1
00:00:00,000 --> 00:00:03,280
Good morning, DEF CON biohacking village.

2
00:00:03,360 --> 00:00:05,240
It's an honor to be here.

3
00:00:05,560 --> 00:00:11,680
If you're confused where you are, you're somewhere in cyberspace at your home.

4
00:00:11,820 --> 00:00:17,420
Following the DEF CON tradition, you may be somewhere between sober and completely intoxicated.

5
00:00:17,420 --> 00:00:21,320
We recommend aggressive rehydration and, you know, take a shower.

6
00:00:21,320 --> 00:00:22,680
That'll really help out.

7
00:00:22,680 --> 00:00:25,820
But before you do so, we appreciate you coming to our talk here.

8
00:00:25,820 --> 00:00:29,220
The talk is entitled Lessons Learned from a Pale Horse.

9
00:00:29,220 --> 00:00:33,200
What COVID-19 can teach us about healthcare cybersecurity.

10
00:00:34,140 --> 00:00:35,440
How are you, buddy?

11
00:00:35,440 --> 00:00:37,600
We haven't seen each other in person for a while.

12
00:00:38,020 --> 00:00:41,600
I feel like I haven't seen anybody in person for a long time.

13
00:00:41,600 --> 00:00:46,920
Was it November when we last saw each other, which for us is like a decade?

14
00:00:47,220 --> 00:00:48,700
Yeah, too long.

15
00:00:48,700 --> 00:00:51,480
I feel like I'm really missing my hacker family.

16
00:00:51,660 --> 00:00:58,920
I've just been talking with my wife about how much I miss going to DEF CON, seeing people in person, walking around.

17
00:00:59,080 --> 00:01:04,280
And then also, it's kind of depressing to think about it, but it's also a kind of a cool opportunity.

18
00:01:04,280 --> 00:01:08,680
Here we are at the Biohacking Village, but invited to speak here on a cool topic like this.

19
00:01:08,720 --> 00:01:12,000
And people all around the globe are going to be able to watch this.

20
00:01:12,080 --> 00:01:13,720
So I think we should go ahead and kick it off.

21
00:01:13,720 --> 00:01:14,760
What do you think, Jeff?

22
00:01:15,000 --> 00:01:15,760
I totally agree.

23
00:01:15,760 --> 00:01:30,560
But first, I think it's just so important to shout out what an amazing accomplishment and achievement it is that villages like the Biohacking Village and others, and even DEF CON itself, have been pulled into this safe mode virtual experience.

24
00:01:30,560 --> 00:01:47,220
As people who have done events ourselves, I can't even imagine the amount of work it took to do this, knowing that our friends at the Biohacking Village, and I'm sure others, have been working since last DEF CON on doing an amazing physical event, and then all of a sudden having to reverse course and change that.

25
00:01:47,220 --> 00:01:53,160
So I just want to give them a huge shout out and major props for what is a job very well done.

26
00:01:53,500 --> 00:01:58,500
But yeah, golf clubs, sure, absolutely, and more and more.

27
00:01:59,760 --> 00:02:01,180
Let's kind of get into it, man.

28
00:02:01,460 --> 00:02:11,060
I think when we originally came up with this, so first of all, I guess for those of us who we haven't had the pleasure of meeting, my name is Replicant Jeff.

29
00:02:11,860 --> 00:02:16,320
I am an anesthesiologist and security researcher hacker.

30
00:02:17,400 --> 00:02:19,200
My name is Christian Nemeth.

31
00:02:19,200 --> 00:02:21,060
People call me Kawati.

32
00:02:21,060 --> 00:02:22,400
That's my handle.

33
00:02:22,520 --> 00:02:28,390
I'm an emergency medicine physician and assistant professor over at UC San Diego.

34
00:02:29,400 --> 00:02:36,620
So I mean, we've both had the privilege of taking care of patients during this global pandemic.

35
00:02:36,620 --> 00:02:43,420
We have, you know, been in the critical care units and the emergency room, treating patients with COVID-19.

36
00:02:43,420 --> 00:03:02,640
And it's been kind of a surreal experience for us because before all of this, we were and still obviously are, you know, advocates for security and health care, being security researchers and kind of having this thesis statement that healthcare security is more than just privacy and patient records and things like that.

37
00:03:02,640 --> 00:03:15,960
There are, you know, vulnerabilities and we've gone over this extensively at other DEF CONs and other gatherings where we're able to talk about these things, you know, medical devices and healthcare infrastructure are as vulnerable as any other area of connected life.

38
00:03:15,960 --> 00:03:25,440
And we know that those vulnerabilities have the potential to potentially affect patients, both in how we care for them and their long term outcomes.

39
00:03:25,440 --> 00:03:29,040
So we've kind of been pushing this thesis for a while.

40
00:03:29,040 --> 00:03:35,300
And then all of a sudden, we found ourselves kind of on the front lines, knee deep in COVID patients during this pandemic.

41
00:03:35,300 --> 00:03:47,460
And that's kind of changed, I think, a little bit of our perspective about ways in which we as a healthcare system can prepare for not just events like this, but also security related concerns as well.

42
00:03:47,460 --> 00:04:07,180
So I think what we wanted to do is kind of see were there any insights that we obtained from our clinical practice and kind of how we think about disaster medicine, which we'll get into and utilization of resources and readiness and preparedness in a medical type of emergency.

43
00:04:07,180 --> 00:04:11,160
Can we apply some of those thoughts and lessons to the security realm?

44
00:04:11,680 --> 00:04:12,940
Sound like a plan?

45
00:04:13,120 --> 00:04:14,160
Sounds like a plan.

46
00:04:14,160 --> 00:04:15,640
We're gonna go ahead and get kicked off.

47
00:04:15,640 --> 00:04:19,520
Many of you out there are like, what is disaster medicine?

48
00:04:19,520 --> 00:04:20,560
It doesn't even make any sense.

49
00:04:20,560 --> 00:04:23,760
Like I'm familiar with cardiology, like they take care of the heart.

50
00:04:23,760 --> 00:04:26,220
I'm familiar with gastroenterology.

51
00:04:26,220 --> 00:04:32,200
You know, they give me a Valium, have me show up next morning and then scope my intestines.

52
00:04:32,700 --> 00:04:35,720
Well, many of you out there might be wondering, what is disaster medicine?

53
00:04:35,720 --> 00:04:45,980
And so under medicine, generally a medicine, you know, surgery, the practice of taking care of someone's health and treating disease, there are all sorts of disciplines.

54
00:04:46,280 --> 00:04:48,040
I practice emergency medicine.

55
00:04:48,040 --> 00:04:51,500
Jeff practices pediatrics and anesthesia.

56
00:04:51,760 --> 00:05:00,580
And there's so much to know in modern medicine, new treatments, new diseases that we, or sorry, diseases that we learn more about.

57
00:05:00,840 --> 00:05:04,380
And as a consequence, it's impossible for a doctor to know all of it.

58
00:05:04,380 --> 00:05:10,400
And it would actually probably be very unsafe for a doctor to practice, you know, every form of medicine.

59
00:05:10,400 --> 00:05:12,200
So we specialize.

60
00:05:12,800 --> 00:05:25,860
Under the house of medicine with all these different specialties, there's a subspecialty, a niche, a further niche, if you will, that discusses and studies and practices disaster medicine.

61
00:05:25,900 --> 00:05:40,900
Disaster medicine is how do you take care of people, not when you're in a fancy hospital where you have two MRI machines, an entire trauma team, you know, dozens and dozens of doctors on a particular service, and hundreds of nurses.

62
00:05:40,900 --> 00:05:49,180
Instead, how do you take care of thousands of patients during an earthquake or during a hurricane ?

63
00:05:49,440 --> 00:05:55,060
How do you take care of patients as they're swelling through the front doors of your hospital during a pandemic?

64
00:05:55,060 --> 00:06:02,580
And you can see that there's some clear disaster medicine being practiced today all over the globe in response to the global pandemic.

65
00:06:02,580 --> 00:06:17,220
And this is a picture of a disaster in the United States and a particular specialized team that the government can call upon to remotely, sorry, to go to a particular location and practice disaster medicine.

66
00:06:17,220 --> 00:06:20,340
These are called DMAT teams or disaster medicine assistance teams.

67
00:06:20,340 --> 00:06:35,600
These are comprised of multidisciplinary teams, nurses, technicians, doctors, they'll go to a place in response to a disaster, they'll organize how they take care of all those patients, they'll deploy electronic health systems, and then they'll be able to help treat all of those people,

68
00:06:35,600 --> 00:06:39,720
perhaps in a high school gym, for instance, instead of a hospital.

69
00:06:39,720 --> 00:06:44,500
So these are called DMAT teams, they practice disaster medicine, and they study it.

70
00:06:44,500 --> 00:06:56,460
You know, lessons learned from Hurricane Maria, for example, well, we study that, do academic papers and publish them so that the next disaster that rolls around, we're better prepared to respond to that.

71
00:06:56,840 --> 00:07:05,100
Well, Jeff and I are thoroughly convinced that there should be a subsection of disaster medicine called cyber disaster medicine.

72
00:07:05,100 --> 00:07:11,440
And we picked a picture of the DEFCON CTF for a couple different reasons.

73
00:07:11,440 --> 00:07:31,880
One, because a lot of what cyber disaster medicine is going to be is merging the two disciplines of clinical practice, taking care of patients' health, treating disease, while also addressing technological problems, systems of connected medical technology that are malfunctioning or perhaps being attacked.

74
00:07:31,880 --> 00:07:34,580
That's really our premise of what Jeff had mentioned.

75
00:07:34,580 --> 00:07:53,560
Our argument, our thesis is that if you attack a hospital, because it's so connected, and so interdependent on vulnerable technology, if you attack that, it won't be available for patient care, or the integrity of the data flowing from these systems will be changed and unreliable,

76
00:07:53,560 --> 00:07:56,240
and as a consequence, patients' health will be affected.

77
00:07:56,240 --> 00:08:15,240
So we think there needs to be essentially a cyber DMAT team, so where we take doctors and hackers and nurses, put them in a team, and if some hospital in Nebraska or some hospital in Idaho gets hit by a ransomware attack, for example, and they are unable to take care of patients,

78
00:08:15,240 --> 00:08:35,280
they're going to need both the medical expertise, the person power to respond to taking care of the strokes and heart attacks that are happening, while also simultaneously working with the technical teams to mitigate the issue and fix those damages to the technological infrastructure to restore care.

79
00:08:35,280 --> 00:08:45,960
So we think convincingly, though, it's going to be more and more of a need of these hybrid teams, where we have both hackers and doctors responding to attacks on healthcare infrastructure.

80
00:08:45,960 --> 00:08:48,680
We call that cyber disaster medicine.

81
00:08:49,480 --> 00:09:00,580
And Claudia, just two points that I want to make real quick about the concept of disaster medicine in general is that it assumes that you're going to be operating from a standpoint of very limited and constrained resources.

82
00:09:00,760 --> 00:09:18,120
And it also implies in some sense that the outcomes you are able to achieve are going to be less than the ideal outcomes that you would have in a non -disaster situation, and that there is some sense of needing to triage priorities accordingly.

83
00:09:19,120 --> 00:09:19,980
Absolutely.

84
00:09:19,980 --> 00:09:26,380
And one of the kind of foundational tenets of disaster medicine is the concept you mentioned of triage.

85
00:09:26,420 --> 00:09:45,660
If you have 10 patients in front of you, one is dead or just nearly died, three are dying, and three are okay, and some are in between, you need a system to be able to respond in the right order to take care of the patients that you can best help with.

86
00:09:45,660 --> 00:09:52,100
So, you know, controversial part of this is, you know, don't treat the patients that are about to die.

87
00:09:52,100 --> 00:09:54,620
Those patients need advanced airways.

88
00:09:54,620 --> 00:09:59,680
They need, you know, five, six people to major surgery.

89
00:09:59,680 --> 00:10:01,100
Yeah, they might need major surgery.

90
00:10:01,100 --> 00:10:03,960
They might need, you know, a lot of broad spectrum antibiotics.

91
00:10:03,960 --> 00:10:05,980
They need a lot of things that you might not have.

92
00:10:06,080 --> 00:10:20,860
If you spend your time focusing on the people who are dying, doing CPR, those types of things, then those three people that might benefit from your care that don't need that many resources but still could have an adverse outcome if you don't pay attention to them immediately,

93
00:10:20,860 --> 00:10:21,840
those are affected.

94
00:10:21,840 --> 00:10:37,200
So, it's this concept of can you make a system, can you make a philosophy, if you will, a protocol to be able to respond and make decisions on who you treat with the limited resources you have and in what order.

95
00:10:37,200 --> 00:10:39,500
So, I think these are foundational things.

96
00:10:39,500 --> 00:10:41,260
I mean, if you don't have a choice, you don't have a choice.

97
00:10:41,260 --> 00:10:46,480
If you're responding after an earthquake, you can't treat everyone at the same time equally.

98
00:10:46,480 --> 00:10:47,960
You have to pick and choose.

99
00:10:48,560 --> 00:10:57,840
I think in some sense, the idea of triage in a healthcare delivery organization from a security standpoint has been one of the trickier things in normal times, right?

100
00:10:57,840 --> 00:11:00,500
Because we almost have like a paralysis of indecision.

101
00:11:00,660 --> 00:11:07,260
People like us talk about all the ways in which we could improve foundational and infrastructure security of a healthcare delivery organization.

102
00:11:07,260 --> 00:11:09,320
We talk about medical devices and things like that.

103
00:11:09,320 --> 00:11:22,280
And sometimes it can seem like there are too many things to fix, whereas this triage mentality helps us kind of focus our priorities and really kind of hone in on the things that may be actionable with the biggest yield and impact for resources invested.

104
00:11:23,300 --> 00:11:24,880
Yeah, I completely agree.

105
00:11:24,960 --> 00:11:26,800
We love security.

106
00:11:26,800 --> 00:11:28,320
You know, we drink the Kool-Aid.

107
00:11:28,320 --> 00:11:32,640
We are admittedly believe it is a big risk to patient safety.

108
00:11:32,640 --> 00:11:39,860
But this is just one of dozens of issues, really serious issues facing healthcare across the globe.

109
00:11:40,920 --> 00:11:42,360
Security is just one of them.

110
00:11:42,360 --> 00:11:48,860
For instance, you know, the disproportionate allocation of resources for disadvantaged populations, right?

111
00:11:48,860 --> 00:11:52,320
Like population health is a big deal, social determinants of health.

112
00:11:52,320 --> 00:11:53,860
Security is just one of these things.

113
00:11:53,860 --> 00:11:56,280
And I agree, there's this triage element of it.

114
00:11:56,280 --> 00:11:57,920
COVID's blown all that up, right?

115
00:11:57,920 --> 00:12:00,000
So we have a global pandemic.

116
00:12:00,000 --> 00:12:04,820
It is sucking every single resource it possibly can out of the healthcare system.

117
00:12:04,820 --> 00:12:10,700
And things like security, undoubtedly, in the triage, if you will, are going lower.

118
00:12:11,160 --> 00:12:12,400
I understand that.

119
00:12:12,400 --> 00:12:13,260
That's very important.

120
00:12:13,260 --> 00:12:14,400
You have to take care of those patients.

121
00:12:14,400 --> 00:12:27,780
But what I fear is that we are putting far more attention to treating the immediate issues of COVID, not realizing that we are really opening ourselves up to the vulnerabilities, and we're not fixing them.

122
00:12:27,780 --> 00:12:31,420
And as a consequence, we could have a one-two punch.

123
00:12:31,420 --> 00:12:35,760
We could have COVID and then a ransomware attack on top of it.

124
00:12:35,760 --> 00:12:41,420
Our ability to take care of patients in some of the hospitals across this country is already so hard.

125
00:12:41,500 --> 00:12:48,880
If we had to deal with a ransomware attack on top of it, my ability to take care of COVID patients in the emergency department is going to be hindered.

126
00:12:48,880 --> 00:12:50,880
That's going to hurt my patients.

127
00:12:50,900 --> 00:12:57,260
And so I think foundational security issues are still something to pay attention to during this pandemic.

128
00:12:57,910 --> 00:13:00,760
I mean, that's another tenet of disaster medicine, right?

129
00:13:00,760 --> 00:13:20,500
You need to fortify your infrastructure during a particular crisis with the anticipation that subsequent issues or events could even further hamper your ability to get the best outcomes in your emergency situation.

130
00:13:20,500 --> 00:13:48,760
So let's move on to some of the points that we came up with just in conversation earlier about some of the things that we as clinicians on the ICU core in the emergency room have drawn as parallels to some of the issues that we as security researchers wearing a different hat were worried about and kind of thinking about pre-COVID and see if there are some areas where we can draw parallels and maybe even lessons from that.

131
00:13:48,760 --> 00:13:54,580
So I want to talk a little bit about kind of just basic data gathering, right?

132
00:13:54,580 --> 00:13:59,620
So this idea of having the information you need in order to make actionable decisions.

133
00:13:59,620 --> 00:14:13,060
From the same point of the pandemic, I remember I was out of the country back in February on a medical surgical mission trip, and we at that point just started receiving information.

134
00:14:13,060 --> 00:14:14,320
I'm in Sacramento.

135
00:14:14,320 --> 00:14:33,340
I work at UC Davis Medical Center, and we were actually the first hospital in the country to care for a patient who was diagnosed with coronavirus, and they weren't able to identify the source of spread, so the first example of what we call the community-acquired case.

136
00:14:33,560 --> 00:14:44,540
And that kind of set off this initial first couple of weeks to early months of uncertainty where we really didn't have a good idea about what the epidemiology looked like, right?

137
00:14:44,620 --> 00:14:51,220
We knew that there were reports earlier in December about where it had originated from a global standpoint.

138
00:14:51,400 --> 00:15:01,600
We knew that we were starting to see cases in other parts of the world, particularly Europe, but we really didn't have a sense of what the overall disease burden was in the U.S.

139
00:15:01,600 --> 00:15:16,860
and our communities, and we thought that we were still at an earlier enough phase that we could do individual kind of contract tracing and isolation, kind of this containment model as opposed to the mitigation that we're now in.

140
00:15:18,700 --> 00:15:24,300
So I think there were a lot of factors that played into that, obviously, and we don't need to necessarily get into that as much.

141
00:15:24,300 --> 00:15:44,520
Some of the issues with cross-cultural communications between countries, some of the mechanisms that we had in place from a federal standpoint that were either kind of like mothballed or not rolled out quite as effectively, but really had a surveillance issue in the beginning period of this crisis.

142
00:15:44,520 --> 00:16:00,860
And so do you feel like in healthcare there's a similar almost like fog of war when it comes to security, when it comes to understanding the threats faced by individual organizations, and kind of how robust are we with respect to being able to communicate and share intelligence from that standpoint?

143
00:16:01,920 --> 00:16:05,080
I think in some regards we've made like huge strides, right?

144
00:16:05,080 --> 00:16:14,360
So things like organizations such as the Help ISAC allow partners to pretty quickly communicate some security issues.

145
00:16:14,360 --> 00:16:27,400
So for those of you listening or watching this video, if you're a part of that, you know, you're going to get multiple emails a day from some of these threat intelligence sharing organizations saying, oh, this is going on, pay attention to this.

146
00:16:27,400 --> 00:16:36,800
And sometimes the conversations even get to the point of, well, I built some tools, or these were particular rules I wrote, this is how I'm mitigating this particular attack.

147
00:16:37,100 --> 00:16:39,340
Those types of things do happen.

148
00:16:39,420 --> 00:16:47,900
But generally speaking, we are not, when I say we, healthcare security is not anywhere close to where it should be.

149
00:16:47,900 --> 00:16:53,480
Just because these organizations exist don't mean that many hospitals are taking advantage of them.

150
00:16:53,480 --> 00:17:05,420
Because of one of the primary things that we want to bring just back to everyone's mind is that there are not a lot of people that work, not a lot of security people that work for healthcare.

151
00:17:05,660 --> 00:17:10,820
I mean, there's a dearth of people and resources around insecurity around healthcare.

152
00:17:10,820 --> 00:17:21,300
So even if you do have robust communication channels, which I don't think we have, but let's say we do, you need people to receive that information, digest it, and act upon it.

153
00:17:21,300 --> 00:17:26,140
And so at the heart of this issue of COVID, we had very poor surveillance at the beginning.

154
00:17:26,140 --> 00:17:34,860
I think we have had a chronic issue, a chronic lack of appropriate surveillance of healthcare security.

155
00:17:35,000 --> 00:17:37,120
There are a couple of barriers, I think, to that.

156
00:17:37,120 --> 00:17:38,240
There's HIPAA.

157
00:17:38,340 --> 00:17:43,280
Now I'm going to go ahead and say, of course, I think I can speak for Jeff.

158
00:17:43,280 --> 00:17:44,980
We're big supporters of HIPAA.

159
00:17:44,980 --> 00:17:48,020
We think the protection of patient information is really, really important.

160
00:17:48,120 --> 00:17:52,320
We are hackers, so we care about our data and it being secure.

161
00:17:52,320 --> 00:18:05,980
We care about our But HIPAA, or if those of you who aren't up there, that piece of legislation that essentially penalizes people who breach protected health information, leak it, lose it, etc.

162
00:18:07,020 --> 00:18:11,120
It's been used as an example of why you can't share information.

163
00:18:11,120 --> 00:18:19,800
I can't talk about a breach when we lost a laptop, or I can't talk about a particular vulnerability, a piece of malware that hit because it might be a HIPAA concern.

164
00:18:19,900 --> 00:18:30,120
And we need to make sure HIPAA comes first, as opposed to information sharing and protecting the hospital down the street from getting hit with the exact same thing that I did.

165
00:18:30,120 --> 00:18:32,060
That should be the priority and it's not.

166
00:18:32,160 --> 00:18:34,100
There's liability concerns.

167
00:18:34,220 --> 00:18:42,820
So there's the thought of, if there is a breach of a hospital or a hospital is under attack, what will the hospital be liable for?

168
00:18:42,820 --> 00:19:00,780
If, for instance, the vulnerability that was exploited had a patch six months ago, and because health care entities deal a lot with other types of legal issues and security is not typically one of them, their legal teams tend to shy away from disclosing information,

169
00:19:00,780 --> 00:19:04,100
sharing information in a timely manner.

170
00:19:04,720 --> 00:19:07,600
There are always branding concerns.

171
00:19:07,600 --> 00:19:13,320
So people don't want to go get care at hospitals that have had breaches.

172
00:19:13,320 --> 00:19:14,260
Why?

173
00:19:14,260 --> 00:19:21,500
Because there are afraid their information is going to get breached or they're afraid while they're there that they're going to get hacked and something bad will happen to them.

174
00:19:21,500 --> 00:19:33,940
So health care institutions generally are adverse to sharing information because of branding concerns and market share competitions, which is some fierce, fierce competition in health care.

175
00:19:33,940 --> 00:19:38,900
I was going to say there's also an incredibly complex hierarchy, right?

176
00:19:38,900 --> 00:19:51,760
Even within a single health care delivery organization with respect to the number of people that are involved in some of those branding issues that you talked about, some of the legal and liability issues.

177
00:19:51,760 --> 00:20:00,620
And it's very hard to centralize and coordinate decisions with respect to security sometimes because they affect so many different aspects of a hospital's function.

178
00:20:00,680 --> 00:20:19,360
And we kind of saw something similar in the overall, I would say, government response to this current crisis is that you just have a lot of different levels of leadership, levels of decision-making, levels of stakeholders from a federal, state, and local level.

179
00:20:19,360 --> 00:20:27,840
And sometimes those wires can get crossed and sometimes there isn't the best communication with the degree to which their spheres of responsibilities overlap.

180
00:20:27,840 --> 00:20:37,200
So sometimes I think we make mutual assumptions that somebody else is covering a certain problem, whether it's things like PPE or bed capacity or things like that.

181
00:20:37,200 --> 00:20:45,940
We sometimes say, well, don't worry about the number of ICU beds we have because the federal government will send this hospital ship or we're expecting a shipment of PPE from the state.

182
00:20:45,940 --> 00:20:54,940
And sometimes I think that degree of organizational complexity makes it really, really difficult to make quick, streamlined decisions.

183
00:20:54,940 --> 00:20:58,520
And sometimes that can also affect the composition of the teams that you're working with, right?

184
00:20:58,520 --> 00:21:03,780
So if you have a system that is not quite as efficient or as effective, you can get pretty high turnover.

185
00:21:03,780 --> 00:21:06,940
I think we've seen that before in hospital security teams, right?

186
00:21:06,940 --> 00:21:13,560
There's this additional level of complexity that comes with working within healthcare that people from the outside aren't always accustomed to.

187
00:21:13,560 --> 00:21:18,240
And sometimes that can be very frustrating to the security professional working in healthcare for the first time.

188
00:21:18,240 --> 00:21:27,680
And I think we've both seen instances of pretty significant burnout and turnover in that sense, simply from the complexity of the overall organizational structure.

189
00:21:28,640 --> 00:21:29,860
Completely agree.

190
00:21:29,860 --> 00:21:33,460
You know, hackers want to make things better for the most part.

191
00:21:33,460 --> 00:21:36,080
You know, we could talk about malicious adversaries, etc.

192
00:21:36,080 --> 00:21:41,300
But that aside, hackers, security folks, they're trying to make things better.

193
00:21:41,300 --> 00:21:43,240
They're trying to make things more secure.

194
00:21:43,240 --> 00:21:52,400
And when they go work for a healthcare organization, that's a great opportunity to do some, to take your knowledge and your skills and put it towards helping people.

195
00:21:52,400 --> 00:22:05,300
You might not be at bedside pushing a medication and an IV, but if you're supporting the hospital's infrastructure that made that medication administration possible and safe and secure, you're really, really doing something good.

196
00:22:05,300 --> 00:22:22,820
Just like you mentioned, we've heard horror story after horror story about talented security professionals, talented hackers going and working at hospitals, taking a pay cut, and then finding concerning things, bringing them to the attention of their leadership,

197
00:22:22,820 --> 00:22:41,740
and at the end of the day saying, we can't fix that issue because of, insert some reason, the cardiologist said no, they want to use that vulnerable device because it's their favorite, or we don't have the budget to do that, we need to buy a new MRI machine,

198
00:22:41,740 --> 00:22:42,580
etc., etc.

199
00:22:42,580 --> 00:22:51,960
So it can be demoralizing to work for a healthcare organization in a security capacity and feel like you can't really change things.

200
00:22:51,960 --> 00:23:02,480
And a lot of that has to do with the bureaucratic complexities, you know, COVID, there are so many different agencies and state governments, etc., it's just turned into this bureaucratic nightmare.

201
00:23:02,660 --> 00:23:20,100
Even in the best of times, a hospital is still a bureaucratic nightmare with so many different layers of administration and clinical expertise that at the end of the day, the bureaucracy can cause rapid turnover of our security professionals.

202
00:23:20,100 --> 00:23:22,900
And, you know, we need them there.

203
00:23:22,900 --> 00:23:43,020
The 2017 Health and Human Services Task Force report, commissioned by Congress, came back and said they thought a minority of hospitals in the United States have even a single full-time security professional on staff, you know, but yet we still march forward connecting more systems together,

204
00:23:43,020 --> 00:23:49,960
increasing our attack surfaces, etc., without the commensurate investment in security personnel.

205
00:23:49,960 --> 00:23:59,640
As a consequence of that, we're putting ourselves in an even worse situation where we are more vulnerable, we have less people to respond to, and the bureaucracy is getting even more complex.

206
00:23:59,760 --> 00:24:01,960
It's an impossible proposition to face.

207
00:24:01,960 --> 00:24:10,260
That problem of turnover, it really highlights how important institutional memory is, right?

208
00:24:10,260 --> 00:24:17,100
And I think that was something that we saw from the standpoint of pandemic response, too, is that there were structures in place, there were playbooks in place.

209
00:24:17,120 --> 00:24:20,200
Some of the problems that we've run into could have potentially been solvable.

210
00:24:20,200 --> 00:24:33,160
And I think we've both seen examples of clinical situations with respect to security where, you know, people have worked on a problem, they've even come up with a potential solution to a problem, they've even started to implement that solution.

211
00:24:33,240 --> 00:24:40,880
And then they go, whether it's for, you know, other opportunities, or just the disillusionment that we've already talked about, they leave.

212
00:24:40,980 --> 00:24:47,680
And the next person coming in sometimes doesn't have the ability to pick up where they left off, they have to kind of reinvent the wheel from the very beginning.

213
00:24:47,700 --> 00:24:53,520
And that chance to build the institutional memory is kind of lost.

214
00:24:55,060 --> 00:24:56,020
Absolutely.

215
00:24:56,060 --> 00:25:06,580
And that's a problem in a lot of different industries, but it's particularly important in healthcare, because there are so much, there's so much specialized, weird medical devices.

216
00:25:06,580 --> 00:25:20,400
It feels like if you work at a hospital, you know, I don't work for IT at a hospital or security at a hospital, you don't only have to know the technical infrastructure and routers and firewalls like you do at any other organization, you also have to know all this weird,

217
00:25:20,400 --> 00:25:26,120
this device on the fourth floor is a 10 year old infusion pump.

218
00:25:26,120 --> 00:25:28,020
And it acts very strange.

219
00:25:28,020 --> 00:25:31,700
And we have tried our best to mitigate its vulnerabilities in the following way.

220
00:25:31,900 --> 00:25:33,320
And it does this function.

221
00:25:33,320 --> 00:25:44,420
And when it doesn't do this function, this is the health implication, there's so much more context around the technological infrastructure in a hospital that is outside the regular domain of security.

222
00:25:44,420 --> 00:25:59,520
And so if you don't have institutional memory, you can't pass down that knowledge, that healthcare context specific knowledge, and that doesn't exist, and you just have rapid turnover, you're risking someone forgetting about the device or what you did about it.

223
00:25:59,520 --> 00:26:04,500
And as a consequence, you're just putting yourself out there more and becoming even more vulnerable.

224
00:26:06,040 --> 00:26:15,680
So I want to talk about communication a little bit, because I think that this is something that has been very challenging from a clinical standpoint, right?

225
00:26:15,680 --> 00:26:32,100
And so tell me if you have had the experience where you are caring for these patients, you are constantly receiving updated protocols with respect to how to safely use protective equipment or the certain situations in which, you know, an aerosol generating procedure might be taking place.

226
00:26:32,100 --> 00:26:33,900
So you need to have an N95 at that point.

227
00:26:33,900 --> 00:26:38,580
But if you're just going into, you know, assess the patient, you can get away with contact droplet precautions.

228
00:26:38,740 --> 00:26:48,440
There's so much that we are learning in real time about the sort of natural course of this disease, about best practices for how to treat it.

229
00:26:48,440 --> 00:26:52,560
That communication from a clinical standpoint is very important.

230
00:26:52,860 --> 00:27:06,360
And there's a transparency that I think, with the best examples of this, it's very beneficial to kind of tell people, this is the information that we're seeing, this is how we're making these decisions, this is why we're implementing things in a certain way.

231
00:27:06,360 --> 00:27:26,760
And when you have situations where that's not the case, you know, whether it's canceling elective surgeries, whether it's how we allocate beds, whether it's our testing protocols and things like that, it's very demoralizing and kind of dispiriting sometimes for the clinicians across the country to be put in situations where they don't really understand how the decisions are made or how they're communicated.

232
00:27:28,380 --> 00:27:37,920
There is an entire other filter over that with respect to certain, you know, trustworthiness of information from a partisan or ideological standpoint that we need to get into.

233
00:27:37,920 --> 00:27:47,120
But clearly, communication and how we talk to each other during these types of situations has been key on the clinical side.

234
00:27:47,120 --> 00:27:53,900
And I was just wondering what your thoughts were with respect to how we talk about healthcare security and those issues.

235
00:27:54,860 --> 00:28:04,300
Yeah, I remember when we first started seeing COVID patients at my hospitals.

236
00:28:04,300 --> 00:28:12,300
And I remember many doctors across the country were getting their information about how to treat them on Twitter.

237
00:28:12,640 --> 00:28:17,040
You know, should you give large amounts of IV fluid?

238
00:28:17,040 --> 00:28:20,960
Should you give patients ibuprofen if they have... remember that?

239
00:28:20,960 --> 00:28:26,160
There was this issue about whether or not NSAIDs like ibuprofen could make it worse.

240
00:28:26,380 --> 00:28:28,980
There was... I remember this adamantly.

241
00:28:28,980 --> 00:28:45,560
The first time I had to intubate a COVID patient, it was because there was this very early information saying, hey, you should intubate these patients early instead of try non-invasive airway maneuvers like high flow oxygen or BiPAP.

242
00:28:45,560 --> 00:28:53,960
There was this fear around BiPAP that if you put this on, it's a mask, it goes over their mask and provides positive pressure and helps patients breathe.

243
00:28:53,960 --> 00:29:02,840
The fear was that that would aerosolize the virus and that everyone in the room, even if you were covered head to toe in PPE, would get the virus if you put a patient on BiPAP.

244
00:29:02,840 --> 00:29:13,600
So there's all these different communication streams, getting information on how to treat patients on Twitter, the academic literature, which is the foundation of how we treat patients, right?

245
00:29:13,600 --> 00:29:21,880
So in medicine, we do studies, we design things, and we collect data, we publish on the scientific method.

246
00:29:22,260 --> 00:29:30,980
In COVID, a lot of that we didn't have time for, like we didn't have random placebo controlled trials on ibuprofen yet.

247
00:29:30,980 --> 00:29:32,940
We didn't have this type of information.

248
00:29:32,940 --> 00:29:36,420
So these communication streams, they just weren't authoritarian.

249
00:29:36,420 --> 00:29:40,140
They weren't coming in a coherent way.

250
00:29:40,140 --> 00:29:42,180
There was conflicting information.

251
00:29:42,240 --> 00:29:54,780
There was a lot of concern about where the data was coming from, you know, and as a consequence, I think it really just paralyzed a lot of frontline clinicians.

252
00:29:54,780 --> 00:29:56,560
We were, what do we do?

253
00:29:56,560 --> 00:29:58,400
I heard we should do this yesterday.

254
00:29:58,400 --> 00:30:00,760
Now I'm hearing we shouldn't do it today.

255
00:30:01,160 --> 00:30:03,900
That was really unfortunate.

256
00:30:03,900 --> 00:30:07,760
Its parallels in healthcare cybersecurity are many.

257
00:30:07,760 --> 00:30:28,700
We've already touched on a few, you know, information sharing being one of them, but I just want to bring up a very important part of this, which is, if there is any silver lining out of what, you know, of the response to coronavirus, it's that the academic journals that a study could take years to collect data and publish,

258
00:30:28,700 --> 00:30:34,640
big journals like the New England Journal, Lancet, a few, JAMA, etc.

259
00:30:34,640 --> 00:30:39,900
They said, we need to rapidly review this literature and start getting it out there.

260
00:30:39,900 --> 00:30:46,420
So they reduced their standards for what would get published a little bit for the sake of, we need to rapidly publish.

261
00:30:46,800 --> 00:30:51,360
At the heart of that is this need for information sharing and communication.

262
00:30:51,380 --> 00:30:55,300
It wasn't the best, but at least they tried.

263
00:30:55,300 --> 00:30:57,680
We don't have that in healthcare cybersecurity.

264
00:30:57,700 --> 00:31:07,140
We don't have hospitals knowingly giving us information, data, anonymized data on attacks.

265
00:31:07,220 --> 00:31:12,280
We don't share data and study it critically and publish that very often.

266
00:31:12,280 --> 00:31:15,020
Instead, hospitals are saying, we got breached.

267
00:31:15,020 --> 00:31:16,040
We don't need to study this.

268
00:31:16,040 --> 00:31:17,680
We don't need to share the raw data.

269
00:31:17,680 --> 00:31:23,160
Instead, we need to forget that this happened, pay our HIPAA fine, and hope we don't ever get into scrutiny again.

270
00:31:23,160 --> 00:31:37,040
We really need to change our philosophy in healthcare security to collect data, pool data, design studies where we can make some meaningful conclusions at the end of the day.

271
00:31:37,040 --> 00:31:38,060
That's science.

272
00:31:38,060 --> 00:31:40,000
We need to share that with everyone.

273
00:31:40,000 --> 00:31:48,060
We need to go through peer review so that other people can review the data and make sure that what we're saying is consistent with what they've experienced.

274
00:31:48,060 --> 00:31:54,920
So at the end of the day, we can answer some fundamental questions that people on this video call have heard time and time again.

275
00:31:54,920 --> 00:31:59,760
For example, the question, should you pay the ransom if your hospital is ransomed?

276
00:31:59,760 --> 00:32:06,360
You'll hear 15 different opinions about whether or not you should pay the ransom if your hospital is under ransomware attack.

277
00:32:06,660 --> 00:32:26,360
But what we don't have is a reliable data set from all the prior hospitals who've been ransomed, looking at things like outcome, how much they paid so that we can take that data, make meaningful conclusions, and through the scientific method, provide recommendations at the end of the day that are evidence-based.

278
00:32:26,360 --> 00:32:29,100
In medicine, we call that evidence-based medicine.

279
00:32:29,100 --> 00:32:33,320
We want to pick the right treatments and do the right thing because there's evidence.

280
00:32:33,320 --> 00:32:38,440
In healthcare cybersecurity, we don't have the evidence base because we don't share it.

281
00:32:38,440 --> 00:32:40,440
We really need to change that.

282
00:32:40,520 --> 00:32:50,180
COVID, we were able to, not perfectly, but we saw some glimmering hopefully in some respects, particularly with the journals, of that getting better.

283
00:32:50,980 --> 00:32:52,220
Yeah, I totally agree.

284
00:32:52,220 --> 00:33:01,340
I want to just go back and clarify too that when talking about the mixed messages that we had early on, that in and of itself is not a problem.

285
00:33:01,440 --> 00:33:11,520
It's okay if we don't know initially in a situation like this, whether the best clinical intervention is invasive mechanical ventilation or non-invasive positive pressure ventilation.

286
00:33:11,540 --> 00:33:22,420
It's okay in the initial period of this when we're still collecting those data points to be able to say, we don't know, there are a couple of different possibilities here and we're going to try one or the other.

287
00:33:22,480 --> 00:33:23,700
I mean, that's the scientific method.

288
00:33:23,700 --> 00:33:26,940
That's the process by which we generate a hypothesis and then test it.

289
00:33:26,940 --> 00:33:31,740
So having different options or different messages initially is not an issue.

290
00:33:31,740 --> 00:33:35,020
It's then needing to, as you said, gather that data.

291
00:33:35,020 --> 00:33:48,460
And I think we, even before all of this, we have been of the perspective that if it does turn out that we are able to look back in five to ten years, that healthcare security was not necessarily the issue of magnitude we thought it was.

292
00:33:48,460 --> 00:34:05,800
I think you and I, as scientists, are both going to be fine with that and able to say, you know, we're much more at peace with the concept of advocating for these issues and for it not turning out to be a big patient safety issue than if we were to sort of ignore them and allow it to be that.

293
00:34:05,960 --> 00:34:17,760
As kind of a tangent to that, I just wanted to ask you briefly, because from a standpoint of communication in this space, in the healthcare security space, we often get opposing viewpoints, which is totally fine.

294
00:34:18,600 --> 00:34:38,580
But something I've been thinking about is we have come into conversations with people who have said, you know, healthcare is something that we don't think attackers are particularly motivated to sort of target or focus on, because, you know, it's a hospital and why would you go after a hospital or why would you go after a medical device?

295
00:34:38,580 --> 00:34:42,240
We just don't think that's going to be a powerful motivating factor for people.

296
00:34:42,600 --> 00:34:54,360
We've obviously seen some examples over the last couple of months where there have been attacks at institutions that were actively treating COVID patients or actively engaged in COVID research.

297
00:34:54,560 --> 00:35:03,460
And it seems that in some of those cases, the particular, you know, there was a very precise targeting based on that fact and that situation.

298
00:35:03,460 --> 00:35:15,840
What do you think about the argument now that healthcare is sort of this different sacrosanct space that won't necessarily be the focus of other types of attacks because of its kind of unique nature in that sense?

299
00:35:16,560 --> 00:35:18,300
Yeah, I think that's demonstrably false.

300
00:35:18,300 --> 00:35:32,640
You brought up a couple of good examples of adversaries who willfully have targeted healthcare infrastructure, primarily COVID research, for their own gain.

301
00:35:32,860 --> 00:35:44,420
And I think those out there that are still saying, you know, hackers aren't going to target healthcare because no one would ever be that evil, really just need to wake up to the fact that two things are true.

302
00:35:44,420 --> 00:35:46,840
One, adversaries are doing that.

303
00:35:46,960 --> 00:35:49,520
Attacks are increasing, they're not decreasing.

304
00:35:50,000 --> 00:35:55,260
And then two, many adversaries might not even know that they're attacking healthcare, right?

305
00:35:55,260 --> 00:36:02,640
So there's no set of IP addresses that are only allocated to hospitals, right?

306
00:36:02,640 --> 00:36:08,820
So if you're out there scanning, trying to propagate malware, you could hit a hospital and not even know it, right?

307
00:36:08,820 --> 00:36:12,220
And by the time you figure that out, the damage might already be done.

308
00:36:12,220 --> 00:36:33,500
So I think we really need to go away from this paradigm of, based on what we think attackers' motivations are, clearly to understanding their motivations, but also assuming that we might not fully understand their motivations, or their motivations may be ill-aimed,

309
00:36:33,500 --> 00:36:36,600
or that they might not even be intending to harm us.

310
00:36:36,600 --> 00:36:38,560
That's the way we stay safe.

311
00:36:38,560 --> 00:36:42,620
You know, it's not bury our head in the sand, no one's evil enough to attack healthcare.

312
00:36:42,620 --> 00:36:54,580
It's instead, assume it's being attacked every day because it is, and treat it like any other valuable resource that a hacker, you know, a malicious adversary might be going after, like a bank, for example.

313
00:36:54,720 --> 00:36:59,580
And these types of... and then also the research infrastructure is really important.

314
00:36:59,580 --> 00:37:08,880
You know, people don't necessarily equate the scientific method and institutions of higher learning as part of the healthcare infrastructure, but they truly are.

315
00:37:08,880 --> 00:37:16,680
Many universities in this world are connected directly to hospitals, like their networks are actually connected, right?

316
00:37:16,680 --> 00:37:24,400
So, in addition, the work that is done on the university side, or the biotech side, directly influences clinical practice.

317
00:37:24,400 --> 00:37:30,820
And if you take out, for instance, a COVID vaccine data cohort, right?

318
00:37:30,820 --> 00:37:35,180
So, we are testing the vaccine for the COVID rollout.

319
00:37:35,180 --> 00:37:43,300
If you attack the infrastructure that collects the data about those results, you could put the vaccine back weeks to months.

320
00:37:43,300 --> 00:37:46,400
And as a consequence, patients will die.

321
00:37:46,400 --> 00:37:49,820
That is a scary proposition.

322
00:37:49,820 --> 00:37:55,600
And we got to understand that it's not very clear where the boundaries of healthcare stop.

323
00:37:55,600 --> 00:38:08,400
And so, we really need a wider appreciation of what exactly is healthcare infrastructure and what domains are affecting the care of patients that are much broader than most people realize.

324
00:38:10,740 --> 00:38:19,240
Buddy, I want to talk really quickly about some of the definitive solutions that we're searching for with respect to COVID.

325
00:38:19,240 --> 00:38:26,200
And I think you mentioned that, you know, there are vaccines that are in the works.

326
00:38:26,200 --> 00:38:35,140
And I think, hopefully, people will be able to look back after all this is over with it and say, man, we really went through that process faster than any other time in human history.

327
00:38:35,140 --> 00:38:39,380
So, to talk about a vaccine, you know, I think they're already in stage three trials.

328
00:38:39,380 --> 00:38:43,440
It's in the candidate six months after this virus was first discovered.

329
00:38:43,440 --> 00:38:45,260
It's pretty incredible just from a science standpoint.

330
00:38:45,260 --> 00:38:57,660
But right now, you and I clinically, when we're taking care of these patients , we don't have direct therapeutics that are really targeted at how this particular virus works and the way that it infects and spreads.

331
00:38:57,680 --> 00:38:58,740
We have adjuncts.

332
00:38:58,740 --> 00:39:00,320
We have things that we think are helpful.

333
00:39:00,320 --> 00:39:10,820
And a lot of the care just kind of comes down to supportive practices with respect to managing organ system effects and things like that, so that, hopefully, patients recover on their own.

334
00:39:10,880 --> 00:39:18,420
So, we're still looking for therapeutics that work directly in inhibiting the virus mechanism of action and replication.

335
00:39:18,420 --> 00:39:21,200
We're still looking for vaccines, obviously, to be rolled out.

336
00:39:22,740 --> 00:39:39,040
I feel like there is a association there with how we think about some of the tools we have in security writ large and how those are implemented in healthcare and how we really haven't yet come to a place where we have healthcare-specific security tools or practices.

337
00:39:39,040 --> 00:39:51,980
This is obviously much more relevant to medical devices and things like that, but where do you think we are with respect to getting products and tools and practices that are tailored specifically for healthcare?

338
00:39:52,740 --> 00:39:54,100
Yeah, I think we're on our way.

339
00:39:54,100 --> 00:40:03,920
We take this slide image because when we first started into this and talking about this, shoot, Jeff, what it was like 10 years ago, 15 years ago?

340
00:40:04,400 --> 00:40:08,540
I just looked back on my timeline and we started med school 10 years ago.

341
00:40:08,580 --> 00:40:10,540
Congratulations, you old dude.

342
00:40:11,500 --> 00:40:21,120
When we first started getting into this, the only solutions that people would say to protect a hospital were basically just rebranded security tools from other industries, right?

343
00:40:21,120 --> 00:40:32,500
So, they basically just took, let's take the tenets and principles around PCI compliance and let's make your hospital PCI compliant for healthcare medical devices.

344
00:40:32,660 --> 00:40:35,840
And what we really saw was that just doesn't work.

345
00:40:35,840 --> 00:40:43,600
To draw an analogy from the medicine realm, we're not treating COVID by giving flu shots, right?

346
00:40:43,600 --> 00:40:48,360
There are no antibiotics that work for COVID, right?

347
00:40:48,360 --> 00:40:54,540
So, just because they work in other diseases doesn't mean they're going to work in this particular instance.

348
00:40:54,540 --> 00:41:08,640
And what we've been saying for a long time is that if you just borrow the tools from other industries without understanding how healthcare works and you deploy them in such a way, they're probably not going to be very effective, right?

349
00:41:08,640 --> 00:41:25,500
We have a big problem with legacy devices in healthcare, for example, that wouldn't be tolerated, legacy medical devices that run out-of-date operating systems that are essentially unpatchable, that have really nasty vulnerabilities and that will be around on your network for 10 years,

350
00:41:25,500 --> 00:41:26,520
for example.

351
00:41:26,540 --> 00:41:33,060
That wouldn't be tolerated in banking infrastructure at a large bank, in a large, well-resourced bank, right?

352
00:41:33,060 --> 00:41:37,720
They wouldn't let a machine on their network that had those vulnerabilities.

353
00:41:37,920 --> 00:41:47,700
But yet, we expect that if we take the same exact approach to banking security and apply it towards healthcare cybersecurity, that we're going to get the same results.

354
00:41:47,700 --> 00:41:50,340
And what you quickly realize is that that's just not possible.

355
00:41:50,340 --> 00:41:56,400
You have to really change your way and understand the context around clinical care, for example.

356
00:41:56,400 --> 00:42:02,800
You also have to understand how your cybersecurity tools impact clinical care, right?

357
00:42:02,800 --> 00:42:25,680
So, just as much as there's been examples of vulnerable imaging devices like CT scanners and MRI machines that can be infected with malware and cause availability issues, there's also been discussions about examples of patching these devices, so well-intentioned patching that results in essentially bricked devices.

358
00:42:25,680 --> 00:42:42,820
And if you don't have a CT scanner at a stroke center, for example, or if you had two and you take one out because it's been bricked by a failed patch, the next stroke patient or the next trauma patient that comes in to the hospital could have to wait longer for their scan.

359
00:42:42,900 --> 00:42:47,700
And that could mean the difference about whether they get a medicine in a critical time window.

360
00:42:47,700 --> 00:42:50,140
It could be the difference about whether they talk or they walk .

361
00:42:50,140 --> 00:42:56,900
It could be the difference between whether or not they go to surgery and get a bullet taken out of a particular location sooner.

362
00:42:56,980 --> 00:42:59,620
So, these have real implications.

363
00:42:59,620 --> 00:43:07,900
If you just think you can apply your same philosophy, your same tools, in exactly the same way in healthcare, you're going to be sorely mistaken.

364
00:43:07,980 --> 00:43:14,320
And you have to do so in a mindful way to avoid patient care implications and patient harm.

365
00:43:15,200 --> 00:43:17,040
I could not agree more, my friend.

366
00:43:17,040 --> 00:43:20,480
Listen, we could probably talk about this for another three hours.

367
00:43:20,480 --> 00:43:25,160
I think we have just barely scratched the surface here, but I think we're almost at the 45-minute mark.

368
00:43:25,160 --> 00:43:31,020
And what I want to do is leave some time for questions on the live session to make sure that we don't overstay our welcome.

369
00:43:32,360 --> 00:43:33,680
This has been really fun.

370
00:43:33,680 --> 00:43:35,580
I am so happy we got to do this.

371
00:43:35,640 --> 00:43:39,080
I want to thank, again, everybody at the Biohacking Village for giving us the opportunity.

372
00:43:39,080 --> 00:43:39,940
It's an honor.

373
00:43:40,100 --> 00:43:47,620
We wish we could see you guys and give you big aseptic hugs, but unfortunately, that's not the world that we're living in.

374
00:43:48,060 --> 00:43:50,860
We just hope everybody is staying safe and healthy.

375
00:43:50,940 --> 00:43:57,500
And hopefully this time next year, we'll all get together and have a have a beer and be able to have this behind us.

376
00:43:57,500 --> 00:43:59,260
Kwadi, I miss you, man.

377
00:43:59,300 --> 00:44:04,100
We should hang out sometime, virtually, of course.

378
00:44:04,100 --> 00:44:06,600
And looking forward to the Q&A.

379
00:44:06,860 --> 00:44:07,820
And thanks, everybody.

380
00:44:07,820 --> 00:44:08,460
Appreciate it.