start	end	text
640	6420	Hi, I'm Bryson. I'm going to be joined by Nina, who's going to help me transcend ICS and med,
6420	12960	which is our medics med ICS talk. In fact, Nina, you deserve named credit for helping me out on
12960	18960	this perilous task. Thank you. I also wanted to be noted that I got informed of this like,
18960	24720	what, 18 hours ago that I would be on this panel discussion fireside chat with you.
24720	31840	Was it even 18 hours ago? No, I've been awake for way too long. So does this mean that I
31840	41020	am part of the unicorn tribe now? You are now part of the herd. Unicorns are herds. They get herds.
41640	45160	Yes. So hear what we have to say. All right. We're going to stop at the bad jokes.
45180	53020	Welcome to my med ICS talk with now joined by the illustrious Nina. All right. So who am I
53020	58060	besides wearing the unicorn stuff? I founded Scythe and Grimm. I'm the co-founder of my own
58060	65380	village, the ICS village. I feel like there's a pattern here. So also check us out at DEF CON 2
65380	70100	to get even more information about ICS. And of course, all of our talks will be published as
70100	75900	well for more detail. All right. Let's get started. All right. So outline. We're going
75900	80780	to be talking through all things ICS. Why is it relevant to hospitals? What are some of the
80780	86700	pieces around implementation? How is ICS different than traditional information technology?
87020	92460	And then specific issues and threats that are organic specifically to industrial control
92460	98780	systems. A quick little note that I got here from yesterday is IBM with Ponemon published their cost
98780	106500	of a data breach report. Comparing the breach lifecycle, so when a breach happens to when it is
106500	114920	found and expunged, healthcare is 96 days slower on average compared to the leader of finance. So
114920	121280	we already have seen an industry that, yes, you were like building up for it. First interruption,
121280	128060	first question. So then what is the time frame of a financial industry breach lifecycle? And
128560	133340	then how does that how does that 96 days get added to that? Not how, but like what's the
133340	139020	normal time frame for one? Sure, I'm trying to remember what that number was. I want to
139020	148580	say it was either 208 or 280 days. So 200 and some days is the fastest for an industry on average to
148580	155280	find a breach and get rid of it. And healthcare is 96 days slower on average for that. So that
155280	162380	is over three months longer to eradicate a breach from their systems. You said 200 days?
162380	168200	That is the fastest, which is finance. 200 plus 96 is approximately a year. Yes. You said three
168200	175720	months. No, so 96 days is three months. Got it, got it. My math is no good. Okay, yes.
176860	179520	Do you want to co-found the math village? Can we do that next?
180920	185720	Making stats literate for everybody. You know what, that would be great. I would love that part.
185720	188180	So Nina, you have some notes on why this is important.
190020	195440	I love that you added this in here. I'm going to let you talk through it so I can just
195980	199860	bombard you with questions. These were literally your notes. I just didn't take them out.
199860	206300	I know, I get that. Okay, so then I guess I'm speaking to it. So I think as we all know at the
206300	212540	biohacking village and folks listening, so healthcare is a 365 day entity. Downtime for
212540	220720	any medical devices or AMRs would mean dead time for patients. What people don't really consider
220720	228420	in the medical ecosystem is the electricity, the water, gas. How are these things affected and
228420	233420	does it, can it hurt patient care? If you go to the dentist, for instance, because I feel like
233420	237260	that's something that everybody can more or less relate to, that water flow that they have in your
237260	241340	mouth and there's a suction on the other side, that gets treated and then it gets sent out into
241340	249420	the world. Electricity, if a surgical suite was underway and electricity went out, granted there
249420	254180	are generators, but let's think about how often the generators are checked and made sure that they
254180	260420	are still active and can produce any electricity or whatever the needs of the hospital is. Negative
260420	266180	airflow and filtration, super important. We're in COVID right now. We know that it's an airborne disease
266180	272800	and just in generalities, that negative airflow that goes from the hospital removes and reduces
273380	277240	the nosoclonal diseases. Nosoclonal diseases are the diseases that you get
277240	284740	in the hospital while you're in the hospital. There are backups to backups in hospitals usually,
284740	296160	but again, how often are they checked? How often are they changed? Who's checking on these? Where's
296160	301640	I'm a city girl, so one of the problems that happened at NYU during Hurricane Sandy
301640	307200	was that their servers and the generators were in the basement and the unfortunate truth is that
307200	311980	those were then gone when the hospital itself got flooded by all the waters and they had to
311980	316720	move the patients over to nearby hospitals. And just thinking about how patients are transported
317680	322820	from one hospital to another, how are they producing medical notes and medical discharges
322820	330260	so that that patient would get treated accurately by that next physician that took care of them?
332200	336920	Healthcare is a great analog for industrial control systems because unlike traditional IT,
336920	341820	when we think of the confidentiality, integrity, and availability triad,
341820	346440	IT generally goes in that order and it's flipped for industrial control systems because just like
346440	351940	healthcare, we need something where availability is the utmost of importance. If I lose electricity
351940	359460	in the middle of an operation, that can cause patient harm. Modern society rests on critical
359460	366200	infrastructure, electricity, water, finance, transportation. If those went out, we go to
366200	372240	the stone age almost overnight. The longer it's out, the more damage that's done and there are
372240	376140	the statistical models then of understanding what that implication is. The final piece on
376140	380720	industrial control systems is there's two levels of it that's relevant for the hospital setting.
380720	384600	There's of course what we're talking about here, which is the grid, the infrastructure that
385360	390160	nominally is providing all of the different resources to the facility. And then there
390160	396300	are industrial control systems embedded inside the facility to help do particular elements.
396460	402400	Nina talked about air filtration and negative airflow. We will have a slide later on that we
402400	406440	talked about in the podcast a couple of months ago where we're going to go into detail on some
406440	412520	of those systems and how they interconnect. I want to add something to my notes. The wi-fi,
412520	417900	right? Nobody's... we haven't thought about how the internet connectivity, if that went out, would
417900	423260	affect all of this. So again, just if you can't print out a patient record or if you're taking
423260	427460	blood and you can't specifically say that this is this patient's because you have to enter
427460	432100	it into the EMR and then a thing prints out, a label prints out, there's a lot of
432920	437900	flow that continuously in the hospital needs to be contemplated. And I actually don't think
437900	442780	it has been. So this is... we had this conversation on the podcast, it hasn't been published yet,
442780	448200	but this is why Bo and I decided that you would be perfect to give this talk.
449500	455280	Well, thank you for having me on and thank you for helping. So what is ICS? Industrial Control
455280	461040	Systems, sometimes also known as SCADA or Operational Technology. There are wonky
461040	466820	differences between those three, but fundamentally it's a catch-all for a couple of things.
466820	470580	The biggest thing that separates ICS from what we think of a traditional computer is
470580	476860	industrial control systems cause physical effects in the real world. We're not just talking data
476860	481480	that stays on a hard drive. We're talking about something that actually changes something in the
481480	487680	world. If it's a water pump, right? Water pressure, water flow is going to change. If it's airflow,
487680	494160	airflow is going to shift and change. Our environment is actually affected. The reason I
494160	498980	chose this picture is the best joke that I have that I think clearly illustrates both what it is
498980	504960	as well as the problems are any computer that's at least 20 years old is an industrial control system.
504960	511500	They were designed to be available and to have a long life cycle. They were... they're expensive.
511500	517160	Most of them are expensive. Heavy, heavy capital costs where I want to put this, I want to forget
517160	521580	it and I don't have to do anything. The introduction of cybersecurity is still a relatively
521580	526620	new phenomenon as much as cybersecurity is a relatively new phenomenon. But particularly in
526620	531360	industrial control systems, it's a new thing where previously this would be the kind of equipment
531360	536380	that was maintained by a safety engineer who was mostly looking at what do I need to maintain the
536380	541400	equipment so that it works, not how do I protect it because somebody might try to manipulate or
541400	547560	attack it. So I just want to speak to that on the healthcare side. So there's so many legacy
547560	552240	systems and so many legacy devices because same concept, everybody was imagining all these things
552240	557100	to be long lasting. And when you're in the hospital and you have all of these devices,
557100	563320	there's not a lot of funding that... there's not a lot of payment that goes into the hospital.
563320	568060	They're kind of just trying to get to zero and balance themselves out. So having all of these
568060	574720	legacy systems and things like this does create a problem when it comes to us putting security
574720	580820	around it because we literally have to build these things in. We have to build... what's the thing
580820	590040	around the castle? Moats. Perimeter defense. Yes, thank you. You can cut all of my English out.
590040	593960	Right, so we have to build perimeters of defense around all of these legacy devices
594520	600420	so that they work and we can continue making sure that the patient and the systems work.
600840	607420	Yeah, so just being specific since perimeter typically means like the outer shell,
607420	613320	and a lot of folks think of that as controlling the ingress and egress to a network. Since a lot
613320	618880	of these kinds of systems can't be directly patched, which is a slide that's coming up,
618880	624740	typically there is a similar kind of inside, usually we wouldn't use perimeter, but
625460	631180	a way to kind of blanket around, control around the traffic to a device. So this is an example
631180	635040	where like software-defined networking has become very popular in ICS environments because
635040	641700	if I can't patch or improve the configuration of the device itself to make it not vulnerable,
641700	646460	at least I can control the traffic around that and adapt it to those kinds of threats.
648160	656840	So ICS versus IT, workers versus nerds. We talked about the performance of where I need
656840	662840	high availability versus in traditional IT, availability is an issue, but it is not the
662840	667140	primary concern. And then of course, when we're talking about risks here, when we think of IT,
667140	672440	we think about patient data, we think about privacy. On the operational technology side,
672440	683800	we're talking about injury or death. Okay, so some layers of ICS. At the very bottom layer is
683800	690080	the direct control. Like I talked about, ICS is where I am physically affecting the environment.
690080	695140	And so the most common element for that would be like a programmable logic controller.
695500	699320	Everybody at this point knows what a PLC is, even if you've never seen one,
699320	704680	because that's what Stuxnet was. Stuxnet affected the PLCs where they were changing
704680	709180	the speed of the centrifuges that were doing the uranium enrichment. Again,
709660	714760	a device controlling physical effect. And what we would see in a hospital environment would be
715180	720840	a pump, something that is cycling water or air. And then above that is the supervisory level. So
720840	727220	this is critical to understand these differences because a PLC is not a smart device. It doesn't
727220	732900	necessarily know what's the correct operational parameters to function in. When we think about
732900	738100	hacking a PLC, very rarely am I going to try to build some special code that's going to go
738100	743800	onto that PLC to rewrite it. That does happen. More likely what we see a lot of is issuing
743800	750400	commands to the PLC because one, PLCs generally don't accept authentication. Two, the traffic is
750400	756460	unencrypted. And three, the PLC itself doesn't know what's good or what's bad. It just does
756460	760080	what the supervisor above tells it to do. And then it just makes that happen in the world.
760080	764600	And it doesn't always have that feedback loop of understanding if I've gone out of tolerance.
764700	769220	The supervisory level is where you would have like a historian or acquisition. And this is
769220	773540	literally what it sounds like, right? Like I am monitoring multiple devices that are able to do
773540	777300	things and I'm telling them what to do and I'm reading what's happening and then I'm adjusting
777300	784600	that. So examples of where we can see that in a hospital are a doctor's workstation or a PACS,
784600	790600	which I forget what PACS stands for. It's a photo acquisition computer system, I think.
790600	791260	Archiving.
791260	792120	What's that?
792120	793080	Archiving.
793080	800280	Archiving, yes. So patient archiving. So keeping track of all of the different images that are
800280	804640	coming from x-rays, MRIs, and all those things and time them in.
804860	813360	So I'm going to challenge you on this question on this slide a little bit. So as healthcare
814120	819040	hackers, as healthcare security researchers, we tend to talk a lot about the medical devices.
819440	824960	We tend to... that's a lot of where the focus is because that's a lot of where the laws revolve
824960	837520	around. What is not discussed a lot is the 911 system. So where would that lie in the ICS layers?
837540	841660	Right. So I think you're talking more about the fact that we see a lot of embedded device
841660	846210	progress, particularly with the work that's been done with Bow and Company at FDA,
847720	852680	with what a lot of the I am the Calvary has been advocating, what the biohacking village has been
852680	857740	advocating. And then there's this broader question that's even beyond hospitals, which is, okay,
857740	860920	what about the rest of the stuff that's a part of that infrastructure, right?
861480	870420	And I think the challenge and the solutions are the same. We have to design for security.
870420	876340	There is no, I have built this and it is secure. We have to have that actually happen. And it's
876340	884260	harder because with traditional ICS, while there has been a lot of attention that has started to
884260	891780	be drawn to what is, like I said, a new market. I mean, ICS security, I would say is about six to
891780	896940	eight years old. And a lot of the startups are all coming up with different solutions around
896940	903880	those things in particular. But this is not something that the average, unless you're a
903880	909900	manufacturing plant, unless you are a part of critical infrastructure delivery, folks aren't
909900	917160	paying attention or doing anything about this. I'm going to bring you back in then. So why
917160	921280	is EMS not considered critical infrastructure?
924060	926460	That's a bigger question about my pay grade.
927560	931400	I mean, maybe we should discuss it because I bring this up because I think we've had this
931400	934900	conversation before and I think a lot of people know, but my father was a paramedic captain for
934900	941820	the fire department of New York. And I've seen how some of the systems work and completely agree.
942380	949900	It's, it's, there's a lot of things going on. And why, why wouldn't this,
949900	959160	why wouldn't 911 systems, the medics, police, the fire, not be considered critical infrastructure
959160	968400	enough that they be added to that healthcare, like workflow, that it gets secured more,
968400	972480	updated more, thought about more, workload more?
973320	979420	So that's, I think that's a, that's a policy and funding question of the SSAs and how,
979420	982660	because I think there's 16 of them now that define...
982660	984740	Just so that we, we don't have acronyms.
984740	990720	Sure. So I don't remember what SSA stands for, but SSA is the specific authorities that are tied,
990720	998020	putting a particular critical infrastructure sector tied to a specific agency. So for example,
998020	1004800	electricity, electricity comes under Department of Energy. Transportation, I believe
1006480	1012780	TSA has that. I'm not sure. I don't have them all memorized. There's 16 of them.
1014780	1019380	So I, that's what I was trying to go look up while you were talking, was looking up what
1019380	1026100	the SSAs were and to see what tied into medical. Cause I don't, I, I don't know if there is some
1026100	1030840	level of that that's already represented, but that's, that's, so that's like the,
1030840	1035060	how the United States government breaks and manages it from a funding and accountability
1035060	1039980	perspective. And then at this lower level, of course, is the actual technical execution,
1039980	1043080	which is the industrial control system itself.
1045740	1048880	So I'm afraid I don't know enough to thoroughly answer your question.
1049480	1051860	You brought me here to challenge you?
1053300	1056340	Fireside chat, challenge accepted.
1058060	1060660	You're just getting even for me leaving those notes in, huh?
1061640	1064560	No, no, kind of.
1065700	1071040	So building automation systems. So this is everything that you can think of, right? This
1071040	1076320	is HVAC, fire detection, security and access control, all of those elements that are pretty
1076320	1080880	much in every building to do it. And we talked about that difference, right? We have the
1080880	1085900	higher level infrastructure of water, electricity, that's being brought to the building, and
1085900	1091620	then the elements inside of it that are doing it. Building automation systems, we're looking
1091620	1097360	at operations and backups. We're looking at efficiencies and savings. And so in the process
1097360	1103960	of what has been traditionally very proprietary closed systems, these are now going to shifting
1103960	1109220	to traditional ICS, like programmable logic controllers to do a lot of the things that
1109220	1114080	used to be proprietary. But now with PLCs, I can work with those on an open ICS development
1114080	1120420	standard to be able to get those savings and that efficiencies across my complexes.
1123470	1126310	I'm good. I'm good. I'll raise my hand.
1127550	1133030	So this is my very fancy explanation of how ICS and IT are two different things.
1133030	1137390	So we've covered some of this organically through what we've been saying, but fundamentally,
1137390	1143350	it's important to recognize that the two are very different, and they need to be treated
1143350	1150270	very differently. As much as there is the debate in IT about patching, as we talked about, that
1150270	1155430	might not even be an option in ICS. And Nina, as you commented about establishing the perimeter,
1155430	1161410	the inner perimeters and moats, we have to have different solutions because we can't patch things
1161410	1168010	to be able to protect them. In fact, ICS can be very brittle. There are a lot of systems on there
1168010	1174310	where even if you send the wrong packet can, in fact, cause the system to crash, which is,
1174310	1178150	of course, very dangerous when we consider about what they're doing and the high availability
1178150	1184710	necessity of it. So they're both different from a deployment and operations perspective. And that,
1184710	1189250	of course, ties back to they have different security considerations that you can't just
1189250	1198510	apply IT solutions to ICS solutions to solve them. So this, your explanation and this slide
1198510	1204410	remind me of the West. Do you remember when the East Coast went dark because somebody hit a line
1204410	1213670	or something like that? So how does that tie into this? I understand somebody broke a
1213670	1217610	electricity power thing. See, and that's part of the problem. I don't know how to
1217610	1224070	articulate this well, so I feel like maybe you can translate for me. Sure. So let's break that
1224070	1231530	down into multiple things. The first is that was not an attack. Right. That was a misconfiguration.
1231530	1236630	That was an overload. And then there were, through various circumstances, it rippled out. But I want
1236630	1242110	to highlight that piece, first of all, because particularly when we're talking about life
1242110	1248590	and injury, loss of limb, when we're also talking about public trust and understanding into buying
1248590	1255150	into our problems, fear and uncertainty and doubt is the easiest way to scare people. And then at
1255150	1258910	some point, they start to shut down and we lose the ability to have that conversation.
1259250	1266930	Most of the kinds of issues that we've seen are human error. They are failures of the systems,
1266930	1271030	not that there was somebody who was coming and attacking us or doing something.
1271030	1276010	And so the question that then follows is, well, why not? Why has critical infrastructure,
1276010	1283650	if it has these issues, why hasn't it been attacked? And what we have seen is there are
1283650	1291210	lots of what I call iterative intelligence operations where third party adversaries
1291210	1297450	are coming and they are learning and they are stepping and they are trying to see what could
1297450	1304370	happen, learn the environment and map it out. Because the second that they actually,
1304370	1310290	imagine if that was insert adversarial country that took down the entire East Coast.
1311650	1317690	The US response would probably be an armed response. It would not be a, we're going to
1317690	1321930	ping you back and we're going to shut some of your web servers down. No, we're probably going to bomb
1321930	1328830	you. And so that level of deterrence is a part of the landscape when we're talking about critical
1328830	1335730	infrastructure and the cybersecurity component. So the other element there is that the grid,
1335730	1341630	which I put in quotation marks is there is not one monolithic grid. The grid is actually broken
1341630	1346670	down into numerous subsections. And even that is broken down into, I want to say there are
1347430	1353350	about 3000 different operating entities that control parts of just the electric grid,
1353350	1359110	all the way down to like co-ops at a tiny little community level up to some of the large regional
1359110	1364310	providers. And so they all, that heterogeneity, all that different stuff, as much as it's
1364310	1369370	interconnected, actually also helps provide resilience for the grid itself, because something
1369370	1374590	happening here, it's very rare for like what you saw, where it rippled out and took multiple
1374590	1385520	things down. It's very difficult for an attacker to do that too. Here we go. Here are the SSAs.
1386440	1390460	Look at that. Right on time. Okay. Well, not right on time. I should have had this earlier.
1390460	1395740	I know. I was trying to give you credit. Nope. Oh, there you go. Healthcare and public health
1395740	1405330	is one. Yes. You're on there already. It was. Yes, we knew that. I knew that. So...
1405330	1414370	Hey, Nina, right on time. Yes. Okay. I don't know what you were going to say about this grid.
1414690	1419350	No, no. So this is where I wanted to, the conversation that you provoked a couple of slides
1419350	1425350	ago, I had built a slide for it, but I was so flustered by the hard question that I forgot
1425350	1430250	that I had a slide for it. This is what it's like having a conversation with me. I know.
1430910	1438910	Okay. So this is a specific breakout in this case. So I always steal vendor graphics because
1438910	1443310	vendors, of course, are always promoting their own things. This happens to be Johnson Controls,
1443310	1449310	but basically it gives us a detailed nominal explanation of all the elements around airborne
1449310	1453670	infection isolation rooms, which is what you were talking about, right? Particularly in a pandemic,
1453670	1458010	this is critical. This is where we keep the air where it's supposed to be so that we don't get
1458010	1464970	it out and infect other people while we're trying to treat them. There's approximately 12, 13
1466850	1477490	different areas or items to be concerned about that have some technical something that needs
1477490	1484310	to be secured in some way. And this is on top of all the other things that are in that hospital.
1488150	1497130	What kind of... do you think the hospitals are taking these things into consideration? Because
1497130	1502310	again, when we've had conversations with the device manufacturers and other hospitals,
1502310	1506490	healthcare in general, they're like, yeah, they talk a lot about the medical devices.
1506490	1518070	This isn't necessarily discussed. So the curiosity is, is this even on their agenda to think about?
1519630	1526770	So the challenge with hospitals is that they are very much hospital or regionally focused,
1526770	1532650	right? There is no like, here are how all hospitals do something.
1533830	1539870	Going to the original slide where I showed the delta of their challenge with responding,
1539870	1548290	I think that shows both a challenge of priority and capability. So things like this are
1549250	1556530	so far, are further down the track than worrying about PHI spillage and privacy
1556530	1562330	and simple IT operations, let alone, this is kind of more like advanced math.
1562330	1569350	So I see a specific security issues. Like all things, it started with security through
1569350	1574710	obscurity. Well, we have our thing and you have to get our thing exactly to be able to
1574710	1580670	do something to it. Over time, that doesn't work anymore. And then we've talked about this
1580670	1585410	numerous times already. What is a patch? A lot of these things weren't built to be patched
1585410	1592610	and they were driven by a very expensive capital outlay tied to life cycle management in the 20
1592610	1600130	to 40 year time range. We've also discussed most of them don't have authentication. Once you're in,
1600130	1605290	I can tell you what to do. And then my joke here on what does crypto mean? Because in their case,
1605290	1610730	they don't even know. Encrypted traffic is not something that you can do at all, particularly
1610730	1615470	if you don't even have authentication to start with. So most of this is transmitted in whatever
1615470	1620550	protocol it's communicating in. And there are ICS specific communication protocols,
1620550	1631550	but they're unencrypted. So the surface area specifically, most ICS, the primary attack
1631550	1637150	vector is through the information technology that connects them. Now, of course, the question is,
1637150	1642530	why do they connect them? And so the joke that I always throw out here is an air gap is not an air
1642530	1647190	gap is not an air gap. Everybody says, oh, it's air gapped. And then literally you just keep asking,
1647190	1651530	keep asking. And then eventually you find, well, it's connected here and it's connected that way.
1651530	1656170	And we don't call it an air gap because da, da, da. And nothing is ever completely disconnected.
1657870	1662170	Asterix, there are always examples where there is, I'm not going to go down that, but fundamentally
1662890	1669930	things do connect. And particularly in a residential setting, they definitely do.
1669930	1675690	And the reason is there's always one thing that your ICS has to tell your IT no matter what.
1676410	1680370	How do I bill you? How much did you use? Because we need the money.
1681710	1687910	And then same sign of problem we see in consumer IoT, there's industrial internet of things,
1687910	1691830	which are the sensors that help provide the feedback for the system to understand what's
1691830	1700130	happening in operation. All of these are much more vulnerable and great examples for lateral
1700130	1707130	movement. What's this on the internet? My joke here being, and so a call out to Chris Kubecka,
1707130	1712450	who presented on hack the world and galaxy with open system intelligence. In her example,
1712450	1718470	she showed how Boeing had a number of things that were vulnerable because a hacker can only
1718470	1722650	hack what they can touch. And if it's internet accessible, then I'm already a good percentage
1722650	1727150	of the way there. And it's the same kind of problem with ICS is making sure that these
1727150	1733670	things are not internet accessible. And oftentimes, not oftentimes, but sometimes they are, and that's
1733770	1739850	a problem. The final vector is physical proximity. Some of these things, particularly when we're
1739850	1747570	looking at like electricity, oil, natural gas, water, they're going to be elements of that
1747570	1754010	critical infrastructure as it extends out from production to transmission or delivery,
1754010	1758530	there's ICS along the way that's out there in public. And maybe it's just surrounded by
1758930	1763310	a fence. Maybe it's surrounded by a barbed wire fence. But one of the things I learned in the army
1763310	1768250	is an obstacle is only good if you have overwatch on it. Just because there's a fence does not mean
1768250	1772150	that somebody can't get to it. So physical proximity to these, particularly when they're
1772150	1778720	speaking RF, is a real challenge. This is well done. Okay.
1780150	1786630	So who is doing this? Well, organized crime, North Korea, like I said, organized crime.
1786810	1792890	So the joke being there that North Korea is fundamentally an organized criminal nation
1792890	1797270	state in what it's doing with its operations. And so a lot of the kinds of attacks that we've
1797270	1803230	primarily seen on hospitals, besides the theft of PHI, PHI being worth a lot more than PII,
1803230	1807350	because I can change my social security number, I can change my name, you can never change your
1807350	1814430	healthcare data, which is why it goes for a multiple on the dark web. Why it's sold for
1814650	1821590	a lot more than a traditional PII record. And then of course, we've seen a significant increase
1821590	1828270	in ransomware. And the IBM report that I referenced earlier, with Ponemon on the cost of
1828350	1834430	a data breach goes into detail about how much has been paid out to ransomware. And the healthcare
1834430	1839430	sector in particular, has been particularly challenged on doing this. We addressed the
1839430	1846270	issues of FUD earlier in the presentation, so we'll skip noting that now. And so, how could
1846270	1851070	they do this? We talked about lateral movement through IT systems being one of the more prominent
1851070	1857370	ways that this can go. Otherwise, we're starting to look at targeted attacks. And so, we went
1857370	1862390	earlier to, well, why haven't we seen these kinds of attacks happen on critical infrastructure
1862390	1869350	writ large is because of the deterrence component. So, I think mostly what we've seen is, of course,
1869350	1878590	there's going to be the primary motivator around finance. So, the easiest way for me to do that,
1880310	1886910	and then potentially the escalation would be a direct denial of service attack. So,
1886910	1893550	focusing on the services that ICS is delivering specifically to a facility or complex,
1893550	1902310	and taking those down. I'm reading your numbers. Those are exponential. Yes.
1902990	1909930	The percentages are high, considering that this is patient care. This is me trusting you
1909930	1920190	with my information, and what will you do with it? And then it's gone. I'm also just thinking about
1920190	1925690	how, again, we talked about this a little bit earlier, the hospitals aim at least to zero out,
1925690	1937190	they're putting $16.5 million out or $640,000. Where is that money coming from? And it's coming
1937190	1944290	from their insurances, because now cybersecurity insurance in hospitals is almost mandatory
1944290	1950410	because of the sensitivity of all of the devices and all of the information that's in there. That's
1950990	1956510	well done you. Yes. Yeah. I mean, the key elements that I would pull out of here on the statistics
1956510	1962210	are one, from the tax going back to 2016, not including this year, 6.6 million patients have
1962210	1966510	been affected by this. Of course, the most significant out of that was the one or cry
1966510	1972310	ransomware that struck the UK national health system several years ago, and that's been
1972310	1976790	attributed to North Korea. The question of motive on that one was whether that was a test, whether
1976790	1980870	that was on accident or whether that was on purpose. And then the final part here is the
1980870	1989150	overall cost of these attacks is $157 million. And mostly that is capturing the overall cost from
1989150	1995710	having to defend, having to identify, having to do the forensics cleanup, the damages that are
1995710	2000950	actually done when there is a breach and the loss of that data, because privacy regulations,
2000950	2006850	around PHI, have become much, much stronger. So there are some teeth to those now.
2006850	2015310	So I tend to... what is your call to action? There's a lot of information in here. It's very
2015310	2020610	dense. What do you want the healthcare community to do? What do you want the
2020610	2025250	ICS community to do? What do you want the security research community to do?
2027210	2034470	Yeah, that's tough. So, I mean, with the talks that I've been giving around embedded systems and
2034470	2044110	IoT for several years now, I talk about the need to design for security. I think that there are
2044110	2048650	some really low-hanging fruit here that we need to do. But that's really easy for me to wave my
2048650	2052050	researcher wand and say, these things should happen. And it's a lot harder for manufacturers
2052790	2059730	to have to increase the cost of their equipment to consumers, corporate consumers who are buying
2059730	2065270	this stuff to actually pay for that. And so that's the chicken and egg there is everybody
2065270	2070910	knows that these are needed things, but who's going to pay for it? And so typically, whenever
2070910	2076770	there's that middle ground of, well, who's going to do this? I think the answer is government for
2076770	2084070	funding those kinds of solutions. But we have a long way to go because it's just like you can't
2084070	2088870	immediately change equipment when you're producing a car. It's these things have an even longer
2088870	2093830	lifecycle. And so it's going to take a long time for us to dig out of that hole. And we really
2093830	2099910	need the patience and the stick-to-itiveness to get there. There are a lot of solutions that are
2099910	2106130	coming out to the market to solve some of this within, hey, if we can't fix something directly,
2106130	2110570	at least we can, like I said, we can work around it. We can control the environment around it to
2110570	2117450	protect it. So as those continue to push out, those will be cheaper solutions to both identity,
2117450	2121810	anomaly detection, and when I say asset identification, anomaly detection,
2121810	2127170	and then also providing protection in a more of a real-time way.
2129950	2134310	That's essentially what's in the innovation hopper for those to continue to progress that way.
2134310	2140330	So those continuing to roll out would be a good thing. So who would you specifically be looking
2140330	2145530	for to engage in this conversation? You said government, but again, we've had this conversation
2145530	2152030	that government is pretty broad. It's dissected into different sectors. Is there a person that
2152030	2159070	you would say, hi person, I have this information, I would love to have a conference with you, a chat,
2159070	2165250	so that we can do a deep dive and we understand the problem. Here it is. Let's work on that
2165250	2174290	solution. So person, place, thing. Sure. So if you can tell me who's the SSA responsible for the
2174290	2179050	medical and healthcare sector from that earlier slide, I would say that they're a part of this.
2180490	2186310	What? Not even a little laugh at that one. I started looking. You were looking it up.
2186310	2194010	So clearly they're a part of it from a sector specific element. I'm with the ICS Village.
2194010	2201330	We're working with CISA and Department of Energy on additionally pushing out additional programs
2201330	2206350	for hackers in the community to be able to do independent research and push some of these things.
2206450	2211170	A lot of it, as we talked about, since IT skillset is different than ICS skillset,
2211170	2214890	and that's the point of what the ICS Village is doing, is giving folks that are interested
2214890	2224030	and on road so that it's not just these abstract things like, oh, PLC and historian and SCADA,
2224690	2231090	DCS, like, what are we talking about? And making those accessible so that infosec,
2231090	2237770	traditional infosec practitioners can get their feet wet with going this direction.
2237930	2241290	Okay. Thank you. Thank you for having me.