start	end	text
0	4520	Thanks, everyone, for joining. This is Securing a Medical Device Network on a Shoestring Budget
5620	12880	by Helen and myself, Matt McMahon. We'll be your presenters today. This will be recorded,
12880	18920	pre-recorded and streamed, but we will be available on Discord to answer any questions.
19580	23560	Just a little bit of an intro in the class. This initially was a four-hour course,
23560	29300	and we cut it down, so we will be trying to cover a good amount of topics in a little bit
29300	34520	of a short time, but it will be recorded and played again, so they're available again on
34520	39040	YouTube. So if you need to get up to get a drink or use the restroom, feel free to do that and
39040	45400	come back, and you can look at any parts that you missed afterwards. So just to kind of give a quick
45400	51700	synopsis of where this training came from. So Helen and I both work for a medical device company
51700	58060	in their cybersecurity group. We're also both either current or former adjunct professors
58060	62520	teaching courses in cybersecurity, healthcare, digital forensics, and things like that.
62640	68380	So we thought this would be a really good class for hospitals to kind of understand some of the
68380	73240	basics. So this is a totally free course, open to anyone, and we're really just looking to share
73240	80240	knowledge. So a note on our target audience. We developed this course initially for the target
80240	86460	audience being like a small critical access, like 25-bed hospital, with a smaller IT staff and a
86460	94360	limited budget. They may not have any cybersecurity staff currently in the workforce.
95000	100080	So there will be things that larger hospital organizations or other individuals can get out
100080	105060	of this course, but if some of the material, at least in the beginning, seems kind of basic,
105060	111600	just kind of bear with us. We're trying to set the stage so that target audience can pick up
111600	117420	and kind of follow us for the whole course. So what we're going to cover today, we're going
117420	123980	to have six different distinct modules. So I'll start with the healthcare threat landscape today,
123980	128140	then Helen will take over for basic network security within the hospital,
128140	132640	network monitoring and scanning, developing and regular patching strategies,
132640	137820	then I'll take back over at the end for physical security, and then vetting of third parties.
138420	143260	We'll then have a short break, and then we'll come back for a panel discussion,
143740	150300	both with Helen and myself, and a number of other experts from the hospital cybersecurity space. So
151160	157160	make sure to come back for that. As I said before, this training is pre-recorded. So we are,
157160	161040	while we're teaching, we're not teaching right now, this was pre-recorded, so we are able to
161040	167640	answer questions on the Discord channel. And be aware, too, that we do have that panel afterwards.
167640	173120	If there's a question specifically on how a hospital may do something, we may defer to the
173120	178040	panel, just because then you'd be able to actually hear from hospital staff on how they would handle
178040	185000	certain situations. So just to kind of start off and set the stage, it's important before you really
185000	189240	can secure or defend anything, you kind of need to know your current threat landscape, and certainly
189240	194120	healthcare is a little bit different than some other threat landscapes. So a lot of the data
194120	199120	that we'll be pulling from the Verizon Data Breach Investigation Report, obviously that comes out
199120	203380	each year, there's a lot of good data that comes with it. But there's another report called the
203380	210120	Protected Health Information Data Breach Report. It takes the DBIR's data specifically just on
210120	215380	healthcare and the healthcare sector related to data breaches. It takes those stats over the
215380	220760	course of three years and extrapolates some data from just the healthcare sector. So we'll be
220760	228740	talking a lot about information from those reports. PHI, I mean, this is probably not
228740	233120	anything new to anyone that's currently working in the field, but just in case you don't know,
233120	239280	medical record, why is it valuable? It could potentially sell for 10 to 20 times on the
239980	245100	black market. What a credit card record could sell for, you can't turn off a PHI record,
245100	250320	protected health information record, like you can a credit card. An attacker could potentially
250320	256320	use the stolen data to acquire expensive medical equipments or technology. And then an attacker
256320	261940	could also combine PHI with a provider number to file fraudulent insurance claims. Just
263320	269660	very quick, some possible things that could happen. One of the things that makes the threat
269660	276040	landscape and healthcare really unique is the prevalence of insider threats. And when we say
276040	280980	insider threats, we typically think of malicious insider threats, but healthcare is unique in that
281640	286580	there's a lot of error that factors into that as well. So non-malicious errors and
287320	294400	data breaches as a result of that. In healthcare, 58% of data breaches over the course of those
294400	299600	three years that were recorded did have some insider component. Again, both malicious and
299600	304420	non-malicious, but that is important to note. It's the only critical infrastructure sector in the
304420	308920	United States. They're actually more likely to be compromised internally than externally. So
308920	315240	we want to make sure that we're taking into account that. So what's the breakdown of some
315240	321440	of the threats? So we talked, I said some of this were non-malicious, so a lot of it is error.
321440	329500	You can see over 30%, 33.5% is just error. So individual staff, maybe clinical staff working
329500	334900	long hours, swing shifts, too many patients than they would normally have certainly in the COVID
334900	340440	era. Working with technology that they might not be familiar with, it's easy to make a mistake
340440	345760	and cause a data breach that way. Misuse would be the second highest, just under 30%.
346980	352680	Misuse in this case would have a deliberate component. So it could be as simple as nurse A
352680	358380	tells nurse B, hey, did you hear about this patient? And nurse B shouldn't have access to
358380	363080	that patient, or it could be selling hundreds of thousands of records. So there's a broad
363080	369380	spectrum there. Physical, we'll touch on a little bit. And what's interesting with this graph,
369380	375280	is you see, if you look on the news, or just search cybersecurity and healthcare,
376080	380100	pretty much what you're going to see is a lot about ransomware. And certainly we'll talk about
380100	386180	ransomware in this presentation about how prevalent it is, and how it's becoming much
386180	390640	more prevalent. But it's just important if you're trying to defend the hospital's network,
390640	394400	to kind of know where your threats are really coming from. Certainly you want to defend against
395040	401020	quote, unquote, hacking, or malware, ransomware. But we'll also want to make sure that we're aware
401020	409560	of the fact that our largest threats might actually be already inside the building,
409560	415580	someone that we've actually given access to. So if we dive down into those errors, again,
415580	423520	over 30%, misdelivery was the biggest. So sending PHI somewhere where it wasn't intended to go to.
424700	430700	Disposal error, so we think we've properly cleared a device, or this could be paper records as well.
430960	436320	Loss, we just lost the data, we didn't know where it went to. Publishing error. Publishing error
436320	440940	typically would be like a study. So we've released a study that we think had anonymized data,
440940	447720	that data was able to be de-anonymized, and they were able to... basically resulted in a data
447720	454000	breach. What do you find interesting about this is, there was a quote in the report that said
454000	459520	healthcare has a paper problem. Typically when you think data breach, we think electronic,
459520	464140	but 43% of all the data breaches that were recorded were actually still on paper.
464440	469100	So moving to electronic could actually reduce the overall data breaches.
469760	474680	Data misuse, so again, misuse required that distinct motive. It could be as simple as
474680	481280	nurse A tells nurse B, hey, your ex-significant other is in the hospital, did you hear about it?
481280	489100	Or it could be selling records. And let's see, and typically this involved at least two-thirds
489100	493980	of privilege abuse. So accessing data that they shouldn't have access to,
493980	503280	maybe escalating their own privileges. Physical, physical was pretty close to 100%, over 95% just
503280	510300	stolen on encrypted laptops. If this was a doctor's laptop that was stolen but encrypted,
510300	515340	they don't include that as a potential data breach, just because they assume that an attacker
515340	520000	wouldn't be able to get to that data. But if the data is non-encrypted, then they assume that they
520000	527440	are able to get to that. So yeah, interesting with this picture, that while the attacker did
527440	533080	break the window and steal the unencrypted laptop full of PHI, they did at least leave the font
533080	540740	So that's nice. And quote-unquote hacking, this is kind of a broad, broad category,
540740	547520	but this included almost 50% was phishing, social engineering. And again, just try to remember that
548280	553520	this is below 15% of the overall data breaches. So again, we're just talking about data breaches
553520	559140	here, not necessarily cyber attacks that bring down hospital networks, but specifically data
559140	566400	breaches and breaking that down. So just under 50% of that was using stolen credentials that
566400	572140	were harvested, again, potentially from phishing or social engineering. Over 20% was brute forcing
572320	580620	a password. 17.9%, so almost 18%, was using a backdoor on a device, could be a medical device,
580620	587140	could be software, whatever that backdoor is. And then you see minimal for the other ones.
588240	595460	Malware, so general category of malware is just under 11%. Again, kind of keep in mind the
595460	602560	prevalence of that internal error, and over 70% of that was specifically ransomware. So obviously,
602560	612020	that's a factor. So while I am trying to highlight the fact that insider threat is statistically a
612020	616700	lot bigger for data breach, data breaches within the healthcare sector, obviously,
616700	622380	malware, there is certain caveats that we need to talk about, it is certainly increasing.
622980	627680	This was an interesting report that came up from NTT Security. They published a report
627680	633620	back in, it's a little bit dated now, but Q2 of 2016. They looked at their entire,
633620	639760	so their security company, they looked at their entire customer portfolio, 7.4% of their customers,
639760	645820	only 7.4% of their customers were hospitals. But those hospitals made up 88% of their clients
645820	651080	that were affected by ransomware. So it really said, wow, while hospitals make up a small
651080	655560	percentage of our actual customer base, they're disproportionately affected by ransomware.
655560	661800	And we'll certainly get in this class as to why that is. Flat networks, lack of proper
662680	667920	security controls, things like that. And it was predicted that ransomware attacks in the
667920	674000	healthcare sector would quadruple in 2020. And certainly we've seen an increase in that.
676460	681400	All right. COVID-19, I can't really have a talk now and not talk about COVID-19. So
681400	686480	certainly that's changed the threat landscape as well. Not just in healthcare, but across the board
686480	693820	we've seen a 667% increase in COVID-19 related email attacks, just from February to June.
693820	702000	And then just cyber attacks in general up 37% in May. And what's interesting with COVID too,
702000	706540	is we're not just seeing cyber attacks, but we're also seeing a lot of fraud.
706660	712700	Interpol has seized over $14 million worth of fake PPE. And certainly hospitals have been caught with
713760	719220	purchasing or trying to purchase PPE in the past when it was a little bit harder to get.
719760	724940	Maybe they had to front funds to get those, and then they just never got their equipment. So
726000	730100	there's a lot of different possibilities there for compromise.
730720	734640	For folks that work in the cybersecurity and healthcare space or industry,
734640	739640	this was an interesting report that came out in March. Basically a number of ransomware shops
740160	748520	said that, no, we won't specifically target the healthcare sector or hospitals during a pandemic,
748520	754960	because that would be incredibly bad. Unfortunately, that was not the case.
754960	761840	They still have continued to attack the healthcare sector. And in many cases, it's actually
761840	769200	increased. So we've seen Health ISAC has reported an increase in COVID-19 themed attacks, up 20% to
769200	774960	30% in just phishing, specifically targeting the healthcare sector. And you can see there,
774960	779980	the average ransom payments. And obviously, during a pandemic, there's a lot of things that
779980	786360	make this more difficult. Obviously, getting physical access to a device, if it's in a
786360	791560	quarantined area, to be able to update it. If you need to physically access the device to
791560	799140	update something, that just adds an extra layer of issue.
799140	801760	So how many hospitals do we know of that have actually been attacked
802440	809240	or been compromised by ransomware, specifically using a COVID-19 hook?
809440	815520	According to Bill Siegel, the CEO of Coveware, there's been at least half a dozen just in the
815520	819600	US. There's probably significantly more than that, but those are the ones that we're aware of.
821020	825520	There is certainly a good amount of under-reporting. It's difficult to really
825520	831760	understand the scope. Hospitals, in a lot of cases, pay the ransom. It may not be reported
831760	837340	if we don't believe that there's a data breach. So it's hard to tell the exact number, but we
837340	844180	know of at least half a dozen in the US. In Canada, a Canadian government hospital there
844180	851440	was affected. It was specifically targeted using a spoofed email that appeared to look like it
851440	855920	came from the World Health Organization. It was procurement-related, so this was a couple months
855920	861720	back when procurement of gloves, masks, things like that were quite difficult. If you read the
862340	868320	email, it was really easy to spot if you knew what you were looking for. The authors really
868320	874100	didn't make any attempt to make it look legit in any way, but because of the need for procurement
874100	880680	materials at that point, again, gloves and masks, it was clicked on and propagated.
881440	889880	Spain. Spain at that time was particularly hard-hit by COVID-19, and the Spanish hospital
889880	894560	was hit by the Netwalker ransomware. It specifically targeted Spanish hospitals,
894560	900740	specifically during the peak of the virus there, using a malicious attachment.
902080	908800	Czech Republic as well. Brno, I believe, had that saying. I hope that's not incorrect.
908800	912360	University Hospital, which was the second largest hospital in the Czech Republic,
912360	921840	was taken offline. It was forced to shut down, and this attack was very want-to-cry-esque.
925770	930570	So not just really hospitals, but we're also looking at laboratories and supply chains.
930570	937910	So in California, the 10X Genomics Company was hit by COVID-19-related or themed ransomware.
937910	943150	A urology consultant company was hit. Medical device manufacturers have been hit.
944590	948270	So why target healthcare? Well, hospitals, as we said earlier,
948270	954050	unfortunately often pay the ransom. There is a need to be online. These technologies are
954050	958790	life and death, and often they have less resources to be able to defend themselves,
958790	967670	so it might be easier to attack a hospital. So some quick key takeaways. Privilege and
967670	973770	escalation abuse was two-thirds of all the incidents. Now, having been someone that worked
973770	981750	for a hospital for a while, doing application access and having to monitor access, I can
981750	990650	certainly say that this is difficult. A lot of this really depends on how those individuals are
991650	996230	keeping access. Certainly, you want to restrict access as much as possible. You don't want to
996230	1003810	leave it open. But in my case anyway, it was certainly noted that the application support
1003810	1009570	staff were working on call on the weekends, and they were not being paid to work on call.
1009570	1012610	So if you're doing that, you're basically creating a situation that
1013770	1021630	encourages or incentivizes your IT staff to leave access more broadly open than it probably needs
1021630	1027010	to be so that they're not getting a call at 11 o'clock at night during shift change when
1027010	1034170	new nurses come on, maybe temporary nurses that need access. So just kind of think about that,
1034170	1041570	maybe how your hospital IT staff or application support staff have to deal with access. Do you
1041570	1046930	have someone that's constantly working, or is it on call? It certainly comes into play.
1049330	1054310	Data mishandling. So this was, you know, kind of a cultural problem that we're talking about where,
1054310	1059590	you know, nurse A tells nurse B, hey, did you hear about this individual? This was almost 17%
1059590	1066310	of the data breach cases. So, you know, something to kind of consider. Certainly, it's human nature,
1066310	1071810	curiosity, so it's difficult, but something to consider. Fraud in the healthcare sector,
1071810	1076170	there is a large amount of fraud in the healthcare sector. It's the third highest
1076770	1081770	industry for fraud in the United States, right behind the government sector, and finance was
1081770	1089570	number one. Breach discovery is also an issue within healthcare. Approximately one-third of
1089570	1094510	the data breaches in the three-year study were not discovered for years. Another third were not
1094510	1101750	discovered for months. So it's important to kind of note that, you know, when you're looking at the
1101750	1106810	numbers or considering if you've been breached, you know, many hospitals may not even be aware of
1106810	1113250	it, so... And just one other thing that kind of complicates this, budgeting and staffing
1113250	1118730	realities, it's commonly cited by CISOs from hospitals that 3% of the hospital budget goes
1118730	1126670	towards IT, and 3% of that 3% goes to security. So they really don't have a lot of, you know,
1126670	1132770	either the staff or the resources that they need to dedicate to security. So that really kind of
1132770	1137010	leads into one of the reasons why we built this course, to try to offer some, you know, free
1137010	1144630	technology, in this case free training, or low-cost technology that could be used to secure a
1145090	1152430	hospital's network. Another issue is what's called agency staff. So at any given hospital, up to 10%
1152430	1158730	of the nurses could potentially be agency staff. So someone calls in, we need someone to, you know,
1158730	1163970	take their shift, they call the agency, they get a nurse, that person then has to be added to all
1163970	1169870	the hospital systems. Certainly if you're working in IT at a hospital, please fight the urge to
1169870	1176470	just create entries in your system called agency nurse 1, 2, or 3. It certainly makes it easier
1176470	1181690	for IT staff, but obviously, you know, for logging and things like that, it could be a bit of a
1181690	1188690	nightmare. So just kind of be aware of that. Just some quick insights from the 2009 HIMSS report
1189370	1196450	of all of the hospitals that were surveyed. Over the course of the last 12 months, 82% of hospitals
1197050	1203230	said that they did have a recent significant security incident. So kind of good to note of
1203230	1209750	the prevalence of how much this is happening. Legacy systems are also an issue. 72% of hospitals
1209750	1216890	said that up to between 1 and 10% of their technology is outdated legacy tech. And if you
1216890	1224270	look at 2016, the 2016 HIMSS study, it interviewed or looked at 200 different hospitals, but I believe
1224470	1228950	a third of those, or I shouldn't say hospitals, 200 different medical facilities, but a third of
1228950	1235510	those were like doctor's offices and smaller offices. So certainly those, that third skewed
1235510	1239730	the stats a little bit. So you can kind of factor that in when you're looking at these numbers.
1239750	1245330	But it's still a little bit scary to even think that those, even if it's like an outpatient clinic
1245330	1251110	or a doctor's office, that numbers would be this high. So 14% of those medical facilities lacked
1251110	1260230	any antivirus or malware, under 20% no firewall protections, 46% no network monitoring, 52%
1260230	1267750	no intrusion prevention, and 41% didn't encrypt data at rest. Again, this is 2016. HIMSS doesn't
1267750	1273830	ask the same questions every year, so we can't see trends, but just kind of something to take
1273830	1281330	into account. So this is the last slide of this. And again, just to kind of talk about our
1281330	1286550	objective, we're really trying to train those small critical access hospitals on some of the
1286550	1295370	things that they can do to help bolster their cybersecurity posture. And this is what's up next.
1295370	1299070	Helen will be taking you over next with basic network security.
1299070	1305690	Thanks for that, Matt, and for really just setting the table here.
1305690	1312710	I wanted to go ahead and preface that in the interest of time, I've removed demos, but I've
1312710	1325050	added a slew of links on added resources, places where you can get demos, and just manuals and
1325050	1330670	the like to the end of this presentation that all the decks will be available to whomever would
1330670	1337770	like them. I also included any slides that I removed in order to streamline this presentation
1338410	1345510	and hit our time restraint. I include them in that slide deck and with my notes. So if you
1345510	1351570	have any questions, you can go ahead and look through that and then reach out to me or Matt.
1353130	1361030	We're going to start with the little parts of network security, you know, cyber hygiene, and
1361030	1372130	just the basics. As Matt said, the 2019 HIMSS study shows the importance of the network
1372130	1381070	security basis, basics. A pattern of cybersecurity threats are discernible across U.S. healthcare
1381070	1392450	organizations, and as Matt has just said, the trend has only increased in the current pandemic era.
1394740	1402000	Elements of network security, there are so many. I have asked this question of other people,
1402000	1408920	and everybody can give you, you know, 20 talking points of things that they find to be
1408920	1416320	the core of network security. Here are some of those elements. We're going to talk about
1416320	1424920	access management, segmentation, we'll go a little bit into firewalls, and we'll finish up with some
1424920	1437810	testing. Now, we're not just coming up with network security requirements out of the air.
1437810	1448890	There is HIPAA support, there is industry support, hospitals need to protect their sensitive data.
1450550	1458410	Network security for the uninitiated and overworked, I understand it's really difficult,
1458410	1465070	but hopefully with this primary, you'll be armed with the tools to at least ask the right questions
1465070	1477530	of your external consultants or Dr. Google. Strong access management is key. You want to
1477530	1486650	secure your endpoints, ensure your remote workers use a VPN. You want to have strong but manageable
1486650	1495310	passwords. You want to use multi-factor when applicable or possible. I understand that
1495310	1502590	it is very common in a lot of workflows in a hospital staff to use their badge already for
1502590	1511950	access, so having them switch to badge and pin is not a stretch. It would be within a normal workflow.
1513090	1518430	Physical controls to limit access to restricted areas are a must, and Matt will get to those
1518430	1524530	later. You want to review administrative accounts, access to servers and workstations
1524530	1529830	and devices. You don't want local admin accounts that can lead to unintended privilege
1530430	1538730	access to systems or data. You don't want generic lab user one. You really want to know who is
1538730	1547850	accessing your data and why. Review the process for elevating access as a request and make sure
1547850	1554250	that there's a separation of duty policy for administrative access. Review shared accounts
1554250	1560350	for necessity and then monitor out for abnormalities or misuse. And finally, you want to
1560350	1567970	review your terminated employees or people that are on leave of absence. If those accounts are
1567970	1581070	not terminated quickly, they can be used inappropriately. The principle of least privilege
1582070	1597950	is one of the basic principles of user access. You don't want one mastered user that has all
1597950	1607290	the keys to the kingdom. If that user is compromised, you are compromised. You don't
1607290	1612190	want one person performing every duty. You want to spread those duties around and you want to have
1612190	1622870	more than one person accessing an area. With that in mind, sorry, I do want to start this over.
1625330	1632910	That was the concept of separations of duty, not the least privilege. The concept of least privilege
1632910	1642470	is that you want to have the user have the minimum access needed to do their job.
1648200	1655620	Network segmentation. Network segmentation is the practice of dividing larger computer networks
1655620	1663180	into several smaller subnetworks that are each isolated from one another. If you think of this
1663180	1671840	like a fence around your house, if you have a fence around your house and you don't have
1671840	1677920	any other protection to keep your house from being broken into, all somebody needs to do
1677920	1686180	is find a way to get in through your fence, right? So that's what you would have even if you just
1686180	1695080	have one firewall or one access area of protection. If you are creating a bunch of smaller
1695680	1704600	networks, smaller segments, even if one area is compromised, the other areas can remain protected.
1709160	1715720	Here are some examples of what a flat network looks like and that's what we have seen in a lot
1715720	1723700	of hospitals. You have the internet and everyone can access the internet and all the equipment
1723700	1733120	runs on the same network and it's almost set up like a home network but in a business that runs,
1733120	1740860	that deals with such sensitive information. The next slide, the next picture is a basic
1742920	1750660	segment and here is an idea of what segmentation in hospitals looks like.
1753080	1760920	Here are, so a VLAN is a logical partition in the layer two network and here's a
1761640	1765200	background of what a switch would look like and
1768400	1781680	some ideas of what the logical layout would look like. So I have removed a section on types of
1781680	1789940	firewalls. There are several types of firewalls and you should look to find which kind suit your
1789940	1796320	purpose. There is some great information out there. I've included that in our resources at
1796320	1803300	the end. Firewalls are your first line of defense for securing healthcare networks from against
1803780	1809420	the public. Firewalls are digital walls that stand between protected health data and potentially
1809420	1818700	dangerous threat actors. You want to start by blocking all, by blocking all traffic by default
1818700	1824300	and then only allowing specific traffic to identify services. This approach provides
1824300	1829200	quality control over traffic and decreases the possibility of breach. You're going to
1829200	1838420	want to make changes slowly over time and I understand that sometimes this is impractical
1838420	1845380	but you want to do this in small segments and secure your network over time during downtime
1845380	1856680	and maintenance zones, maintenance periods. So the approach of quality control over traffic
1857660	1865460	can be achieved by controlling the last rule in an access control list to denial traffic.
1865460	1869760	And this can be done explicitly or implicitly depending on the platform.
1889280	1895700	So you follow an established set of rules and then firewalls can actively monitor incoming
1895700	1902900	and outgoing traffic. In doing so, a firewall blocks the secure network from the internet,
1902900	1912940	only allowing pre-cleared data to pass. So you want to know the firewall's purpose,
1912940	1921680	what the affected devices are, what users have access, what date your rule applied,
1921680	1924560	and who's the name of the person who added the rule.
1925880	1934260	Some inbound rules are whitelists, which are falling out of favor and are being called allow
1934260	1943580	lists or a few other terms, which will be, you know, only allowing Jim and Mary to go to the
1943580	1950560	insurance billing information website. These are who's allowed to access an area. There's a deny
1950560	1963060	list, which is, you can go ahead and allow these doctors to go anywhere except ratemymd.com. You
1963060	1969660	don't want them reading reviews and getting upset on shift. You want to block, so you're not going
1969660	1978380	to allow one person access to anything, whatever the thing you're saying. Okay, this guy is in
1980700	1986320	environmental services. He doesn't need to access financial records. That's blocked all together.
1986360	1993140	And then a VPN. So you say, okay, you're only going to allow this physician that works from
1993140	1999740	home to access our network if they're using our approved remote access avenue.
2001140	2007100	SANS has some great firewall information. I'll have links to that in the resources at the end
2007100	2015500	of my deck. And they have a firewall checklist. The main purpose of the firewall is to drop all
2015500	2021240	traffic that is not explicitly permitted as a safeguard to stop uninvited traffic from passing
2021240	2029320	through a firewall. You want to place a drop any, any, well, an any, any, any drop rule. It's a
2029320	2035540	cleanup rule. So if you forget about something, this default rule will clean it up. You want to
2035540	2041340	have this at the bottom of each security zone. And this will provide just a catch all,
2041940	2048500	catch all mechanism for capturing traffic. Here's an example of what a cleanup rule would look like.
2050200	2058400	It's also important to note that with all of this, you need robust documentation
2058870	2067220	and a strict change procedure. Firewalls rules will need to be updated for any new service or
2067220	2073460	new devices. They're going to have changes over time. But before adding or changing or removing
2073460	2080820	any rules, you want to implement a formal change procedure that can make sure you're keeping track
2080820	2089870	of the modifications. So here are some guidelines for those procedure, change procedures.
2094420	2105890	I know automation is a important topic and automation is definitely possible with firewalls
2105890	2113810	configuration, for rules, for management of your fleet. You can manage windows firewalls
2114350	2122490	via domain group policies. You can use configuration management for traditional
2122490	2131310	firewalls. You can use something like granted. Linux has web-based tools to manage
2133690	2140950	network routers, switches, firewalls, etc. You can have a fleet managed
2142390	2148890	software so, you know, like certain vendors will have their own tools to manage their fleets.
2149390	2155350	And it's the same with wireless access points. So you'll want to pick the management tool that
2155350	2165490	works for your particular network. When working in windows, you can manage all the firewalls via
2165490	2173810	domains, group domain policies. Here's the Linux note and the other items I just mentioned.
2174650	2182130	Testing. So it's not enough to assume that you've applied adequate security controls.
2182130	2190950	You want to make sure that you test different aspects of security either for compliance.
2191030	2197750	You might have a customer or a patient that has questions and if they're a large donor or
2197750	2205330	something you might be motivated enough to test this. There might be a need for some sort of
2205330	2213670	full red team engagement or overall whatever you want to do to assess risk readiness.
2214050	2222330	And it is important to pick a strategy. And there's different levels of depth here.
2222350	2230970	There's the vulnerability scanning or security scanning which is automated. There are several
2230970	2239250	tools out there for this. And it's to get an idea of basic weaknesses. So are there patches
2239250	2247290	that haven't been applied yet? Are there ports open that might be suspicious? What's the idea
2247290	2254890	of traffic going on right now? It gives you an idea of your risk in an automated way so you don't
2254890	2262650	have to have an extra resource devoting time to that. It does not by any means replace more robust
2262650	2270350	security measures but it is a way to get an idea of what's going on and what weaknesses you may have.
2271090	2279170	A pen test is more in-depth. It involves a person simulating
2279170	2286790	different types of attacks in order to find as many vulnerabilities as possible. They will provide
2286790	2295190	you with a report and depending on if you're what the agency you're going with to do this or
2295190	2300490	what kind of your internal testers, what their process is, they may also help you find
2300490	2305650	remediations for that. Risk assessments are more
2308010	2317010	either enterprise risk management or sometimes compliance related. It's a process of reviewing
2317010	2323570	and analyzing potential risks that later you can prioritize and get business input on
2323570	2330970	and you're going to try to come up with a plan as to see what the possible ways of preventing
2330970	2338190	these risks from becoming a reality. So you're going to prioritize components that carry the
2338190	2345650	highest risk and you'll say, okay, this stores most of our patient data, for example. We're
2345650	2351150	going to go ahead and market for some more robust testing so we can get an idea of where our
2351150	2359030	are and really plug those holes to the best of our ability. Security auditing is verification.
2359430	2365190	You can audit your access management policy. You can also use this tied to compliance
2366110	2374270	and you can analyze the system in working conditions. You're taking a view of what's
2374270	2381850	going on. You're not... the chances of something going offline or breaking are quite slim.
2381990	2387410	That can happen in a test, in a penetration test, but not so much in a risk assessment.
2390470	2398290	Sorry, not so much in auditing or reviews. Red teams are similar to a pen test,
2398290	2404250	but it's more targeted and it usually involves more than one person. It is a team of people
2404250	2413770	that are trying to get in using the techniques of a malicious person or some sort of threat actor
2414490	2421230	and they're going to try to get in and access sensitive data as quietly as possible without
2421230	2429350	being detected, just like the bad guys. They're going to just look to avoid being detected.
2429350	2437110	They're usually there for a longer period of time than other testers and they use a variety
2437110	2444510	of techniques. This could even include some physical testing to break in
2445550	2455510	and to get access to things that they probably shouldn't have. The
2457810	2465270	final note here is application security testing. At some hospitals, there will be some level of
2465270	2471350	development and this would be the process of testing and analyzing and reporting on the
2471350	2477690	security level or posture of a particular application. It's used a lot in web development,
2477690	2488470	but also app development like for Apple applications. It's just an idea, a way to
2488470	2493950	test and gauge the security strength of that application and then find areas that you can
2493950	2504410	remediate. There are times when you're going to want to bring in outside help.
2505110	2511170	You want to develop, especially if you're going to have an outside digital forensics incident
2511170	2517570	response team, you're going to want to develop this relationship long before a crisis situation
2517570	2525150	happens. So find out how many cases they work a year, how many of them are hospitals, get references
2525150	2533190	or testimonials from past clients, find out what experience level their team is at, how many of them
2533190	2538650	have worked in the health care industry, and find out if they can help with overall readiness
2539190	2547510	and not just be there when things go wrong. Recently, Liz Waddell did a presentation called
2547510	2554730	Help, We Need an Adult, Engaging an External IR Team that provides some great tips and you can
2554730	2564530	find it online just googling the name. And here are, here's the beginning of the resources.
2567370	2568510	There are
2572490	2577470	CIS, so the CIS and NIST and then the open source
2578170	2582870	testing manual as well as links to many articles and demos.
2584750	2593690	And that is the end of our basic network security section. Moving on to the next section. So
2594910	2602290	a question that comes up pretty often is how do you monitor all the devices you have in a network?
2602970	2612810	And this is going to start with really seeing what you have and then figuring out how to
2612810	2619230	capture that data and monitor what's going on. Obviously, we don't have the resources
2620170	2627690	to go and look at every device, so you need to have a smart approach to this.
2629150	2635610	We're going to touch on network discovery, logging, and setting up a strategy for
2637910	2642390	asset management and real-time monitoring.
2644550	2649970	So as I mentioned, before we get started, you're going to have to do some planning.
2651110	2658650	Some of this is going to be with network discovery. You're going to want to perform a scan
2658650	2665090	to get the lay of the land and probe a network for all connected devices.
2665610	2670890	Institutions are going to need to be aware that certain brands of devices or certain
2671770	2677750	device models do not like being scanned, and so you're going to want to avoid doing
2677750	2683190	this kind of heavy network discovery while they're in use. Or you're going to want to
2683190	2689650	have that dialogue with your medical device manufacturer to see if you have some of those
2689650	2696370	devices, and then perhaps take the device offline or create a strategy for managing
2696370	2703370	that device while you're discovering everything else on your network. Ultimately, you cannot
2704130	2712050	protect what you if you don't know it exists. And one strategy is to log as much as possible,
2712050	2718870	get as detailed lay of the land as possible, and then if you find a new device that isn't
2718870	2726330	in your inventory, you're going to treat it as hostile. So you're really going to
2726330	2733890	want to be as thorough with discovery as possible. And in this network discovery,
2733890	2740890	you're going to find some items that are immediately glaring. They're going to be
2740890	2747370	operating systems or firmwares out of date. You're going to find just some simple vulnerabilities
2747370	2753930	that come up, and you can remediate them along the way as you're doing your asset inventory.
2754370	2760610	You're going to have to decide what's important to the organization early on,
2760610	2768950	because you can't keep a log of everything. Long-term storage is expensive for this kind
2768950	2774830	of monitoring. So you're going to have to prioritize what data you want to keep a track
2774830	2787650	of the most. You're going to want to structure your log data. You're going to have some
2787650	2797290	normalization across logs. There's a common information model that was created to solve this,
2797290	2805390	and a community, an open source community, that also provides some information on this,
2805390	2810550	and I have a link to that in my resources. If you're unsure of where to start, or you
2810550	2817230	want some structured guidance, there are many different SIEM vendors, and so you can reach out
2817230	2822690	to them and see about writing rules that support your organization devices in these cases.
2824250	2829890	Don't feel pressured by these salespeople. Make sure you're in control of your conversation.
2833740	2837660	You're going to want to separate and centralize your log data.
2840480	2848180	Decide what you need from the logs and what you can discard. Logs are similar... logs are similar to
2850700	2856420	finding the log data that's important to you. So security logs, system logs, intrusion attempts,
2856420	2860960	connections, figure out what matters to you, and those are the logs you're going to need
2861620	2868980	to keep. Separate logs come in handy for searching and dashboards, so you can organize your data in
2869080	2874080	a way that's intuitive to you. If devices are Windows, you may be able to use the window event
2874080	2882140	forwarding to push to the syslog. If you're using the Linux environment, use existing syslog.
2882140	2889940	If you're pushing to a SIEM, there's lots of options, so Splunk, Security Onion, AlienVault,
2890500	2899340	etc. There's paid versions, non-paid versions, obviously the open source ones are an increased
2899340	2909060	level of effort, but everything is going to need fine-tuning. That is the nature of logging. So
2911780	2916440	you're going to log devices to ensure communication to only trusted endpoints,
2916440	2925030	log IPs and connections in and out of network, log an alert of large data transfers,
2925740	2932880	you're going to want to log local devices and workstations for USB devices that are plugged in,
2932880	2942000	you're going to want to log application setups to what's running on startup,
2942000	2947620	you're going to want to search for malicious applications or malicious services,
2948900	2957740	there are different options for inventory based on your operating system,
2957740	2964180	you have a lot of variety in this space, use whatever works best for your workflow.
2965120	2970720	You're going to want to correlate data sources. So you're going to use existing logs and security
2970720	2977280	system events combined with local host logs to detect anything that's out of the normal,
2977280	2983200	out of normal and flag it as a malicious activity. For this, you're going to need to establish a
2983200	2988440	baseline. You're going to have to have a period of time where you are figuring out what is normal
2988440	2995140	in your environment. And once you know what normal is, you can start to define what abnormal looks
2995140	3003260	like. Your correlation only works if your logs have been normalized. So you're going to want to
3003260	3011180	use identifiers that work for you as an organization, be consistent, whatever is intuitive
3011180	3018920	for your group, proceduralize that and make it standard. So you, for example, if the core group
3018920	3027260	in New York file server one, if you want to abbreviate just taking the first letter of
3027260	3034640	every major word, if that works for you, do it. Do whatever works for you. You can say MRI,
3037840	3046960	diagnostic services, left wing, whatever works for you, figure it out and then make it canon.
3046960	3052950	You want to label your equipment, include warnings or pertinent information,
3053200	3060780	and you want to also log MAC addresses, model numbers, serial numbers, licensing keys,
3060780	3066040	anything that is important, especially if something goes wrong.
3068230	3075590	So you use those unique identifiers when logging so that you can easily identify
3075590	3082250	in your dashboard what is going on. Utilize scripting to run searches on interesting data,
3082250	3087670	send this to email for the process. You're not going to want to do this by hand, use a dashboard.
3088850	3095910	Perform real-time monitoring. Again, you're not going to want to do this all by hand,
3095910	3101510	you're going to want to have some dashboard, deploy automation when possible,
3101510	3108290	and work with your vendor if you can. If you're using a free version,
3108290	3112350	those are often supported by robust communities and reach out to the community.
3113390	3120350	So things are complex to set up and administer, and I understand. Small teams have limited cycles,
3120350	3128610	I understand that as well. You're going to want to take your time to really fine-tune this to work
3128610	3134870	for your particular infrastructure. And utilize a SIEM, it'll tie together all the information
3135350	3145610	and make network monitoring easy for your staff. So assets, bad guys, and the things we can't see
3146090	3153350	are really where we have high risk. With no logging, no asset inventory, and no central
3153350	3161750	logging server, no SIEM to tie everything else, you're really dealing with an issue of the lack
3161750	3169270	of visibility. This is where that strategy helps, where we're tying all of that information to make
3169530	3179870	a map of what you have as a network, and it's the first step in figuring out where your risk is.
3180630	3188230	So here is a fun little map. Next we're going to talk about developing a patch strategy.
3188830	3195830	So now we're moving on to my last topic, and then we'll close out with Matt on his final two topics.
3195830	3206790	My last topic of the day is medical device patching. This is a complex topic, but we start
3207230	3214470	with, like everything else, with a strategy. Why have a patch management strategy? It avoids
3214470	3219890	downtime and response efforts, it increases compliance, there's high return on investment
3219890	3226770	for the effort, and ultimately increases the security posture of your organization.
3228330	3235210	There's also some FDA guidance you might want to look up on the topics. Security updates are
3235210	3243750	managed by the manufacturer's quality system, but they have made it easier to go ahead and push out
3243750	3251910	to the customer. What is part of this process? There will be hazard analysis, formal testing,
3251910	3258010	and then it'll be released. Why are patches generated? Well, sometimes it's because there's
3258010	3265950	an uncontrolled risk that has an unacceptable risk to either clinical functionality or patient
3265950	3273330	safety, sometimes it's just maintenance or part of good cyber hygiene, and sometimes it's that a
3273330	3283190	third-party component requires a patch. There's a lot of challenges, one of them being the variety.
3283650	3289710	There are hundreds of possible options for operating systems, and then when you add in
3289710	3299070	the hardware and software components, there's a lot of variety in that install base.
3299830	3306050	The hospital network has some complexity and risks. You have a lot of vendors, you know, we like to
3306050	3314590	you only use us, but that's just not the case. There is a number of vendors, there's a number
3314590	3322370	of platforms for remote access, and some devices do not have remote access available at all.
3322770	3328150	Then there's the availability of a third-party patch. Just because a third-party component has
3328310	3334630	a risk does not always mean that they will get us the patch in the time we manage to provide it to
3334630	3340690	you. And then there's dependencies on the back end, servers and the like. There's organizational
3340690	3347970	issues, so who does this device belong to? Does IT have a good relationship with the clinical team?
3347990	3355470	I mean, in smaller places, the bioengineering guy and the IT guy and the IS guy are probably
3355470	3363710	all the same person, but it depends on how that person deals with the clinical staff.
3363710	3369150	And then what are the functionality risks? There's also regulatory and compliance concerns,
3369150	3376970	what the change management process is. Devices are in use 24 hours a day, seven days a week.
3377110	3381150	Device systems, like I mentioned earlier, they have dependencies.
3382290	3386810	Hospitals are typically not allowed to install operating system patches directly.
3387190	3393690	This is becoming less of a problem as more software-only solutions are created.
3393710	3398330	But it is still a problem, especially in your legacy devices and install base.
3398410	3404030	And what is impacted if things go wrong? Patient safety, care, delivery, and you have a reduced
3404030	3414550	revenue. If you have to divert patients, if you have to delay diagnosis, you're going to have
3414830	3425890	a reduced income. More complexities. The diversity of the medical device manufacturer,
3425890	3431750	service level agreements, larger healthcare organization deliveries typically rely on
3431750	3437610	automated patch management systems to coordinate the distribution and installation of patches.
3438410	3444490	These agents for these programs or security agents are not generally approved for use by
3444490	3449670	medical device manufacturers. Automated systems might accidentally push a patch to a non-approved
3449670	3458590	device and that patch might bring that device offline or render it unreliable.
3458730	3464480	HDOs have a difficulty for monitoring for and assessing the impact of vulnerabilities.
3465080	3470760	If they may not know that vulnerability exists, they don't have a lot of visibility into what the
3470760	3478280	third-party components are of that product. Many devices can only be patched when not in use or in
3478280	3487100	service for patient care and patient safety reasons. And for this, I'm saying leverage your
3487100	3493220	existing preventative maintenance cycles for certain devices. But when the device is in use
3493220	3502240	24-7, that cycle might not come more quickly enough. We hear this a lot. There's a shared
3502240	3509300	responsibility. Medical device manufacturers need to make a safe device or as safe as possible
3509860	3520240	and give you the avenues to have safe settings, you know, control your access to your device,
3521300	3529080	protect your data, respect privacy. They need to have robust security features. The device needs
3529080	3535300	to be hardened and tested. We need to disclose vulnerabilities. We need to tell you what the
3535300	3542280	third-party software is in the device and we need to provide patches in a timely manner. Hospitals
3542280	3549140	need to deploy devices in a secure environment, which includes segregation. They need to monitor
3549140	3556220	their network. They need to have an access management slash traffic control system.
3556280	3561500	So that could be like physical security vulnerability analysis. They need to do
3561500	3565960	security awareness training. We don't touch on security awareness training in this topic,
3565960	3574460	but it is important. And you want to teach proper use. You want to have a life cycle and change
3574460	3580020	management policy that includes patching and you're going to want to assess your risk.
3582200	3589440	So as you may or may not tell by now, I'm pretty keen on processes. Asset management
3590140	3596900	is an important part of many of the things I've mentioned, including patching.
3597860	3603160	You're going to want to give each device a profile where you're saying
3604460	3612020	you're triaging by exposure, likelihood, and impact in your risk profile. So do you have
3612820	3620760	a flat network and a device that has a lot of ports open and not a lot of security controls
3620760	3626360	in place for that device? Your network exposure risk is high. And then you go, you said, yeah,
3626360	3632360	okay, that's high, but it doesn't actually store any PHI. It just may have a couple of
3632920	3639480	values that are anonymized. Okay, well, then your data exposure is low.
3639620	3645440	Patient safety and clinical care risk, does this directly affect a decision in patient care?
3645440	3653340	Or is it an A1C that may be a factor in a diagnosis or a fasting glucose that may not be
3656500	3661960	directly impacting a clinical care decision in an emergent moment?
3665610	3672030	So how do you create this profile? If it's networked, you can, as we mentioned earlier,
3672030	3678550	with the discovery portion, you can collect a hostname, MAC address, IP address,
3678550	3686310	wireless interfaces. You may also want to note serial number. Oftentimes that is an identifier
3686310	3695110	used by service. So when there is a problem, they may use, there's a vulnerability that impacts
3695110	3702450	serial numbers one through 10, or ending in one through 10, and all others are fine.
3702450	3709650	Or we're rolling out a patch to these serial numbers. So you would like to note that information
3709650	3712810	or communication with your device manufacturer.
3714690	3719710	You're going to want to create this, part of creating this medical device security profile
3720530	3726990	is the software bill of materials and your security white paper. So many, many manufacturers
3726990	3734510	are now in the process of collecting this information. As you can tell, the software
3734510	3742610	bill of materials is important for a variety of reasons. It's involved in vulnerability analysis,
3742610	3750610	in your privacy concerns, in pretty much everything. The white paper should also tell you
3751110	3756530	what your operating system is and patch level and update. They're just going to let you know
3756530	3760850	if there's any middleware, any dependencies, there's often network flow diagrams. You can
3760850	3770250	get an idea with the documentation that your vendors provide of what your risk is.
3774400	3778320	So when you're creating your medical device security profile, you're going to want to
3778320	3783280	take a look at the controls. What are the credential management options? Is there
3784520	3791220	antivirus or other security technology available with the encrypt? You're going to ask what
3791220	3795800	logging capabilities they have and how do they manage remote access? You're going to want to
3795800	3802540	keep a copy of the MDS2 security and security white paper for every version of the device
3802540	3809380	that you have in use in your environment. There is enough variety at significant releases that
3809380	3817940	you will need this data. Make it part of your profile. So as I was mentioning, the network
3817940	3824620	exposure. Is the device in an internet accessible network zone? Does this have
3824620	3832080	dial home capabilities? Is it remote accessible? These all increase your network exposure risk.
3834290	3842830	Data exposure. Does the device store PHI or PII? Is the sensitive data only stored
3842830	3849130	for a small period of time or is it permanent? How many records are stored? How is it stored?
3849690	3856050	These are all questions you're going to want to ask your MDM. They are your partners in this.
3858460	3866420	You are also going to need to figure out how critical is this device to care? Is it life
3866420	3873920	sustaining? Does this represent a single point of failure? Has the security evaluation been performed?
3873920	3878700	You're allowed to ask your medical device manufacturer, hey, what security testing has
3878700	3887040	been performed on this device? What did you do about it? And especially if this is critical to
3887040	3897570	care, you might want to have those conversations. You're going to need to plan your patch execution
3897570	3906970	safely. So if you can, if you have a test device, you're going to want to, one, receive your
3907670	3914890	manufacturer's approval. Test it on a device that's not in use at all. Verify that it does
3914890	3921970	not in any way impact your workflow, just so that we know it works in your environment.
3922370	3927390	Schedule a patch during a maintenance cycle, so a time that the device will be down anyways.
3927690	3934930	Use your device in use safeguards that are in your manual. Deploy and apply the patch and validate
3934930	3945190	that the device is ready to return to service. So you're going to want to make sure that this is an
3945190	3952730	approved patch. If you want to, for some reason, apply a patch that did not come from your
3952730	3957250	manufacturer, you need to reach out to your manufacturer and have that conversation.
3957670	3963630	See what your service level agreement says. Manufacturers do have a list of approved patches,
3964330	3968910	so get that documentation from them and make sure you're up to date.
3969030	3975690	Ensure that the patch management system can isolate authorized patches and employ,
3975690	3980750	ensure that only your authorized and approved patches are deployed on the device.
3985050	3991010	Here's some considerations. You're going to want to see what your change management policy says.
3991210	3996350	Schedule the patch during the prevent and maintenance cycle. I can't stress that enough.
3996350	4004550	Please do not use a device that's in use. Should, by any accident that happens,
4004550	4010070	you know, you don't want to take a device offline that a patient is using.
4010850	4018390	When impossible, employ device in use safeguards. The two-man rule. So, hey, I'm going to patch this
4018390	4025070	MRI machine. Can you see it? Can you verify that this is actually empty and not in use?
4025070	4030310	Because we have it on the schedule that it's not in use today. Yes, I'm looking at it,
4030310	4035890	there's nobody in it, and there's no plan to use it today. You're going to want to isolate the
4035890	4043490	medical device on a maintenance VLAN and then deploy. When everything is back up and running,
4043490	4050850	return it to service. So, that is our patch planning. I know it's a little more involved
4050850	4059750	than your automated patch deployment that you can do with your workstations and servers,
4059750	4066670	but because these devices are so important to clinical workflow, we need to put in this effort.
4067710	4074450	Next up is Matt, and he has the fun topic of physical security.
4074670	4080530	So, thank you, Helen, for that great overview on a number of topics. We only have two more modules
4080530	4086310	left that should be pretty quick. We have physical security, and then we're going to cover third-party
4086310	4092190	risk assessments and communication. So, we'll jump right into physical security. So, why is
4092190	4098270	physical security in healthcare important? Well, if we're trying to protect PHI, you know, physical
4098270	4103990	security is certainly one thing that we definitely want to consider. If you can't block physical
4103990	4109830	access to the hospital, individuals can come in and potentially get access to data either on a
4109830	4119090	device or something of that nature. So, we'll quickly look a little bit at hospital physical
4119090	4125950	security studies that have been done and kind of understand, again, try to lay that foundation of
4126270	4133650	what the current threat landscape is. So, of a survey that was done in 2018 for physical security
4133650	4139810	in hospitals, 34% of hospitals did report some incidents of trespassing that year. That was up
4139810	4146930	from two years prior. And only 42% of hospitals did report having a visitor management system.
4146930	4151330	Now, when I say a visitor management system, what the study defined as a visitor management system
4151330	4159630	did require a visitor to both sign in, have a photo ID, and a visible badge while walking around.
4159630	4165770	So, if a hospital had two of those but not three, they didn't technically meet the criteria for
4165770	4171290	visitor management systems. So, that 42% is of the reporting hospitals that had all three.
4171410	4178190	And 20% of hospitals actually had some sort of physical man-trap that stopped individuals from
4178190	4185210	coming in physically before entering the rest of the hospital. So, what do we want to restrict?
4185210	4188630	Obviously, physical access. We're talking about physical access to hospital.
4189090	4193290	But again, if we go back to that first slide deck that we had, we're not just talking about
4193770	4197250	visitors, but we also want to consider staff. You know, is there certain areas
4197250	4202950	that staff don't need to be in, or do we just give them access kind of carte blanche to
4202950	4208470	all areas of the hospital? So, we certainly want to consider that. And, you know, definitely
4208470	4214930	remember that 58% of healthcare data breaches do involve insiders, both malicious and unintentional.
4214930	4218610	Certainly, don't forget about your own staff when we're considering these.
4220110	4224650	Physical security plan evolution. So, obviously, your physical security plan for your hospital
4224650	4234750	wants to evolve, not just with big events like we saw after 9-11, where a number of new doors and
4234750	4241730	walls and things like that certainly were installed to restrict certain areas. But, you know, we
4241730	4245670	want it to continuously evolve as the threat landscape evolves.
4247010	4254010	This was a great study. This was by Marlee McKee. Not really a study, but Marlee McKee.
4254010	4259990	She has, interestingly enough, a couple million followers, and she is self-identified as
4259990	4265110	America's modern manners and etiquette expert. And she claims that opening the door at work
4265110	4271710	was her number two for America's top five manners. So, these are things that people should do.
4272210	4278390	Obviously, those of us that work in security realize that this is really not good. But it is,
4278390	4284290	you know, prevalent. Door holding, at least in a number of cultures, is prevalent. So, we need to
4284290	4290110	kind of look at that and factor that into our physical security plans. This was a study that
4290110	4296230	was done by the University of Omaha. It was fairly interesting. There was about 1,500 students that
4296230	4302850	were assessed to see if they would basically hold the door if someone walked up behind them.
4302910	4306630	Two-thirds of the individuals, if there was someone that immediately tailgated them as
4306630	4311870	they were coming in the door, they would open the door and leave it open. There really wasn't any
4311870	4319130	gender difference for that category, but it was interesting that the latter two,
4319130	4329230	significant gender difference. Females reported seriously significantly lower for both glancing
4329230	4333130	back and seeing if someone was coming and standing there and holding the door and then holding the
4333130	4339310	door open for a significant amount of time. So, didn't really go into why there was that
4339310	4346190	difference with genders. But, you know, if you're incorporating this into your incorporating door
4346190	4349750	holding into your physical security plan, it might be something that you might want to look
4349750	4354150	at that study and dive a little bit deeper into. Maybe those gender differences are something that
4354150	4360150	you could leverage to make your facility more secure, if you can understand kind of why that's
4360150	4366590	happening. We're certainly not going to reinvent the wheel. This is a, you know, less than a two
4366590	4375570	hour training. So, if you want to see some great physical security training, I definitely recommend
4375570	4380390	Jason Street's DEF CON talk on physical security. It goes over a number of different physical
4380390	4385690	security penetration tests that he's done and how easy it is to gain access. So, you know, again,
4385690	4390870	this is just this is the very short abbreviated version that's specific to hospitals. So,
4390870	4398050	if you want more, I would definitely look at that. So, why is any of this important? Physical
4398050	4403690	security or at a, you know, cyber security or hacking conference? Why is physical security
4403690	4410150	important? Well, manufacturers, so medical device manufacturers, make certain assumptions when they
4410150	4414600	create a medical device. They assume, as Helen was talking in some of her past presentations,
4414990	4420370	that they assume that a device is going into a secure environment. And that's not always the
4420370	4426370	case. It's certainly going to vary. If it's maybe a large, you know, CT device that they might make
4426370	4431370	assumptions that that's going to be in a secure facility or maybe in a secure laboratory, certain
4431370	4436770	devices. But, you know, it is understood there's certain smaller, like, point of care devices that
4436770	4441910	can be physically picked up and carried around or, you know, might be in a ER setting or even
4441910	4445750	in a home setting are obviously gonna have less physical security. But you just want to kind of
4445750	4452370	be aware of what physical security assumptions, you know, your medical device manufacturers are
4454010	4460750	assuming. Yeah. So, testing those assumptions. While I was creating this training, I had the
4460750	4465970	unfortunate but fruitful experience of having an individual that was close to me
4466590	4473630	be admitted to a hospital. They were first admitted to a local, like, 25-bed critical
4473630	4480830	access hospital, regional hospital, then moved to a larger university hospital, and then in a number
4480830	4487710	of, like, physical rehab facilities. So I was able to kind of, you know, visit regularly and observe
4487710	4492970	different situations that were happening with kind of the eye of being a, you know,
4492970	4498310	an occasional medical device penetration tester. So I've never done actual hospital penetration
4498310	4502550	testing, though I have some colleagues that have, and I've included some of their insights,
4502550	4509370	but this is kind of what I've noticed. So the hospitals that I did visit, they did not check my
4509370	4514530	ID, which was interesting because I could have very easily just provided a name of any patient
4514530	4520990	that was in the hospital at the time and be given access. And I actually tested this out,
4520990	4525810	it's kind of an interesting OSINT experiment, but if you go to Facebook and just kind of do a search
4525810	4530630	for, you know, hospital, in probably 30 minutes or less, you're going to be able to find a name of
4531090	4536990	a patient, you know, whether it's a friend, distant colleague, whatever, that's currently,
4536990	4541230	you know, in a hospital, maybe social media posts that says, you know, this could be Facebook or
4541230	4546490	any social media post, hey, I had a spill, I'm in a hospital, this is a hospital, come visit me.
4546750	4550910	We now know that individual's in that hospital, and a good number of hospitals, you can simply go
4550910	4555270	there, provide their name, maybe provide a fake name, because they're not actually checking your
4555270	4564230	ID, and be given physical access to the hospital. Once you're inside, at least I found in the
4564230	4569450	hospitals that I was in, I pretty much had access to go anywhere in the hospital, which with some
4569450	4574790	restrictions, and there were signs that basically told me kind of wherever I wanted to go. So,
4574790	4578850	if I was a, you know, nefarious actor, and I wanted to get access to the server room,
4578850	4583490	it clearly showed on the map exactly where that was, and it said on the door, you know,
4583490	4592270	exactly where that was. Yeah, keep going. I was going to mention one more thing, but I'll
4592270	4597530	mention it at the end. At the patient's bedside, there was obviously anyone that's ever visited
4597530	4602750	someone in a hospital, you know, especially if it's a critical case, you know, that patient is
4602750	4607750	surrounded by a number of different medical devices. Many of those devices, such as a cow
4607750	4613270	or computer on wheels, which is where the nurse or the clinical staff would sit down and do their
4613270	4618150	documentation. So, they would do their vital signs, ask the patient all their questions, then go to
4618150	4624750	this computer to write notes. Typically, for what I've seen, most of these were not locked down,
4624750	4630510	at least in the hospital that I was in, and I've installed medical software in a previous role,
4630510	4635230	and that's certainly not the case. A number of hospitals do lock down all their computer on
4635650	4641410	cows, computer on wheels, and have a certain timeout to be able to lock that out of, you know,
4641410	4647050	inactivity. But in this case, you know, the devices were open. That's not a picture of a device,
4647050	4653270	that's just one that I took off the web. And there was a number of other medical devices at the
4653270	4660370	bedside that, you know, had USB ports that, you know, if you look at the device and Google it,
4660750	4665830	you can probably identify that it doesn't restrict any type of traffic. So, if you had a rubber
4665830	4670270	ducky, things like that, you know, I might be able to either extract data out of the device or
4670270	4675310	potentially run a script on it. So, there's a lot of things you can do once you get physical access
4675810	4679990	that, you know, we often think, well, if someone's in the hospital, they're hurt, they need to be
4679990	4685670	there. But, you know, nefarious people get hurt too and end up in hospitals or visit family members
4685670	4691870	or friends that are in hospitals. So, it's kind of something to consider. One thing that I found
4691870	4699750	interesting, so, like I said, I've done some, like, a very small amount of penetration testing
4699750	4705350	for medical devices, but I have a colleague that does actual hospital penetration tests.
4705410	4709170	And he says that, you know, with a mop and a bucket, there's essentially nowhere in the hospital
4709170	4714850	that he can't go. Anytime he's done a physical penetration test or just a penetration test in
4714850	4720890	general, you know, he always, this is what he does for every hospital he's gone into, he dresses up
4720890	4726170	like a janitor and they generally give him access to anywhere he wants to go, including secure
4726170	4731970	facilities or secure areas of the hospital. So, if you're looking to do physical penetration testing
4731970	4735910	at a hospital, that's probably a good plan.
4737850	4743270	So, health, there was a great talk a couple years ago at one of the Health ISAC summits
4743810	4749390	that specifically looked at printers as kind of, you know, having a lot, basically being
4749390	4754390	chock-full of PHI. So, they typically have a lot of records. You can do print last 10, you know,
4754390	4758210	especially if this is a discharge printer where, you know, if you go to the hospital, you get
4758210	4765070	discharged, you go sit in front of a nurse, she prints out your, you know, 15, 20, 50 page,
4765070	4771790	whatever medical record, gives it to you, and then you go out the door. So, that printer is
4771790	4776910	like chock-full of records. It's probably right next to an exit door, and it may or may not
4776910	4782330	require authentication. So, just something to kind of think of. Printers often get overlooked,
4782330	4787370	but it might have just as much, if not more, PHI than an actual medical device.
4788890	4794450	Access in the waiting room. This was, you know, often we think of, okay, we have to actually get
4794450	4798670	in the building to be able to find a network jack or to be able to get some sort of, you know, access
4798670	4803970	that we need. But Helen, if she's still on the line, had a great story of one of her friends
4803970	4811670	that was doing a penetration test for a hospital and found network access right from the
4811670	4819870	lobby. I don't know if she's still on. I am. So, we met up before his test. This was his first,
4819870	4826290	like, hospital test. And he goes, I imagine hospitals are like a fortress. Like, oh, no,
4826290	4834470	dear. They are not. And he's like, no, no, you're kidding me. And I'm like, yeah, they're pretty
4834470	4843510	bad. I would totally expect a flat network. So, he has a plan to say that he is, you know,
4843510	4849810	waiting for a patient. And he doesn't even need it. Nobody asks him. So, he just sits down with
4849810	4858610	his laptop. And there's a network connection there. And he's like, it can't be this easy.
4858610	4867350	Sure enough, it was live. So, definitely interesting as far as the initial gaining of
4867350	4877050	access. Emergency waiting rooms are full of people. And they aren't necessarily highly
4877050	4880410	monitored as well as lobbies. Lobbies don't always have receptionists.
4881150	4887630	Yeah. Great. Well, thank you for that story, Helen. So, what can be done about this? Obviously,
4887630	4893370	it could require IDs for all visitors. So, when they're entering a facility, it requires some
4893370	4897890	visible badge. And it could just be a sticker. It's certainly helpful if that visible badge
4897890	4901390	actually says where they're going. So, that, you know, if they're in an area where they're
4901390	4907110	not supposed to be, it's clearly visible. Restricting physical access to only areas that
4907550	4911430	these individuals should be. I mean, I've certainly been lost a number of times in
4911430	4915670	hospitals. Just, you know, you go in and then you just have access to everywhere.
4915670	4921310	They're so big, you get lost. You know, if you could actually have individuals kind of
4921310	4924590	guide people to where they're supposed to be going to. And in a large hospital,
4924590	4929070	that's obviously never going to happen. It's just too large and there's too many visitors.
4929330	4934030	But I have seen it work pretty well, again, in like a Midwest, like small critical access,
4934030	4938990	25-bed hospital, where they have a number of volunteers where they're just, you know,
4938990	4943530	looking for something to do and help out. And, you know, I've been surprised to show up at those
4943530	4948870	hospitals to install software and, you know, had a person that actually brought me from the door
4948870	4952530	to right where I needed to be. So if you're one of those small hospitals and you're looking for
4952530	4957450	something for volunteers to do, that might be a good thing that they can do to, you know,
4957450	4961230	be friendly with visitors, but also help increase your security posture.
4962350	4966350	Train staff on tailgating. And again, leveraging those, you know, if you can leverage the
4966350	4970770	differences and understand kind of why that's happening. You can lock all devices when they're
4970770	4976890	not in use. Require authentication on printers is good. And, you know, when we're locking devices
4976890	4982870	too, that's obviously, you know, that's going to be a process. You're probably looking at,
4982870	4986830	like, hospitals that do it well are doing like a tap and go system. So you just, you know, I have
4986830	4993010	my card on a lanyard and I'm just tapping it on each device that I have access to. And that's
4993010	4997390	going to look different across your hospital. Certainly in the ER, there's a little bit more
4997390	5001850	risk because you have, you know, people coming into the ER constantly. You're certainly a guest
5001850	5009810	of people that are there or patients. But, you know, in an ER, like, seconds count. So it's
5010250	5014190	understandable that there's going to be less restrictions in that setting where, you know,
5014190	5018390	having to have a doctor stop and actually log into a system is certainly going to slow down
5018390	5024170	and it could adversely affect patient outcomes. But, you know, if you can do like a tap and go
5024170	5028990	system or something that is efficient, you know, anything you can lock down, certainly the better.
5029470	5040110	But again, do it, you know, do it in a way that is useful. Again, going back to that application
5040650	5046290	support staff that I was at a hospital, if, you know, you're not, if your staff's not getting
5046290	5052390	paid over the weekend to be on call and they regularly get calls at 11 at night during shift
5052390	5058090	change, you're basically incentivizing them to open access up more than it should be so that
5058090	5065130	they don't get that call. So definitely try to avoid that. And, you know, either asking manufacturers
5065130	5070450	to, you know, filter traffic. So doing that in your assessments on devices to see if that's an option
5070450	5076230	or physically blocking a USB port, because certainly it wouldn't be the first infusion
5076230	5081790	pump that was plugged into a patient that, you know, crashed when it was actually infusing
5081790	5087230	something into a patient because someone plugged a USB, you know, whether it's something malicious
5087230	5090910	or just a phone charger, certainly if it has a USB port, someone's going to eventually try
5090910	5097990	to charge your phone with it. So just kind of be aware of that. Some other things just to kind of,
5097990	5102790	you know, go with the win-win philosophy, you know, locking down access to a hospital not only
5102790	5109730	protects PHI, but it also protects your employees and patients. You know, hospitals are places where
5109730	5114370	injured people go. That's fairly obvious. But, you know, the reason that they're injured or sick
5114370	5119310	might just be because they're sick, or it might be because they were in some violent altercation
5119310	5124130	where, you know, the assailant is now, you know, going to come back to try to do the job,
5124130	5131590	to finish the job. And we've seen an increase from 2017 in actual violence against, specifically
5131590	5138310	against staff for in U.S. hospitals. It's up 57% in the emergency department and 52%
5139310	5144510	increase outside of the ED. So certainly increasing physical security in your hospital,
5144510	5151030	again, not only helps protect PHI, but also helps protect your staff and your patients.
5151810	5157870	So thank you for that. And we have one last module coming up on vetting third parties and
5157870	5163410	talking about communication. Alright, so thanks everyone for sticking with us for the previous
5163410	5170630	five modules. This is our last module. And this is on third party communication and risk assessments.
5170630	5175230	So this is all about how if you are a hospital, and you're wondering how you gather all the
5175230	5179670	information that you need from a maybe a medical device manufacturer, a third party,
5179670	5185130	and incorporate that into some risk calculation to make decisions, purchasing decisions based on
5185130	5191550	or security decisions of, you know, what do I do for this device to secure down my network,
5191550	5197690	this would be the module for you. So, you know, again, just to try to set some stats and some
5197690	5203030	groundwork. If you're wondering how many hospitals are actually if you're a hospital that's maybe not
5203030	5207530	doing these third party risk assessments, but you're wondering what percentage of them do.
5208030	5212230	Back to the 2017 HIMSS study, and this is a little bit dated, so it's probably even
5212230	5218590	more so now, but 88% of medical facilities are conducting cybersecurity risk assessments on
5218590	5223790	third party products, so medical devices and other products. And 38% of medical facilities
5223790	5227950	are pen testing equipment. So if you're a medical device manufacturer, and you're not pen testing
5227950	5235670	your equipment, certainly be aware that your customers most likely are pen testing, or maybe
5235670	5240130	at least going to ask you and inquire about if you know if you are pen testing.
5242230	5250790	So the Ponemon study back in 2019, just looking at basically how much hospitals actually spend on
5250790	5255790	this on risk management, and HDO or health delivery organization, just a kind of a big
5255790	5262370	word for a large hospital organization, on average spends about $3.8 million a year
5262370	5266410	on third party vendor risk management. And you know, why do they do that? Well,
5266410	5270990	juxtapose that with the average cost of a data breach is about $2.9 million.
5272230	5277270	And if you look at the just the vast number of vendors that HDOs have under contract,
5277270	5282650	it's over 1300, which is just unfathomable that they're managing that.
5283550	5289130	Why they tend to do a really good job assessing all of those third parties initially when they're
5289130	5296550	first looking at them, less than 30% are actually annually reassessed. So, you know, it's a big lift
5296550	5301110	and a good amount of work to get them assessed initially, but we're not really looking at them
5301910	5306690	relooking at these technologies a year, two years, five years after they're in the door.
5308730	5313890	So if there is a concern during this risk assessment process, you know, what happens?
5313890	5318490	What do hospitals typically typically do? Well, again, looking at that same same study,
5318490	5323310	about 21% of the time, the assessment gap leads to the manufacturer remediating it.
5323330	5327630	So the customer says, Hey, we, we did a risk assessment, we found this, we're not gonna be
5327630	5332250	able to purchase the product, unless something happens. 21% of the time, the manufacturer does
5332250	5339490	something to fix that or address it. 33% of the time, the HDO, or health delivery organization
5339490	5344570	mitigates the gap themselves. So it might be, you know, cordoning off that device on its own
5344570	5352590	segments of the network, maybe a separate VLAN, or some other security, security technique to be
5352590	5358990	able to reduce that risk. And 28% of the time, medical device manufacturers should be certainly
5358990	5364250	aware of this. 28% of the time, HDOs just terminate the agreement and say this doesn't,
5364250	5368310	this device does not meet our basic security requirements, so we cannot purchase it.
5368310	5372410	So that is definitely happening in the hospital sector currently.
5373430	5378370	Why are we doing this? What is the risk? About 20% of healthcare data breaches are caused by
5378370	5384030	third-party vendors, either by, you know, the vendor or, you know, somehow associated to that
5384030	5391970	vendor. What is the cost and labor? You know, again, this course kind of focuses on smaller
5391970	5397350	hospitals, but those larger, bigger HDOs, health delivery organizations, how much time are they
5397350	5405690	spending assessing this risk? Well, the average hospital or HDO has about 3.21, so that's
5405690	5412670	obviously a percentage, but over three employees on average solely dedicated to just assessing
5412670	5419610	third-party risk. And if you do the math on that, that's about 513 hours a month that HDOs are
5419610	5424310	dedicating just specifically to looking at third-party risk of vendors that they're going to
5424310	5431930	partner with or vendors that have devices that they're considering purchasing. So can you automate
5431930	5436870	this process? Certainly you can. About a third of HDOs do use some sort of tool to automate this
5436870	5443290	process. There's a number of tools on the right-hand side that you can see. Obviously, a pretty broad
5443290	5448890	distribution. We're not going to vouch for any one, but, you know, if you have that question,
5448890	5454870	maybe it's a good question for the panel afterwards for the HDOs to see what they're currently using.
5456370	5460550	You know, if you're going to do this assessment, you should then have some baseline security
5460550	5465930	standard that you're going to measure it against. The Mayo Clinic has what they call a gold standard.
5465970	5470570	It's a list of 77 different requirements. Most of those requirements went into the new
5471650	5481670	MDS2 or the new document that basically lays out security features that we'll talk about a little
5481670	5488790	bit later. And Mayo has presented this at a number of different conferences, so you can probably find
5488890	5496770	a little bit more information from searching that. And what that allows you to do, it allows
5496770	5501910	you to... actually, some of the features, I should say, in that 77 where every device is easily
5501910	5509050	patchable, every device receives timely updates, and, you know, certainly a number of other facets.
5509230	5513630	And what this allows you to do is focus on the high-priority devices, so the devices that have a
5513630	5519670	high risk score, a potential for high risk. And also what you want to look at, too, is assess the
5519670	5525210	whole family of devices. If you're purchasing, say, five different point-of-care devices that are all
5525210	5530770	different, and the risk may be low for each of those devices, but all of those devices, you know,
5530770	5536390	send unencrypted traffic to a middleware application, you know, you want to look at that
5536390	5542030	whole family of devices and not miss something, kind of understanding that, you know, the sum of
5542030	5547770	all the parts and just looking at the devices individually. So communication, we'll talk a
5547770	5553590	little bit about communication and how HDOs and their third parties actually communicate some of
5553590	5558530	this information. So we talked about the MDS-2, which is short for Medical Disclosure Statement
5558530	5565290	for Medical Device Security. This is a standard form when a medical device goes for FDA approval,
5565290	5570550	510k approval, this is part of it. So if you ask, any medical device manufacturer should be able to
5570550	5575210	give you an MDS-2 for their product, depending on when that product came out, it might be a
5575210	5581770	different version. The latest version I was talking about that Mayo has their 77 requirements,
5581770	5587650	most of them incorporated into, came out in 2019, I think it was November or December, so that's the
5587650	5594450	latest update. So the MDS-2 is a good place to get information. Security white paper as well,
5594450	5598850	a number of medical device manufacturers create security white papers that offer a lot more
5598850	5605610	information above and beyond what's in the MDS-2. And some of that information, so you might have a
5605610	5610910	full software bill of material, includes information like which ports and services are running,
5610910	5616220	which ports are open and which services are running on the device, specifically what sensitive data
5617590	5622260	elements are stored or transmitted on the device. Probably give you a network diagram of how the
5622260	5628920	is meant to kind of live in your network, so you can see that. It'll talk about authentication,
5628920	5634320	malware protection, security testing, if security testing has been completed, so if the device has
5634320	5639140	gone through a rigorous secure development process, there should be notes on that.
5640540	5644980	The intended operating environment is important, because that's, again, going back to those
5644980	5649680	manufacturer assumptions, this is what the manufacturer assumes, or where the manufacturer
5649680	5653100	assumes that the device is going to live in. So they assume that there's going to be network
5653500	5659660	segmentation, and a firewall, and a number of other things. So it's good to certainly look at
5659660	5663360	that, because that will, that will, you'll be able to see the recommendations of how you should
5663360	5671300	secure this device, and network controls, physical controls, logging, how the manufacturer may
5671300	5676220	remotely connect to the device for service, and whether you want that or not, you can turn it on
5676220	5683120	or off, likely. Any administrative controls, how to contact both service, and then maybe the,
5683120	5688700	for a cybersecurity issue, how to look for that too. If the device has any certifications, like
5688700	5700370	ISO 27001, things like that. So how do HDOs acquire this information? It's pretty common.
5700470	5705950	What they're largely doing is sending us security questionnaires, and most medical device
5705950	5711790	manufacturers are receiving hundreds of these from U.S. customers each year. They're extremely
5711790	5717290	lengthy, extremely detailed questions. If you are tasked with creating one of these, if you can,
5717290	5724130	you know, try to create one in a good format that allows manufacturers to just kind of go through
5724130	5729370	and check off, or uncheck things that aren't applicable. So if it's, you know, not a cloud
5729370	5734830	product, you can click no, not a cloud product, and it automatically fills in NA to the next 150
5734830	5739690	questions, and the manufacturer doesn't have to click NA and then put in a comment for each as
5739690	5746210	to why it's not applicable, that would be great. Just some sample questions, you know, pretty
5746210	5754010	standard, you know. How do you get this information? Again, I can only imagine on the HDO side if you
5754010	5761330	have 1300 different, you know, third parties trying to, even if each manufacturer has their
5761330	5766690	own information portal where all of the MDS-2s and security white papers and SBOMs are in that
5766690	5772210	one centralized location, you still have to go to 1300 different portals to get that information.
5772390	5779010	There's been some industry attempts to try to have all of that information centralized to one place,
5779610	5786210	but those haven't, those have either faltered or have haven't really caught on. So maybe we'll get
5786210	5791970	there eventually, but in the meantime, you can at least, for a good amount of manufacturers,
5791970	5798150	go to one place and get all of the information that you need. You know, as I said, SBOM, MDS-2,
5798150	5803670	white papers, installation guide, you know, any other information, hopefully in that one place
5803670	5810950	to make it a little easier for you. Business Associate Agreement, or BAA, this came from the
5810950	5817650	HIPAA Omnibus Rule. So this is, you know, basically the requirement or the agreement between
5817650	5826810	the medical device manufacturer or third party that's handling secure data. So the third party
5826810	5833610	agreement with the health delivery organization. One thing to kind of note of that is this last
5833610	5839730	line, that if you are working with a third party that's offshore or outside of the U.S.,
5839730	5846870	the Office of Civil Rights, or OCR, so the group that's tasked with enforcing this,
5847690	5851510	probably doesn't have jurisdiction. So just kind of something to consider.
5852790	5857690	And if you Google BAA example, there's a number of examples that you can see. You know,
5857690	5863750	your legal department is probably going to create this, but just, you know, there are examples.
5864610	5869810	ISA, so this would be more if you're actually handling the customer's data. So, you know,
5869810	5874090	typically it would have an ISA. And again, there's, we could spend a whole class on just
5874090	5879470	creating BAAs and ISAs, but it basically just sets out the minimum expectations for securely
5879470	5886250	hosting someone else's data and follows the framework. Security Testing Considerations.
5886470	5891710	This has come up a little bit, but, you know, earlier in the class, but we just have to assume
5891710	5896550	that these hospitals are pen testing devices. If you're a medical device manufacturer,
5897250	5901310	it is a good practice to reach out to the manufacturer before you do the test and just
5901310	5905830	ask, hey, is there any considerations that I might need to know? Is there anything that if I do,
5905830	5909650	it's going to break the device? As Helen said a few times, obviously you don't want to test
5909650	5915290	in a live environment. You want to test in a test environment and kind of need to be aware that,
5915290	5920690	you know, there could be adverse reactions to pen testing, but certainly, you know, it is a good
5920690	5925650	thing to do, but just, you know, have that open dialogue with the manufacturer so that, you know,
5925650	5929750	you can have the best result of that pen test as possible and share the findings, too. You know,
5929750	5934970	certainly medical device manufacturers want to know if there's any, you know, issues that they
5934970	5941000	could potentially fix. So, thanks. That is the class. We do have a little bit extra,
5941790	5948290	so that's all the content, but again, as this class, the focus is, you know, that one or two,
5949110	5955570	so either IT or cybersecurity person working in a small hospital, this was, we tried to cram
5955570	5961470	everything into an hour and a half, you know, two hours, and here's a little bit more information on,
5961470	5966210	you know, where do I go next? How do I keep learning? How do I, you know, stay current?
5966210	5970950	Things like that. So, if you're that, again, that one person that doesn't really, that wants to stay
5971450	5975610	engaged, wants to learn more, wants to get certifications, things like that, stay involved
5975610	5980890	in the security community. If you're watching this live at DEF CON, you're probably already
5980890	5985830	engaged, but if you're watching this on YouTube after the fact, you're, you may not be. So,
5985830	5991550	obviously, there's traditional coursework out there. There's a number of different places or
5991550	5996830	organizations, universities that you can take cybersecurity training in. There's not a lot
5996830	6002910	that do specifically healthcare and cybersecurity. Salve, Virginia University does have a graduate
6002910	6008250	class on healthcare administration and cybersecurity. So, it's the only university that I
6008250	6012670	know that has numerous classes in cybersecurity and healthcare, and are kind of pairing the two
6012670	6019570	together. There's also the University of Houston may have an executive program on it, and Coursera
6019570	6024630	has a class on cybersecurity and healthcare, too. But there's not too many... I hear that Salve also
6024630	6030770	has some really cool professors in this sector. They may. So, you know, again, I don't want to
6030770	6034670	hype Salve too much, but it is interesting that they actually have, you know, if you're
6034670	6040150	looking for classes that are specific to healthcare and cybersecurity, they're the
6040150	6047150	only organization that I know that are pairing those two topics. Certifications, there's a number
6047150	6053750	of certifications that you can take. Security Plus is kind of CompTIA. Many of their certifications
6053750	6059030	are kind of considered entry level. That's a bad thing, but if you're new, that's great.
6059030	6063510	The Security Plus is interesting because it's kind of more entry level in security,
6063510	6068310	but it typically requires that you have the CompTIA A Plus and Network Plus before. I shouldn't say
6068310	6072830	that. It doesn't require it, but it recommends it. So that might be more of an entry level
6073450	6080570	or an earlier career cert. The HCISPP, so the Healthcare... was it Healthcare Information
6080570	6087710	and Security and Privacy Practitioners Certification from ISC Squared is kind of the
6089030	6094130	more of the senior level certification. It does require two years of working full time
6094130	6099670	in the security field. So that's another certification to look at. Surely there's
6099670	6104430	others out there too. Those are just two that we thought might be applicable to this group.
6104970	6113650	There's a number of great free online classes, CyberArea and Coursera. I only picked these
6113650	6118450	because they were listed in the link at the bottom for TechRadar as the top two. And having
6118450	6124290	taken classes from each, they are good. I will note that I don't know about these two, but a lot
6124290	6129910	of the free classes. So as a professor, I use some of the free courseware in my classes as like
6129910	6139430	sub-modules for teaching. And I don't know why, but basically as of like fall 2019, a lot of these
6139430	6146530	online free education courses or programs started putting some content behind a paywall and anything
6146530	6152530	like HIPAA and cybersecurity related tended to fall under that. So just be aware that some of the
6152530	6157090	content may be free and some of it you may have to pay for, but it may be reasonable. So it may be
6157090	6162730	worthwhile. It may be cheaper to just have all your employees take classes at one of these places
6162730	6169350	and pay for an organizational membership to develop your own course. Definitely get involved.
6169350	6174710	Join us in some of the industry groups that we work in. There's the Health ISAC. They have a
6174710	6179550	number of industry groups. I was leading the global data privacy group for a while. There's
6179550	6184570	groups on just about everything else. The Healthcare Sector Coordinating Council.
6184690	6190170	They have some great groups on like secure development life cycle and any number of
6190170	6194990	other things. There's a work group right now on training and development that I'm involved in
6195750	6201170	that would be a great one to get involved in if you're looking at continuing to get
6201170	6206390	more training. And there's certainly other groups out there. AIME, a number of other
6206390	6212210	organizations. These are just two that tend to be popular in the industry. Please don't
6212210	6217730	take any of these as a decisive list of everything that you can look at. And local security groups.
6217730	6221310	Again, if you're watching this live, you're probably familiar with this, but if you're
6221310	6227910	watching this on YouTube after the fact, local OWASP chapters are great for monthly meetups.
6227910	6232570	And then DEF CON. So we're at DEF CON. There's local DEF CON groups or chapters.
6233630	6238270	DEF CON 617 was a Boston group that I was involved for a while. And now I'm heavily
6238270	6243190	involved with DEF CON 401. So they do, you know, most of these do like monthly,
6243750	6247570	that's kind of like a lunch learn, but they're usually at night where they might have pizza
6247570	6252850	and someone to give a talk. And, you know, it might be a technical, it might be, you know,
6252850	6257170	it could be any topic related to security. So, and it's good for networking, kind of making
6257170	6262490	contacts within your area as well. So, and the, one of the good things, if there's a good thing
6262490	6268110	about COVID-19 is that because we're not meeting in person, a lot of these groups are doing online
6268110	6273370	meetings now that you don't have to geographically live close to, like DEF CON 401. If you look at
6273370	6277910	their meetup, they have a number of, I think the next couple months, maybe at least two or three
6277910	6281970	months are going to be online because we can't meet in person. So, you know, you can, if you
6281970	6286050	live in an area where there isn't one of these groups and you can't, if you go to like DEF CON
6286050	6290550	groups.org and try to find one in your area, but if there isn't one in your area, maybe at least
6290550	6296690	for the next couple months, who knows how long, you can visit one online. Again, if you're super
6296690	6302250	new to InfoSec, this is a good book. It was free for a while online. I don't know if it still is,
6302250	6308070	but there was a PDF for free online. If you do have to buy it, maybe it's five bucks. But yeah,
6308070	6312850	if you do do InfoSec and trying to figure out how to grow your career, learn more, you know,
6312850	6319190	get certifications, things like that. This is a great book to check out. Some other good resources,
6319190	6324050	Micah Hoffman's presentation at B-Sides on how to join the InfoSec community. Again, getting
6324050	6328730	involved. One of the great things about the InfoSec community is that, you know, we're constantly
6328730	6333210	sharing information and training each other and it doesn't really cost a lot of money,
6333210	6339210	which is great. You can just kind of go to conferences for fairly cheap and continue to
6339210	6344430	keep learning. So things to Google, you know, you can Google hacking the skills shortage,
6344430	6349270	we'll pull up good articles on that. Best information security certifications for,
6349270	6354650	you know, insert the year, five grade starter cybersecurity certifications, things like that.
6354650	6359870	We'll all kind of put you in line of understanding, you know, kind of maybe your next career step.
6359870	6364570	And not necessarily career step of just where, you know, where to go to if you to leave your
6364570	6369190	company and go somewhere else. But if you like working at a hospital, how to keep evolving your
6369190	6373130	skills so that you become a better, you know, defender of your hospital organization.
6374470	6378310	So we want to keep the conversation going. We're going to take a short break.
6378310	6384890	So definitely go get some food, get your favorite beverage, and we'll be back in a little bit to
6384890	6388010	actually have a panel discussion where you can not only talk to me and Helen,
6389510	6393470	but a number of other experts in the field that know a lot more than we do.
6393470	6397390	And some of them work at hospitals, so they can give you that perspective as well.
6398730	6406550	So let's see. Yeah, so, you know, certainly reach out, again, both in the follow-up
6408610	6412570	panel afterwards, but also, you know, if you have a specific question that you don't want
6412570	6416570	to raise there, you can reach out. Here's our contact information. We'll leave that
6416570	6421290	up for a little bit so you can email us, you know, hit us up on Twitter, you know,
6421290	6424670	however you want to get a hold of us. And we look forward to hearing from you more.
6424670	6429250	Again, take a take a good break, and then we'll be back for the panel discussion,
6429250	6434870	and we look forward to hearing some of your questions. So thanks for all of everyone paying
6434870	6438730	attention and the questions that were in the Discord channel during this training,
6438730	6442830	and we look forward to seeing you at that panel. Thanks. Thank you for your time.