WEBVTT 00:00.000 --> 00:03.280 Good morning, DEF CON biohacking village. 00:03.360 --> 00:05.240 It's an honor to be here. 00:05.560 --> 00:11.680 If you're confused where you are, you're somewhere in cyberspace at your home. 00:11.820 --> 00:17.420 Following the DEF CON tradition, you may be somewhere between sober and completely intoxicated. 00:17.420 --> 00:21.320 We recommend aggressive rehydration and, you know, take a shower. 00:21.320 --> 00:22.680 That'll really help out. 00:22.680 --> 00:25.820 But before you do so, we appreciate you coming to our talk here. 00:25.820 --> 00:29.220 The talk is entitled Lessons Learned from a Pale Horse. 00:29.220 --> 00:33.200 What COVID-19 can teach us about healthcare cybersecurity. 00:34.140 --> 00:35.440 How are you, buddy? 00:35.440 --> 00:37.600 We haven't seen each other in person for a while. 00:38.020 --> 00:41.600 I feel like I haven't seen anybody in person for a long time. 00:41.600 --> 00:46.920 Was it November when we last saw each other, which for us is like a decade? 00:47.220 --> 00:48.700 Yeah, too long. 00:48.700 --> 00:51.480 I feel like I'm really missing my hacker family. 00:51.660 --> 00:58.920 I've just been talking with my wife about how much I miss going to DEF CON, seeing people in person, walking around. 00:59.080 --> 01:04.280 And then also, it's kind of depressing to think about it, but it's also a kind of a cool opportunity. 01:04.280 --> 01:08.680 Here we are at the Biohacking Village, but invited to speak here on a cool topic like this. 01:08.720 --> 01:12.000 And people all around the globe are going to be able to watch this. 01:12.080 --> 01:13.720 So I think we should go ahead and kick it off. 01:13.720 --> 01:14.760 What do you think, Jeff? 01:15.000 --> 01:15.760 I totally agree. 01:15.760 --> 01:30.560 But first, I think it's just so important to shout out what an amazing accomplishment and achievement it is that villages like the Biohacking Village and others, and even DEF CON itself, have been pulled into this safe mode virtual experience. 01:30.560 --> 01:47.220 As people who have done events ourselves, I can't even imagine the amount of work it took to do this, knowing that our friends at the Biohacking Village, and I'm sure others, have been working since last DEF CON on doing an amazing physical event, and then all of a sudden having to reverse course and change that. 01:47.220 --> 01:53.160 So I just want to give them a huge shout out and major props for what is a job very well done. 01:53.500 --> 01:58.500 But yeah, golf clubs, sure, absolutely, and more and more. 01:59.760 --> 02:01.180 Let's kind of get into it, man. 02:01.460 --> 02:11.060 I think when we originally came up with this, so first of all, I guess for those of us who we haven't had the pleasure of meeting, my name is Replicant Jeff. 02:11.860 --> 02:16.320 I am an anesthesiologist and security researcher hacker. 02:17.400 --> 02:19.200 My name is Christian Nemeth. 02:19.200 --> 02:21.060 People call me Kawati. 02:21.060 --> 02:22.400 That's my handle. 02:22.520 --> 02:28.390 I'm an emergency medicine physician and assistant professor over at UC San Diego. 02:29.400 --> 02:36.620 So I mean, we've both had the privilege of taking care of patients during this global pandemic. 02:36.620 --> 02:43.420 We have, you know, been in the critical care units and the emergency room, treating patients with COVID-19. 02:43.420 --> 03:02.640 And it's been kind of a surreal experience for us because before all of this, we were and still obviously are, you know, advocates for security and health care, being security researchers and kind of having this thesis statement that healthcare security is more than just privacy and patient records and things like that. 03:02.640 --> 03:15.960 There are, you know, vulnerabilities and we've gone over this extensively at other DEF CONs and other gatherings where we're able to talk about these things, you know, medical devices and healthcare infrastructure are as vulnerable as any other area of connected life. 03:15.960 --> 03:25.440 And we know that those vulnerabilities have the potential to potentially affect patients, both in how we care for them and their long term outcomes. 03:25.440 --> 03:29.040 So we've kind of been pushing this thesis for a while. 03:29.040 --> 03:35.300 And then all of a sudden, we found ourselves kind of on the front lines, knee deep in COVID patients during this pandemic. 03:35.300 --> 03:47.460 And that's kind of changed, I think, a little bit of our perspective about ways in which we as a healthcare system can prepare for not just events like this, but also security related concerns as well. 03:47.460 --> 04:07.180 So I think what we wanted to do is kind of see were there any insights that we obtained from our clinical practice and kind of how we think about disaster medicine, which we'll get into and utilization of resources and readiness and preparedness in a medical type of emergency. 04:07.180 --> 04:11.160 Can we apply some of those thoughts and lessons to the security realm? 04:11.680 --> 04:12.940 Sound like a plan? 04:13.120 --> 04:14.160 Sounds like a plan. 04:14.160 --> 04:15.640 We're gonna go ahead and get kicked off. 04:15.640 --> 04:19.520 Many of you out there are like, what is disaster medicine? 04:19.520 --> 04:20.560 It doesn't even make any sense. 04:20.560 --> 04:23.760 Like I'm familiar with cardiology, like they take care of the heart. 04:23.760 --> 04:26.220 I'm familiar with gastroenterology. 04:26.220 --> 04:32.200 You know, they give me a Valium, have me show up next morning and then scope my intestines. 04:32.700 --> 04:35.720 Well, many of you out there might be wondering, what is disaster medicine? 04:35.720 --> 04:45.980 And so under medicine, generally a medicine, you know, surgery, the practice of taking care of someone's health and treating disease, there are all sorts of disciplines. 04:46.280 --> 04:48.040 I practice emergency medicine. 04:48.040 --> 04:51.500 Jeff practices pediatrics and anesthesia. 04:51.760 --> 05:00.580 And there's so much to know in modern medicine, new treatments, new diseases that we, or sorry, diseases that we learn more about. 05:00.840 --> 05:04.380 And as a consequence, it's impossible for a doctor to know all of it. 05:04.380 --> 05:10.400 And it would actually probably be very unsafe for a doctor to practice, you know, every form of medicine. 05:10.400 --> 05:12.200 So we specialize. 05:12.800 --> 05:25.860 Under the house of medicine with all these different specialties, there's a subspecialty, a niche, a further niche, if you will, that discusses and studies and practices disaster medicine. 05:25.900 --> 05:40.900 Disaster medicine is how do you take care of people, not when you're in a fancy hospital where you have two MRI machines, an entire trauma team, you know, dozens and dozens of doctors on a particular service, and hundreds of nurses. 05:40.900 --> 05:49.180 Instead, how do you take care of thousands of patients during an earthquake or during a hurricane ? 05:49.440 --> 05:55.060 How do you take care of patients as they're swelling through the front doors of your hospital during a pandemic? 05:55.060 --> 06:02.580 And you can see that there's some clear disaster medicine being practiced today all over the globe in response to the global pandemic. 06:02.580 --> 06:17.220 And this is a picture of a disaster in the United States and a particular specialized team that the government can call upon to remotely, sorry, to go to a particular location and practice disaster medicine. 06:17.220 --> 06:20.340 These are called DMAT teams or disaster medicine assistance teams. 06:20.340 --> 06:35.600 These are comprised of multidisciplinary teams, nurses, technicians, doctors, they'll go to a place in response to a disaster, they'll organize how they take care of all those patients, they'll deploy electronic health systems, and then they'll be able to help treat all of those people, 06:35.600 --> 06:39.720 perhaps in a high school gym, for instance, instead of a hospital. 06:39.720 --> 06:44.500 So these are called DMAT teams, they practice disaster medicine, and they study it. 06:44.500 --> 06:56.460 You know, lessons learned from Hurricane Maria, for example, well, we study that, do academic papers and publish them so that the next disaster that rolls around, we're better prepared to respond to that. 06:56.840 --> 07:05.100 Well, Jeff and I are thoroughly convinced that there should be a subsection of disaster medicine called cyber disaster medicine. 07:05.100 --> 07:11.440 And we picked a picture of the DEFCON CTF for a couple different reasons. 07:11.440 --> 07:31.880 One, because a lot of what cyber disaster medicine is going to be is merging the two disciplines of clinical practice, taking care of patients' health, treating disease, while also addressing technological problems, systems of connected medical technology that are malfunctioning or perhaps being attacked. 07:31.880 --> 07:34.580 That's really our premise of what Jeff had mentioned. 07:34.580 --> 07:53.560 Our argument, our thesis is that if you attack a hospital, because it's so connected, and so interdependent on vulnerable technology, if you attack that, it won't be available for patient care, or the integrity of the data flowing from these systems will be changed and unreliable, 07:53.560 --> 07:56.240 and as a consequence, patients' health will be affected. 07:56.240 --> 08:15.240 So we think there needs to be essentially a cyber DMAT team, so where we take doctors and hackers and nurses, put them in a team, and if some hospital in Nebraska or some hospital in Idaho gets hit by a ransomware attack, for example, and they are unable to take care of patients, 08:15.240 --> 08:35.280 they're going to need both the medical expertise, the person power to respond to taking care of the strokes and heart attacks that are happening, while also simultaneously working with the technical teams to mitigate the issue and fix those damages to the technological infrastructure to restore care. 08:35.280 --> 08:45.960 So we think convincingly, though, it's going to be more and more of a need of these hybrid teams, where we have both hackers and doctors responding to attacks on healthcare infrastructure. 08:45.960 --> 08:48.680 We call that cyber disaster medicine. 08:49.480 --> 09:00.580 And Claudia, just two points that I want to make real quick about the concept of disaster medicine in general is that it assumes that you're going to be operating from a standpoint of very limited and constrained resources. 09:00.760 --> 09:18.120 And it also implies in some sense that the outcomes you are able to achieve are going to be less than the ideal outcomes that you would have in a non -disaster situation, and that there is some sense of needing to triage priorities accordingly. 09:19.120 --> 09:19.980 Absolutely. 09:19.980 --> 09:26.380 And one of the kind of foundational tenets of disaster medicine is the concept you mentioned of triage. 09:26.420 --> 09:45.660 If you have 10 patients in front of you, one is dead or just nearly died, three are dying, and three are okay, and some are in between, you need a system to be able to respond in the right order to take care of the patients that you can best help with. 09:45.660 --> 09:52.100 So, you know, controversial part of this is, you know, don't treat the patients that are about to die. 09:52.100 --> 09:54.620 Those patients need advanced airways. 09:54.620 --> 09:59.680 They need, you know, five, six people to major surgery. 09:59.680 --> 10:01.100 Yeah, they might need major surgery. 10:01.100 --> 10:03.960 They might need, you know, a lot of broad spectrum antibiotics. 10:03.960 --> 10:05.980 They need a lot of things that you might not have. 10:06.080 --> 10:20.860 If you spend your time focusing on the people who are dying, doing CPR, those types of things, then those three people that might benefit from your care that don't need that many resources but still could have an adverse outcome if you don't pay attention to them immediately, 10:20.860 --> 10:21.840 those are affected. 10:21.840 --> 10:37.200 So, it's this concept of can you make a system, can you make a philosophy, if you will, a protocol to be able to respond and make decisions on who you treat with the limited resources you have and in what order. 10:37.200 --> 10:39.500 So, I think these are foundational things. 10:39.500 --> 10:41.260 I mean, if you don't have a choice, you don't have a choice. 10:41.260 --> 10:46.480 If you're responding after an earthquake, you can't treat everyone at the same time equally. 10:46.480 --> 10:47.960 You have to pick and choose. 10:48.560 --> 10:57.840 I think in some sense, the idea of triage in a healthcare delivery organization from a security standpoint has been one of the trickier things in normal times, right? 10:57.840 --> 11:00.500 Because we almost have like a paralysis of indecision. 11:00.660 --> 11:07.260 People like us talk about all the ways in which we could improve foundational and infrastructure security of a healthcare delivery organization. 11:07.260 --> 11:09.320 We talk about medical devices and things like that. 11:09.320 --> 11:22.280 And sometimes it can seem like there are too many things to fix, whereas this triage mentality helps us kind of focus our priorities and really kind of hone in on the things that may be actionable with the biggest yield and impact for resources invested. 11:23.300 --> 11:24.880 Yeah, I completely agree. 11:24.960 --> 11:26.800 We love security. 11:26.800 --> 11:28.320 You know, we drink the Kool-Aid. 11:28.320 --> 11:32.640 We are admittedly believe it is a big risk to patient safety. 11:32.640 --> 11:39.860 But this is just one of dozens of issues, really serious issues facing healthcare across the globe. 11:40.920 --> 11:42.360 Security is just one of them. 11:42.360 --> 11:48.860 For instance, you know, the disproportionate allocation of resources for disadvantaged populations, right? 11:48.860 --> 11:52.320 Like population health is a big deal, social determinants of health. 11:52.320 --> 11:53.860 Security is just one of these things. 11:53.860 --> 11:56.280 And I agree, there's this triage element of it. 11:56.280 --> 11:57.920 COVID's blown all that up, right? 11:57.920 --> 12:00.000 So we have a global pandemic. 12:00.000 --> 12:04.820 It is sucking every single resource it possibly can out of the healthcare system. 12:04.820 --> 12:10.700 And things like security, undoubtedly, in the triage, if you will, are going lower. 12:11.160 --> 12:12.400 I understand that. 12:12.400 --> 12:13.260 That's very important. 12:13.260 --> 12:14.400 You have to take care of those patients. 12:14.400 --> 12:27.780 But what I fear is that we are putting far more attention to treating the immediate issues of COVID, not realizing that we are really opening ourselves up to the vulnerabilities, and we're not fixing them. 12:27.780 --> 12:31.420 And as a consequence, we could have a one-two punch. 12:31.420 --> 12:35.760 We could have COVID and then a ransomware attack on top of it. 12:35.760 --> 12:41.420 Our ability to take care of patients in some of the hospitals across this country is already so hard. 12:41.500 --> 12:48.880 If we had to deal with a ransomware attack on top of it, my ability to take care of COVID patients in the emergency department is going to be hindered. 12:48.880 --> 12:50.880 That's going to hurt my patients. 12:50.900 --> 12:57.260 And so I think foundational security issues are still something to pay attention to during this pandemic. 12:57.910 --> 13:00.760 I mean, that's another tenet of disaster medicine, right? 13:00.760 --> 13:20.500 You need to fortify your infrastructure during a particular crisis with the anticipation that subsequent issues or events could even further hamper your ability to get the best outcomes in your emergency situation. 13:20.500 --> 13:48.760 So let's move on to some of the points that we came up with just in conversation earlier about some of the things that we as clinicians on the ICU core in the emergency room have drawn as parallels to some of the issues that we as security researchers wearing a different hat were worried about and kind of thinking about pre-COVID and see if there are some areas where we can draw parallels and maybe even lessons from that. 13:48.760 --> 13:54.580 So I want to talk a little bit about kind of just basic data gathering, right? 13:54.580 --> 13:59.620 So this idea of having the information you need in order to make actionable decisions. 13:59.620 --> 14:13.060 From the same point of the pandemic, I remember I was out of the country back in February on a medical surgical mission trip, and we at that point just started receiving information. 14:13.060 --> 14:14.320 I'm in Sacramento. 14:14.320 --> 14:33.340 I work at UC Davis Medical Center, and we were actually the first hospital in the country to care for a patient who was diagnosed with coronavirus, and they weren't able to identify the source of spread, so the first example of what we call the community-acquired case. 14:33.560 --> 14:44.540 And that kind of set off this initial first couple of weeks to early months of uncertainty where we really didn't have a good idea about what the epidemiology looked like, right? 14:44.620 --> 14:51.220 We knew that there were reports earlier in December about where it had originated from a global standpoint. 14:51.400 --> 15:01.600 We knew that we were starting to see cases in other parts of the world, particularly Europe, but we really didn't have a sense of what the overall disease burden was in the U.S. 15:01.600 --> 15:16.860 and our communities, and we thought that we were still at an earlier enough phase that we could do individual kind of contract tracing and isolation, kind of this containment model as opposed to the mitigation that we're now in. 15:18.700 --> 15:24.300 So I think there were a lot of factors that played into that, obviously, and we don't need to necessarily get into that as much. 15:24.300 --> 15:44.520 Some of the issues with cross-cultural communications between countries, some of the mechanisms that we had in place from a federal standpoint that were either kind of like mothballed or not rolled out quite as effectively, but really had a surveillance issue in the beginning period of this crisis. 15:44.520 --> 16:00.860 And so do you feel like in healthcare there's a similar almost like fog of war when it comes to security, when it comes to understanding the threats faced by individual organizations, and kind of how robust are we with respect to being able to communicate and share intelligence from that standpoint? 16:01.920 --> 16:05.080 I think in some regards we've made like huge strides, right? 16:05.080 --> 16:14.360 So things like organizations such as the Help ISAC allow partners to pretty quickly communicate some security issues. 16:14.360 --> 16:27.400 So for those of you listening or watching this video, if you're a part of that, you know, you're going to get multiple emails a day from some of these threat intelligence sharing organizations saying, oh, this is going on, pay attention to this. 16:27.400 --> 16:36.800 And sometimes the conversations even get to the point of, well, I built some tools, or these were particular rules I wrote, this is how I'm mitigating this particular attack. 16:37.100 --> 16:39.340 Those types of things do happen. 16:39.420 --> 16:47.900 But generally speaking, we are not, when I say we, healthcare security is not anywhere close to where it should be. 16:47.900 --> 16:53.480 Just because these organizations exist don't mean that many hospitals are taking advantage of them. 16:53.480 --> 17:05.420 Because of one of the primary things that we want to bring just back to everyone's mind is that there are not a lot of people that work, not a lot of security people that work for healthcare. 17:05.660 --> 17:10.820 I mean, there's a dearth of people and resources around insecurity around healthcare. 17:10.820 --> 17:21.300 So even if you do have robust communication channels, which I don't think we have, but let's say we do, you need people to receive that information, digest it, and act upon it. 17:21.300 --> 17:26.140 And so at the heart of this issue of COVID, we had very poor surveillance at the beginning. 17:26.140 --> 17:34.860 I think we have had a chronic issue, a chronic lack of appropriate surveillance of healthcare security. 17:35.000 --> 17:37.120 There are a couple of barriers, I think, to that. 17:37.120 --> 17:38.240 There's HIPAA. 17:38.340 --> 17:43.280 Now I'm going to go ahead and say, of course, I think I can speak for Jeff. 17:43.280 --> 17:44.980 We're big supporters of HIPAA. 17:44.980 --> 17:48.020 We think the protection of patient information is really, really important. 17:48.120 --> 17:52.320 We are hackers, so we care about our data and it being secure. 17:52.320 --> 18:05.980 We care about our But HIPAA, or if those of you who aren't up there, that piece of legislation that essentially penalizes people who breach protected health information, leak it, lose it, etc. 18:07.020 --> 18:11.120 It's been used as an example of why you can't share information. 18:11.120 --> 18:19.800 I can't talk about a breach when we lost a laptop, or I can't talk about a particular vulnerability, a piece of malware that hit because it might be a HIPAA concern. 18:19.900 --> 18:30.120 And we need to make sure HIPAA comes first, as opposed to information sharing and protecting the hospital down the street from getting hit with the exact same thing that I did. 18:30.120 --> 18:32.060 That should be the priority and it's not. 18:32.160 --> 18:34.100 There's liability concerns. 18:34.220 --> 18:42.820 So there's the thought of, if there is a breach of a hospital or a hospital is under attack, what will the hospital be liable for? 18:42.820 --> 19:00.780 If, for instance, the vulnerability that was exploited had a patch six months ago, and because health care entities deal a lot with other types of legal issues and security is not typically one of them, their legal teams tend to shy away from disclosing information, 19:00.780 --> 19:04.100 sharing information in a timely manner. 19:04.720 --> 19:07.600 There are always branding concerns. 19:07.600 --> 19:13.320 So people don't want to go get care at hospitals that have had breaches. 19:13.320 --> 19:14.260 Why? 19:14.260 --> 19:21.500 Because there are afraid their information is going to get breached or they're afraid while they're there that they're going to get hacked and something bad will happen to them. 19:21.500 --> 19:33.940 So health care institutions generally are adverse to sharing information because of branding concerns and market share competitions, which is some fierce, fierce competition in health care. 19:33.940 --> 19:38.900 I was going to say there's also an incredibly complex hierarchy, right? 19:38.900 --> 19:51.760 Even within a single health care delivery organization with respect to the number of people that are involved in some of those branding issues that you talked about, some of the legal and liability issues. 19:51.760 --> 20:00.620 And it's very hard to centralize and coordinate decisions with respect to security sometimes because they affect so many different aspects of a hospital's function. 20:00.680 --> 20:19.360 And we kind of saw something similar in the overall, I would say, government response to this current crisis is that you just have a lot of different levels of leadership, levels of decision-making, levels of stakeholders from a federal, state, and local level. 20:19.360 --> 20:27.840 And sometimes those wires can get crossed and sometimes there isn't the best communication with the degree to which their spheres of responsibilities overlap. 20:27.840 --> 20:37.200 So sometimes I think we make mutual assumptions that somebody else is covering a certain problem, whether it's things like PPE or bed capacity or things like that. 20:37.200 --> 20:45.940 We sometimes say, well, don't worry about the number of ICU beds we have because the federal government will send this hospital ship or we're expecting a shipment of PPE from the state. 20:45.940 --> 20:54.940 And sometimes I think that degree of organizational complexity makes it really, really difficult to make quick, streamlined decisions. 20:54.940 --> 20:58.520 And sometimes that can also affect the composition of the teams that you're working with, right? 20:58.520 --> 21:03.780 So if you have a system that is not quite as efficient or as effective, you can get pretty high turnover. 21:03.780 --> 21:06.940 I think we've seen that before in hospital security teams, right? 21:06.940 --> 21:13.560 There's this additional level of complexity that comes with working within healthcare that people from the outside aren't always accustomed to. 21:13.560 --> 21:18.240 And sometimes that can be very frustrating to the security professional working in healthcare for the first time. 21:18.240 --> 21:27.680 And I think we've both seen instances of pretty significant burnout and turnover in that sense, simply from the complexity of the overall organizational structure. 21:28.640 --> 21:29.860 Completely agree. 21:29.860 --> 21:33.460 You know, hackers want to make things better for the most part. 21:33.460 --> 21:36.080 You know, we could talk about malicious adversaries, etc. 21:36.080 --> 21:41.300 But that aside, hackers, security folks, they're trying to make things better. 21:41.300 --> 21:43.240 They're trying to make things more secure. 21:43.240 --> 21:52.400 And when they go work for a healthcare organization, that's a great opportunity to do some, to take your knowledge and your skills and put it towards helping people. 21:52.400 --> 22:05.300 You might not be at bedside pushing a medication and an IV, but if you're supporting the hospital's infrastructure that made that medication administration possible and safe and secure, you're really, really doing something good. 22:05.300 --> 22:22.820 Just like you mentioned, we've heard horror story after horror story about talented security professionals, talented hackers going and working at hospitals, taking a pay cut, and then finding concerning things, bringing them to the attention of their leadership, 22:22.820 --> 22:41.740 and at the end of the day saying, we can't fix that issue because of, insert some reason, the cardiologist said no, they want to use that vulnerable device because it's their favorite, or we don't have the budget to do that, we need to buy a new MRI machine, 22:41.740 --> 22:42.580 etc., etc. 22:42.580 --> 22:51.960 So it can be demoralizing to work for a healthcare organization in a security capacity and feel like you can't really change things. 22:51.960 --> 23:02.480 And a lot of that has to do with the bureaucratic complexities, you know, COVID, there are so many different agencies and state governments, etc., it's just turned into this bureaucratic nightmare. 23:02.660 --> 23:20.100 Even in the best of times, a hospital is still a bureaucratic nightmare with so many different layers of administration and clinical expertise that at the end of the day, the bureaucracy can cause rapid turnover of our security professionals. 23:20.100 --> 23:22.900 And, you know, we need them there. 23:22.900 --> 23:43.020 The 2017 Health and Human Services Task Force report, commissioned by Congress, came back and said they thought a minority of hospitals in the United States have even a single full-time security professional on staff, you know, but yet we still march forward connecting more systems together, 23:43.020 --> 23:49.960 increasing our attack surfaces, etc., without the commensurate investment in security personnel. 23:49.960 --> 23:59.640 As a consequence of that, we're putting ourselves in an even worse situation where we are more vulnerable, we have less people to respond to, and the bureaucracy is getting even more complex. 23:59.760 --> 24:01.960 It's an impossible proposition to face. 24:01.960 --> 24:10.260 That problem of turnover, it really highlights how important institutional memory is, right? 24:10.260 --> 24:17.100 And I think that was something that we saw from the standpoint of pandemic response, too, is that there were structures in place, there were playbooks in place. 24:17.120 --> 24:20.200 Some of the problems that we've run into could have potentially been solvable. 24:20.200 --> 24:33.160 And I think we've both seen examples of clinical situations with respect to security where, you know, people have worked on a problem, they've even come up with a potential solution to a problem, they've even started to implement that solution. 24:33.240 --> 24:40.880 And then they go, whether it's for, you know, other opportunities, or just the disillusionment that we've already talked about, they leave. 24:40.980 --> 24:47.680 And the next person coming in sometimes doesn't have the ability to pick up where they left off, they have to kind of reinvent the wheel from the very beginning. 24:47.700 --> 24:53.520 And that chance to build the institutional memory is kind of lost. 24:55.060 --> 24:56.020 Absolutely. 24:56.060 --> 25:06.580 And that's a problem in a lot of different industries, but it's particularly important in healthcare, because there are so much, there's so much specialized, weird medical devices. 25:06.580 --> 25:20.400 It feels like if you work at a hospital, you know, I don't work for IT at a hospital or security at a hospital, you don't only have to know the technical infrastructure and routers and firewalls like you do at any other organization, you also have to know all this weird, 25:20.400 --> 25:26.120 this device on the fourth floor is a 10 year old infusion pump. 25:26.120 --> 25:28.020 And it acts very strange. 25:28.020 --> 25:31.700 And we have tried our best to mitigate its vulnerabilities in the following way. 25:31.900 --> 25:33.320 And it does this function. 25:33.320 --> 25:44.420 And when it doesn't do this function, this is the health implication, there's so much more context around the technological infrastructure in a hospital that is outside the regular domain of security. 25:44.420 --> 25:59.520 And so if you don't have institutional memory, you can't pass down that knowledge, that healthcare context specific knowledge, and that doesn't exist, and you just have rapid turnover, you're risking someone forgetting about the device or what you did about it. 25:59.520 --> 26:04.500 And as a consequence, you're just putting yourself out there more and becoming even more vulnerable. 26:06.040 --> 26:15.680 So I want to talk about communication a little bit, because I think that this is something that has been very challenging from a clinical standpoint, right? 26:15.680 --> 26:32.100 And so tell me if you have had the experience where you are caring for these patients, you are constantly receiving updated protocols with respect to how to safely use protective equipment or the certain situations in which, you know, an aerosol generating procedure might be taking place. 26:32.100 --> 26:33.900 So you need to have an N95 at that point. 26:33.900 --> 26:38.580 But if you're just going into, you know, assess the patient, you can get away with contact droplet precautions. 26:38.740 --> 26:48.440 There's so much that we are learning in real time about the sort of natural course of this disease, about best practices for how to treat it. 26:48.440 --> 26:52.560 That communication from a clinical standpoint is very important. 26:52.860 --> 27:06.360 And there's a transparency that I think, with the best examples of this, it's very beneficial to kind of tell people, this is the information that we're seeing, this is how we're making these decisions, this is why we're implementing things in a certain way. 27:06.360 --> 27:26.760 And when you have situations where that's not the case, you know, whether it's canceling elective surgeries, whether it's how we allocate beds, whether it's our testing protocols and things like that, it's very demoralizing and kind of dispiriting sometimes for the clinicians across the country to be put in situations where they don't really understand how the decisions are made or how they're communicated. 27:28.380 --> 27:37.920 There is an entire other filter over that with respect to certain, you know, trustworthiness of information from a partisan or ideological standpoint that we need to get into. 27:37.920 --> 27:47.120 But clearly, communication and how we talk to each other during these types of situations has been key on the clinical side. 27:47.120 --> 27:53.900 And I was just wondering what your thoughts were with respect to how we talk about healthcare security and those issues. 27:54.860 --> 28:04.300 Yeah, I remember when we first started seeing COVID patients at my hospitals. 28:04.300 --> 28:12.300 And I remember many doctors across the country were getting their information about how to treat them on Twitter. 28:12.640 --> 28:17.040 You know, should you give large amounts of IV fluid? 28:17.040 --> 28:20.960 Should you give patients ibuprofen if they have... remember that? 28:20.960 --> 28:26.160 There was this issue about whether or not NSAIDs like ibuprofen could make it worse. 28:26.380 --> 28:28.980 There was... I remember this adamantly. 28:28.980 --> 28:45.560 The first time I had to intubate a COVID patient, it was because there was this very early information saying, hey, you should intubate these patients early instead of try non-invasive airway maneuvers like high flow oxygen or BiPAP. 28:45.560 --> 28:53.960 There was this fear around BiPAP that if you put this on, it's a mask, it goes over their mask and provides positive pressure and helps patients breathe. 28:53.960 --> 29:02.840 The fear was that that would aerosolize the virus and that everyone in the room, even if you were covered head to toe in PPE, would get the virus if you put a patient on BiPAP. 29:02.840 --> 29:13.600 So there's all these different communication streams, getting information on how to treat patients on Twitter, the academic literature, which is the foundation of how we treat patients, right? 29:13.600 --> 29:21.880 So in medicine, we do studies, we design things, and we collect data, we publish on the scientific method. 29:22.260 --> 29:30.980 In COVID, a lot of that we didn't have time for, like we didn't have random placebo controlled trials on ibuprofen yet. 29:30.980 --> 29:32.940 We didn't have this type of information. 29:32.940 --> 29:36.420 So these communication streams, they just weren't authoritarian. 29:36.420 --> 29:40.140 They weren't coming in a coherent way. 29:40.140 --> 29:42.180 There was conflicting information. 29:42.240 --> 29:54.780 There was a lot of concern about where the data was coming from, you know, and as a consequence, I think it really just paralyzed a lot of frontline clinicians. 29:54.780 --> 29:56.560 We were, what do we do? 29:56.560 --> 29:58.400 I heard we should do this yesterday. 29:58.400 --> 30:00.760 Now I'm hearing we shouldn't do it today. 30:01.160 --> 30:03.900 That was really unfortunate. 30:03.900 --> 30:07.760 Its parallels in healthcare cybersecurity are many. 30:07.760 --> 30:28.700 We've already touched on a few, you know, information sharing being one of them, but I just want to bring up a very important part of this, which is, if there is any silver lining out of what, you know, of the response to coronavirus, it's that the academic journals that a study could take years to collect data and publish, 30:28.700 --> 30:34.640 big journals like the New England Journal, Lancet, a few, JAMA, etc. 30:34.640 --> 30:39.900 They said, we need to rapidly review this literature and start getting it out there. 30:39.900 --> 30:46.420 So they reduced their standards for what would get published a little bit for the sake of, we need to rapidly publish. 30:46.800 --> 30:51.360 At the heart of that is this need for information sharing and communication. 30:51.380 --> 30:55.300 It wasn't the best, but at least they tried. 30:55.300 --> 30:57.680 We don't have that in healthcare cybersecurity. 30:57.700 --> 31:07.140 We don't have hospitals knowingly giving us information, data, anonymized data on attacks. 31:07.220 --> 31:12.280 We don't share data and study it critically and publish that very often. 31:12.280 --> 31:15.020 Instead, hospitals are saying, we got breached. 31:15.020 --> 31:16.040 We don't need to study this. 31:16.040 --> 31:17.680 We don't need to share the raw data. 31:17.680 --> 31:23.160 Instead, we need to forget that this happened, pay our HIPAA fine, and hope we don't ever get into scrutiny again. 31:23.160 --> 31:37.040 We really need to change our philosophy in healthcare security to collect data, pool data, design studies where we can make some meaningful conclusions at the end of the day. 31:37.040 --> 31:38.060 That's science. 31:38.060 --> 31:40.000 We need to share that with everyone. 31:40.000 --> 31:48.060 We need to go through peer review so that other people can review the data and make sure that what we're saying is consistent with what they've experienced. 31:48.060 --> 31:54.920 So at the end of the day, we can answer some fundamental questions that people on this video call have heard time and time again. 31:54.920 --> 31:59.760 For example, the question, should you pay the ransom if your hospital is ransomed? 31:59.760 --> 32:06.360 You'll hear 15 different opinions about whether or not you should pay the ransom if your hospital is under ransomware attack. 32:06.660 --> 32:26.360 But what we don't have is a reliable data set from all the prior hospitals who've been ransomed, looking at things like outcome, how much they paid so that we can take that data, make meaningful conclusions, and through the scientific method, provide recommendations at the end of the day that are evidence-based. 32:26.360 --> 32:29.100 In medicine, we call that evidence-based medicine. 32:29.100 --> 32:33.320 We want to pick the right treatments and do the right thing because there's evidence. 32:33.320 --> 32:38.440 In healthcare cybersecurity, we don't have the evidence base because we don't share it. 32:38.440 --> 32:40.440 We really need to change that. 32:40.520 --> 32:50.180 COVID, we were able to, not perfectly, but we saw some glimmering hopefully in some respects, particularly with the journals, of that getting better. 32:50.980 --> 32:52.220 Yeah, I totally agree. 32:52.220 --> 33:01.340 I want to just go back and clarify too that when talking about the mixed messages that we had early on, that in and of itself is not a problem. 33:01.440 --> 33:11.520 It's okay if we don't know initially in a situation like this, whether the best clinical intervention is invasive mechanical ventilation or non-invasive positive pressure ventilation. 33:11.540 --> 33:22.420 It's okay in the initial period of this when we're still collecting those data points to be able to say, we don't know, there are a couple of different possibilities here and we're going to try one or the other. 33:22.480 --> 33:23.700 I mean, that's the scientific method. 33:23.700 --> 33:26.940 That's the process by which we generate a hypothesis and then test it. 33:26.940 --> 33:31.740 So having different options or different messages initially is not an issue. 33:31.740 --> 33:35.020 It's then needing to, as you said, gather that data. 33:35.020 --> 33:48.460 And I think we, even before all of this, we have been of the perspective that if it does turn out that we are able to look back in five to ten years, that healthcare security was not necessarily the issue of magnitude we thought it was. 33:48.460 --> 34:05.800 I think you and I, as scientists, are both going to be fine with that and able to say, you know, we're much more at peace with the concept of advocating for these issues and for it not turning out to be a big patient safety issue than if we were to sort of ignore them and allow it to be that. 34:05.960 --> 34:17.760 As kind of a tangent to that, I just wanted to ask you briefly, because from a standpoint of communication in this space, in the healthcare security space, we often get opposing viewpoints, which is totally fine. 34:18.600 --> 34:38.580 But something I've been thinking about is we have come into conversations with people who have said, you know, healthcare is something that we don't think attackers are particularly motivated to sort of target or focus on, because, you know, it's a hospital and why would you go after a hospital or why would you go after a medical device? 34:38.580 --> 34:42.240 We just don't think that's going to be a powerful motivating factor for people. 34:42.600 --> 34:54.360 We've obviously seen some examples over the last couple of months where there have been attacks at institutions that were actively treating COVID patients or actively engaged in COVID research. 34:54.560 --> 35:03.460 And it seems that in some of those cases, the particular, you know, there was a very precise targeting based on that fact and that situation. 35:03.460 --> 35:15.840 What do you think about the argument now that healthcare is sort of this different sacrosanct space that won't necessarily be the focus of other types of attacks because of its kind of unique nature in that sense? 35:16.560 --> 35:18.300 Yeah, I think that's demonstrably false. 35:18.300 --> 35:32.640 You brought up a couple of good examples of adversaries who willfully have targeted healthcare infrastructure, primarily COVID research, for their own gain. 35:32.860 --> 35:44.420 And I think those out there that are still saying, you know, hackers aren't going to target healthcare because no one would ever be that evil, really just need to wake up to the fact that two things are true. 35:44.420 --> 35:46.840 One, adversaries are doing that. 35:46.960 --> 35:49.520 Attacks are increasing, they're not decreasing. 35:50.000 --> 35:55.260 And then two, many adversaries might not even know that they're attacking healthcare, right? 35:55.260 --> 36:02.640 So there's no set of IP addresses that are only allocated to hospitals, right? 36:02.640 --> 36:08.820 So if you're out there scanning, trying to propagate malware, you could hit a hospital and not even know it, right? 36:08.820 --> 36:12.220 And by the time you figure that out, the damage might already be done. 36:12.220 --> 36:33.500 So I think we really need to go away from this paradigm of, based on what we think attackers' motivations are, clearly to understanding their motivations, but also assuming that we might not fully understand their motivations, or their motivations may be ill-aimed, 36:33.500 --> 36:36.600 or that they might not even be intending to harm us. 36:36.600 --> 36:38.560 That's the way we stay safe. 36:38.560 --> 36:42.620 You know, it's not bury our head in the sand, no one's evil enough to attack healthcare. 36:42.620 --> 36:54.580 It's instead, assume it's being attacked every day because it is, and treat it like any other valuable resource that a hacker, you know, a malicious adversary might be going after, like a bank, for example. 36:54.720 --> 36:59.580 And these types of... and then also the research infrastructure is really important. 36:59.580 --> 37:08.880 You know, people don't necessarily equate the scientific method and institutions of higher learning as part of the healthcare infrastructure, but they truly are. 37:08.880 --> 37:16.680 Many universities in this world are connected directly to hospitals, like their networks are actually connected, right? 37:16.680 --> 37:24.400 So, in addition, the work that is done on the university side, or the biotech side, directly influences clinical practice. 37:24.400 --> 37:30.820 And if you take out, for instance, a COVID vaccine data cohort, right? 37:30.820 --> 37:35.180 So, we are testing the vaccine for the COVID rollout. 37:35.180 --> 37:43.300 If you attack the infrastructure that collects the data about those results, you could put the vaccine back weeks to months. 37:43.300 --> 37:46.400 And as a consequence, patients will die. 37:46.400 --> 37:49.820 That is a scary proposition. 37:49.820 --> 37:55.600 And we got to understand that it's not very clear where the boundaries of healthcare stop. 37:55.600 --> 38:08.400 And so, we really need a wider appreciation of what exactly is healthcare infrastructure and what domains are affecting the care of patients that are much broader than most people realize. 38:10.740 --> 38:19.240 Buddy, I want to talk really quickly about some of the definitive solutions that we're searching for with respect to COVID. 38:19.240 --> 38:26.200 And I think you mentioned that, you know, there are vaccines that are in the works. 38:26.200 --> 38:35.140 And I think, hopefully, people will be able to look back after all this is over with it and say, man, we really went through that process faster than any other time in human history. 38:35.140 --> 38:39.380 So, to talk about a vaccine, you know, I think they're already in stage three trials. 38:39.380 --> 38:43.440 It's in the candidate six months after this virus was first discovered. 38:43.440 --> 38:45.260 It's pretty incredible just from a science standpoint. 38:45.260 --> 38:57.660 But right now, you and I clinically, when we're taking care of these patients , we don't have direct therapeutics that are really targeted at how this particular virus works and the way that it infects and spreads. 38:57.680 --> 38:58.740 We have adjuncts. 38:58.740 --> 39:00.320 We have things that we think are helpful. 39:00.320 --> 39:10.820 And a lot of the care just kind of comes down to supportive practices with respect to managing organ system effects and things like that, so that, hopefully, patients recover on their own. 39:10.880 --> 39:18.420 So, we're still looking for therapeutics that work directly in inhibiting the virus mechanism of action and replication. 39:18.420 --> 39:21.200 We're still looking for vaccines, obviously, to be rolled out. 39:22.740 --> 39:39.040 I feel like there is a association there with how we think about some of the tools we have in security writ large and how those are implemented in healthcare and how we really haven't yet come to a place where we have healthcare-specific security tools or practices. 39:39.040 --> 39:51.980 This is obviously much more relevant to medical devices and things like that, but where do you think we are with respect to getting products and tools and practices that are tailored specifically for healthcare? 39:52.740 --> 39:54.100 Yeah, I think we're on our way. 39:54.100 --> 40:03.920 We take this slide image because when we first started into this and talking about this, shoot, Jeff, what it was like 10 years ago, 15 years ago? 40:04.400 --> 40:08.540 I just looked back on my timeline and we started med school 10 years ago. 40:08.580 --> 40:10.540 Congratulations, you old dude. 40:11.500 --> 40:21.120 When we first started getting into this, the only solutions that people would say to protect a hospital were basically just rebranded security tools from other industries, right? 40:21.120 --> 40:32.500 So, they basically just took, let's take the tenets and principles around PCI compliance and let's make your hospital PCI compliant for healthcare medical devices. 40:32.660 --> 40:35.840 And what we really saw was that just doesn't work. 40:35.840 --> 40:43.600 To draw an analogy from the medicine realm, we're not treating COVID by giving flu shots, right? 40:43.600 --> 40:48.360 There are no antibiotics that work for COVID, right? 40:48.360 --> 40:54.540 So, just because they work in other diseases doesn't mean they're going to work in this particular instance. 40:54.540 --> 41:08.640 And what we've been saying for a long time is that if you just borrow the tools from other industries without understanding how healthcare works and you deploy them in such a way, they're probably not going to be very effective, right? 41:08.640 --> 41:25.500 We have a big problem with legacy devices in healthcare, for example, that wouldn't be tolerated, legacy medical devices that run out-of-date operating systems that are essentially unpatchable, that have really nasty vulnerabilities and that will be around on your network for 10 years, 41:25.500 --> 41:26.520 for example. 41:26.540 --> 41:33.060 That wouldn't be tolerated in banking infrastructure at a large bank, in a large, well-resourced bank, right? 41:33.060 --> 41:37.720 They wouldn't let a machine on their network that had those vulnerabilities. 41:37.920 --> 41:47.700 But yet, we expect that if we take the same exact approach to banking security and apply it towards healthcare cybersecurity, that we're going to get the same results. 41:47.700 --> 41:50.340 And what you quickly realize is that that's just not possible. 41:50.340 --> 41:56.400 You have to really change your way and understand the context around clinical care, for example. 41:56.400 --> 42:02.800 You also have to understand how your cybersecurity tools impact clinical care, right? 42:02.800 --> 42:25.680 So, just as much as there's been examples of vulnerable imaging devices like CT scanners and MRI machines that can be infected with malware and cause availability issues, there's also been discussions about examples of patching these devices, so well-intentioned patching that results in essentially bricked devices. 42:25.680 --> 42:42.820 And if you don't have a CT scanner at a stroke center, for example, or if you had two and you take one out because it's been bricked by a failed patch, the next stroke patient or the next trauma patient that comes in to the hospital could have to wait longer for their scan. 42:42.900 --> 42:47.700 And that could mean the difference about whether they get a medicine in a critical time window. 42:47.700 --> 42:50.140 It could be the difference about whether they talk or they walk . 42:50.140 --> 42:56.900 It could be the difference between whether or not they go to surgery and get a bullet taken out of a particular location sooner. 42:56.980 --> 42:59.620 So, these have real implications. 42:59.620 --> 43:07.900 If you just think you can apply your same philosophy, your same tools, in exactly the same way in healthcare, you're going to be sorely mistaken. 43:07.980 --> 43:14.320 And you have to do so in a mindful way to avoid patient care implications and patient harm. 43:15.200 --> 43:17.040 I could not agree more, my friend. 43:17.040 --> 43:20.480 Listen, we could probably talk about this for another three hours. 43:20.480 --> 43:25.160 I think we have just barely scratched the surface here, but I think we're almost at the 45-minute mark. 43:25.160 --> 43:31.020 And what I want to do is leave some time for questions on the live session to make sure that we don't overstay our welcome. 43:32.360 --> 43:33.680 This has been really fun. 43:33.680 --> 43:35.580 I am so happy we got to do this. 43:35.640 --> 43:39.080 I want to thank, again, everybody at the Biohacking Village for giving us the opportunity. 43:39.080 --> 43:39.940 It's an honor. 43:40.100 --> 43:47.620 We wish we could see you guys and give you big aseptic hugs, but unfortunately, that's not the world that we're living in. 43:48.060 --> 43:50.860 We just hope everybody is staying safe and healthy. 43:50.940 --> 43:57.500 And hopefully this time next year, we'll all get together and have a have a beer and be able to have this behind us. 43:57.500 --> 43:59.260 Kwadi, I miss you, man. 43:59.300 --> 44:04.100 We should hang out sometime, virtually, of course. 44:04.100 --> 44:06.600 And looking forward to the Q&A. 44:06.860 --> 44:07.820 And thanks, everybody. 44:07.820 --> 44:08.460 Appreciate it.