because that's a lot of where the laws revolve around. 167 00:13:45,760 --> 00:13:52,120 What is not discussed a lot is the 911 system. 168 00:13:52,780 --> 00:13:57,520 So where would that lie in the ICS layers? 169 00:13:57,540 --> 00:13:57,800 Right. 170 00:13:57,800 --> 00:14:13,540 So I think you're talking more about the fact that we see a lot of embedded device progress, particularly with the work that's been done with Bow and Company at FDA, with what a lot of the I am the Calvary has been advocating, what the biohacking village has been advocating. 171 00:14:13,540 --> 00:14:20,920 And then there's this broader question that's even beyond hospitals, which is, okay, what about the rest of the stuff that's a part of that infrastructure, right? 172 00:14:21,480 --> 00:14:26,040 And I think the challenge and the solutions are the same. 173 00:14:27,800 --> 00:14:30,420 We have to design for security. 174 00:14:30,420 --> 00:14:33,400 There is no, I have built this and it is secure. 175 00:14:33,520 --> 00:14:36,020 We have to have that actually happen. 176 00:14:36,020 --> 00:14:47,760 And it's harder because with traditional ICS, while there has been a lot of attention that has started to be drawn to what is, like I said, a new market. 177 00:14:47,760 --> 00:14:52,920 I mean, ICS security, I would say is about six to eight years old. 178 00:14:53,600 --> 00:14:58,780 And a lot of the startups are all coming up with different solutions around those things in particular. 179 00:14:58,940 --> 00:15:11,960 But this is not something that the average, unless you're a manufacturing plant, unless you are a part of critical infrastructure delivery, folks aren't paying attention or doing anything about this. 180 00:15:11,960 --> 00:15:13,420 I'm going to bring you back in then. 181 00:15:13,420 --> 00:15:21,280 So why is EMS not considered critical infrastructure? 182 00:15:24,060 --> 00:15:26,460 That's a bigger question about my pay grade. 183 00:15:27,560 --> 00:15:36,300 I mean, maybe we should discuss it because I bring this up because I think we've had this conversation before and I think a lot of people know, but my father was a paramedic captain for the fire department of New York. 184 00:15:36,340 --> 00:15:41,820 And I've seen how some of the systems work and completely agree. 185 00:15:42,380 --> 00:15:45,180 It's, it's, there's a lot of things going on. 186 00:15:45,180 --> 00:16:12,480 And why, why wouldn't this, why wouldn't 911 systems, the medics, police, the fire, not be considered critical infrastructure enough that they be added to that healthcare, like workflow, that it gets secured more, updated more, thought about more, workload more? 187 00:16:13,320 --> 00:16:22,660 So that's, I think that's a, that's a policy and funding question of the SSAs and how, because I think there's 16 of them now that define... 188 00:16:22,660 --> 00:16:24,740 Just so that we, we don't have acronyms. 189 00:16:24,740 --> 00:16:25,020 Sure. 190 00:16:25,020 --> 00:16:36,860 So I don't remember what SSA stands for, but SSA is the specific authorities that are tied, putting a particular critical infrastructure sector tied to a specific agency. 191 00:16:36,860 --> 00:16:41,580 So for example, electricity, electricity comes under Department of Energy. 192 00:16:42,880 --> 00:16:48,000 Transportation, I believe TSA has that. 193 00:16:48,380 --> 00:16:49,300 I'm not sure. 194 00:16:49,300 --> 00:16:50,760 I don't have them all memorized. 195 00:16:51,020 --> 00:16:52,780 There's 16 of them. 196 00:16:54,780 --> 00:17:03,740 So I, that's what I was trying to go look up while you were talking, was looking up what the SSAs were and to see what tied into medical. 197 00:17:03,740 --> 00:17:15,900 Cause I don't, I, I don't know if there is some level of that that's already represented, but that's, that's, so that's like the, how the United States government breaks and manages it from a funding and accountability perspective. 198 00:17:15,900 --> 00:17:23,080 And then at this lower level, of course, is the actual technical execution, which is the industrial control system itself. 199 00:17:25,740 --> 00:17:28,880 So I'm afraid I don't know enough to thoroughly answer your question. 200 00:17:29,480 --> 00:17:31,860 You brought me here to challenge you? 201 00:17:33,300 --> 00:17:36,340 Fireside chat, challenge accepted. 202 00:17:38,060 --> 00:17:40,660 You're just getting even for me leaving those notes in, huh? 203 00:17:41,640 --> 00:17:44,560 No, no, kind of. 204 00:17:45,700 --> 00:17:48,100 So building automation systems. 205 00:17:48,200 --> 00:17:50,860 So this is everything that you can think of, right? 206 00:17:50,860 --> 00:17:58,620 This is HVAC, fire detection, security and access control, all of those elements that are pretty much in every building to do it. 207 00:17:58,620 --> 00:17:59,820 And we talked about that difference, right? 208 00:17:59,820 --> 00:18:08,760 We have the higher level infrastructure of water, electricity, that's being brought to the building, and then the elements inside of it that are doing it. 209 00:18:09,000 --> 00:18:13,320 Building automation systems, we're looking at operations and backups. 210 00:18:13,320 --> 00:18:15,800 We're looking at efficiencies and savings. 211 00:18:15,800 --> 00:18:30,520 And so in the process of what has been traditionally very proprietary closed systems, these are now going to shifting to traditional ICS, like programmable logic controllers to do a lot of the things that used to be proprietary. 212 00:18:30,560 --> 00:18:40,420 But now with PLCs, I can work with those on an open ICS development standard to be able to get those savings and that efficiencies across my complexes. 213 00:18:43,470 --> 00:18:44,470 I'm good. 214 00:18:44,470 --> 00:18:45,150 I'm good. 215 00:18:45,150 --> 00:18:46,310 I'll raise my hand. 216 00:18:47,550 --> 00:18:53,030 So this is my very fancy explanation of how ICS and IT are two different things. 217 00:18:53,030 --> 00:19:04,450 So we've covered some of this organically through what we've been saying, but fundamentally, it's important to recognize that the two are very different, and they need to be treated very differently. 218 00:19:04,450 --> 00:19:12,650 As much as there is the debate in IT about patching, as we talked about, that might not even be an option in ICS. 219 00:19:12,650 --> 00:19:23,230 And Nina, as you commented about establishing the perimeter, the inner perimeters and moats, we have to have different solutions because we can't patch things to be able to protect them. 220 00:19:23,350 --> 00:19:26,030 In fact, ICS can be very brittle. 221 00:19:26,030 --> 00:19:39,390 There are a lot of systems on there where even if you send the wrong packet can, in fact, cause the system to crash, which is, of course, very dangerous when we consider about what they're doing and the high availability necessity of it. 222 00:19:39,390 --> 00:19:44,110 So they're both different from a deployment and operations perspective. 223 00:19:44,110 --> 00:19:54,030 And that, of course, ties back to they have different security considerations that you can't just apply IT solutions to ICS solutions to solve them. 224 00:19:54,990 --> 00:20:00,310 So this, your explanation and this slide remind me of the West. 225 00:20:00,310 --> 00:20:05,470 Do you remember when the East Coast went dark because somebody hit a line or something like that? 226 00:20:05,470 --> 00:20:09,930 So how does that tie into this? 227 00:20:09,930 --> 00:20:14,930 I understand somebody broke a electricity power thing. 228 00:20:15,170 --> 00:20:16,390 See, and that's part of the problem. 229 00:20:16,390 --> 00:20:22,530 I don't know how to articulate this well, so I feel like maybe you can translate for me. 230 00:20:22,750 --> 00:20:23,190 Sure. 231 00:20:23,190 --> 00:20:25,590 So let's break that down into multiple things. 232 00:20:25,590 --> 00:20:28,910 The first is that was not an attack. 233 00:20:28,910 --> 00:20:29,530 Right. 234 00:20:29,530 --> 00:20:31,530 That was a misconfiguration. 235 00:20:31,530 --> 00:20:32,790 That was an overload. 236 00:20:32,850 --> 00:20:36,290 And then there were, through various circumstances, it rippled out. 237 00:20:36,290 --> 00:20:54,290 But I want to highlight that piece, first of all, because particularly when we're talking about life and injury, loss of limb, when we're also talking about public trust and understanding into buying into our problems, fear and uncertainty and doubt is the easiest way to scare people. 238 00:20:54,290 --> 00:20:58,910 And then at some point, they start to shut down and we lose the ability to have that conversation. 239 00:20:59,250 --> 00:21:04,570 Most of the kinds of issues that we've seen are human error. 240 00:21:04,890 --> 00:21:11,030 They are failures of the systems, not that there was somebody who was coming and attacking us or doing something. 241 00:21:11,030 --> 00:21:14,570 And so the question that then follows is, well, why not? 242 00:21:14,570 --> 00:21:21,350 Why has critical infrastructure, if it has these issues, why hasn't it been attacked? 243 00:21:21,350 --> 00:21:41,250 And what we have seen is there are lots of what I call iterative intelligence operations where third party adversaries are coming and they are learning and they are stepping and they are trying to see what could happen, learn the environment and map it out. 244 00:21:41,350 --> 00:21:50,290 Because the second that they actually, imagine if that was insert adversarial country that took down the entire East Coast. 245 00:21:51,650 --> 00:21:56,190 The US response would probably be an armed response. 246 00:21:56,370 --> 00:22:00,910 It would not be a, we're going to ping you back and we're going to shut some of your web servers down. 247 00:22:00,910 --> 00:22:02,650 No, we're probably going to bomb you. 248 00:22:02,730 --> 00:22:11,650 And so that level of deterrence is a part of the landscape when we're talking about critical infrastructure and the cybersecurity component. 249 00:22:12,390 --> 00:22:20,010 So the other element there is that the grid, which I put in quotation marks is there is not one monolithic grid. 250 00:22:20,210 --> 00:22:23,850 The grid is actually broken down into numerous subsections. 251 00:22:23,850 --> 00:22:40,210 And even that is broken down into, I want to say there are about 3000 different operating entities that control parts of just the electric grid, all the way down to like co-ops at a tiny little community level up to some of the large regional providers. 252 00:22:40,210 --> 00:22:55,550 And so they all, that heterogeneity, all that different stuff, as much as it's interconnected, actually also helps provide resilience for the grid itself, because something happening here, it's very rare for like what you saw, where it rippled out and took multiple things down. 253 00:22:55,570 --> 00:22:58,350 It's very difficult for an attacker to do that too. 254 00:23:03,360 --> 00:23:04,040 Here we go. 255 00:23:04,040 --> 00:23:05,520 Here are the SSAs. 256 00:23:06,440 --> 00:23:07,320 Look at that. 257 00:23:07,320 --> 00:23:08,300 Right on time. 258 00:23:08,300 --> 00:23:08,820 Okay. 259 00:23:08,840 --> 00:23:09,680 Well, not right on time. 260 00:23:09,680 --> 00:23:10,460 I should have had this earlier. 261 00:23:10,460 --> 00:23:10,520 I know . 262 00:23:10,560 --> 00:23:12,360 I was trying to give you credit. 263 00:23:13,860 --> 00:23:14,440 Nope. 264 00:23:14,480 --> 00:23:15,000 Oh, there you go. 265 00:23:15,000 --> 00:23:16,320 Healthcare and public health is one. 266 00:23:16,360 --> 00:23:17,080 Yes. 267 00:23:17,120 --> 00:23:18,160 You're on there already. 268 00:23:18,160 --> 00:23:18,780 It was. 269 00:23:22,470 --> 00:23:23,730 Yes, we knew that. 270 00:23:23,730 --> 00:23:24,630 I knew that. 271 00:23:24,970 --> 00:23:25,330 So... 272 00:23:25,330 --> 00:23:26,910 Hey, Nina, right on time. 273 00:23:29,090 --> 00:23:29,890 Yes. 274 00:23:30,150 --> 00:23:30,950 Okay. 275 00:23:31,970 --> 00:23:34,370 I don't know what you were going to say about this grid. 276 00:23:34,690 --> 00:23:35,350 No, no. 277 00:23:35,350 --> 00:23:46,830 So this is where I wanted to, the conversation that you provoked a couple of slides ago, I had built a slide for it, but I was so flustered by the hard question that I forgot that I had a slide for it. 278 00:23:47,370 --> 00:23:49,530 This is what it's like having a conversation with me. 279 00:23:49,530 --> 00:23:50,250 I know. 280 00:23:50,910 --> 00:23:51,550 Okay. 281 00:23:51,550 --> 00:23:56,610 So this is a specific breakout in this case. 282 00:23:56,610 --> 00:24:01,150 So I always steal vendor graphics because vendors, of course, are always promoting their own things. 283 00:24:01,490 --> 00:24:12,110 This happens to be Johnson Controls, but basically it gives us a detailed nominal explanation of all the elements around airborne infection isolation rooms, which is what you were talking about, right? 284 00:24:12,110 --> 00:24:14,830 Particularly in a pandemic, this is critical. 285 00:24:14,830 --> 00:24:20,670 This is where we keep the air where it's supposed to be so that we don't get it out and infect other people while we're trying to treat them. 286 00:24:20,930 --> 00:24:39,290 There's approximately 12, 13 different areas or items to be concerned about that have some technical something that needs to be secured in some way. 287 00:24:39,290 --> 00:24:44,310 And this is on top of all the other things that are in that hospital. 288 00:24:48,150 --> 00:24:56,890 What kind of... do you think the hospitals are taking these things into consideration? 289 00:24:56,890 --> 00:25:06,490 Because again, when we've had conversations with the device manufacturers and other hospitals, healthcare in general, they're like, yeah, they talk a lot about the medical devices. 290 00:25:06,490 --> 00:25:09,010 This isn't necessarily discussed. 291 00:25:09,050 --> 00:25:18,070 So the curiosity is, is this even on their agenda to think about? 292 00:25:19,630 --> 00:25:26,930 So the challenge with hospitals is that they are very much hospital or regionally focused, right? 293 00:25:26,930 --> 00:25:32,650 There is no like, here are how all hospitals do something. 294 00:25:33,830 --> 00:25:45,570 Going to the original slide where I showed the delta of their challenge with responding, I think that shows both a challenge of priority and capability. 295 00:25:45,930 --> 00:26:02,330 So things like this are so far, are further down the track than worrying about PHI spillage and privacy and simple IT operations, let alone, this is kind of more like advanced math. 296 00:26:02,330 --> 00:26:05,130 So I see a specific security issues. 297 00:26:05,590 --> 00:26:10,010 Like all things, it started with security through obscurity. 298 00:26:10,010 --> 00:26:16,150 Well, we have our thing and you have to get our thing exactly to be able to do something to it. 299 00:26:16,150 --> 00:26:18,690 Over time, that doesn't work anymore. 300 00:26:18,910 --> 00:26:22,270 And then we've talked about this numerous times already. 301 00:26:22,270 --> 00:26:23,550 What is a patch? 302 00:26:23,550 --> 00:26:33,850 A lot of these things weren't built to be patched and they were driven by a very expensive capital outlay tied to life cycle management in the 20 to 40 year time range. 303 00:26:34,890 --> 00:26:39,030 We've also discussed most of them don't have authentication. 304 00:26:39,350 --> 00:26:41,750 Once you're in, I can tell you what to do. 305 00:26:41,750 --> 00:26:44,150 And then my joke here on what does crypto mean? 306 00:26:44,150 --> 00:26:46,530 Because in their case, they don't even know. 307 00:26:46,870 --> 00:26:52,750 Encrypted traffic is not something that you can do at all, particularly if you don't even have authentication to start with. 308 00:26:52,750 --> 00:26:57,510 So most of this is transmitted in whatever protocol it's communicating in. 309 00:26:57,510 --> 00:27:02,030 And there are ICS specific communication protocols, but they're unencrypted. 310 00:27:04,030 --> 00:27:15,610 So the surface area specifically, most ICS, the primary attack vector is through the information technology that connects them. 311 00:27:15,610 --> 00:27:19,010 Now, of course, the question is, why do they connect them? 312 00:27:19,210 --> 00:27:23,850 And so the joke that I always throw out here is an air gap is not an air gap is not an air gap. 313 00:27:23,850 --> 00:27:25,490 Everybody says, oh, it's air gapped. 314 00:27:25,530 --> 00:27:27,770 And then literally you just keep asking, keep asking. 315 00:27:27,770 --> 00:27:31,530 And then eventually you find, well, it's connected here and it's connected that way. 316 00:27:31,530 --> 00:27:33,350 And we don't call it an air gap because da, da, da. 317 00:27:33,350 --> 00:27:36,170 And nothing is ever completely disconnected. 318 00:27:37,870 --> 00:27:44,110 Asterix, there are always examples where there is, I'm not going to go down that, but fundamentally things do connect. 319 00:27:44,110 --> 00:27:49,930 And particularly in a residential setting, they definitely do. 320 00:27:49,930 --> 00:27:55,690 And the reason is there's always one thing that your ICS has to tell your IT no matter what. 321 00:27:56,410 --> 00:27:57,870 How do I bill you? 322 00:27:57,870 --> 00:27:59,070 How much did you use? 323 00:27:59,070 --> 00:28:00,370 Because we need the money. 324 00:28:01,710 --> 00:28:13,270 And then same sign of problem we see in consumer IoT, there's industrial internet of things, which are the sensors that help provide the feedback for the system to understand what's happening in operation. 325 00:28:14,110 --> 00:28:21,150 All of these are much more vulnerable and great examples for lateral movement. 326 00:28:21,530 --> 00:28:23,330 What's this on the internet? 327 00:28:23,430 --> 00:28:31,230 My joke here being, and so a call out to Chris Kubecka, who presented on hack the world and galaxy with open system intelligence. 328 00:28:31,230 --> 00:28:39,670 In her example, she showed how Boeing had a number of things that were vulnerable because a hacker can only hack what they can touch. 329 00:28:39,670 --> 00:28:43,610 And if it's internet accessible, then I'm already a good percentage of the way there. 330 00:28:43,610 --> 00:28:49,890 And it's the same kind of problem with ICS is making sure that these things are not internet accessible. 331 00:28:50,130 --> 00:28:54,510 And oftentimes, not oftentimes, but sometimes they are, and that's a problem. 332 00:28:54,510 --> 00:28:57,190 The final vector is physical proximity. 333 00:28:58,010 --> 00:29:16,730 Some of these things, particularly when we're looking at like electricity, oil, natural gas, water, they're going to be elements of that critical infrastructure as it extends out from production to transmission or delivery, there's ICS along the way that's out there in public. 334 00:29:16,730 --> 00:29:19,670 And maybe it's just surrounded by a fence. 335 00:29:19,670 --> 00:29:21,650 Maybe it's surrounded by a barbed wire fence. 336 00:29:21,650 --> 00:29:26,310 But one of the things I learned in the army is an obstacle is only good if you have overwatch on it. 337 00:29:26,330 --> 00:29:29,370 Just because there's a fence does not mean that somebody can't get to it. 338 00:29:29,370 --> 00:29:35,830 So physical proximity to these, particularly when they're speaking RF, is a real challenge. 339 00:29:37,130 --> 00:29:38,370 This is well done. 340 00:29:38,370 --> 00:29:38,720 Okay. 341 00:29:40,150 --> 00:29:41,930 So who is doing this? 342 00:29:41,930 --> 00:29:46,630 Well, organized crime, North Korea, like I said, organized crime. 343 00:29:46,810 --> 00:29:55,510 So the joke being there that North Korea is fundamentally an organized criminal nation state in what it's doing with its operations. 344 00:29:55,510 --> 00:30:08,310 And so a lot of the kinds of attacks that we've primarily seen on hospitals, besides the theft of PHI, PHI being worth a lot more than PII, because I can change my social security number, I can change my name, you can never change your healthcare data, 345 00:30:08,310 --> 00:30:12,850 which is why it goes for a multiple on the dark web. 346 00:30:13,030 --> 00:30:17,050 Why it's sold for a lot more than a traditional PII record. 347 00:30:17,210 --> 00:30:23,110 And then of course, we've seen a significant increase in ransomware. 348 00:30:23,650 --> 00:30:33,550 And the IBM report that I referenced earlier, with Ponemon on the cost of a data breach goes into detail about how much has been paid out to ransomware. 349 00:30:33,550 --> 00:30:38,470 And the healthcare sector in particular, has been particularly challenged on doing this. 350 00:30:38,470 --> 00:30:43,890 We addressed the issues of FUD earlier in the presentation, so we'll skip noting that now. 351 00:30:44,670 --> 00:30:47,170 And so, how could they do this? 352 00:30:47,170 --> 00:30:52,490 We talked about lateral movement through IT systems being one of the more prominent ways that this can go. 353 00:30:52,950 --> 00:30:56,250 Otherwise, we're starting to look at targeted attacks. 354 00:30:56,410 --> 00:31:05,490 And so, we went earlier to, well, why haven't we seen these kinds of attacks happen on critical infrastructure writ large is because of the deterrence component. 355 00:31:05,630 --> 00:31:12,930 So, I think mostly what we've seen is, of course, there's going to be the primary motivator around finance. 356 00:31:12,930 --> 00:31:26,410 So, the easiest way for me to do that, and then potentially the escalation would be a direct denial of service attack. 357 00:31:26,410 --> 00:31:35,570 So, focusing on the services that ICS is delivering specifically to a facility or complex, and taking those down. 358 00:31:36,810 --> 00:31:38,650 I'm reading your numbers. 359 00:31:38,650 --> 00:31:41,190 Those are exponential. 360 00:31:41,190 --> 00:31:42,310 Yes. 361 00:31:42,990 --> 00:31:48,190 The percentages are high, considering that this is patient care. 362 00:31:48,190 --> 00:31:52,930 This is me trusting you with my information, and what will you do with it? 363 00:31:52,930 --> 00:31:55,710 And then it's gone. 364 00:31:59,010 --> 00:32:15,210 I'm also just thinking about how, again, we talked about this a little bit earlier, the hospitals aim at least to zero out, they're putting $16.5 million out or $640,000. 365 00:32:15,230 --> 00:32:16,830 Where is that money coming from? 366 00:32:16,830 --> 00:32:30,010 And it's coming from their insurances, because now cybersecurity insurance in hospitals is almost mandatory because of the sensitivity of all of the devices and all of the information that's in there. 367 00:32:30,010 --> 00:32:31,970 That's well done you. 368 00:32:31,970 --> 00:32:32,690 Yes. 369 00:32:32,690 --> 00:32:33,010 Yeah. 370 00:32:33,010 --> 00:32:43,510 I mean, the key elements that I would pull out of here on the statistics are one, from the tax going back to 2016, not including this year, 6.6 million patients have been affected by this. 371 00:32:43,510 --> 00:32:53,730 Of course, the most significant out of that was the one or cry ransomware that struck the UK national health system several years ago, and that's been attributed to North Korea. 372 00:32:53,730 --> 00:32:59,150 The question of motive on that one was whether that was a test, whether that was on accident or whether that was on purpose. 373 00:32:59,330 --> 00:33:04,190 And then the final part here is the overall cost of these attacks is $157 million. 374 00:33:04,690 --> 00:33:23,670 And mostly that is capturing the overall cost from having to defend, having to identify, having to do the forensics cleanup, the damages that are actually done when there is a breach and the loss of that data, because privacy regulations, around PHI, have become much, 375 00:33:23,670 --> 00:33:24,950 much stronger. 376 00:33:24,950 --> 00:33:26,850 So there are some teeth to those now. 377 00:33:26,850 --> 00:33:33,490 So I tend to... what is your call to action? 378 00:33:33,490 --> 00:33:35,090 There's a lot of information in here. 379 00:33:35,090 --> 00:33:36,270 It's very dense. 380 00:33:36,470 --> 00:33:39,370 What do you want the healthcare community to do? 381 00:33:39,370 --> 00:33:42,230 What do you want the ICS community to do? 382 00:33:42,230 --> 00:33:45,250 What do you want the security research community to do? 383 00:33:47,210 --> 00:33:48,850 Yeah, that's tough. 384 00:33:49,710 --> 00:34:02,010 So, I mean, with the talks that I've been giving around embedded systems and IoT for several years now, I talk about the need to design for security. 385 00:34:02,410 --> 00:34:06,390 I think that there are some really low-hanging fruit here that we need to do. 386 00:34:06,390 --> 00:34:10,470 But that's really easy for me to wave my researcher wand and say, these things should happen. 387 00:34:10,470 --> 00:34:22,570 And it's a lot harder for manufacturers to have to increase the cost of their equipment to consumers, corporate consumers who are buying this stuff to actually pay for that. 388 00:34:23,290 --> 00:34:28,890 And so that's the chicken and egg there is everybody knows that these are needed things, but who's going to pay for it? 389 00:34:29,270 --> 00:34:34,890 And so typically, whenever there's that middle ground of, well, who's going to do this? 390 00:34:34,950 --> 00:34:38,610 I think the answer is government for funding those kinds of solutions. 391 00:34:39,830 --> 00:34:46,870 But we have a long way to go because it's just like you can't immediately change equipment when you're producing a car. 392 00:34:47,250 --> 00:34:49,730 It's these things have an even longer lifecycle. 393 00:34:49,850 --> 00:34:52,890 And so it's going to take a long time for us to dig out of that hole. 394 00:34:52,910 --> 00:34:57,130 And we really need the patience and the stick-to-itiveness to get there. 395 00:34:57,690 --> 00:35:08,730 There are a lot of solutions that are coming out to the market to solve some of this within, hey, if we can't fix something directly, at least we can, like I said, we can work around it. 396 00:35:08,730 --> 00:35:11,570 We can control the environment around it to protect it. 397 00:35:11,850 --> 00:35:27,170 So as those continue to push out, those will be cheaper solutions to both identity, anomaly detection, and when I say asset identification, anomaly detection, and then also providing protection in a more of a real-time way. 398 00:35:29,950 --> 00:35:34,310 That's essentially what's in the innovation hopper for those to continue to progress that way. 399 00:35:34,310 --> 00:35:38,690 So those continuing to roll out would be a good thing. 400 00:35:38,850 --> 00:35:43,250 So who would you specifically be looking for to engage in this conversation? 401 00:35:43,250 --> 00:35:47,850 You said government, but again, we've had this conversation that government is pretty broad. 402 00:35:48,610 --> 00:35:50,850 It's dissected into different sectors. 403 00:35:50,850 --> 00:36:03,410 Is there a person that you would say, hi person, I have this information, I would love to have a conference with you, a chat, so that we can do a deep dive and we understand the problem. 404 00:36:03,410 --> 00:36:04,410 Here it is. 405 00:36:04,510 --> 00:36:06,070 Let's work on that solution. 406 00:36:06,690 --> 00:36:08,970 So person, place, thing. 407 00:36:09,170 --> 00:36:09,630 Sure. 408 00:36:09,630 --> 00:36:19,050 So if you can tell me who's the SSA responsible for the medical and healthcare sector from that earlier slide, I would say that they're a part of this. 409 00:36:20,490 --> 00:36:21,010 What? 410 00:36:21,010 --> 00:36:22,610 Not even a little laugh at that one. 411 00:36:22,610 --> 00:36:24,310 I started looking. 412 00:36:24,790 --> 00:36:26,310 You were looking it up. 413 00:36:26,310 --> 00:36:31,090 So clearly they're a part of it from a sector specific element. 414 00:36:32,130 --> 00:36:34,010 I'm with the ICS Village. 415 00:36:34,010 --> 00:36:46,350 We're working with CISA and Department of Energy on additionally pushing out additional programs for hackers in the community to be able to do independent research and push some of these things. 416 00:36:46,450 --> 00:37:04,030 A lot of it, as we talked about, since IT skillset is different than ICS skillset, and that's the point of what the ICS Village is doing, is giving folks that are interested and on road so that it's not just these abstract things like, oh, PLC and historian and SCADA, 417 00:37:04,690 --> 00:37:07,030 DCS, like, what are we talking about? 418 00:37:07,030 --> 00:37:17,770 And making those accessible so that infosec, traditional infosec practitioners can get their feet wet with going this direction. 419 00:37:17,930 --> 00:37:18,370 Okay. 420 00:37:18,370 --> 00:37:19,430 Thank you. 421 00:37:19,430 --> 00:37:21,290 Thank you for having me.