start	end	text
0	4940	Hi, I'm Mitch Parker, Information Security Officer at IU Health in Indianapolis, Indiana.
4940	10500	And today's topic is going to be advancing medical device security, how collaboration
10500	16820	between providers, manufacturers and pen testers is advancing what's possible with security.
16920	21740	And with us today, we have an incredibly distinguished panel of people we've been able to find who
21740	26040	I'd like to have introduce themselves right now. We're going to start with Florence Hudson.
26040	30140	Very good. Thank you so much, Mitch, for having me join you. And hey,
30140	38040	DEF CON crowd. Geeks and all. And goons. So I'm Florence Hudson, and I'm Founder and CEO of FDHint,
38040	41900	which is an international consulting firm for advanced technology and diversity and inclusion.
42220	47520	I also work for the NSF Cybersecurity Center of Excellence at Indiana University.
47520	52500	I lead the Cybersecurity Research Transition to Practice Program. And I'm also Executive
52500	56560	Director for the Northeast Big Data Innovation Hub at Columbia University,
56560	60860	leading translational data science opportunities in the Northeast US.
62900	70520	Oh, and I should say, I'm also Working Group Chair for IEEE UL P2933. For those who aren't
70520	76640	acronym queens and kings, it stands for Institute for Electronic Engineers and Underwriters
76640	81640	Laboratories. Working group on creating a standard around clinical innovative things,
81640	87260	data, and device interoperability with TIPS, which stands for Trust, Identity, Privacy,
87260	91920	Protection, Safety, and Security. And Mitch is one of our Co-Vice Chairs. So thank you very
91920	95880	much for having me, Mitch. Thank you, Florence. We'll take it over to Rob Suarez.
97460	103500	Hi. Hi, DEF CON. This is... My name is Rob Suarez, and I'm the Chief Information Security
103500	110460	Officer for BD. That's Beckton Dickinson. And we're a global medical technology
111640	116480	company offering some of the most advanced products across the continuum of care.
116620	124020	It's my job at BD to make sure that we are protecting those products that we're delivering
124220	129600	a secure product and also the environment in which they reside in, which is typically a hospital,
129600	137200	but increasingly, you know, a patient bedside at home as well. And so I'm very excited to talk to
137200	141700	my fellow panelists today about medical device cybersecurity. This is a passion of mine,
141700	148640	and I've had the honor actually of working alongside Mitch and Michael as well on several
148640	155000	industry initiatives. And so again, looking forward to the discussion today. Thank you.
155360	162400	And last but not least, Mr. Michael McNeil. Hi, DEF CON. This is Michael McNeil. I'm the
162400	167640	Senior Vice President and Global Chief Information Security Officer at McKesson,
167640	176280	and just recently got to the organization. But as, you know, Rob has just stated, have had a
176280	183080	number of years collaborating, you know, with the team here. And my days go back into
183080	189280	Philips as well as into Medtronic from a medical device perspective over the past 10 years.
189280	196480	Really looking forward to this particular session and again have collaborated with these guys in a
196480	202100	number of different industry and forums. And again, I think you'll find our conversations
202100	208200	today to be pretty enlightening because it takes that ecosystem and for us to come together
208200	214660	to really execute here. Thank you so much, Michael. So I'm going to launch right into
214660	219720	the first question here. First question is, what are the biggest concerns that each of you
219720	227800	sees related to medical device security? So I'll start if I might. So what I mentioned
227800	232980	when we were first opening up, I talked about tips, tips for the Internet of Things.
233080	237260	This is a framework we've been creating with IEEE for four years now. As I mentioned,
237260	242300	it stands for trust and identity, privacy, protection, safety, and security. I'm worried
242300	247080	about all those things. I'm worried about the trust and identity of the devices, the device
247080	251880	to device communication, the device to human, the doctor to the device to the human, human to
251880	256780	everything. So I'm concerned about trust and identity, how we're going to maintain that and
256780	262020	make sure we're vigilant about it. I'm concerned about privacy of data, whether you're in your home
262020	266180	country or another country and what the different regulations are and how we're going to manage it.
266180	270380	I'm concerned about protection and safety, how we're going to keep the humans safe, how we're
270380	274960	going to keep the device safe, the infrastructure, the financial side of the institution, if your
274960	280240	device is hacked and everybody finds out, like some of the FDA and DHS and U.S. CERT recalls.
280240	286620	And I'm concerned about the cybersecurity. So we have a lot to do as the leaders in this space for
286620	293340	IT and for cybersecurity and for medical devices. So I look forward to continuing the collaboration
293340	298280	we're doing through groups like this and also like in the IEEE working group where we have
298280	303600	over 250 humans from 22 countries and six continents who are worried about this too,
304120	308780	including device manufacturers and providers and payers and regulators and everybody as we know,
308780	313580	Mitch. So I'm worried about all that stuff. What about the rest of you? Are you worried?
315340	324300	So I'll go next on that one. Thank you, Florence. For me, it's actually very similar to what you'll
324300	331200	find was reported out and I believe it was 2017 and what was the healthcare industry
331200	337020	cybersecurity task force report. In fact, on that task force, I got to serve alongside Michael
337020	343100	McNeil and several other individuals across the industry and produce a report that outlined
343100	350680	observations and recommendations for improving cybersecurity across the industry in healthcare.
350680	356280	There was a specific section that was dedicated just for medical device cybersecurity,
356280	362520	and I got to tell you, that was three years ago. A lot of those findings still apply to this day.
362800	369780	And one that pops out to me immediately is that medical devices are in hospital settings for 15
369780	377620	to 20 years, but new cybersecurity threats emerge daily. And every hospital and every patient
377620	385060	environment is unique. So there's no one-size-fits-all approach. And at BD, we're
385060	392520	working closely with healthcare providers on understanding medical device cybersecurity as it
392520	398620	exists out in a clinical setting, out in the real world. And we're also working, we're really
398620	406080	committed to transparency. And for example, providing coordinated vulnerability disclosures
406080	414420	on medical device vulnerabilities. But unfortunately, it's just not enough. There's
415060	422640	really a long time span to medical devices in these environments. And so increasing transparency
422640	428560	absolutely helps, but we also need to build stronger relationships and stronger collaborations
429420	434980	across... Florence, as you really described, across the continuum of stakeholders that we have
434980	442760	when it comes to just using a medical device and managing it when it's in use.
443600	452520	Yeah. And from my perspective to build on what Rob has just stated, he's hit the nail on the head,
452520	460800	and we've been having these kinds of conversations and discussions even before the 2017 and earlier
460800	470320	when we go back a few years on this particular topic. I think people have heard me talk in the
470320	477020	past and it really doesn't... It's kind of interesting. It doesn't change. It just perpetuates
477020	486080	itself. So as Rob just talked about, legacy devices as we call them in the ecosystem and how
486080	493020	we manage that, that to me ties right into what I've always said is sort of the three deadly sins
493020	499340	that I've kind of communicated over time. Because you have these types of devices, you need to make
499340	504100	sure that you can patch and update them in a timely manner. So one of the deadly sins, if I
504100	509640	can't patch and update a device, I'm not going to be able to maintain the security of that solution
509640	517100	out in the marketplace. When I look at the types of devices and a number of them when they were
517100	521740	designed and developed and they're in these environments, if they got hard-coded credentials,
521740	526940	those are the keys to the kingdom. If I open the keys up and I let anybody come in, front, back,
526940	532900	side doors, any way that you have, then you have access and you're going to be able to align.
532900	539280	And then for us, when it comes to the type of information, again, as I would say that
539280	545380	Florence had talked about in terms of thinking of the type of data and the type of information
545380	552000	that needs to be held secure, if you don't do encryption and de-identify and make sure that
552000	558920	that's not available to cause the kinds of harm to individuals, to the solution itself,
558920	565320	you get to those deadly sins. So the sins are there and we're doing a much better job,
565320	571640	I believe, in having an awareness around the design and how we need to build that into our
571640	579580	solution set. But it's how do you manage that legacy that's sitting out there in the current
579580	587980	environment? And as we've also said in the past, because of the nature of the marketplace,
588480	597140	it's like prying those systems out of their cold, dead hands in some of these hospitals and other
597140	603860	types of entities, because they don't have, obviously, with Mitch, the wherewithal to just
603860	608980	immediately turn around, you know, your capital and your inventory for some of these types of
608980	616160	solutions. Yeah, so I totally agree. It's the products we have today. It's the new products
616160	621720	and how we create design-in plans so that you design in a defense-in-depth level of security
621720	627500	at the hardware, firmware, software, and service level. I suggest we go all the way down to the IP
627500	632260	of the design of the chip. You know, we need to go all the way down and all the way up.
632260	637400	And we also need, I know in the standards work we're doing, we're saying that we need to be able
637400	642360	to look forward too. I'm an old rocket scientist, or experienced. My girlfriend's saying not to
642360	646020	use the term old, but I'm an experienced rocket scientist. I used to work on future missions
646020	649780	around Jupiter. Did we know exactly what we were doing? No, but we had a planet, you know,
649780	654140	and you look forward, you say, what's going to happen? So in the standards work that we're doing,
654140	659600	we're agreeing that it has to be a standard that is extensible into the future. You know,
659600	663300	so what we're also doing is envisioning, well, how can we use artificial intelligence
663300	668300	and machine learning better? What about when it's a hologram and the doctor's like, oh my gosh,
668300	672300	she's right here. You look a little jaundiced. I'm like, how do you know that? You know,
672300	678500	I'm in my pajamas. How did that just happen? Right? So when we're in XR, AR, VR, how's all
678500	682900	this stuff going to play? And then if you want to get excited about protocols, think of what,
682900	686500	you know, communications protocol, that's going to be all about. You know, that's going to get
686500	691880	into your EHR or how they're going to read, you know, from your, from your little devices. So
691880	697560	we're also trying to think of what could happen. So being an aerospace engineer and designing,
697560	702660	you know, not just spacecraft, but also planes and jets, you have your heads down display,
702660	706500	right? Your altimeter. And then you have your heads up display. We need both.
708640	713810	I am in full agreement with you and can tell you the biggest challenge I saw
714610	720430	with all these years of working for healthcare and hospitals. I've been in the provider space
720430	725230	for about a dozen years as a CISO. And biggest challenge I've always found has actually been
725230	732290	paying for it all because a lot of, a lot of hospitals out there, especially with COVID,
732290	739630	have significant financial challenges these days. And right now, I mean, every hospital
739630	745210	has a problem paying. Before January or February of this year, you still would have had about,
745210	749270	I'd say about half the hospitals in the United States, whereby I asked them to update a good
749270	754170	chunk of their clinical engineering equipment. They would have likely looked at me and said,
754170	758930	when I can fix my roof, when I can fix my floor, and when I can patch the hole in the boiler.
759510	763330	And what do you want? Do you want a roof over your head or do you want secure medical devices?
763330	769110	And I've actually once had a clinical chair from the department sit me down and say,
769110	774050	I'd like to update my devices, but I need to get different ones in here because I'm not able to do
774050	782710	women's health properly. And to me, that put a lot of items in perspective. And I've always worked
782710	788290	with my customers to make sure that we can get them on at least a good path to where they need
788290	794910	to be using minimal cost solutions. Because to be very blunt, it's 15 to 20 years also, because
794910	800510	it's all I have money for. And that's sadly the situation in the United States. And after things
800510	807930	happen, after we have some leveling off with COVID, we're going to be in a much different
807930	813530	place, more like 2009 when it comes to the economy. But to get these good items in place,
813530	818490	you need to have standards. And that leads me to the second question, which is, what standards
818490	823070	efforts are in play for medical device security that you're currently working with? So again,
823070	829650	to you, Florence, because of all the IEEE work. Absolutely. I have to apologize. I have a robo
829650	834610	caller who won't give up. So you're going to hear my phone in the background. So anyone else been
834610	841770	through this? So the standards efforts, we have a number of standards efforts in play, and we're
841770	849070	trying to hold hands and work together. So at IEEE, we have this IEEE UL P2933, which is the
849070	853790	for clinical IOT data and device interoperability with TIPS, as we discussed. There are also
853790	859190	efforts on blockchain for healthcare and how that plays in. There are efforts going on with ISO and
859190	865810	IEC and open mobile health and communications interoperability. So we actually just had a
865810	870690	really cool session last week, where Mitch and I presented along with a number of our colleagues
870690	876350	from around the world regarding addressing clinical IOT interoperability and security
876350	882490	challenges globally. And so one of our colleagues representing Underwriters Laboratories,
882490	887650	after we each spoke about P2933, you know, this kind of IOT thing, and then open mobile health,
887650	892650	and a few other things, he got up and said, okay, here's one page with like all this stuff on it.
892830	896830	You know, we have a pyramid here, we have a triangle, and we have all these other pieces.
896930	901530	We have to figure out how we're going to work together. So if any of you out there are
901530	907470	interested in getting involved in this, we're actually hoping to have a longitudinal plan here.
907530	912930	We had Julian Goldman from Harvard, and Mass General, who was on the panel,
912930	920870	and Ida Sim from UCSF. We had Mitch, me, Ken Fuchs, McGregor, Anura, Fernando from Underwriters
920870	927230	Laboratories. And I always forget at least one. Oh, and Ken, I think that's most of it.
927230	930950	And so we're all going to be getting together again in the fall. And we're interested in
930950	935570	anybody else who wants to join us. So Mitch, I don't know if we're giving out our email addresses
935570	945330	or how you want to do that. But, you know, we'll find a way to make the P2933 web page
945330	953030	completely accessible and get information over there. So in the meantime, you can send me an
953030	960130	email along with my robocaller at florence.com. And I think I'm going to give them my email address
960130	962570	so they're not so disruptive the next time.
964090	972030	Hey, Florence, I'm really excited to hear that IEEE is getting involved in this space.
973230	978350	And, you know, it's exciting to hear that. There's not enough that we can do
979010	984570	actually to really formalize the process of multiple device cybersecurity
985120	992030	across the lifecycle of these technologies. I would like to also recognize, you know,
992250	997150	a lot of the work that the FDA has done in producing cybersecurity guidance documents
997150	1006410	over the last, oh my gosh, you know, many years. And so, you know, whether it's pre-market
1006410	1012910	requirements for submissions and cybersecurity, or it's post-market surveillance, right? And
1012910	1017270	knowing how to do coordinated vulnerability disclosures, those guidance documents are very
1017270	1024190	helpful. Also very relevant today, you know, is cybersecurity for off-the-shelf software
1024190	1030350	components. Again, you know, FDA has some good guidance documents, a good guidance document on
1030350	1037230	that. Recently, and, you know, they've taken a very collaborative approach to cybersecurity
1037230	1043030	engaging very different stakeholders. And a great example of that, you know, FDA has engaged NTIA
1043630	1050790	on creating a software bill of materials standard and a set of deliverables around that as well.
1050790	1057650	And it's all around how manufacturers can be more ready to identify vulnerabilities in third-party
1057650	1062530	components, and then extending that capability out to hospitals, you know, who have this technology
1062530	1069510	in an operational environment. And, you know, the last two things here I'll mention is
1070050	1075810	International Medical Device Regulators Forum. You know, it's not just the U.S. and FDA that's
1075810	1081490	going through this problem. This is a global issue in medical device cybersecurity. And the
1082050	1087690	International Medical Device Regulators Forum, INDRS, has come together to produce a cybersecurity
1087690	1095710	guidance document that really sets to harmonize... provide harmonized guidance to regulators
1095710	1101490	globally. So, you know, different countries and regions can set up their own guidance
1101490	1108730	documents and map that to their own regulatory bodies. And the last one here I'll mention,
1108730	1115430	I have to mention it because, boy, it was a lot of work, but the Healthcare Sector Coordinating
1115430	1123690	Council. And, you know, Michael also and Mitch, you know, were contributors to this effort as well,
1123690	1128530	produced what's called the Joint Security Plan, the MedTech Joint Security Plan,
1128530	1134310	otherwise referred to as the JSP. And, you know, in this document, you know, anyone can find...
1135170	1140070	it's not just... it's not standard. It's actually a plan, a way to put in motion
1141250	1148450	a security program from design, development, all the way out to, you know, complaint handling for
1148450	1153530	medical devices, and what to do when these devices are out in the field, and risk management,
1153530	1157550	again, throughout the continuum of care. So if you want to know how to do a risk assessment
1157550	1162830	on medical devices, if you want to know, you know, when to do a penetration test,
1162830	1167350	what types of design requirements are helpful for medical device and cybersecurity,
1167350	1173110	how to structure your organization, you know, those things you can find in the JSP today.
1173110	1180490	And working with MDIC, we're also developing an effort to actually benchmark against those
1180490	1186990	different capabilities. So that way, if you're a small medical device manufacturer or a large one,
1186990	1192470	you want to know where to go next, and how to build out your program, and what's good enough.
1192470	1201570	And so this benchmarking initiative with MDIC will help us create that set of metrics,
1201570	1207430	and again, the benchmark itself, so that we can share it openly across our industry stakeholders,
1207430	1212870	and collectively improve our programs, be able to speak to our executive leadership, too, as well,
1212870	1218010	that have to pay and make and commit to this investment in medical device cybersecurity.
1218010	1222630	That sounds really cool. Do they have guidance for manufacturers as well as providers?
1224350	1232230	So, Healthcare Sector Coordinating Council also has, yes, guidance for healthcare providers,
1232230	1239130	too. It's called HICP, H-I-C-P. And then you have the Joint Security Plan,
1239130	1246350	which is focused on medical devices and healthcare IT solutions. And so, yes,
1246350	1255210	they have guidance for both sets of stakeholders. Right. And yeah, so as Rob stated, the IMDRF,
1255210	1264050	also, the way it was documented, it addresses, here's what's the pertinent areas for the
1264050	1270830	manufacturer, the health delivery organization, the different stakeholders, even patients,
1270830	1275710	as it pertains to the different topics that was put into that type of guidance. And again,
1275710	1282110	that one was global. A couple of others that I would just want to make sure that we have included
1282110	1290030	when you talk about health delivery organizations, MIDA has always championed and updated their,
1290030	1297230	you know, MDS2 documentation, which is utilized for the procurement process with health delivery
1297230	1304270	organizations. And that MDS2 is something that has been maintained as a part of the release schedule
1304270	1310390	and with the inclusion of the SBOM as a component and a deliverable of that,
1310390	1317610	it gives organizations like Mitch's the ability of being able to understand the ingredients of
1317610	1322990	the product and the solutions that they are acquiring and how they need to develop and
1322990	1330810	execute that. And then as Rob said, the AAMI organization has taken on the ability of taking
1330990	1337550	a look at some of those, you know, pre-market and post-market type of guidance documentation,
1337550	1344830	and then they created their technical, you know, references in their TIR 57 and 97, which allows
1344830	1351470	you to provide some of the how-to on those different stakeholders in the industry, how they
1351470	1358190	need to execute against those particular technical references and standards. So I think that kind of,
1358190	1365850	we gave you the alphabet soup and then some in response, Mitch. Yeah, absolutely. No excuses now.
1366970	1371970	I can tell you that that 2019 MDS2 form, thank you very much for that, Michael. That's been
1371970	1377030	incredible in our organization. We've actually started using that a lot. The first vendor that
1377030	1384050	actually gave us one was Philips. So very happy that... I'll take the old pats on the back for
1384050	1387030	that. We're starting to get those in from our vendors and they've been helping us out with a
1387030	1394550	lot of different purposes. So my next question here is, what are the most difficult medical device
1394550	1399190	security issues to solve? I want to throw a real ringer in there.
1402670	1409650	I'll take the first. Okay, go ahead, Rob. Yeah, I'll take a first stab at that. So
1410710	1416450	I think one of the most difficult issues to solve, just to change it up here, aside from...
1417010	1423930	and it does relate to the issue of legacy medical devices, is also that hospital environments
1424290	1431710	may have hundreds of thousands of connected medical devices at one time and from thousands
1431710	1443110	of different vendors. And so while I may not directly feel that pain, I feel for our customers
1443110	1450930	at BD that are healthcare providers and have to manage this tremendous complexity.
1451710	1459610	And what compounds this situation is that not every medical device manufacturer
1459610	1467310	is doing things like patching of their medical devices or routine updates to their medical
1467310	1477290	devices. And also, that's why transparency is so important, because these new threats emerge
1477290	1484330	daily. And boy, I'm sure there's a lot of homework that healthcare providers have to do when a new
1484330	1491710	security vulnerability pops up and you don't find a timely and effective or meaningful communication
1492230	1501130	from a medical device manufacturer to facilitate a response. So yeah, I think those are
1501950	1506690	really, really important issues that we need to address.
1507450	1515150	You know, one of the things I would add on where Rob is at, and again, I do agree that the
1515770	1521410	level of connectivity and the complexity of the type of solutions is definitely
1522530	1528030	a critical one, but let me be a little bit more provocative and throw something else out there.
1528030	1535990	I think when you look at potentially, and again, and this gets back to, again, I think
1535990	1542350	where Florence was at when we talk about taking it down to the chip level. I think when I look
1542350	1550990	at the greed that exists in society around the revenue that either wants to be made or
1550990	1558170	maintained on devices, and then what that would be from your brand and impression. I think one of
1558170	1566650	the best things that happened was the fact when the Health Sector Coordinating Council and HISAC
1566650	1572510	and others have come together and petitioned organizations like Microsoft, especially during
1572510	1580810	this time of COVID, to extend the patching and the updates for Windows 7 and to make that
1580810	1588410	date in the hospital sector not to extend it. So the more that we can
1588410	1596790	do activities as a community like that to either extend the life or to be much more
1597670	1604010	economical around how these products and solutions are being used. And again,
1604010	1610670	my provocativeness, get away from the potential greed that might exist out there. I think
1610670	1617230	that'll help us to try to address some of the issues that might exist
1617230	1620750	in the ecosystem. It's one thought.
1624470	1631990	Yeah, greed and jealousy are motivators that we can use in business to get people to do
1631990	1640130	things. And so it's the human condition, I think. So if we could
1640130	1647110	figure out how to leverage that, I think that would be good. So in the standards work that we do,
1647570	1652930	you know, it's IEEE, it's at the individual level, it doesn't cost anything to join the
1652930	1657010	working group. And what I tell people is, you know, this will be like a take-home test
1657010	1662010	if you get involved now, because you can help define it, you know, and then you could be the
1662010	1666730	first ones to have it. And you could be at the leading edge when, you know, I was at Yale New
1666730	1672050	Haven a couple years ago talking about this tips framework, and very bright as they are,
1672050	1675790	the chief information and chief medical officers looked at me and said,
1675790	1679750	so do you have a tips maturity model that you could hand us today that we could use tomorrow
1679750	1683490	to look at all these hundreds of thousands of devices in our hospital and our patients?
1683490	1689030	Like, whoa, I wish the answer to that was yes, but it's going to take a village, right? Ah,
1689030	1693070	the biohacking village, look where we are, how handy is this? So maybe that's something, you
1693070	1697930	know, we can end up working on together. And people can get involved in creating this tips maturity
1697930	1703650	model, validating it, certifying it, you know, maybe that's, you know, what we can do is get
1703650	1708390	other people jealous, like, ooh, you know, I want to go to the head of the class. That would be great.
1710130	1715170	I, I agree with you. And I think, and again, there's other challenges as well. And I'm going
1715170	1719170	to be just as provocative as Michael right here and bring out another big one, which is the
1719170	1726270	electronic medical records systems of record themselves. So we have to make sure that these
1726270	1731370	systems of record that we eventually store all this information in, we have to make sure we keep
1731370	1739450	them as updated and up to date and able to support these devices just as much as the devices
1739450	1743590	themselves. There was actually an interesting paper I read from the late Michael Sinow and
1743590	1750190	some other people that had put together the best model for electronic medical record system
1750190	1757170	implementation at a health system in New Jersey they were at. And what it came down to is that
1757170	1766350	25% of the cost was the EMR. 75% was the cost of the ancillary devices themselves. So I think
1766350	1772870	we could stand to make sure that we have a good budgeting model that we make sure that we
1772870	1781130	understand what devices work, what version of an EMR and be able to cost it all out. And we can solve
1781130	1788210	that challenge with simply doing a lot of good financial work and making sure also that the
1788210	1795970	system of record aka the EMR also stays updated. Easier said than done. So talking about other
1795970	1800190	challenges to your future leads to question number four which is how do you solve the
1800190	1807930	challenges today with an anticipatory eye and what the next threats may be?
1807930	1813330	First on that right here I'll start off again with Florence. Oh heads down display heads up
1813330	1818850	display. What is it you're trying to deal with today? And we have we'll start with with that
1818850	1823950	and we have to have the guts to look at what we haven't done yet. Now we're all talking about
1823950	1827490	standard this you know we haven't done with SNOMED and low ink and this and that and fire
1827490	1831330	and HL7. Oh my god this stuff is so incredible because people who are brilliant who created it
1831330	1836670	right. But it's not done and it will probably never be done right because there's a lot of
1836670	1842890	hacking that you know continues to evolve as we know. The the bad dudes and dudettes and robots
1842890	1848610	are just as smart as the good ones unfortunately. So what we have to do is not be afraid to look
1848610	1853970	at what haven't we done yet. So as an example so we're talking about trust and identity and
1853970	1859670	security and devices. So what if we had you know what if we figured out a federated identity
1859670	1864690	management system for devices with you know digital identifiers, decentralized identifiers,
1864690	1869630	and we try to do that globally. People go oh we haven't done that yet. I'm like exactly
1870150	1877330	that's exactly the point. So is that exactly what we need? Maybe not. But go wide and then decide
1877330	1882430	you know how we start today and where we need to go. So we have the guts we have to have the guts
1882430	1888790	to say we haven't figured it all out yet. Figure out what we can do today and then build a step
1888790	1893690	function you know a plan going forward. And you know you should we should do some brainstorming
1893690	1898410	like I was about holograms and VR and AR and XR and your R and my R and all this other kind of
1898410	1902550	stuff that's going to happen. And stuff that we don't even have terms for yet. They're going to
1902550	1908730	be part of this. So I'd say that you know we have to start by being brave enough to understand what
1908730	1912650	we already have from AIME and ISO and IEC and IEEE and all this other cool stuff and all the
1912650	1918250	providers and all the manufacturers. Then look at what we haven't done yet. Have the guts to do that.
1918250	1922450	Figure it out and then create a step function toward the future. So that's my recommendation.
1923020	1930730	Yeah I love the comments from Florence and the direction. I've built a few homes
1930730	1937530	because of having to relocate. And I always look at what your current environment is
1937530	1943730	as an organization, as a team. And to her point, I want to make sure that foundation is in place.
1943730	1950510	And one of the biggest hurdles is to be able to consistently execute in a number of these
1950510	1957410	organizations that foundational piece that she described. In terms of making sure that
1957410	1963090	we're doing consistently the activities and efforts that we should have in place right now.
1963090	1969910	And so when you have multinational organizations, different business units,
1969910	1977390	different variations of releases and schedules of products and devices, different mixes of
1977950	1983990	solutions, whether or not they're capital related or implantables. And I mean,
1983990	1989670	there's a myriad of things that exist out there, but you have to be pretty consistent with
1989670	1995070	how am I developing that solution? How am I maintaining that? How am I updating that? How
1995070	2000350	are we interacting and getting the right information at a consistent level like those
2000910	2008170	MDS2s updated on that entire product portfolio? That's the basics in terms of the blocking and
2008170	2015210	tackling that usually isn't the most sexy thing that you think of, and sometimes is really
2015210	2022310	overlooked. And so we really need to get that foundational areas in place across all of the
2022310	2030110	elements of, as we say in the ecosystem, for devices and solutions. And even as Mitch just
2030110	2036250	pointed out from his earlier statements around the electronic health and medical records,
2036830	2041910	Rob and I know that our counterparts in some of those entities, when we were on the cybersecurity
2041910	2046610	task force, it was like pulling teeth to get them to want to even come to the table
2047150	2051990	and having the discussions. And even when you have certain solutions where
2052610	2059530	we're there was astonished to say, man, you had the ability to maintain the certain level
2059530	2068210	of the release and not go back multiple inversions. But you did that to want to be
2068210	2073830	supposedly in compliance and supporting your customers, but you were doing a total detriment
2073830	2079670	to the industry by not aligning and forcing that you couldn't have stuff out there. But
2079670	2085950	they were in a much easier position to maintain their devices at the most current levels and
2085950	2090630	updates. And we were sitting there like, man, are you kidding? Because we don't have that luxury
2090630	2097890	when it came to some of the devices, especially for organizations that had implantables and pumps
2097890	2104090	and other things of those natures. So... Don't hold back, Michael.
2104930	2114910	It's DEF CON. So when I think about what we can do right now, I think about the current
2114910	2121070	environment that we're in. And it touches on a little bit of what you've heard
2121070	2127130	from others on this panel, actually. We're in an environment where I think most of our
2127130	2134010	organizations, if you work in healthcare, we're distracted. Really distracted. If you're even just
2134010	2141430	the general public, you're distracted. Okay? COVID has taken a lot of the focus away from
2141430	2150030	other things like cybersecurity. If we're not careful in tying the story behind how cybersecurity
2150550	2156910	is the underpinning to providing a resilient and thriving healthcare system.
2157030	2165690	It's just essential. We can't have resilient and effective healthcare without securing it.
2165690	2172750	They go hand in hand. And I say that because the other issue we're facing here is that
2173070	2180670	most healthcare delivery organizations don't even have a single person dedicated to
2180670	2186890	cybersecurity. And this is one of the findings of the Healthcare Industry Cybersecurity Task
2186890	2195570	Force report that went to Congress in 2017. So there's not enough people working in this space
2195690	2202450	we need to bring in more stakeholders from different backgrounds into the healthcare
2202450	2209910	industry and into the cybersecurity industry to really... and even if it's not their title,
2209910	2216730	but to build a community of practice around everyone's shared responsibilities around
2216730	2223350	cybersecurity. And the last thing I'll say from the stuff that we can control as the cybersecurity
2223350	2234130	professionals, I think especially Michael and Mitch and myself, we need to as healthcare and
2234130	2239590	medical technology companies, as healthcare providers, we need to look at our investment
2239590	2247490	in security and ask ourselves this, are we protecting what society values most?
2247490	2254450	And if you ask anyone, what is important to protect in healthcare to protect,
2254450	2261050	they will tell you most likely, even if it's my mom, all right, she will tell you,
2261050	2267590	it's probably going to be patient safety, patient health, right? And probably also patient privacy.
2268510	2275570	And so look at our investment today and figure out if there's changes that we need to take in
2275570	2282470	our approach. And maybe touching on Florence's idea there to make it even more tangible around
2282470	2288150	creating some sort of model for identity management in healthcare, you don't have to go
2288150	2295070	too far. I mean, for many years, the cybersecurity industry has been talking about what's called
2295650	2303230	zero trust principles. And so the idea behind zero trust principles are instead of trusting
2303230	2309390	devices inside the network, you know, in this approach, it means trusting no one by default
2309390	2315690	and operating as though the network had already been compromised. And so this means incorporating
2315690	2321470	different types of criteria for authenticating and authorizing users. And the fundamental
2321870	2327570	technologies exist today. It's just changing your strategy as a cybersecurity professional
2327570	2332410	to focus on the idea that you've already been compromised. And how do we strengthen authentication
2332410	2338530	through multi-factor authentication, through conditional access for devices and users
2338530	2344610	connecting to the network? And so those types of technologies exist today. There is hope in,
2344610	2349710	again, what's available to cybersecurity professionals today. But I would also go
2349710	2354890	back and say, we need to expand our community of practice. So if we get all geeky-weeky,
2354890	2358310	which we could do with each other, fire this and HL7 that, and we're so cool,
2358690	2365730	you know, trust zone and hardware. I got upgraded for free one day on a plane when I was flying
2365730	2370250	planes. And I was sitting next to a guy who runs a hospital, a doctor. And I was telling him what
2370250	2373750	we're doing. He said, well, you know what? I'm glad you're working on that because my job is
2373750	2380990	to keep that patient on the table alive. That's what I focus on all day. So in our working group,
2382330	2389410	2933 working group, actually it's all about, we always talk about it, protecting the humans,
2389410	2394890	keeping the humans alive. That's why we're doing this. That's exactly why, you know, my background,
2394890	2398610	my mother died the day I was born. It was a medical error, you know, whole stuff here. So
2398610	2403530	I carry this with me. How do you keep the humans alive? And that's what we're focused on. And if
2403530	2408170	you actually read our project authorization request at IEEE, it says to improve health
2408170	2412670	outcomes. We're not doing this for us geeky weekies. We're doing it to improve health outcomes
2412670	2418690	and to keep the humans alive. And eventually what I would love to see, and we actually had a meeting
2418690	2424210	at my last firm and with Microsoft a few years ago, we were talking about creating like a
2424210	2428930	cybersecurity learning hub for humans, you know, normal people. And we said, oh, cradle to grave.
2428930	2433870	And we said, oh, that's kind of rude. Let's say pre-K to AARP. And we're going to teach them
2433870	2438730	what TIPS is. You know, so when I was a little girl, remember I'm a geek, I was a rocket scientist. So
2438730	2444470	I used to look for the little UL tag on my, on my electric cords. Any of you guys? I did. I always
2444470	2450970	look for them because that meant safety, right? And so what we want to do is teach them why they
2450970	2455370	should ask for this. So someday, I don't know if it's two, three or five years from now, some little
2455370	2458870	five-year-old is going to be at the doctor and they're going to try to give her an insulin pump.
2458870	2464530	And she's going to say, does that have TIPS? And she doesn't need to know what it stands for.
2464530	2470170	We do. We're the geeks. We need to understand that it's trust and identity and federated identity
2470170	2474770	management. And when the doctor, you know, goes into the little device next to grandma's bed that
2474770	2480890	goes into her implanted pacemaker, you check the credentials of that doctor every single time.
2481110	2486170	You make sure they're still, you know, related to whatever their provider is. You make sure they
2486170	2491170	still are credentialed. You make sure it's really the doctor and you have to figure out how to do it.
2491230	2496570	So that's our vision is that we really want this to protect the humans and make the humans aware of
2496570	2501270	it. Just like I looked for that little UL tag, which not everybody did, I know, but you know,
2501270	2505770	how do we teach them and then make sure that the manufacturers are delivering that because
2505770	2510790	then you have demand, you have push and pull from the citizens, from the patients, right?
2510790	2515350	And then the providers and the payers should care about this. It reduces their liability.
2515350	2519390	You know, I used to work on smart buildings years ago when we were first creating a smart
2519390	2525070	building strategy when I was a VP at IBM. And I remember, you know, we were talking to these
2525070	2529230	building management system companies and one of them said, oh, you know what? Security is like
2529230	2533610	number 11 on my list of top 10 things to worry about. And their device was hacked nine months
2533610	2539190	later and the whole leadership team was out. And now it's part of their brand promise. Oh,
2539190	2544830	imagine that, right? So we need to make that a requirement. You know, we need people to be
2544830	2550430	incented to do that and to have the citizens and patients asking for it.
2551650	2557650	Absolutely, Florence. And also one other thing that my organization's had a big challenge with
2557650	2564430	has also been privacy because one of the areas we've got to worry about is not only do we have,
2564430	2570090	we're collecting all this data on people and we have numerous data points on all the people we're
2570090	2574990	collecting from these devices. And we need to make sure that we're protecting that. So
2574990	2581290	important question I have here is what about privacy? How are we incorporating this into
2581290	2586510	our products? How are we incorporating it into our data governance plans? So to lead off here,
2586510	2594170	I believe this is going to be our final question for the three of you. So start off with Michael.
2594710	2602170	Sure. I think that the, you know, privacy takes on, you know, from a legal perspective,
2602170	2609070	you want to understand, you know, the requirements by the different geographies,
2609070	2614770	by the different jurisdictions, by, you know, what the hospitals and, you know,
2614770	2620590	the different entities have in terms of managing that type of information. But to me, Mitch, it's
2621350	2627510	nothing more than another component of your requirements. So if you design privacy as you
2627510	2632790	would security by design in your development process, you take into account what are those
2632790	2638430	sets of requirements and you have to harmonize for, you know, some of us, you know, like, you
2638430	2646070	know, Rob and I and others out there that deal in multi, you know, geographies, you know, multi
2646070	2653130	types of regulatory and compliance environments, and you have to develop what your baseline is.
2653130	2657630	And then once you develop that baseline, and you include those sets of requirements,
2657630	2663510	I would look at the steward of, you know, the CISOs, you know, and it's three of us on the call
2663510	2669550	to be able to make sure that we're executing against that. We go to our legal teams and the
2669550	2675410	privacy organization, really for that foundation to make sure that we're interpreting those
2675410	2680570	requirements, and we're executing those requirements, you know, effectively with the
2680570	2687970	tools and the solutions that we then deploy out in the marketplace. And so I have always had,
2687970	2695070	you know, kind of a mix of the privacy and the data protection elements kind of be able to be
2695070	2700990	co-mingled within, you know, the team. Operationally, if you do it right, you want the CISO side of the
2700990	2706150	house to be managing that, and you want your legal and your compliance arms to be able to
2706150	2712290	help you develop and, you know, and document what those requirements need to be, you know,
2712290	2720440	from a privacy perspective, in my opinion. So I got to tell you, I don't think I could
2720440	2730400	describe it any better than Michael, or I should say Professor McNeil. It's so well said, really,
2730400	2737780	I can't do better than that. I mean, you know, to address privacy requirements alongside security
2737780	2743540	requirements, I absolutely agree. As security professionals, like, you know, bring your privacy
2743540	2750140	friends along with you. And absolutely right that, you know, there's things that, you know,
2750140	2760380	we think of in security that sometimes are counterintuitive to privacy. And then also,
2760380	2766480	again, what Michael said around, you know, treating, bringing your legal professionals,
2766480	2771320	especially, you know, when you're addressing privacy requirements, the complexity is,
2771320	2778060	as he mentioned, this is different across every single country. And you do have to,
2778060	2785980	you know, establish as a company, a common foundation, based off of values, based off
2785980	2791440	of values and principles, you know, as a company, what do we stand for? What is it that we want to
2792060	2801720	do when it comes to this huge civil rights issue, you know, of privacy? And sometimes that means we
2801720	2806280	want to do everything that we can, and we are going to establish, you know, the strictest,
2806280	2811480	you know, governance of privacy across all of our technologies and product platforms, you know,
2811480	2816240	that is, again, a decision that companies need to make. And I got to tell you, I don't think
2816240	2823420	there's many customers that would complain, you know, about a company creating a position
2823420	2828460	and a very robust and comprehensive position on privacy across their different technologies for
2828460	2834100	customers. So... Agreed. So I'll make a couple of comments. I'm sorry, Mitch. I couldn't agree
2834100	2839680	more with you. So what do you think? Oh, you know, Mia, I always think something. So there
2839680	2844360	are a couple of things. One is on the privacy side, it's one of our subgroups, it's part of
2844360	2848320	TIPS, you know, Trust, Identity, Privacy, right in the middle, Protection, Safety, and Security.
2848320	2852520	And we have a woman from the European Union who's leading that subgroup, which is great,
2852520	2859400	because she actually found the privacy rules by country in Europe. Not surprising, right?
2859400	2864540	So what we're doing is making sure that we're going deep on those, identifying the patterns,
2864540	2868580	and then figuring out what are the little things we have to worry about here if we're creating a
2868580	2873420	standard that's international. So if I'm wearing an implanted device, I'm in the U.S., I'm in the
2873420	2877560	U.K., I'm in Russia, I'm in China, I'm in South Africa, am I going to be safe? You know, is my
2877560	2881840	data going to be private? What does that mean? What are the implications? So we're already baking
2881840	2889840	that in to the plan. The other thing is that I was at an event at my alma mater at Princeton,
2889840	2893880	and Sonia Sotomayor was there. She's a Supreme Court Justice in the U.S. for those of you who
2893880	2898580	don't know her. She's brilliant. And so I asked her, what do you think about privacy and security
2898580	2902740	and the Internet of Things, all these devices all over the place? I said, I'm working on security.
2902740	2907700	She said, that's good because I'm working on privacy because I don't think the citizens realize
2907700	2912740	the human rights that they're giving up. Very interesting. So she's on it, and she's already
2912740	2916960	written a couple of things on it if you want to look at what she's done. And then the other thing
2916960	2921300	I just want to mention very quickly, we were talking about, you know, what's our goal here?
2921300	2925480	I spoke at an event at Academic Medical Center Conference a few years ago, and then about a year
2925480	2930320	or so ago, a gentleman reached out to me and said, oh, I wrote a book, and I found your presentation,
2930320	2934920	and I referred to you in my book. I was like, oh, I'm so honored. What's the name of your book?
2934920	2943380	The Doctor Will Kill You Now. And he talked about the security and privacy issues,
2943380	2948660	and this guy who, like, you know, lives in his mother's basement and then moves to another
2948660	2953180	state. It's not bad living in your mother's basement, I have that going on too, but moves to
2953180	2960520	another state, fakes a PA license, gets into a doctor's office, gets into the system, actually
2960520	2967380	turns off the power in the hospital so someone on event dies. Then he gets into somebody's personal
2967380	2972880	medical record, changes his blood type, they're given a transfusion, and they die. And then his
2972880	2979700	next target is a children's hospital. So if anybody is looking at, so why should I worry
2979700	2985640	about this security and privacy stuff? That's a good book. It's only 15 bucks. And the guy who
2985640	2991400	wrote it is an MD, and he used to lead the IEEE chapter in Rochester, New York, years ago.
2991400	2996900	So he, you know, he's on both sides. He's an electrical engineer, computer scientist, more double
2997440	3003720	and then he's also a doctor. So we all have to work on this. This is serious. It's just going
3003720	3009360	to get worse. A lot more things are connected. There are attack surfaces all over the place.
3009360	3016920	We need a defense in depth strategy. And it's for privacy and security and protection and safety.
3021830	3026790	I'm impressed by the depth of knowledge everyone brings here. And I speak from the provider
3026790	3031890	perspective here. I'm very happy to be working with you all, especially from the standards
3031890	3037410	perspective as well. I think we have a good foundation. We just all need to continue to keep
3037410	3043790	working together. And you have my commitment and for all of you in the medical device industry know
3043790	3049290	you have my organization's commitment as well. So thank you so much for all taking the time today.
3049290	3055350	This is incredibly appreciated and hope all of you out there appreciate this today as well. So
3055350	3060430	thank you all so much for taking the time. And this is the group here signing off.