WEBVTT 00:00.640 --> 00:01.760 Hi, I'm Bryson. 00:01.880 --> 00:08.680 I'm going to be joined by Nina, who's going to help me transcend ICS and med, which is our medics med ICS talk. 00:08.680 --> 00:14.520 In fact, Nina, you deserve named credit for helping me out on this perilous task. 00:14.580 --> 00:15.000 Thank you. 00:15.000 --> 00:24.720 I also wanted to be noted that I got informed of this like, what, 18 hours ago that I would be on this panel discussion fireside chat with you. 00:24.720 --> 00:26.720 Was it even 18 hours ago? 00:26.720 --> 00:30.200 No, I've been awake for way too long. 00:30.200 --> 00:34.940 So does this mean that I am part of the unicorn tribe now? 00:35.580 --> 00:37.520 You are now part of the herd. 00:38.480 --> 00:39.940 Unicorns are herds. 00:39.940 --> 00:41.020 They get herds. 00:41.640 --> 00:41.980 Yes. 00:41.980 --> 00:43.400 So hear what we have to say. 00:43.400 --> 00:43.640 All right. 00:43.640 --> 00:45.160 We're going to stop at the bad jokes. 00:45.180 --> 00:51.100 Welcome to my med ICS talk with now joined by the illustrious Nina. 00:51.600 --> 00:52.240 All right. 00:52.240 --> 00:54.660 So who am I besides wearing the unicorn stuff? 00:54.660 --> 00:56.180 I founded Scythe and Grimm. 00:56.180 --> 01:00.040 I'm the co-founder of my own village, the ICS village. 01:00.140 --> 01:01.880 I feel like there's a pattern here. 01:02.880 --> 01:08.160 So also check us out at DEF CON 2 to get even more information about ICS. 01:08.260 --> 01:11.800 And of course, all of our talks will be published as well for more detail. 01:12.640 --> 01:13.300 All right. 01:13.300 --> 01:14.260 Let's get started. 01:14.260 --> 01:14.720 All right. 01:14.720 --> 01:15.680 So outline. 01:15.680 --> 01:18.140 We're going to be talking through all things ICS. 01:18.140 --> 01:20.060 Why is it relevant to hospitals? 01:20.060 --> 01:23.000 What are some of the pieces around implementation? 01:23.320 --> 01:26.700 How is ICS different than traditional information technology? 01:27.020 --> 01:33.440 And then specific issues and threats that are organic specifically to industrial control systems. 01:33.440 --> 01:40.580 A quick little note that I got here from yesterday is IBM with Ponemon published their cost of a data breach report. 01:40.740 --> 01:54.780 Comparing the breach lifecycle, so when a breach happens to when it is found and expunged, healthcare is 96 days slower on average compared to the leader of finance. 01:54.780 --> 02:00.340 So we already have seen an industry that, yes, you were like building up for it. 02:00.340 --> 02:02.140 First interruption, first question. 02:02.140 --> 02:07.920 So then what is the time frame of a financial industry breach lifecycle? 02:07.920 --> 02:11.780 And then how does that how does that 96 days get added to that? 02:11.780 --> 02:14.940 Not how, but like what's the normal time frame for one? 02:15.180 --> 02:18.560 Sure, I'm trying to remember what that number was. 02:18.600 --> 02:22.020 I want to say it was either 208 or 280 days. 02:22.620 --> 02:31.760 So 200 and some days is the fastest for an industry on average to find a breach and get rid of it. 02:31.780 --> 02:35.120 And healthcare is 96 days slower on average for that. 02:35.120 --> 02:39.320 So that is over three months longer to eradicate a breach from their systems. 02:40.320 --> 02:42.380 You said 200 days? 02:42.380 --> 02:45.100 That is the fastest, which is finance. 02:45.100 --> 02:47.300 200 plus 96 is approximately a year. 02:47.320 --> 02:47.780 Yes. 02:47.780 --> 02:48.820 You said three months. 02:49.100 --> 02:51.460 No, so 96 days is three months. 02:51.460 --> 02:52.300 Got it, got it. 02:52.300 --> 02:54.160 My math is no good. 02:54.160 --> 02:55.720 Okay, yes. 02:56.860 --> 02:58.600 Do you want to co-found the math village? 02:58.600 --> 02:59.520 Can we do that next? 03:00.920 --> 03:03.140 Making stats literate for everybody. 03:03.220 --> 03:04.880 You know what, that would be great. 03:04.880 --> 03:05.720 I would love that part. 03:05.720 --> 03:08.180 So Nina, you have some notes on why this is important. 03:10.020 --> 03:12.200 I love that you added this in here. 03:13.240 --> 03:17.340 I'm going to let you talk through it so I can just bombard you with questions. 03:17.340 --> 03:18.600 These were literally your notes. 03:18.600 --> 03:19.860 I just didn't take them out. 03:19.860 --> 03:20.960 I know, I get that. 03:20.960 --> 03:22.920 Okay, so then I guess I'm speaking to it. 03:22.920 --> 03:31.480 So I think as we all know at the biohacking village and folks listening, so healthcare is a 365 day entity. 03:31.960 --> 03:38.260 Downtime for any medical devices or AMRs would mean dead time for patients. 03:39.000 --> 03:46.060 What people don't really consider in the medical ecosystem is the electricity, the water, gas. 03:46.060 --> 03:50.920 How are these things affected and does it, can it hurt patient care? 03:51.360 --> 04:02.360 If you go to the dentist, for instance, because I feel like that's something that everybody can more or less relate to, that water flow that they have in your mouth and there's a suction on the other side, that gets treated and then it gets sent out into the world. 04:02.660 --> 04:19.820 Electricity, if a surgical suite was underway and electricity went out, granted there are generators, but let's think about how often the generators are checked and made sure that they are still active and can produce any electricity or whatever the needs of the hospital is. 04:19.840 --> 04:23.240 Negative airflow and filtration, super important. 04:23.240 --> 04:24.740 We're in COVID right now. 04:24.740 --> 04:35.080 We know that it's an airborne disease and just in generalities, that negative airflow that goes from the hospital removes and reduces the nosoclonal diseases. 04:35.120 --> 04:40.320 Nosoclonal diseases are the diseases that you get in the hospital while you're in the hospital. 04:41.200 --> 04:46.160 There are backups to backups in hospitals usually, but again, how often are they checked? 04:46.160 --> 04:47.560 How often are they changed? 04:47.560 --> 04:48.840 Who's checking on these? 04:55.600 --> 05:14.340 Where's I'm a city girl, so one of the problems that happened at NYU during Hurricane Sandy was that their servers and the generators were in the basement and the unfortunate truth is that those were then gone when the hospital itself got flooded by all the waters and they had to move the patients over to nearby hospitals. 05:14.340 --> 05:30.260 And just thinking about how patients are transported from one hospital to another, how are they producing medical notes and medical discharges so that that patient would get treated accurately by that next physician that took care of them? 05:32.200 --> 05:47.100 Healthcare is a great analog for industrial control systems because unlike traditional IT, when we think of the confidentiality, integrity, and availability triad, IT generally goes in that order and it's flipped for industrial control systems because just like healthcare, 05:47.100 --> 05:50.860 we need something where availability is the utmost of importance. 05:50.860 --> 05:56.560 If I lose electricity in the middle of an operation, that can cause patient harm. 05:57.500 --> 06:03.640 Modern society rests on critical infrastructure, electricity, water, finance, transportation. 06:03.640 --> 06:08.520 If those went out, we go to the stone age almost overnight. 06:08.820 --> 06:15.380 The longer it's out, the more damage that's done and there are the statistical models then of understanding what that implication is. 06:15.380 --> 06:20.720 The final piece on industrial control systems is there's two levels of it that's relevant for the hospital setting. 06:20.720 --> 06:29.500 There's of course what we're talking about here, which is the grid, the infrastructure that nominally is providing all of the different resources to the facility. 06:29.500 --> 06:36.300 And then there are industrial control systems embedded inside the facility to help do particular elements. 06:36.460 --> 06:39.140 Nina talked about air filtration and negative airflow. 06:39.660 --> 06:48.180 We will have a slide later on that we talked about in the podcast a couple of months ago where we're going to go into detail on some of those systems and how they interconnect. 06:48.820 --> 06:50.840 I want to add something to my notes. 06:51.080 --> 06:53.140 The wi-fi, right? 06:53.680 --> 06:59.440 Nobody's... we haven't thought about how the internet connectivity, if that went out, would affect all of this. 06:59.500 --> 07:16.580 So again, just if you can't print out a patient record or if you're taking blood and you can't specifically say that this is this patient's because you have to enter it into the EMR and then a thing prints out, a label prints out, there's a lot of flow that continuously in the hospital needs to be contemplated. 07:16.580 --> 07:18.980 And I actually don't think it has been. 07:18.980 --> 07:28.200 So this is... we had this conversation on the podcast, it hasn't been published yet, but this is why Bo and I decided that you would be perfect to give this talk. 07:29.500 --> 07:31.980 Well, thank you for having me on and thank you for helping. 07:32.800 --> 07:34.560 So what is ICS? 07:34.560 --> 07:40.020 Industrial Control Systems, sometimes also known as SCADA or Operational Technology. 07:40.100 --> 07:46.820 There are wonky differences between those three, but fundamentally it's a catch-all for a couple of things. 07:46.820 --> 07:55.460 The biggest thing that separates ICS from what we think of a traditional computer is industrial control systems cause physical effects in the real world. 07:55.460 --> 07:58.480 We're not just talking data that stays on a hard drive. 07:58.480 --> 08:02.160 We're talking about something that actually changes something in the world. 08:02.160 --> 08:03.900 If it's a water pump, right? 08:03.900 --> 08:06.280 Water pressure, water flow is going to change. 08:06.280 --> 08:09.640 If it's airflow, airflow is going to shift and change. 08:09.640 --> 08:12.740 Our environment is actually affected. 08:13.120 --> 08:24.960 The reason I chose this picture is the best joke that I have that I think clearly illustrates both what it is as well as the problems are any computer that's at least 20 years old is an industrial control system. 08:24.960 --> 08:29.900 They were designed to be available and to have a long life cycle. 08:30.020 --> 08:31.500 They were... they're expensive. 08:31.500 --> 08:32.840 Most of them are expensive. 08:32.840 --> 08:38.820 Heavy, heavy capital costs where I want to put this, I want to forget it and I don't have to do anything. 08:38.820 --> 08:46.040 The introduction of cybersecurity is still a relatively new phenomenon as much as cybersecurity is a relatively new phenomenon. 08:46.040 --> 09:02.340 But particularly in industrial control systems, it's a new thing where previously this would be the kind of equipment that was maintained by a safety engineer who was mostly looking at what do I need to maintain the equipment so that it works, not how do I protect it because somebody might try to manipulate or attack it. 09:03.440 --> 09:06.580 So I just want to speak to that on the healthcare side. 09:06.580 --> 09:13.360 So there's so many legacy systems and so many legacy devices because same concept, everybody was imagining all these things to be long lasting. 09:13.380 --> 09:23.320 And when you're in the hospital and you have all of these devices, there's not a lot of funding that... there's not a lot of payment that goes into the hospital. 09:23.320 --> 09:26.880 They're kind of just trying to get to zero and balance themselves out. 09:26.880 --> 09:38.920 So having all of these legacy systems and things like this does create a problem when it comes to us putting security around it because we literally have to build these things in. 09:38.920 --> 09:41.900 We have to build... what's the thing around the castle? 09:41.900 --> 09:42.660 Moats. 09:44.280 --> 09:45.780 Perimeter defense. 09:45.780 --> 09:47.200 Yes, thank you. 09:47.520 --> 09:50.040 You can cut all of my English out. 09:50.040 --> 10:00.420 Right, so we have to build perimeters of defense around all of these legacy devices so that they work and we can continue making sure that the patient and the systems work. 10:00.840 --> 10:12.160 Yeah, so just being specific since perimeter typically means like the outer shell, and a lot of folks think of that as controlling the ingress and egress to a network. 10:12.440 --> 10:29.620 Since a lot of these kinds of systems can't be directly patched, which is a slide that's coming up, typically there is a similar kind of inside, usually we wouldn't use perimeter, but a way to kind of blanket around, control around the traffic to a device. 10:29.940 --> 10:46.460 So this is an example where like software-defined networking has become very popular in ICS environments because if I can't patch or improve the configuration of the device itself to make it not vulnerable, at least I can control the traffic around that and adapt it to those kinds of threats. 10:48.160 --> 10:52.920 So ICS versus IT, workers versus nerds. 10:53.040 --> 11:03.900 We talked about the performance of where I need high availability versus in traditional IT, availability is an issue, but it is not the primary concern. 11:03.900 --> 11:10.560 And then of course, when we're talking about risks here, when we think of IT, we think about patient data, we think about privacy. 11:10.560 --> 11:15.260 On the operational technology side, we're talking about injury or death. 11:19.040 --> 11:21.940 Okay, so some layers of ICS. 11:22.020 --> 11:25.040 At the very bottom layer is the direct control. 11:25.040 --> 11:30.080 Like I talked about, ICS is where I am physically affecting the environment. 11:30.080 --> 11:35.140 And so the most common element for that would be like a programmable logic controller. 11:35.500 --> 11:41.620 Everybody at this point knows what a PLC is, even if you've never seen one, because that's what Stuxnet was. 11:41.620 --> 11:48.740 Stuxnet affected the PLCs where they were changing the speed of the centrifuges that were doing the uranium enrichment. 11:48.740 --> 11:51.820 Again, a device controlling physical effect. 11:52.160 --> 11:58.280 And what we would see in a hospital environment would be a pump, something that is cycling water or air. 11:58.280 --> 12:00.680 And then above that is the supervisory level. 12:00.680 --> 12:06.460 So this is critical to understand these differences because a PLC is not a smart device. 12:06.460 --> 12:12.160 It doesn't necessarily know what's the correct operational parameters to function in. 12:12.160 --> 12:19.700 When we think about hacking a PLC, very rarely am I going to try to build some special code that's going to go onto that PLC to rewrite it. 12:19.700 --> 12:21.220 That does happen. 12:21.220 --> 12:28.960 More likely what we see a lot of is issuing commands to the PLC because one, PLCs generally don't accept authentication. 12:29.340 --> 12:31.460 Two, the traffic is unencrypted. 12:31.500 --> 12:35.680 And three, the PLC itself doesn't know what's good or what's bad. 12:35.680 --> 12:38.460 It just does what the supervisor above tells it to do. 12:38.460 --> 12:40.080 And then it just makes that happen in the world. 12:40.080 --> 12:44.600 And it doesn't always have that feedback loop of understanding if I've gone out of tolerance. 12:44.700 --> 12:48.360 The supervisory level is where you would have like a historian or acquisition. 12:48.360 --> 12:50.460 And this is literally what it sounds like, right? 12:50.460 --> 12:57.960 Like I am monitoring multiple devices that are able to do things and I'm telling them what to do and I'm reading what's happening and then I'm adjusting that. 12:57.960 --> 13:06.300 So examples of where we can see that in a hospital are a doctor's workstation or a PACS, which I forget what PACS stands for. 13:06.300 --> 13:10.600 It's a photo acquisition computer system, I think. 13:10.600 --> 13:11.260 Archiving. 13:11.260 --> 13:12.120 What's that? 13:12.120 --> 13:13.080 Archiving. 13:13.080 --> 13:14.580 Archiving, yes. 13:14.580 --> 13:16.100 So patient archiving. 13:16.300 --> 13:24.640 So keeping track of all of the different images that are coming from x-rays, MRIs, and all those things and time them in. 13:24.860 --> 13:29.680 So I'm going to challenge you on this question on this slide a little bit. 13:29.760 --> 13:39.040 So as healthcare hackers, as healthcare security researchers, we tend to talk a lot about the medical devices. 13:39.440 --> 13:45.700 We tend to... that's a lot of where the focus is because that's a lot of where the laws revolve around. 13:45.760 --> 13:52.120 What is not discussed a lot is the 911 system. 13:52.780 --> 13:57.520 So where would that lie in the ICS layers? 13:57.540 --> 13:57.800 Right. 13:57.800 --> 14:13.540 So I think you're talking more about the fact that we see a lot of embedded device progress, particularly with the work that's been done with Bow and Company at FDA, with what a lot of the I am the Calvary has been advocating, what the biohacking village has been advocating. 14:13.540 --> 14:20.920 And then there's this broader question that's even beyond hospitals, which is, okay, what about the rest of the stuff that's a part of that infrastructure, right? 14:21.480 --> 14:26.040 And I think the challenge and the solutions are the same. 14:27.800 --> 14:30.420 We have to design for security. 14:30.420 --> 14:33.400 There is no, I have built this and it is secure. 14:33.520 --> 14:36.020 We have to have that actually happen. 14:36.020 --> 14:47.760 And it's harder because with traditional ICS, while there has been a lot of attention that has started to be drawn to what is, like I said, a new market. 14:47.760 --> 14:52.920 I mean, ICS security, I would say is about six to eight years old. 14:53.600 --> 14:58.780 And a lot of the startups are all coming up with different solutions around those things in particular. 14:58.940 --> 15:11.960 But this is not something that the average, unless you're a manufacturing plant, unless you are a part of critical infrastructure delivery, folks aren't paying attention or doing anything about this. 15:11.960 --> 15:13.420 I'm going to bring you back in then. 15:13.420 --> 15:21.280 So why is EMS not considered critical infrastructure? 15:24.060 --> 15:26.460 That's a bigger question about my pay grade. 15:27.560 --> 15:36.300 I mean, maybe we should discuss it because I bring this up because I think we've had this conversation before and I think a lot of people know, but my father was a paramedic captain for the fire department of New York. 15:36.340 --> 15:41.820 And I've seen how some of the systems work and completely agree. 15:42.380 --> 15:45.180 It's, it's, there's a lot of things going on. 15:45.180 --> 16:12.480 And why, why wouldn't this, why wouldn't 911 systems, the medics, police, the fire, not be considered critical infrastructure enough that they be added to that healthcare, like workflow, that it gets secured more, updated more, thought about more, workload more? 16:13.320 --> 16:22.660 So that's, I think that's a, that's a policy and funding question of the SSAs and how, because I think there's 16 of them now that define... 16:22.660 --> 16:24.740 Just so that we, we don't have acronyms. 16:24.740 --> 16:25.020 Sure. 16:25.020 --> 16:36.860 So I don't remember what SSA stands for, but SSA is the specific authorities that are tied, putting a particular critical infrastructure sector tied to a specific agency. 16:36.860 --> 16:41.580 So for example, electricity, electricity comes under Department of Energy. 16:42.880 --> 16:48.000 Transportation, I believe TSA has that. 16:48.380 --> 16:49.300 I'm not sure. 16:49.300 --> 16:50.760 I don't have them all memorized. 16:51.020 --> 16:52.780 There's 16 of them. 16:54.780 --> 17:03.740 So I, that's what I was trying to go look up while you were talking, was looking up what the SSAs were and to see what tied into medical. 17:03.740 --> 17:15.900 Cause I don't, I, I don't know if there is some level of that that's already represented, but that's, that's, so that's like the, how the United States government breaks and manages it from a funding and accountability perspective. 17:15.900 --> 17:23.080 And then at this lower level, of course, is the actual technical execution, which is the industrial control system itself. 17:25.740 --> 17:28.880 So I'm afraid I don't know enough to thoroughly answer your question. 17:29.480 --> 17:31.860 You brought me here to challenge you? 17:33.300 --> 17:36.340 Fireside chat, challenge accepted. 17:38.060 --> 17:40.660 You're just getting even for me leaving those notes in, huh? 17:41.640 --> 17:44.560 No, no, kind of. 17:45.700 --> 17:48.100 So building automation systems. 17:48.200 --> 17:50.860 So this is everything that you can think of, right? 17:50.860 --> 17:58.620 This is HVAC, fire detection, security and access control, all of those elements that are pretty much in every building to do it. 17:58.620 --> 17:59.820 And we talked about that difference, right? 17:59.820 --> 18:08.760 We have the higher level infrastructure of water, electricity, that's being brought to the building, and then the elements inside of it that are doing it. 18:09.000 --> 18:13.320 Building automation systems, we're looking at operations and backups. 18:13.320 --> 18:15.800 We're looking at efficiencies and savings. 18:15.800 --> 18:30.520 And so in the process of what has been traditionally very proprietary closed systems, these are now going to shifting to traditional ICS, like programmable logic controllers to do a lot of the things that used to be proprietary. 18:30.560 --> 18:40.420 But now with PLCs, I can work with those on an open ICS development standard to be able to get those savings and that efficiencies across my complexes. 18:43.470 --> 18:44.470 I'm good. 18:44.470 --> 18:45.150 I'm good. 18:45.150 --> 18:46.310 I'll raise my hand. 18:47.550 --> 18:53.030 So this is my very fancy explanation of how ICS and IT are two different things. 18:53.030 --> 19:04.450 So we've covered some of this organically through what we've been saying, but fundamentally, it's important to recognize that the two are very different, and they need to be treated very differently. 19:04.450 --> 19:12.650 As much as there is the debate in IT about patching, as we talked about, that might not even be an option in ICS. 19:12.650 --> 19:23.230 And Nina, as you commented about establishing the perimeter, the inner perimeters and moats, we have to have different solutions because we can't patch things to be able to protect them. 19:23.350 --> 19:26.030 In fact, ICS can be very brittle. 19:26.030 --> 19:39.390 There are a lot of systems on there where even if you send the wrong packet can, in fact, cause the system to crash, which is, of course, very dangerous when we consider about what they're doing and the high availability necessity of it. 19:39.390 --> 19:44.110 So they're both different from a deployment and operations perspective. 19:44.110 --> 19:54.030 And that, of course, ties back to they have different security considerations that you can't just apply IT solutions to ICS solutions to solve them. 19:54.990 --> 20:00.310 So this, your explanation and this slide remind me of the West. 20:00.310 --> 20:05.470 Do you remember when the East Coast went dark because somebody hit a line or something like that? 20:05.470 --> 20:09.930 So how does that tie into this? 20:09.930 --> 20:14.930 I understand somebody broke a electricity power thing. 20:15.170 --> 20:16.390 See, and that's part of the problem. 20:16.390 --> 20:22.530 I don't know how to articulate this well, so I feel like maybe you can translate for me. 20:22.750 --> 20:23.190 Sure. 20:23.190 --> 20:25.590 So let's break that down into multiple things. 20:25.590 --> 20:28.910 The first is that was not an attack. 20:28.910 --> 20:29.530 Right. 20:29.530 --> 20:31.530 That was a misconfiguration. 20:31.530 --> 20:32.790 That was an overload. 20:32.850 --> 20:36.290 And then there were, through various circumstances, it rippled out. 20:36.290 --> 20:54.290 But I want to highlight that piece, first of all, because particularly when we're talking about life and injury, loss of limb, when we're also talking about public trust and understanding into buying into our problems, fear and uncertainty and doubt is the easiest way to scare people. 20:54.290 --> 20:58.910 And then at some point, they start to shut down and we lose the ability to have that conversation. 20:59.250 --> 21:04.570 Most of the kinds of issues that we've seen are human error. 21:04.890 --> 21:11.030 They are failures of the systems, not that there was somebody who was coming and attacking us or doing something. 21:11.030 --> 21:14.570 And so the question that then follows is, well, why not? 21:14.570 --> 21:21.350 Why has critical infrastructure, if it has these issues, why hasn't it been attacked? 21:21.350 --> 21:41.250 And what we have seen is there are lots of what I call iterative intelligence operations where third party adversaries are coming and they are learning and they are stepping and they are trying to see what could happen, learn the environment and map it out. 21:41.350 --> 21:50.290 Because the second that they actually, imagine if that was insert adversarial country that took down the entire East Coast. 21:51.650 --> 21:56.190 The US response would probably be an armed response. 21:56.370 --> 22:00.910 It would not be a, we're going to ping you back and we're going to shut some of your web servers down. 22:00.910 --> 22:02.650 No, we're probably going to bomb you. 22:02.730 --> 22:11.650 And so that level of deterrence is a part of the landscape when we're talking about critical infrastructure and the cybersecurity component. 22:12.390 --> 22:20.010 So the other element there is that the grid, which I put in quotation marks is there is not one monolithic grid. 22:20.210 --> 22:23.850 The grid is actually broken down into numerous subsections. 22:23.850 --> 22:40.210 And even that is broken down into, I want to say there are about 3000 different operating entities that control parts of just the electric grid, all the way down to like co-ops at a tiny little community level up to some of the large regional providers. 22:40.210 --> 22:55.550 And so they all, that heterogeneity, all that different stuff, as much as it's interconnected, actually also helps provide resilience for the grid itself, because something happening here, it's very rare for like what you saw, where it rippled out and took multiple things down. 22:55.570 --> 22:58.350 It's very difficult for an attacker to do that too. 23:03.360 --> 23:04.040 Here we go. 23:04.040 --> 23:05.520 Here are the SSAs. 23:06.440 --> 23:07.320 Look at that. 23:07.320 --> 23:08.300 Right on time. 23:08.300 --> 23:08.820 Okay. 23:08.840 --> 23:09.680 Well, not right on time. 23:09.680 --> 23:10.460 I should have had this earlier. 23:10.460 --> 23:10.520 I know . 23:10.560 --> 23:12.360 I was trying to give you credit. 23:13.860 --> 23:14.440 Nope. 23:14.480 --> 23:15.000 Oh, there you go. 23:15.000 --> 23:16.320 Healthcare and public health is one. 23:16.360 --> 23:17.080 Yes. 23:17.120 --> 23:18.160 You're on there already. 23:18.160 --> 23:18.780 It was. 23:22.470 --> 23:23.730 Yes, we knew that. 23:23.730 --> 23:24.630 I knew that. 23:24.970 --> 23:25.330 So... 23:25.330 --> 23:26.910 Hey, Nina, right on time. 23:29.090 --> 23:29.890 Yes. 23:30.150 --> 23:30.950 Okay. 23:31.970 --> 23:34.370 I don't know what you were going to say about this grid. 23:34.690 --> 23:35.350 No, no. 23:35.350 --> 23:46.830 So this is where I wanted to, the conversation that you provoked a couple of slides ago, I had built a slide for it, but I was so flustered by the hard question that I forgot that I had a slide for it. 23:47.370 --> 23:49.530 This is what it's like having a conversation with me. 23:49.530 --> 23:50.250 I know. 23:50.910 --> 23:51.550 Okay. 23:51.550 --> 23:56.610 So this is a specific breakout in this case. 23:56.610 --> 24:01.150 So I always steal vendor graphics because vendors, of course, are always promoting their own things. 24:01.490 --> 24:12.110 This happens to be Johnson Controls, but basically it gives us a detailed nominal explanation of all the elements around airborne infection isolation rooms, which is what you were talking about, right? 24:12.110 --> 24:14.830 Particularly in a pandemic, this is critical. 24:14.830 --> 24:20.670 This is where we keep the air where it's supposed to be so that we don't get it out and infect other people while we're trying to treat them. 24:20.930 --> 24:39.290 There's approximately 12, 13 different areas or items to be concerned about that have some technical something that needs to be secured in some way. 24:39.290 --> 24:44.310 And this is on top of all the other things that are in that hospital. 24:48.150 --> 24:56.890 What kind of... do you think the hospitals are taking these things into consideration? 24:56.890 --> 25:06.490 Because again, when we've had conversations with the device manufacturers and other hospitals, healthcare in general, they're like, yeah, they talk a lot about the medical devices. 25:06.490 --> 25:09.010 This isn't necessarily discussed. 25:09.050 --> 25:18.070 So the curiosity is, is this even on their agenda to think about? 25:19.630 --> 25:26.930 So the challenge with hospitals is that they are very much hospital or regionally focused, right? 25:26.930 --> 25:32.650 There is no like, here are how all hospitals do something. 25:33.830 --> 25:45.570 Going to the original slide where I showed the delta of their challenge with responding, I think that shows both a challenge of priority and capability. 25:45.930 --> 26:02.330 So things like this are so far, are further down the track than worrying about PHI spillage and privacy and simple IT operations, let alone, this is kind of more like advanced math. 26:02.330 --> 26:05.130 So I see a specific security issues. 26:05.590 --> 26:10.010 Like all things, it started with security through obscurity. 26:10.010 --> 26:16.150 Well, we have our thing and you have to get our thing exactly to be able to do something to it. 26:16.150 --> 26:18.690 Over time, that doesn't work anymore. 26:18.910 --> 26:22.270 And then we've talked about this numerous times already. 26:22.270 --> 26:23.550 What is a patch? 26:23.550 --> 26:33.850 A lot of these things weren't built to be patched and they were driven by a very expensive capital outlay tied to life cycle management in the 20 to 40 year time range. 26:34.890 --> 26:39.030 We've also discussed most of them don't have authentication. 26:39.350 --> 26:41.750 Once you're in, I can tell you what to do. 26:41.750 --> 26:44.150 And then my joke here on what does crypto mean? 26:44.150 --> 26:46.530 Because in their case, they don't even know. 26:46.870 --> 26:52.750 Encrypted traffic is not something that you can do at all, particularly if you don't even have authentication to start with. 26:52.750 --> 26:57.510 So most of this is transmitted in whatever protocol it's communicating in. 26:57.510 --> 27:02.030 And there are ICS specific communication protocols, but they're unencrypted. 27:04.030 --> 27:15.610 So the surface area specifically, most ICS, the primary attack vector is through the information technology that connects them. 27:15.610 --> 27:19.010 Now, of course, the question is, why do they connect them? 27:19.210 --> 27:23.850 And so the joke that I always throw out here is an air gap is not an air gap is not an air gap. 27:23.850 --> 27:25.490 Everybody says, oh, it's air gapped. 27:25.530 --> 27:27.770 And then literally you just keep asking, keep asking. 27:27.770 --> 27:31.530 And then eventually you find, well, it's connected here and it's connected that way. 27:31.530 --> 27:33.350 And we don't call it an air gap because da, da, da. 27:33.350 --> 27:36.170 And nothing is ever completely disconnected. 27:37.870 --> 27:44.110 Asterix, there are always examples where there is, I'm not going to go down that, but fundamentally things do connect. 27:44.110 --> 27:49.930 And particularly in a residential setting, they definitely do. 27:49.930 --> 27:55.690 And the reason is there's always one thing that your ICS has to tell your IT no matter what. 27:56.410 --> 27:57.870 How do I bill you? 27:57.870 --> 27:59.070 How much did you use? 27:59.070 --> 28:00.370 Because we need the money. 28:01.710 --> 28:13.270 And then same sign of problem we see in consumer IoT, there's industrial internet of things, which are the sensors that help provide the feedback for the system to understand what's happening in operation. 28:14.110 --> 28:21.150 All of these are much more vulnerable and great examples for lateral movement. 28:21.530 --> 28:23.330 What's this on the internet? 28:23.430 --> 28:31.230 My joke here being, and so a call out to Chris Kubecka, who presented on hack the world and galaxy with open system intelligence. 28:31.230 --> 28:39.670 In her example, she showed how Boeing had a number of things that were vulnerable because a hacker can only hack what they can touch. 28:39.670 --> 28:43.610 And if it's internet accessible, then I'm already a good percentage of the way there. 28:43.610 --> 28:49.890 And it's the same kind of problem with ICS is making sure that these things are not internet accessible. 28:50.130 --> 28:54.510 And oftentimes, not oftentimes, but sometimes they are, and that's a problem. 28:54.510 --> 28:57.190 The final vector is physical proximity. 28:58.010 --> 29:16.730 Some of these things, particularly when we're looking at like electricity, oil, natural gas, water, they're going to be elements of that critical infrastructure as it extends out from production to transmission or delivery, there's ICS along the way that's out there in public. 29:16.730 --> 29:19.670 And maybe it's just surrounded by a fence. 29:19.670 --> 29:21.650 Maybe it's surrounded by a barbed wire fence. 29:21.650 --> 29:26.310 But one of the things I learned in the army is an obstacle is only good if you have overwatch on it. 29:26.330 --> 29:29.370 Just because there's a fence does not mean that somebody can't get to it. 29:29.370 --> 29:35.830 So physical proximity to these, particularly when they're speaking RF, is a real challenge. 29:37.130 --> 29:38.370 This is well done. 29:38.370 --> 29:38.720 Okay. 29:40.150 --> 29:41.930 So who is doing this? 29:41.930 --> 29:46.630 Well, organized crime, North Korea, like I said, organized crime. 29:46.810 --> 29:55.510 So the joke being there that North Korea is fundamentally an organized criminal nation state in what it's doing with its operations. 29:55.510 --> 30:08.310 And so a lot of the kinds of attacks that we've primarily seen on hospitals, besides the theft of PHI, PHI being worth a lot more than PII, because I can change my social security number, I can change my name, you can never change your healthcare data, 30:08.310 --> 30:12.850 which is why it goes for a multiple on the dark web. 30:13.030 --> 30:17.050 Why it's sold for a lot more than a traditional PII record. 30:17.210 --> 30:23.110 And then of course, we've seen a significant increase in ransomware. 30:23.650 --> 30:33.550 And the IBM report that I referenced earlier, with Ponemon on the cost of a data breach goes into detail about how much has been paid out to ransomware. 30:33.550 --> 30:38.470 And the healthcare sector in particular, has been particularly challenged on doing this. 30:38.470 --> 30:43.890 We addressed the issues of FUD earlier in the presentation, so we'll skip noting that now. 30:44.670 --> 30:47.170 And so, how could they do this? 30:47.170 --> 30:52.490 We talked about lateral movement through IT systems being one of the more prominent ways that this can go. 30:52.950 --> 30:56.250 Otherwise, we're starting to look at targeted attacks. 30:56.410 --> 31:05.490 And so, we went earlier to, well, why haven't we seen these kinds of attacks happen on critical infrastructure writ large is because of the deterrence component. 31:05.630 --> 31:12.930 So, I think mostly what we've seen is, of course, there's going to be the primary motivator around finance. 31:12.930 --> 31:26.410 So, the easiest way for me to do that, and then potentially the escalation would be a direct denial of service attack. 31:26.410 --> 31:35.570 So, focusing on the services that ICS is delivering specifically to a facility or complex, and taking those down. 31:36.810 --> 31:38.650 I'm reading your numbers. 31:38.650 --> 31:41.190 Those are exponential. 31:41.190 --> 31:42.310 Yes. 31:42.990 --> 31:48.190 The percentages are high, considering that this is patient care. 31:48.190 --> 31:52.930 This is me trusting you with my information, and what will you do with it? 31:52.930 --> 31:55.710 And then it's gone. 31:59.010 --> 32:15.210 I'm also just thinking about how, again, we talked about this a little bit earlier, the hospitals aim at least to zero out, they're putting $16.5 million out or $640,000. 32:15.230 --> 32:16.830 Where is that money coming from? 32:16.830 --> 32:30.010 And it's coming from their insurances, because now cybersecurity insurance in hospitals is almost mandatory because of the sensitivity of all of the devices and all of the information that's in there. 32:30.010 --> 32:31.970 That's well done you. 32:31.970 --> 32:32.690 Yes. 32:32.690 --> 32:33.010 Yeah. 32:33.010 --> 32:43.510 I mean, the key elements that I would pull out of here on the statistics are one, from the tax going back to 2016, not including this year, 6.6 million patients have been affected by this. 32:43.510 --> 32:53.730 Of course, the most significant out of that was the one or cry ransomware that struck the UK national health system several years ago, and that's been attributed to North Korea. 32:53.730 --> 32:59.150 The question of motive on that one was whether that was a test, whether that was on accident or whether that was on purpose. 32:59.330 --> 33:04.190 And then the final part here is the overall cost of these attacks is $157 million. 33:04.690 --> 33:23.670 And mostly that is capturing the overall cost from having to defend, having to identify, having to do the forensics cleanup, the damages that are actually done when there is a breach and the loss of that data, because privacy regulations, around PHI, have become much, 33:23.670 --> 33:24.950 much stronger. 33:24.950 --> 33:26.850 So there are some teeth to those now. 33:26.850 --> 33:33.490 So I tend to... what is your call to action? 33:33.490 --> 33:35.090 There's a lot of information in here. 33:35.090 --> 33:36.270 It's very dense. 33:36.470 --> 33:39.370 What do you want the healthcare community to do? 33:39.370 --> 33:42.230 What do you want the ICS community to do? 33:42.230 --> 33:45.250 What do you want the security research community to do? 33:47.210 --> 33:48.850 Yeah, that's tough. 33:49.710 --> 34:02.010 So, I mean, with the talks that I've been giving around embedded systems and IoT for several years now, I talk about the need to design for security. 34:02.410 --> 34:06.390 I think that there are some really low-hanging fruit here that we need to do. 34:06.390 --> 34:10.470 But that's really easy for me to wave my researcher wand and say, these things should happen. 34:10.470 --> 34:22.570 And it's a lot harder for manufacturers to have to increase the cost of their equipment to consumers, corporate consumers who are buying this stuff to actually pay for that. 34:23.290 --> 34:28.890 And so that's the chicken and egg there is everybody knows that these are needed things, but who's going to pay for it? 34:29.270 --> 34:34.890 And so typically, whenever there's that middle ground of, well, who's going to do this? 34:34.950 --> 34:38.610 I think the answer is government for funding those kinds of solutions. 34:39.830 --> 34:46.870 But we have a long way to go because it's just like you can't immediately change equipment when you're producing a car. 34:47.250 --> 34:49.730 It's these things have an even longer lifecycle. 34:49.850 --> 34:52.890 And so it's going to take a long time for us to dig out of that hole. 34:52.910 --> 34:57.130 And we really need the patience and the stick-to-itiveness to get there. 34:57.690 --> 35:08.730 There are a lot of solutions that are coming out to the market to solve some of this within, hey, if we can't fix something directly, at least we can, like I said, we can work around it. 35:08.730 --> 35:11.570 We can control the environment around it to protect it. 35:11.850 --> 35:27.170 So as those continue to push out, those will be cheaper solutions to both identity, anomaly detection, and when I say asset identification, anomaly detection, and then also providing protection in a more of a real-time way. 35:29.950 --> 35:34.310 That's essentially what's in the innovation hopper for those to continue to progress that way. 35:34.310 --> 35:38.690 So those continuing to roll out would be a good thing. 35:38.850 --> 35:43.250 So who would you specifically be looking for to engage in this conversation? 35:43.250 --> 35:47.850 You said government, but again, we've had this conversation that government is pretty broad. 35:48.610 --> 35:50.850 It's dissected into different sectors. 35:50.850 --> 36:03.410 Is there a person that you would say, hi person, I have this information, I would love to have a conference with you, a chat, so that we can do a deep dive and we understand the problem. 36:03.410 --> 36:04.410 Here it is. 36:04.510 --> 36:06.070 Let's work on that solution. 36:06.690 --> 36:08.970 So person, place, thing. 36:09.170 --> 36:09.630 Sure. 36:09.630 --> 36:19.050 So if you can tell me who's the SSA responsible for the medical and healthcare sector from that earlier slide, I would say that they're a part of this. 36:20.490 --> 36:21.010 What? 36:21.010 --> 36:22.610 Not even a little laugh at that one. 36:22.610 --> 36:24.310 I started looking. 36:24.790 --> 36:26.310 You were looking it up. 36:26.310 --> 36:31.090 So clearly they're a part of it from a sector specific element. 36:32.130 --> 36:34.010 I'm with the ICS Village. 36:34.010 --> 36:46.350 We're working with CISA and Department of Energy on additionally pushing out additional programs for hackers in the community to be able to do independent research and push some of these things. 36:46.450 --> 37:04.030 A lot of it, as we talked about, since IT skillset is different than ICS skillset, and that's the point of what the ICS Village is doing, is giving folks that are interested and on road so that it's not just these abstract things like, oh, PLC and historian and SCADA, 37:04.690 --> 37:07.030 DCS, like, what are we talking about? 37:07.030 --> 37:17.770 And making those accessible so that infosec, traditional infosec practitioners can get their feet wet with going this direction. 37:17.930 --> 37:18.370 Okay. 37:18.370 --> 37:19.430 Thank you. 37:19.430 --> 37:21.290 Thank you for having me.