1
00:00:00,000 --> 00:00:04,940
Hi, I'm Mitch Parker, Information Security Officer at IU Health in Indianapolis, Indiana.

2
00:00:04,940 --> 00:00:16,820
And today's topic is going to be advancing medical device security, how collaboration between providers, manufacturers and pen testers is advancing what's possible with security.

3
00:00:16,920 --> 00:00:23,860
And with us today, we have an incredibly distinguished panel of people we've been able to find who I'd like to have introduce themselves right now.

4
00:00:23,860 --> 00:00:26,040
We're going to start with Florence Hudson.

5
00:00:26,040 --> 00:00:27,040
Very good.

6
00:00:27,040 --> 00:00:29,660
Thank you so much, Mitch, for having me join you.

7
00:00:29,660 --> 00:00:31,520
And hey, DEF CON crowd.

8
00:00:31,560 --> 00:00:32,840
Geeks and all.

9
00:00:33,260 --> 00:00:34,060
And goons.

10
00:00:34,060 --> 00:00:41,900
So I'm Florence Hudson, and I'm Founder and CEO of FDHint, which is an international consulting firm for advanced technology and diversity and inclusion.

11
00:00:42,220 --> 00:00:47,520
I also work for the NSF Cybersecurity Center of Excellence at Indiana University.

12
00:00:47,520 --> 00:00:51,160
I lead the Cybersecurity Research Transition to Practice Program.

13
00:00:51,160 --> 00:01:00,860
And I'm also Executive Director for the Northeast Big Data Innovation Hub at Columbia University, leading translational data science opportunities in the Northeast US.

14
00:01:02,900 --> 00:01:09,820
Oh, and I should say, I'm also Working Group Chair for IEEE UL P2933.

15
00:01:09,820 --> 00:01:17,980
For those who aren't acronym queens and kings, it stands for Institute for Electronic Engineers and Underwriters Laboratories.

16
00:01:18,080 --> 00:01:29,320
Working group on creating a standard around clinical innovative things, data, and device interoperability with TIPS, which stands for Trust, Identity, Privacy, Protection, Safety, and Security.

17
00:01:29,320 --> 00:01:31,340
And Mitch is one of our Co-Vice Chairs.

18
00:01:31,340 --> 00:01:33,200
So thank you very much for having me, Mitch.

19
00:01:33,200 --> 00:01:34,140
Thank you, Florence.

20
00:01:34,140 --> 00:01:35,880
We'll take it over to Rob Suarez.

21
00:01:37,460 --> 00:01:38,080
Hi.

22
00:01:38,080 --> 00:01:39,040
Hi, DEF CON.

23
00:01:39,040 --> 00:01:45,400
This is... My name is Rob Suarez, and I'm the Chief Information Security Officer for BD.

24
00:01:45,540 --> 00:01:47,320
That's Beckton Dickinson.

25
00:01:47,580 --> 00:01:56,480
And we're a global medical technology company offering some of the most advanced products across the continuum of care.

26
00:01:56,620 --> 00:02:14,660
It's my job at BD to make sure that we are protecting those products that we're delivering a secure product and also the environment in which they reside in, which is typically a hospital, but increasingly, you know, a patient bedside at home as well.

27
00:02:14,660 --> 00:02:20,480
And so I'm very excited to talk to my fellow panelists today about medical device cybersecurity.

28
00:02:20,480 --> 00:02:30,300
This is a passion of mine, and I've had the honor actually of working alongside Mitch and Michael as well on several industry initiatives.

29
00:02:30,920 --> 00:02:33,880
And so again, looking forward to the discussion today.

30
00:02:33,880 --> 00:02:35,000
Thank you.

31
00:02:35,360 --> 00:02:37,380
And last but not least, Mr.

32
00:02:37,380 --> 00:02:38,600
Michael McNeil.

33
00:02:39,020 --> 00:02:40,000
Hi, DEF CON.

34
00:02:40,000 --> 00:02:41,380
This is Michael McNeil.

35
00:02:41,440 --> 00:02:52,100
I'm the Senior Vice President and Global Chief Information Security Officer at McKesson, and just recently got to the organization.

36
00:02:52,100 --> 00:03:00,160
But as, you know, Rob has just stated, have had a number of years collaborating, you know, with the team here.

37
00:03:00,160 --> 00:03:09,280
And my days go back into Philips as well as into Medtronic from a medical device perspective over the past 10 years.

38
00:03:09,280 --> 00:03:18,860
Really looking forward to this particular session and again have collaborated with these guys in a number of different industry and forums.

39
00:03:18,860 --> 00:03:29,940
And again, I think you'll find our conversations today to be pretty enlightening because it takes that ecosystem and for us to come together to really execute here.

40
00:03:30,860 --> 00:03:32,940
Thank you so much, Michael.

41
00:03:32,940 --> 00:03:35,780
So I'm going to launch right into the first question here.

42
00:03:35,780 --> 00:03:42,600
First question is, what are the biggest concerns that each of you sees related to medical device security?

43
00:03:42,660 --> 00:03:46,380
So I'll start if I might.

44
00:03:46,400 --> 00:03:52,980
So what I mentioned when we were first opening up, I talked about tips, tips for the Internet of Things.

45
00:03:53,080 --> 00:03:56,640
This is a framework we've been creating with IEEE for four years now.

46
00:03:56,640 --> 00:04:01,940
As I mentioned, it stands for trust and identity, privacy, protection, safety, and security.

47
00:04:01,940 --> 00:04:03,420
I'm worried about all those things.

48
00:04:03,580 --> 00:04:12,840
I'm worried about the trust and identity of the devices, the device to device communication, the device to human, the doctor to the device to the human, human to everything.

49
00:04:13,040 --> 00:04:18,840
So I'm concerned about trust and identity, how we're going to maintain that and make sure we're vigilant about it.

50
00:04:18,900 --> 00:04:26,180
I'm concerned about privacy of data, whether you're in your home country or another country and what the different regulations are and how we're going to manage it.

51
00:04:26,180 --> 00:04:39,400
I'm concerned about protection and safety, how we're going to keep the humans safe, how we're going to keep the device safe, the infrastructure, the financial side of the institution, if your device is hacked and everybody finds out, like some of the FDA and DHS and U.S.

52
00:04:39,400 --> 00:04:40,240
CERT recalls.

53
00:04:40,240 --> 00:04:42,480
And I'm concerned about the cybersecurity.

54
00:04:42,480 --> 00:04:50,480
So we have a lot to do as the leaders in this space for IT and for cybersecurity and for medical devices.

55
00:04:50,480 --> 00:05:08,780
So I look forward to continuing the collaboration we're doing through groups like this and also like in the IEEE working group where we have over 250 humans from 22 countries and six continents who are worried about this too, including device manufacturers and providers and payers and regulators and everybody as we know,

56
00:05:08,780 --> 00:05:09,340
Mitch.

57
00:05:09,340 --> 00:05:11,160
So I'm worried about all that stuff.

58
00:05:11,160 --> 00:05:12,680
What about the rest of you?

59
00:05:12,680 --> 00:05:13,580
Are you worried?

60
00:05:15,340 --> 00:05:17,820
So I'll go next on that one.

61
00:05:17,820 --> 00:05:19,040
Thank you, Florence.

62
00:05:19,760 --> 00:05:33,580
For me, it's actually very similar to what you'll find was reported out and I believe it was 2017 and what was the healthcare industry cybersecurity task force report.

63
00:05:33,580 --> 00:05:50,680
In fact, on that task force, I got to serve alongside Michael McNeil and several other individuals across the industry and produce a report that outlined observations and recommendations for improving cybersecurity across the industry in healthcare.

64
00:05:50,680 --> 00:05:58,400
There was a specific section that was dedicated just for medical device cybersecurity, and I got to tell you, that was three years ago.

65
00:05:58,400 --> 00:06:02,520
A lot of those findings still apply to this day.

66
00:06:02,800 --> 00:06:14,700
And one that pops out to me immediately is that medical devices are in hospital settings for 15 to 20 years, but new cybersecurity threats emerge daily.

67
00:06:14,960 --> 00:06:19,540
And every hospital and every patient environment is unique.

68
00:06:19,540 --> 00:06:22,620
So there's no one-size-fits-all approach.

69
00:06:23,340 --> 00:06:36,220
And at BD, we're working closely with healthcare providers on understanding medical device cybersecurity as it exists out in a clinical setting, out in the real world.

70
00:06:36,360 --> 00:06:40,620
And we're also working, we're really committed to transparency.

71
00:06:41,100 --> 00:06:49,640
And for example, providing coordinated vulnerability disclosures on medical device vulnerabilities.

72
00:06:49,900 --> 00:06:54,280
But unfortunately, it's just not enough.

73
00:06:54,280 --> 00:07:00,260
There's really a long time span to medical devices in these environments.

74
00:07:00,260 --> 00:07:22,760
And so increasing transparency absolutely helps, but we also need to build stronger relationships and stronger collaborations across... Florence, as you really described, across the continuum of stakeholders that we have when it comes to just using a medical device and managing it when it's in use.

75
00:07:23,600 --> 00:07:24,420
Yeah.

76
00:07:24,420 --> 00:07:46,240
And from my perspective to build on what Rob has just stated, he's hit the nail on the head, and we've been having these kinds of conversations and discussions even before the 2017 and earlier when we go back a few years on this particular topic.

77
00:07:46,720 --> 00:07:53,540
I think people have heard me talk in the past and it really doesn't... It's kind of interesting.

78
00:07:53,540 --> 00:07:54,720
It doesn't change.

79
00:07:54,720 --> 00:07:57,780
It just perpetuates itself.

80
00:07:57,780 --> 00:08:15,700
So as Rob just talked about, legacy devices as we call them in the ecosystem and how we manage that, that to me ties right into what I've always said is sort of the three deadly sins that I've kind of communicated over time.

81
00:08:15,720 --> 00:08:22,260
Because you have these types of devices, you need to make sure that you can patch and update them in a timely manner.

82
00:08:22,260 --> 00:08:31,900
So one of the deadly sins, if I can't patch and update a device, I'm not going to be able to maintain the security of that solution out in the marketplace.

83
00:08:32,140 --> 00:08:43,300
When I look at the types of devices and a number of them when they were designed and developed and they're in these environments, if they got hard-coded credentials, those are the keys to the kingdom.

84
00:08:43,300 --> 00:08:52,900
If I open the keys up and I let anybody come in, front, back, side doors, any way that you have, then you have access and you're going to be able to align.

85
00:08:52,900 --> 00:09:17,040
And then for us, when it comes to the type of information, again, as I would say that Florence had talked about in terms of thinking of the type of data and the type of information that needs to be held secure, if you don't do encryption and de-identify and make sure that that's not available to cause the kinds of harm to individuals,

86
00:09:17,040 --> 00:09:20,700
to the solution itself, you get to those deadly sins.

87
00:09:20,700 --> 00:09:32,780
So the sins are there and we're doing a much better job, I believe, in having an awareness around the design and how we need to build that into our solution set.

88
00:09:32,780 --> 00:09:40,740
But it's how do you manage that legacy that's sitting out there in the current environment?

89
00:09:40,740 --> 00:10:05,760
And as we've also said in the past, because of the nature of the marketplace, it's like prying those systems out of their cold, dead hands in some of these hospitals and other types of entities, because they don't have, obviously, with Mitch, the wherewithal to just immediately turn around,

90
00:10:05,760 --> 00:10:09,980
you know, your capital and your inventory for some of these types of solutions.

91
00:10:10,020 --> 00:10:12,120
Yeah, so I totally agree.

92
00:10:12,120 --> 00:10:14,840
It's the products we have today.

93
00:10:14,900 --> 00:10:24,940
It's the new products and how we create design-in plans so that you design in a defense-in-depth level of security at the hardware, firmware, software, and service level.

94
00:10:25,220 --> 00:10:28,900
I suggest we go all the way down to the IP of the design of the chip.

95
00:10:29,060 --> 00:10:32,260
You know, we need to go all the way down and all the way up.

96
00:10:32,260 --> 00:10:38,620
And we also need, I know in the standards work we're doing, we're saying that we need to be able to look forward too.

97
00:10:38,620 --> 00:10:41,440
I'm an old rocket scientist, or experienced.

98
00:10:41,440 --> 00:10:44,960
My girlfriend's saying not to use the term old, but I'm an experienced rocket scientist.

99
00:10:44,960 --> 00:10:46,800
I used to work on future missions around Jupiter.

100
00:10:46,800 --> 00:10:48,100
Did we know exactly what we were doing?

101
00:10:48,100 --> 00:10:52,020
No, but we had a planet, you know, and you look forward, you say, what's going to happen?

102
00:10:52,040 --> 00:10:59,220
So in the standards work that we're doing, we're agreeing that it has to be a standard that is extensible into the future.

103
00:10:59,400 --> 00:11:04,720
You know, so what we're also doing is envisioning, well, how can we use artificial intelligence and machine learning better?

104
00:11:05,020 --> 00:11:09,420
What about when it's a hologram and the doctor's like, oh my gosh, she's right here.

105
00:11:09,640 --> 00:11:10,700
You look a little jaundiced.

106
00:11:10,700 --> 00:11:12,060
I'm like, how do you know that?

107
00:11:12,060 --> 00:11:13,280
You know, I'm in my pajamas.

108
00:11:13,280 --> 00:11:14,280
How did that just happen?

109
00:11:14,280 --> 00:11:14,700
Right?

110
00:11:14,720 --> 00:11:19,740
So when we're in XR, AR, VR, how's all this stuff going to play?

111
00:11:19,800 --> 00:11:25,660
And then if you want to get excited about protocols, think of what, you know, communications protocol, that's going to be all about.

112
00:11:25,660 --> 00:11:31,680
You know, that's going to get into your EHR or how they're going to read, you know, from your, from your little devices.

113
00:11:31,680 --> 00:11:34,260
So we're also trying to think of what could happen.

114
00:11:34,260 --> 00:11:42,820
So being an aerospace engineer and designing, you know, not just spacecraft, but also planes and jets, you have your heads down display, right?

115
00:11:42,820 --> 00:11:43,520
Your altimeter.

116
00:11:43,520 --> 00:11:45,360
And then you have your heads up display.

117
00:11:45,420 --> 00:11:46,500
We need both.

118
00:11:48,640 --> 00:11:59,150
I am in full agreement with you and can tell you the biggest challenge I saw with all these years of working for healthcare and hospitals.

119
00:11:59,150 --> 00:12:02,290
I've been in the provider space for about a dozen years as a CISO.

120
00:12:02,290 --> 00:12:15,790
And biggest challenge I've always found has actually been paying for it all because a lot of, a lot of hospitals out there, especially with COVID, have significant financial challenges these days.

121
00:12:16,090 --> 00:12:20,710
And right now, I mean, every hospital has a problem paying.

122
00:12:20,790 --> 00:12:31,210
Before January or February of this year, you still would have had about, I'd say about half the hospitals in the United States, whereby I asked them to update a good chunk of their clinical engineering equipment.

123
00:12:31,470 --> 00:12:38,930
They would have likely looked at me and said, when I can fix my roof, when I can fix my floor, and when I can patch the hole in the boiler.

124
00:12:39,510 --> 00:12:40,690
And what do you want?

125
00:12:40,690 --> 00:12:43,330
Do you want a roof over your head or do you want secure medical devices?

126
00:12:43,330 --> 00:12:55,910
And I've actually once had a clinical chair from the department sit me down and say, I'd like to update my devices, but I need to get different ones in here because I'm not able to do women's health properly.

127
00:12:56,710 --> 00:13:01,910
And to me, that put a lot of items in perspective.

128
00:13:01,910 --> 00:13:11,470
And I've always worked with my customers to make sure that we can get them on at least a good path to where they need to be using minimal cost solutions.

129
00:13:11,470 --> 00:13:16,470
Because to be very blunt, it's 15 to 20 years also, because it's all I have money for.

130
00:13:16,490 --> 00:13:19,550
And that's sadly the situation in the United States.

131
00:13:19,550 --> 00:13:31,310
And after things happen, after we have some leveling off with COVID, we're going to be in a much different place, more like 2009 when it comes to the economy.

132
00:13:31,490 --> 00:13:34,650
But to get these good items in place, you need to have standards.

133
00:13:34,650 --> 00:13:42,030
And that leads me to the second question, which is, what standards efforts are in play for medical device security that you're currently working with?

134
00:13:42,030 --> 00:13:45,850
So again, to you, Florence, because of all the IEEE work.

135
00:13:47,030 --> 00:13:47,690
Absolutely.

136
00:13:47,690 --> 00:13:48,810
I have to apologize.

137
00:13:48,810 --> 00:13:50,910
I have a robo caller who won't give up.

138
00:13:50,910 --> 00:13:53,550
So you're going to hear my phone in the background.

139
00:13:53,830 --> 00:13:55,190
So anyone else been through this?

140
00:13:55,190 --> 00:14:03,310
So the standards efforts, we have a number of standards efforts in play, and we're trying to hold hands and work together.

141
00:14:03,350 --> 00:14:13,250
So at IEEE, we have this IEEE UL P2933, which is the for clinical IOT data and device interoperability with TIPS, as we discussed.

142
00:14:13,250 --> 00:14:17,230
There are also efforts on blockchain for healthcare and how that plays in.

143
00:14:17,230 --> 00:14:24,090
There are efforts going on with ISO and IEC and open mobile health and communications interoperability.

144
00:14:24,090 --> 00:14:37,670
So we actually just had a really cool session last week, where Mitch and I presented along with a number of our colleagues from around the world regarding addressing clinical IOT interoperability and security challenges globally.

145
00:14:38,390 --> 00:14:52,650
And so one of our colleagues representing Underwriters Laboratories, after we each spoke about P2933, you know, this kind of IOT thing, and then open mobile health, and a few other things, he got up and said, okay, here's one page with like all this stuff on it.

146
00:14:52,830 --> 00:14:56,830
You know, we have a pyramid here, we have a triangle, and we have all these other pieces.

147
00:14:56,930 --> 00:14:59,310
We have to figure out how we're going to work together.

148
00:14:59,410 --> 00:15:07,470
So if any of you out there are interested in getting involved in this, we're actually hoping to have a longitudinal plan here.

149
00:15:07,530 --> 00:15:14,730
We had Julian Goldman from Harvard, and Mass General, who was on the panel, and Ida Sim from UCSF.

150
00:15:14,730 --> 00:15:22,150
We had Mitch, me, Ken Fuchs, McGregor, Anura, Fernando from Underwriters Laboratories.

151
00:15:22,510 --> 00:15:24,730
And I always forget at least one.

152
00:15:25,050 --> 00:15:27,230
Oh, and Ken, I think that's most of it.

153
00:15:27,230 --> 00:15:30,050
And so we're all going to be getting together again in the fall.

154
00:15:30,050 --> 00:15:33,050
And we're interested in anybody else who wants to join us.

155
00:15:33,050 --> 00:15:37,370
So Mitch, I don't know if we're giving out our email addresses or how you want to do that.

156
00:15:37,510 --> 00:15:49,350
But, you know, we'll find a way to make the P2933 web page completely accessible and get information over there.

157
00:15:50,070 --> 00:15:57,190
So in the meantime, you can send me an email along with my robocaller at florence.com.

158
00:15:57,950 --> 00:16:02,570
And I think I'm going to give them my email address so they're not so disruptive the next time.

159
00:16:04,090 --> 00:16:12,030
Hey, Florence, I'm really excited to hear that IEEE is getting involved in this space.

160
00:16:13,230 --> 00:16:16,650
And, you know, it's exciting to hear that.

161
00:16:16,650 --> 00:16:28,250
There's not enough that we can do actually to really formalize the process of multiple device cybersecurity across the lifecycle of these technologies.

162
00:16:28,410 --> 00:16:42,870
I would like to also recognize, you know, a lot of the work that the FDA has done in producing cybersecurity guidance documents over the last, oh my gosh, you know, many years.

163
00:16:43,130 --> 00:16:52,490
And so, you know, whether it's pre-market requirements for submissions and cybersecurity, or it's post-market surveillance, right?

164
00:16:52,490 --> 00:16:58,070
And knowing how to do coordinated vulnerability disclosures, those guidance documents are very helpful.

165
00:16:58,070 --> 00:17:05,470
Also very relevant today, you know, is cybersecurity for off-the-shelf software components.

166
00:17:05,470 --> 00:17:11,310
Again, you know, FDA has some good guidance documents, a good guidance document on that.

167
00:17:11,510 --> 00:17:19,890
Recently, and, you know, they've taken a very collaborative approach to cybersecurity engaging very different stakeholders.

168
00:17:19,890 --> 00:17:30,790
And a great example of that, you know, FDA has engaged NTIA on creating a software bill of materials standard and a set of deliverables around that as well.

169
00:17:30,790 --> 00:17:44,510
And it's all around how manufacturers can be more ready to identify vulnerabilities in third-party components, and then extending that capability out to hospitals, you know, who have this technology in an operational environment.

170
00:17:45,070 --> 00:17:53,110
And, you know, the last two things here I'll mention is International Medical Device Regulators Forum.

171
00:17:53,110 --> 00:17:55,030
You know, it's not just the U.S.

172
00:17:55,030 --> 00:17:56,770
and FDA that's going through this problem.

173
00:17:56,770 --> 00:18:00,670
This is a global issue in medical device cybersecurity.

174
00:18:00,830 --> 00:18:16,710
And the International Medical Device Regulators Forum, INDRS, has come together to produce a cybersecurity guidance document that really sets to harmonize... provide harmonized guidance to regulators globally.

175
00:18:16,710 --> 00:18:26,030
So, you know, different countries and regions can set up their own guidance documents and map that to their own regulatory bodies.

176
00:18:26,490 --> 00:18:36,550
And the last one here I'll mention, I have to mention it because, boy, it was a lot of work, but the Healthcare Sector Coordinating Council.

177
00:18:37,050 --> 00:18:50,670
And, you know, Michael also and Mitch, you know, were contributors to this effort as well, produced what's called the Joint Security Plan, the MedTech Joint Security Plan, otherwise referred to as the JSP.

178
00:18:50,990 --> 00:18:54,310
And, you know, in this document, you know, anyone can find...

179
00:18:55,170 --> 00:18:57,470
it's not just... it's not standard.

180
00:18:57,470 --> 00:19:15,890
It's actually a plan, a way to put in motion a security program from design, development, all the way out to, you know, complaint handling for medical devices, and what to do when these devices are out in the field, and risk management, again, throughout the continuum of care.

181
00:19:15,890 --> 00:19:29,710
So if you want to know how to do a risk assessment on medical devices, if you want to know, you know, when to do a penetration test, what types of design requirements are helpful for medical device and cybersecurity, how to structure your organization,

182
00:19:29,710 --> 00:19:33,110
you know, those things you can find in the JSP today.

183
00:19:33,110 --> 00:19:41,910
And working with MDIC, we're also developing an effort to actually benchmark against those different capabilities.

184
00:19:41,910 --> 00:19:52,470
So that way, if you're a small medical device manufacturer or a large one, you want to know where to go next, and how to build out your program, and what's good enough.

185
00:19:52,470 --> 00:20:12,130
And so this benchmarking initiative with MDIC will help us create that set of metrics, and again, the benchmark itself, so that we can share it openly across our industry stakeholders, and collectively improve our programs, be able to speak to our executive leadership,

186
00:20:12,130 --> 00:20:18,010
too, as well, that have to pay and make and commit to this investment in medical device cybersecurity.

187
00:20:18,010 --> 00:20:19,130
That sounds really cool.

188
00:20:19,130 --> 00:20:22,630
Do they have guidance for manufacturers as well as providers?

189
00:20:24,350 --> 00:20:32,530
So, Healthcare Sector Coordinating Council also has, yes, guidance for healthcare providers, too.

190
00:20:32,530 --> 00:20:36,030
It's called HICP, H-I-C-P.

191
00:20:36,150 --> 00:20:45,090
And then you have the Joint Security Plan, which is focused on medical devices and healthcare IT solutions.

192
00:20:45,510 --> 00:20:50,430
And so, yes, they have guidance for both sets of stakeholders.

193
00:20:50,430 --> 00:20:51,110
Right.

194
00:20:51,110 --> 00:21:15,190
And yeah, so as Rob stated, the IMDRF, also, the way it was documented, it addresses, here's what's the pertinent areas for the manufacturer, the health delivery organization, the different stakeholders, even patients, as it pertains to the different topics that was put into that type of guidance.

195
00:21:15,190 --> 00:21:17,770
And again, that one was global.

196
00:21:17,770 --> 00:21:38,510
A couple of others that I would just want to make sure that we have included when you talk about health delivery organizations, MIDA has always championed and updated their, you know, MDS2 documentation, which is utilized for the procurement process with health delivery organizations.

197
00:21:38,510 --> 00:22:04,330
And that MDS2 is something that has been maintained as a part of the release schedule and with the inclusion of the SBOM as a component and a deliverable of that, it gives organizations like Mitch's the ability of being able to understand the ingredients of the product and the solutions that they are acquiring and how they need to develop and execute that.

198
00:22:04,330 --> 00:22:23,950
And then as Rob said, the AAMI organization has taken on the ability of taking a look at some of those, you know, pre-market and post-market type of guidance documentation, and then they created their technical, you know, references in their TIR 57 and 97,

199
00:22:23,950 --> 00:22:36,650
which allows you to provide some of the how-to on those different stakeholders in the industry, how they need to execute against those particular technical references and standards.

200
00:22:36,650 --> 00:22:42,630
So I think that kind of, we gave you the alphabet soup and then some in response, Mitch.

201
00:22:43,070 --> 00:22:44,250
Yeah, absolutely.

202
00:22:44,250 --> 00:22:45,850
No excuses now.

203
00:22:46,970 --> 00:22:51,490
I can tell you that that 2019 MDS2 form, thank you very much for that, Michael.

204
00:22:51,490 --> 00:22:53,870
That's been incredible in our organization.

205
00:22:54,090 --> 00:22:56,410
We've actually started using that a lot.

206
00:22:56,410 --> 00:22:58,810
The first vendor that actually gave us one was Philips.

207
00:22:59,210 --> 00:23:04,150
So very happy that... I'll take the old pats on the back for that.

208
00:23:04,150 --> 00:23:08,130
We're starting to get those in from our vendors and they've been helping us out with a lot of different purposes.

209
00:23:08,370 --> 00:23:17,030
So my next question here is, what are the most difficult medical device security issues to solve?

210
00:23:17,030 --> 00:23:19,190
I want to throw a real ringer in there.

211
00:23:22,670 --> 00:23:24,210
I'll take the first.

212
00:23:24,490 --> 00:23:25,790
Okay, go ahead, Rob.

213
00:23:25,790 --> 00:23:29,510
Yeah, I'll take a first stab at that.

214
00:23:29,510 --> 00:23:36,450
So I think one of the most difficult issues to solve, just to change it up here, aside from...

215
00:23:37,010 --> 00:23:55,270
and it does relate to the issue of legacy medical devices, is also that hospital environments may have hundreds of thousands of connected medical devices at one time and from thousands of different vendors.

216
00:23:55,430 --> 00:24:10,930
And so while I may not directly feel that pain, I feel for our customers at BD that are healthcare providers and have to manage this tremendous complexity.

217
00:24:11,710 --> 00:24:28,690
And what compounds this situation is that not every medical device manufacturer is doing things like patching of their medical devices or routine updates to their medical devices.

218
00:24:28,790 --> 00:24:38,650
And also, that's why transparency is so important, because these new threats emerge daily.

219
00:24:38,750 --> 00:24:58,210
And boy, I'm sure there's a lot of homework that healthcare providers have to do when a new security vulnerability pops up and you don't find a timely and effective or meaningful communication from a medical device manufacturer to facilitate a response.

220
00:24:58,210 --> 00:25:06,690
So yeah, I think those are really, really important issues that we need to address.

221
00:25:07,450 --> 00:25:28,030
You know, one of the things I would add on where Rob is at, and again, I do agree that the level of connectivity and the complexity of the type of solutions is definitely a critical one, but let me be a little bit more provocative and throw something else out there.

222
00:25:28,030 --> 00:25:40,890
I think when you look at potentially, and again, and this gets back to, again, I think where Florence was at when we talk about taking it down to the chip level.

223
00:25:40,930 --> 00:25:57,570
I think when I look at the greed that exists in society around the revenue that either wants to be made or maintained on devices, and then what that would be from your brand and impression.

224
00:25:57,570 --> 00:26:26,950
I think one of the best things that happened was the fact when the Health Sector Coordinating Council and HISAC and others have come together and petitioned organizations like Microsoft, especially during this time of COVID, to extend the patching and the updates for Windows 7 and to make that date in the hospital sector not to extend it.

225
00:26:26,950 --> 00:26:43,190
So the more that we can do activities as a community like that to either extend the life or to be much more economical around how these products and solutions are being used.

226
00:26:43,190 --> 00:26:49,990
And again, my provocativeness, get away from the potential greed that might exist out there.

227
00:26:49,990 --> 00:26:59,190
I think that'll help us to try to address some of the issues that might exist in the ecosystem.

228
00:26:59,190 --> 00:27:00,750
It's one thought.

229
00:27:04,470 --> 00:27:13,110
Yeah, greed and jealousy are motivators that we can use in business to get people to do things.

230
00:27:13,950 --> 00:27:18,790
And so it's the human condition, I think.

231
00:27:18,890 --> 00:27:24,070
So if we could figure out how to leverage that, I think that would be good.

232
00:27:24,110 --> 00:27:34,030
So in the standards work that we do, you know, it's IEEE, it's at the individual level, it doesn't cost anything to join the working group.

233
00:27:34,110 --> 00:27:43,470
And what I tell people is, you know, this will be like a take-home test if you get involved now, because you can help define it, you know, and then you could be the first ones to have it.

234
00:27:43,470 --> 00:28:03,490
And you could be at the leading edge when, you know, I was at Yale New Haven a couple years ago talking about this tips framework, and very bright as they are, the chief information and chief medical officers looked at me and said, so do you have a tips maturity model that you could hand us today that we could use tomorrow to look at all these hundreds of thousands of devices in our hospital and our patients?

235
00:28:03,490 --> 00:28:08,790
Like, whoa, I wish the answer to that was yes, but it's going to take a village, right?

236
00:28:08,790 --> 00:28:11,670
Ah, the biohacking village, look where we are, how handy is this?

237
00:28:11,670 --> 00:28:14,770
So maybe that's something, you know, we can end up working on together.

238
00:28:15,090 --> 00:28:27,150
And people can get involved in creating this tips maturity model, validating it, certifying it, you know, maybe that's, you know, what we can do is get other people jealous, like, ooh, you know, I want to go to the head of the class.

239
00:28:27,150 --> 00:28:28,390
That would be great.

240
00:28:30,130 --> 00:28:32,410
I, I agree with you.

241
00:28:32,410 --> 00:28:34,990
And I think, and again, there's other challenges as well.

242
00:28:34,990 --> 00:28:42,450
And I'm going to be just as provocative as Michael right here and bring out another big one, which is the electronic medical records systems of record themselves.

243
00:28:43,490 --> 00:29:00,030
So we have to make sure that these systems of record that we eventually store all this information in, we have to make sure we keep them as updated and up to date and able to support these devices just as much as the devices themselves.

244
00:29:00,030 --> 00:29:15,230
There was actually an interesting paper I read from the late Michael Sinow and some other people that had put together the best model for electronic medical record system implementation at a health system in New Jersey they were at.

245
00:29:15,230 --> 00:29:19,490
And what it came down to is that 25% of the cost was the EMR.

246
00:29:19,490 --> 00:29:25,370
75% was the cost of the ancillary devices themselves.

247
00:29:25,550 --> 00:29:39,990
So I think we could stand to make sure that we have a good budgeting model that we make sure that we understand what devices work, what version of an EMR and be able to cost it all out.

248
00:29:39,990 --> 00:29:51,930
And we can solve that challenge with simply doing a lot of good financial work and making sure also that the system of record aka the EMR also stays updated.

249
00:29:51,930 --> 00:29:54,110
Easier said than done.

250
00:29:54,310 --> 00:30:07,930
So talking about other challenges to your future leads to question number four which is how do you solve the challenges today with an anticipatory eye and what the next threats may be?

251
00:30:07,930 --> 00:30:11,110
First on that right here I'll start off again with Florence.

252
00:30:11,970 --> 00:30:14,050
Oh heads down display heads up display.

253
00:30:14,050 --> 00:30:16,210
What is it you're trying to deal with today?

254
00:30:16,470 --> 00:30:22,970
And we have we'll start with with that and we have to have the guts to look at what we haven't done yet.

255
00:30:22,970 --> 00:30:28,210
Now we're all talking about standard this you know we haven't done with SNOMED and low ink and this and that and fire and HL7.

256
00:30:28,210 --> 00:30:31,970
Oh my god this stuff is so incredible because people who are brilliant who created it right.

257
00:30:32,390 --> 00:30:39,870
But it's not done and it will probably never be done right because there's a lot of hacking that you know continues to evolve as we know.

258
00:30:39,950 --> 00:30:45,290
The the bad dudes and dudettes and robots are just as smart as the good ones unfortunately.

259
00:30:45,530 --> 00:30:49,990
So what we have to do is not be afraid to look at what haven't we done yet.

260
00:30:49,990 --> 00:30:55,390
So as an example so we're talking about trust and identity and security and devices.

261
00:30:55,630 --> 00:31:06,650
So what if we had you know what if we figured out a federated identity management system for devices with you know digital identifiers, decentralized identifiers, and we try to do that globally.

262
00:31:06,650 --> 00:31:08,950
People go oh we haven't done that yet.

263
00:31:08,950 --> 00:31:12,010
I'm like exactly that's exactly the point.

264
00:31:12,110 --> 00:31:14,230
So is that exactly what we need?

265
00:31:14,230 --> 00:31:15,390
Maybe not.

266
00:31:15,410 --> 00:31:20,010
But go wide and then decide you know how we start today and where we need to go.

267
00:31:20,010 --> 00:31:25,270
So we have the guts we have to have the guts to say we haven't figured it all out yet.

268
00:31:25,810 --> 00:31:30,770
Figure out what we can do today and then build a step function you know a plan going forward.

269
00:31:31,090 --> 00:31:39,650
And you know you should we should do some brainstorming like I was about holograms and VR and AR and XR and your R and my R and all this other kind of stuff that's going to happen.

270
00:31:39,730 --> 00:31:42,030
And stuff that we don't even have terms for yet.

271
00:31:42,210 --> 00:31:43,790
They're going to be part of this.

272
00:31:43,950 --> 00:31:54,790
So I'd say that you know we have to start by being brave enough to understand what we already have from AIME and ISO and IEC and IEEE and all this other cool stuff and all the providers and all the manufacturers.

273
00:31:54,910 --> 00:31:56,810
Then look at what we haven't done yet.

274
00:31:56,810 --> 00:31:58,250
Have the guts to do that.

275
00:31:58,250 --> 00:32:01,150
Figure it out and then create a step function toward the future.

276
00:32:01,150 --> 00:32:02,450
So that's my recommendation.

277
00:32:03,020 --> 00:32:08,770
Yeah I love the comments from Florence and the direction.

278
00:32:09,170 --> 00:32:13,130
I've built a few homes because of having to relocate.

279
00:32:13,130 --> 00:32:19,950
And I always look at what your current environment is as an organization, as a team.

280
00:32:19,950 --> 00:32:23,730
And to her point, I want to make sure that foundation is in place.

281
00:32:23,730 --> 00:32:35,670
And one of the biggest hurdles is to be able to consistently execute in a number of these organizations that foundational piece that she described.

282
00:32:35,670 --> 00:32:43,090
In terms of making sure that we're doing consistently the activities and efforts that we should have in place right now.

283
00:32:43,090 --> 00:33:03,250
And so when you have multinational organizations, different business units, different variations of releases and schedules of products and devices, different mixes of solutions, whether or not they're capital related or implantables.

284
00:33:03,250 --> 00:33:11,870
And I mean, there's a myriad of things that exist out there, but you have to be pretty consistent with how am I developing that solution?

285
00:33:11,870 --> 00:33:13,170
How am I maintaining that?

286
00:33:13,170 --> 00:33:14,930
How am I updating that?

287
00:33:14,930 --> 00:33:25,310
How are we interacting and getting the right information at a consistent level like those MDS2s updated on that entire product portfolio?

288
00:33:25,310 --> 00:33:36,310
That's the basics in terms of the blocking and tackling that usually isn't the most sexy thing that you think of, and sometimes is really overlooked.

289
00:33:36,310 --> 00:33:48,130
And so we really need to get that foundational areas in place across all of the elements of, as we say in the ecosystem, for devices and solutions.

290
00:33:48,130 --> 00:34:09,010
And even as Mitch just pointed out from his earlier statements around the electronic health and medical records, Rob and I know that our counterparts in some of those entities, when we were on the cybersecurity task force, it was like pulling teeth to get them to want to even come to the table and having the discussions.

291
00:34:09,150 --> 00:34:24,150
And even when you have certain solutions where we're there was astonished to say, man, you had the ability to maintain the certain level of the release and not go back multiple inversions.

292
00:34:24,150 --> 00:34:39,550
But you did that to want to be supposedly in compliance and supporting your customers, but you were doing a total detriment to the industry by not aligning and forcing that you couldn't have stuff out there.

293
00:34:39,550 --> 00:34:46,490
But they were in a much easier position to maintain their devices at the most current levels and updates.

294
00:34:46,490 --> 00:34:49,090
And we were sitting there like, man, are you kidding?

295
00:34:49,150 --> 00:35:00,030
Because we don't have that luxury when it came to some of the devices, especially for organizations that had implantables and pumps and other things of those natures.

296
00:35:01,890 --> 00:35:04,090
So... Don't hold back, Michael.

297
00:35:04,930 --> 00:35:06,670
It's DEF CON.

298
00:35:07,650 --> 00:35:17,350
So when I think about what we can do right now, I think about the current environment that we're in.

299
00:35:17,350 --> 00:35:23,990
And it touches on a little bit of what you've heard from others on this panel, actually.

300
00:35:23,990 --> 00:35:31,150
We're in an environment where I think most of our organizations, if you work in healthcare, we're distracted.

301
00:35:31,150 --> 00:35:32,850
Really distracted.

302
00:35:32,850 --> 00:35:36,770
If you're even just the general public, you're distracted.

303
00:35:36,770 --> 00:35:37,270
Okay?

304
00:35:37,270 --> 00:35:44,410
COVID has taken a lot of the focus away from other things like cybersecurity.

305
00:35:44,410 --> 00:35:56,910
If we're not careful in tying the story behind how cybersecurity is the underpinning to providing a resilient and thriving healthcare system.

306
00:35:57,030 --> 00:35:58,370
It's just essential.

307
00:35:58,370 --> 00:36:05,690
We can't have resilient and effective healthcare without securing it.

308
00:36:05,690 --> 00:36:07,790
They go hand in hand.

309
00:36:07,790 --> 00:36:21,690
And I say that because the other issue we're facing here is that most healthcare delivery organizations don't even have a single person dedicated to cybersecurity.

310
00:36:21,690 --> 00:36:31,810
And this is one of the findings of the Healthcare Industry Cybersecurity Task Force report that went to Congress in 2017.

311
00:36:32,130 --> 00:36:58,290
So there's not enough people working in this space we need to bring in more stakeholders from different backgrounds into the healthcare industry and into the cybersecurity industry to really... and even if it's not their title, but to build a community of practice around everyone's shared responsibilities around cybersecurity.

312
00:36:58,710 --> 00:37:22,610
And the last thing I'll say from the stuff that we can control as the cybersecurity professionals, I think especially Michael and Mitch and myself, we need to as healthcare and medical technology companies, as healthcare providers, we need to look at our investment in security and ask ourselves this,

313
00:37:22,610 --> 00:37:27,490
are we protecting what society values most?

314
00:37:27,490 --> 00:37:44,450
And if you ask anyone, what is important to protect in healthcare to protect, they will tell you most likely, even if it's my mom, all right, she will tell you, it's probably going to be patient safety, patient health, right?

315
00:37:44,450 --> 00:37:47,590
And probably also patient privacy.

316
00:37:48,510 --> 00:37:56,910
And so look at our investment today and figure out if there's changes that we need to take in our approach.

317
00:37:56,910 --> 00:38:09,390
And maybe touching on Florence's idea there to make it even more tangible around creating some sort of model for identity management in healthcare, you don't have to go too far.

318
00:38:09,390 --> 00:38:17,890
I mean, for many years, the cybersecurity industry has been talking about what's called zero trust principles.

319
00:38:18,330 --> 00:38:32,970
And so the idea behind zero trust principles are instead of trusting devices inside the network, you know, in this approach, it means trusting no one by default and operating as though the network had already been compromised.

320
00:38:33,230 --> 00:38:40,210
And so this means incorporating different types of criteria for authenticating and authorizing users.

321
00:38:40,210 --> 00:38:43,110
And the fundamental technologies exist today.

322
00:38:43,110 --> 00:38:50,450
It's just changing your strategy as a cybersecurity professional to focus on the idea that you've already been compromised.

323
00:38:50,450 --> 00:39:00,290
And how do we strengthen authentication through multi-factor authentication, through conditional access for devices and users connecting to the network?

324
00:39:00,950 --> 00:39:03,350
And so those types of technologies exist today.

325
00:39:03,350 --> 00:39:08,890
There is hope in, again, what's available to cybersecurity professionals today.

326
00:39:08,890 --> 00:39:13,390
But I would also go back and say, we need to expand our community of practice.

327
00:39:13,630 --> 00:39:20,430
So if we get all geeky-weeky, which we could do with each other, fire this and HL7 that, and we're so cool, you know, trust zone and hardware.

328
00:39:20,490 --> 00:39:26,530
I got upgraded for free one day on a plane when I was flying planes.

329
00:39:26,650 --> 00:39:29,450
And I was sitting next to a guy who runs a hospital, a doctor.

330
00:39:29,470 --> 00:39:30,730
And I was telling him what we're doing.

331
00:39:30,730 --> 00:39:31,750
He said, well, you know what?

332
00:39:31,750 --> 00:39:35,790
I'm glad you're working on that because my job is to keep that patient on the table alive.

333
00:39:36,310 --> 00:39:38,110
That's what I focus on all day.

334
00:39:38,770 --> 00:39:50,890
So in our working group, 2933 working group, actually it's all about, we always talk about it, protecting the humans, keeping the humans alive.

335
00:39:50,890 --> 00:39:52,730
That's why we're doing this.

336
00:39:52,810 --> 00:39:56,210
That's exactly why, you know, my background, my mother died the day I was born.

337
00:39:56,210 --> 00:39:58,450
It was a medical error, you know, whole stuff here.

338
00:39:58,450 --> 00:40:00,090
So I carry this with me.

339
00:40:00,090 --> 00:40:01,970
How do you keep the humans alive?

340
00:40:01,970 --> 00:40:03,330
And that's what we're focused on.

341
00:40:03,330 --> 00:40:08,810
And if you actually read our project authorization request at IEEE, it says to improve health outcomes.

342
00:40:08,810 --> 00:40:11,070
We're not doing this for us geeky weekies.

343
00:40:11,070 --> 00:40:14,670
We're doing it to improve health outcomes and to keep the humans alive.

344
00:40:14,750 --> 00:40:27,110
And eventually what I would love to see, and we actually had a meeting at my last firm and with Microsoft a few years ago, we were talking about creating like a cybersecurity learning hub for humans, you know, normal people.

345
00:40:27,110 --> 00:40:28,870
And we said, oh, cradle to grave.

346
00:40:28,870 --> 00:40:29,990
And we said, oh, that's kind of rude.

347
00:40:29,990 --> 00:40:32,150
Let's say pre-K to AARP.

348
00:40:32,150 --> 00:40:35,430
And we're going to teach them what TIPS is.

349
00:40:35,430 --> 00:40:38,450
You know, so when I was a little girl, remember I'm a geek, I was a rocket scientist.

350
00:40:38,450 --> 00:40:42,630
So I used to look for the little UL tag on my, on my electric cords.

351
00:40:42,630 --> 00:40:43,490
Any of you guys?

352
00:40:43,490 --> 00:40:44,010
I did.

353
00:40:44,010 --> 00:40:47,090
I always look for them because that meant safety, right?

354
00:40:47,350 --> 00:40:51,690
And so what we want to do is teach them why they should ask for this.

355
00:40:51,690 --> 00:40:58,870
So someday, I don't know if it's two, three or five years from now, some little five-year-old is going to be at the doctor and they're going to try to give her an insulin pump.

356
00:40:58,870 --> 00:41:01,490
And she's going to say, does that have TIPS?

357
00:41:01,930 --> 00:41:04,530
And she doesn't need to know what it stands for.

358
00:41:04,530 --> 00:41:05,350
We do.

359
00:41:05,350 --> 00:41:06,390
We're the geeks.

360
00:41:06,390 --> 00:41:10,770
We need to understand that it's trust and identity and federated identity management.

361
00:41:10,770 --> 00:41:20,890
And when the doctor, you know, goes into the little device next to grandma's bed that goes into her implanted pacemaker, you check the credentials of that doctor every single time.

362
00:41:21,110 --> 00:41:25,290
You make sure they're still, you know, related to whatever their provider is.

363
00:41:25,290 --> 00:41:27,670
You make sure they still are credentialed.

364
00:41:27,670 --> 00:41:31,170
You make sure it's really the doctor and you have to figure out how to do it.

365
00:41:31,230 --> 00:41:36,670
So that's our vision is that we really want this to protect the humans and make the humans aware of it.

366
00:41:36,670 --> 00:41:50,170
Just like I looked for that little UL tag, which not everybody did, I know, but you know, how do we teach them and then make sure that the manufacturers are delivering that because then you have demand, you have push and pull from the citizens, from the patients,

367
00:41:50,170 --> 00:41:50,790
right?

368
00:41:50,790 --> 00:41:53,650
And then the providers and the payers should care about this.

369
00:41:53,650 --> 00:41:55,350
It reduces their liability.

370
00:41:55,350 --> 00:42:01,710
You know, I used to work on smart buildings years ago when we were first creating a smart building strategy when I was a VP at IBM.

371
00:42:02,170 --> 00:42:08,290
And I remember, you know, we were talking to these building management system companies and one of them said, oh, you know what?

372
00:42:08,390 --> 00:42:11,970
Security is like number 11 on my list of top 10 things to worry about.

373
00:42:11,970 --> 00:42:15,750
And their device was hacked nine months later and the whole leadership team was out.

374
00:42:15,990 --> 00:42:18,770
And now it's part of their brand promise.

375
00:42:18,770 --> 00:42:20,210
Oh, imagine that, right?

376
00:42:20,250 --> 00:42:23,070
So we need to make that a requirement.

377
00:42:23,070 --> 00:42:30,430
You know, we need people to be incented to do that and to have the citizens and patients asking for it.

378
00:42:31,650 --> 00:42:33,030
Absolutely, Florence.

379
00:42:33,030 --> 00:42:51,990
And also one other thing that my organization's had a big challenge with has also been privacy because one of the areas we've got to worry about is not only do we have, we're collecting all this data on people and we have numerous data points on all the people we're collecting from these devices.

380
00:42:51,990 --> 00:42:54,670
And we need to make sure that we're protecting that.

381
00:42:54,670 --> 00:42:58,930
So important question I have here is what about privacy?

382
00:42:59,570 --> 00:43:01,910
How are we incorporating this into our products?

383
00:43:01,910 --> 00:43:04,830
How are we incorporating it into our data governance plans?

384
00:43:04,870 --> 00:43:10,770
So to lead off here, I believe this is going to be our final question for the three of you.

385
00:43:11,130 --> 00:43:14,170
So start off with Michael.

386
00:43:14,710 --> 00:43:15,230
Sure.

387
00:43:15,230 --> 00:43:39,070
I think that the, you know, privacy takes on, you know, from a legal perspective, you want to understand, you know, the requirements by the different geographies, by the different jurisdictions, by, you know, what the hospitals and, you know, the different entities have in terms of managing that type of information.

388
00:43:39,070 --> 00:43:45,010
But to me, Mitch, it's nothing more than another component of your requirements.

389
00:43:45,150 --> 00:44:03,110
So if you design privacy as you would security by design in your development process, you take into account what are those sets of requirements and you have to harmonize for, you know, some of us, you know, like, you know, Rob and I and others out there that deal in multi,

390
00:44:03,110 --> 00:44:13,130
you know, geographies, you know, multi types of regulatory and compliance environments, and you have to develop what your baseline is.

391
00:44:13,130 --> 00:44:27,530
And then once you develop that baseline, and you include those sets of requirements, I would look at the steward of, you know, the CISOs, you know, and it's three of us on the call to be able to make sure that we're executing against that.

392
00:44:27,530 --> 00:44:45,250
We go to our legal teams and the privacy organization, really for that foundation to make sure that we're interpreting those requirements, and we're executing those requirements, you know, effectively with the tools and the solutions that we then deploy out in the marketplace.

393
00:44:45,490 --> 00:44:57,530
And so I have always had, you know, kind of a mix of the privacy and the data protection elements kind of be able to be co-mingled within, you know, the team.

394
00:44:57,690 --> 00:45:13,530
Operationally, if you do it right, you want the CISO side of the house to be managing that, and you want your legal and your compliance arms to be able to help you develop and, you know, and document what those requirements need to be, you know, from a privacy perspective,

395
00:45:13,530 --> 00:45:14,650
in my opinion.

396
00:45:18,280 --> 00:45:24,400
So I got to tell you, I don't think I could describe it any better than Michael, or I should say Professor McNeil.

397
00:45:27,980 --> 00:45:32,280
It's so well said, really, I can't do better than that.

398
00:45:32,280 --> 00:45:40,000
I mean, you know, to address privacy requirements alongside security requirements, I absolutely agree.

399
00:45:40,000 --> 00:45:45,400
As security professionals, like, you know, bring your privacy friends along with you.

400
00:45:45,800 --> 00:45:55,880
And absolutely right that, you know, there's things that, you know, we think of in security that sometimes are counterintuitive to privacy.

401
00:45:55,880 --> 00:46:15,180
And then also, again, what Michael said around, you know, treating, bringing your legal professionals, especially, you know, when you're addressing privacy requirements, the complexity is, as he mentioned, this is different across every single country.

402
00:46:15,480 --> 00:46:29,860
And you do have to, you know, establish as a company, a common foundation, based off of values, based off of values and principles, you know, as a company, what do we stand for?

403
00:46:29,860 --> 00:46:38,220
What is it that we want to do when it comes to this huge civil rights issue, you know, of privacy?

404
00:46:39,020 --> 00:46:54,860
And sometimes that means we want to do everything that we can, and we are going to establish, you know, the strictest, you know, governance of privacy across all of our technologies and product platforms, you know, that is, again, a decision that companies need to make.

405
00:46:54,940 --> 00:47:09,200
And I got to tell you, I don't think there's many customers that would complain, you know, about a company creating a position and a very robust and comprehensive position on privacy across their different technologies for customers.

406
00:47:10,180 --> 00:47:11,680
So... Agreed.

407
00:47:11,680 --> 00:47:13,120
So I'll make a couple of comments.

408
00:47:13,120 --> 00:47:13,740
I'm sorry, Mitch.

409
00:47:13,740 --> 00:47:14,520
I couldn't agree more with you.

410
00:47:14,520 --> 00:47:15,360
So what do you think?

411
00:47:17,140 --> 00:47:19,360
Oh, you know, Mia, I always think something.

412
00:47:19,360 --> 00:47:20,680
So there are a couple of things.

413
00:47:20,900 --> 00:47:28,320
One is on the privacy side, it's one of our subgroups, it's part of TIPS, you know, Trust, Identity, Privacy, right in the middle, Protection, Safety, and Security.

414
00:47:28,320 --> 00:47:37,220
And we have a woman from the European Union who's leading that subgroup, which is great, because she actually found the privacy rules by country in Europe.

415
00:47:37,940 --> 00:47:39,400
Not surprising, right?

416
00:47:39,400 --> 00:47:50,740
So what we're doing is making sure that we're going deep on those, identifying the patterns, and then figuring out what are the little things we have to worry about here if we're creating a standard that's international.

417
00:47:50,900 --> 00:47:57,120
So if I'm wearing an implanted device, I'm in the U.S., I'm in the U.K., I'm in Russia, I'm in China, I'm in South Africa, am I going to be safe?

418
00:47:57,120 --> 00:47:58,500
You know, is my data going to be private?

419
00:47:58,500 --> 00:47:59,460
What does that mean?

420
00:47:59,460 --> 00:48:00,600
What are the implications?

421
00:48:00,720 --> 00:48:04,020
So we're already baking that in to the plan.

422
00:48:04,240 --> 00:48:11,680
The other thing is that I was at an event at my alma mater at Princeton, and Sonia Sotomayor was there.

423
00:48:11,740 --> 00:48:13,360
She's a Supreme Court Justice in the U.S.

424
00:48:13,360 --> 00:48:14,540
for those of you who don't know her.

425
00:48:14,540 --> 00:48:15,320
She's brilliant.

426
00:48:15,700 --> 00:48:21,400
And so I asked her, what do you think about privacy and security and the Internet of Things, all these devices all over the place?

427
00:48:21,400 --> 00:48:22,740
I said, I'm working on security.

428
00:48:22,740 --> 00:48:29,640
She said, that's good because I'm working on privacy because I don't think the citizens realize the human rights that they're giving up.

429
00:48:30,000 --> 00:48:31,260
Very interesting.

430
00:48:31,320 --> 00:48:35,760
So she's on it, and she's already written a couple of things on it if you want to look at what she's done.

431
00:48:36,220 --> 00:48:41,300
And then the other thing I just want to mention very quickly, we were talking about, you know, what's our goal here?

432
00:48:41,300 --> 00:48:52,000
I spoke at an event at Academic Medical Center Conference a few years ago, and then about a year or so ago, a gentleman reached out to me and said, oh, I wrote a book, and I found your presentation, and I referred to you in my book.

433
00:48:52,060 --> 00:48:53,640
I was like, oh, I'm so honored.

434
00:48:53,640 --> 00:48:54,920
What's the name of your book?

435
00:48:54,920 --> 00:48:57,180
The Doctor Will Kill You Now.

436
00:48:58,500 --> 00:49:09,900
And he talked about the security and privacy issues, and this guy who, like, you know, lives in his mother's basement and then moves to another state.

437
00:49:09,900 --> 00:49:25,540
It's not bad living in your mother's basement, I have that going on too, but moves to another state, fakes a PA license, gets into a doctor's office, gets into the system, actually turns off the power in the hospital so someone on event dies.

438
00:49:25,540 --> 00:49:32,200
Then he gets into somebody's personal medical record, changes his blood type, they're given a transfusion, and they die.

439
00:49:32,200 --> 00:49:35,640
And then his next target is a children's hospital.

440
00:49:36,320 --> 00:49:42,380
So if anybody is looking at, so why should I worry about this security and privacy stuff?

441
00:49:42,380 --> 00:49:43,480
That's a good book.

442
00:49:43,480 --> 00:49:44,780
It's only 15 bucks.

443
00:49:44,780 --> 00:49:51,400
And the guy who wrote it is an MD, and he used to lead the IEEE chapter in Rochester, New York, years ago.

444
00:49:51,400 --> 00:49:53,900
So he, you know, he's on both sides.

445
00:49:53,900 --> 00:50:00,020
He's an electrical engineer, computer scientist, more double and then he's also a doctor.

446
00:50:00,020 --> 00:50:01,680
So we all have to work on this.

447
00:50:01,680 --> 00:50:03,040
This is serious.

448
00:50:03,080 --> 00:50:04,900
It's just going to get worse.

449
00:50:05,220 --> 00:50:07,260
A lot more things are connected.

450
00:50:07,260 --> 00:50:09,360
There are attack surfaces all over the place.

451
00:50:09,360 --> 00:50:11,400
We need a defense in depth strategy.

452
00:50:11,740 --> 00:50:16,920
And it's for privacy and security and protection and safety.

453
00:50:21,830 --> 00:50:25,450
I'm impressed by the depth of knowledge everyone brings here.

454
00:50:25,450 --> 00:50:28,030
And I speak from the provider perspective here.

455
00:50:28,030 --> 00:50:32,750
I'm very happy to be working with you all, especially from the standards perspective as well.

456
00:50:32,750 --> 00:50:35,050
I think we have a good foundation.

457
00:50:35,270 --> 00:50:38,970
We just all need to continue to keep working together.

458
00:50:38,970 --> 00:50:46,010
And you have my commitment and for all of you in the medical device industry know you have my organization's commitment as well.

459
00:50:46,130 --> 00:50:49,290
So thank you so much for all taking the time today.

460
00:50:49,290 --> 00:50:55,190
This is incredibly appreciated and hope all of you out there appreciate this today as well.

461
00:50:55,190 --> 00:50:58,090
So thank you all so much for taking the time.

462
00:50:58,590 --> 00:51:00,430
And this is the group here signing off.