WEBVTT 00:00.000 --> 00:04.940 Hi, I'm Mitch Parker, Information Security Officer at IU Health in Indianapolis, Indiana. 00:04.940 --> 00:16.820 And today's topic is going to be advancing medical device security, how collaboration between providers, manufacturers and pen testers is advancing what's possible with security. 00:16.920 --> 00:23.860 And with us today, we have an incredibly distinguished panel of people we've been able to find who I'd like to have introduce themselves right now. 00:23.860 --> 00:26.040 We're going to start with Florence Hudson. 00:26.040 --> 00:27.040 Very good. 00:27.040 --> 00:29.660 Thank you so much, Mitch, for having me join you. 00:29.660 --> 00:31.520 And hey, DEF CON crowd. 00:31.560 --> 00:32.840 Geeks and all. 00:33.260 --> 00:34.060 And goons. 00:34.060 --> 00:41.900 So I'm Florence Hudson, and I'm Founder and CEO of FDHint, which is an international consulting firm for advanced technology and diversity and inclusion. 00:42.220 --> 00:47.520 I also work for the NSF Cybersecurity Center of Excellence at Indiana University. 00:47.520 --> 00:51.160 I lead the Cybersecurity Research Transition to Practice Program. 00:51.160 --> 01:00.860 And I'm also Executive Director for the Northeast Big Data Innovation Hub at Columbia University, leading translational data science opportunities in the Northeast US. 01:02.900 --> 01:09.820 Oh, and I should say, I'm also Working Group Chair for IEEE UL P2933. 01:09.820 --> 01:17.980 For those who aren't acronym queens and kings, it stands for Institute for Electronic Engineers and Underwriters Laboratories. 01:18.080 --> 01:29.320 Working group on creating a standard around clinical innovative things, data, and device interoperability with TIPS, which stands for Trust, Identity, Privacy, Protection, Safety, and Security. 01:29.320 --> 01:31.340 And Mitch is one of our Co-Vice Chairs. 01:31.340 --> 01:33.200 So thank you very much for having me, Mitch. 01:33.200 --> 01:34.140 Thank you, Florence. 01:34.140 --> 01:35.880 We'll take it over to Rob Suarez. 01:37.460 --> 01:38.080 Hi. 01:38.080 --> 01:39.040 Hi, DEF CON. 01:39.040 --> 01:45.400 This is... My name is Rob Suarez, and I'm the Chief Information Security Officer for BD. 01:45.540 --> 01:47.320 That's Beckton Dickinson. 01:47.580 --> 01:56.480 And we're a global medical technology company offering some of the most advanced products across the continuum of care. 01:56.620 --> 02:14.660 It's my job at BD to make sure that we are protecting those products that we're delivering a secure product and also the environment in which they reside in, which is typically a hospital, but increasingly, you know, a patient bedside at home as well. 02:14.660 --> 02:20.480 And so I'm very excited to talk to my fellow panelists today about medical device cybersecurity. 02:20.480 --> 02:30.300 This is a passion of mine, and I've had the honor actually of working alongside Mitch and Michael as well on several industry initiatives. 02:30.920 --> 02:33.880 And so again, looking forward to the discussion today. 02:33.880 --> 02:35.000 Thank you. 02:35.360 --> 02:37.380 And last but not least, Mr. 02:37.380 --> 02:38.600 Michael McNeil. 02:39.020 --> 02:40.000 Hi, DEF CON. 02:40.000 --> 02:41.380 This is Michael McNeil. 02:41.440 --> 02:52.100 I'm the Senior Vice President and Global Chief Information Security Officer at McKesson, and just recently got to the organization. 02:52.100 --> 03:00.160 But as, you know, Rob has just stated, have had a number of years collaborating, you know, with the team here. 03:00.160 --> 03:09.280 And my days go back into Philips as well as into Medtronic from a medical device perspective over the past 10 years. 03:09.280 --> 03:18.860 Really looking forward to this particular session and again have collaborated with these guys in a number of different industry and forums. 03:18.860 --> 03:29.940 And again, I think you'll find our conversations today to be pretty enlightening because it takes that ecosystem and for us to come together to really execute here. 03:30.860 --> 03:32.940 Thank you so much, Michael. 03:32.940 --> 03:35.780 So I'm going to launch right into the first question here. 03:35.780 --> 03:42.600 First question is, what are the biggest concerns that each of you sees related to medical device security? 03:42.660 --> 03:46.380 So I'll start if I might. 03:46.400 --> 03:52.980 So what I mentioned when we were first opening up, I talked about tips, tips for the Internet of Things. 03:53.080 --> 03:56.640 This is a framework we've been creating with IEEE for four years now. 03:56.640 --> 04:01.940 As I mentioned, it stands for trust and identity, privacy, protection, safety, and security. 04:01.940 --> 04:03.420 I'm worried about all those things. 04:03.580 --> 04:12.840 I'm worried about the trust and identity of the devices, the device to device communication, the device to human, the doctor to the device to the human, human to everything. 04:13.040 --> 04:18.840 So I'm concerned about trust and identity, how we're going to maintain that and make sure we're vigilant about it. 04:18.900 --> 04:26.180 I'm concerned about privacy of data, whether you're in your home country or another country and what the different regulations are and how we're going to manage it. 04:26.180 --> 04:39.400 I'm concerned about protection and safety, how we're going to keep the humans safe, how we're going to keep the device safe, the infrastructure, the financial side of the institution, if your device is hacked and everybody finds out, like some of the FDA and DHS and U.S. 04:39.400 --> 04:40.240 CERT recalls. 04:40.240 --> 04:42.480 And I'm concerned about the cybersecurity. 04:42.480 --> 04:50.480 So we have a lot to do as the leaders in this space for IT and for cybersecurity and for medical devices. 04:50.480 --> 05:08.780 So I look forward to continuing the collaboration we're doing through groups like this and also like in the IEEE working group where we have over 250 humans from 22 countries and six continents who are worried about this too, including device manufacturers and providers and payers and regulators and everybody as we know, 05:08.780 --> 05:09.340 Mitch. 05:09.340 --> 05:11.160 So I'm worried about all that stuff. 05:11.160 --> 05:12.680 What about the rest of you? 05:12.680 --> 05:13.580 Are you worried? 05:15.340 --> 05:17.820 So I'll go next on that one. 05:17.820 --> 05:19.040 Thank you, Florence. 05:19.760 --> 05:33.580 For me, it's actually very similar to what you'll find was reported out and I believe it was 2017 and what was the healthcare industry cybersecurity task force report. 05:33.580 --> 05:50.680 In fact, on that task force, I got to serve alongside Michael McNeil and several other individuals across the industry and produce a report that outlined observations and recommendations for improving cybersecurity across the industry in healthcare. 05:50.680 --> 05:58.400 There was a specific section that was dedicated just for medical device cybersecurity, and I got to tell you, that was three years ago. 05:58.400 --> 06:02.520 A lot of those findings still apply to this day. 06:02.800 --> 06:14.700 And one that pops out to me immediately is that medical devices are in hospital settings for 15 to 20 years, but new cybersecurity threats emerge daily. 06:14.960 --> 06:19.540 And every hospital and every patient environment is unique. 06:19.540 --> 06:22.620 So there's no one-size-fits-all approach. 06:23.340 --> 06:36.220 And at BD, we're working closely with healthcare providers on understanding medical device cybersecurity as it exists out in a clinical setting, out in the real world. 06:36.360 --> 06:40.620 And we're also working, we're really committed to transparency. 06:41.100 --> 06:49.640 And for example, providing coordinated vulnerability disclosures on medical device vulnerabilities. 06:49.900 --> 06:54.280 But unfortunately, it's just not enough. 06:54.280 --> 07:00.260 There's really a long time span to medical devices in these environments. 07:00.260 --> 07:22.760 And so increasing transparency absolutely helps, but we also need to build stronger relationships and stronger collaborations across... Florence, as you really described, across the continuum of stakeholders that we have when it comes to just using a medical device and managing it when it's in use. 07:23.600 --> 07:24.420 Yeah. 07:24.420 --> 07:46.240 And from my perspective to build on what Rob has just stated, he's hit the nail on the head, and we've been having these kinds of conversations and discussions even before the 2017 and earlier when we go back a few years on this particular topic. 07:46.720 --> 07:53.540 I think people have heard me talk in the past and it really doesn't... It's kind of interesting. 07:53.540 --> 07:54.720 It doesn't change. 07:54.720 --> 07:57.780 It just perpetuates itself. 07:57.780 --> 08:15.700 So as Rob just talked about, legacy devices as we call them in the ecosystem and how we manage that, that to me ties right into what I've always said is sort of the three deadly sins that I've kind of communicated over time. 08:15.720 --> 08:22.260 Because you have these types of devices, you need to make sure that you can patch and update them in a timely manner. 08:22.260 --> 08:31.900 So one of the deadly sins, if I can't patch and update a device, I'm not going to be able to maintain the security of that solution out in the marketplace. 08:32.140 --> 08:43.300 When I look at the types of devices and a number of them when they were designed and developed and they're in these environments, if they got hard-coded credentials, those are the keys to the kingdom. 08:43.300 --> 08:52.900 If I open the keys up and I let anybody come in, front, back, side doors, any way that you have, then you have access and you're going to be able to align. 08:52.900 --> 09:17.040 And then for us, when it comes to the type of information, again, as I would say that Florence had talked about in terms of thinking of the type of data and the type of information that needs to be held secure, if you don't do encryption and de-identify and make sure that that's not available to cause the kinds of harm to individuals, 09:17.040 --> 09:20.700 to the solution itself, you get to those deadly sins. 09:20.700 --> 09:32.780 So the sins are there and we're doing a much better job, I believe, in having an awareness around the design and how we need to build that into our solution set. 09:32.780 --> 09:40.740 But it's how do you manage that legacy that's sitting out there in the current environment? 09:40.740 --> 10:05.760 And as we've also said in the past, because of the nature of the marketplace, it's like prying those systems out of their cold, dead hands in some of these hospitals and other types of entities, because they don't have, obviously, with Mitch, the wherewithal to just immediately turn around, 10:05.760 --> 10:09.980 you know, your capital and your inventory for some of these types of solutions. 10:10.020 --> 10:12.120 Yeah, so I totally agree. 10:12.120 --> 10:14.840 It's the products we have today. 10:14.900 --> 10:24.940 It's the new products and how we create design-in plans so that you design in a defense-in-depth level of security at the hardware, firmware, software, and service level. 10:25.220 --> 10:28.900 I suggest we go all the way down to the IP of the design of the chip. 10:29.060 --> 10:32.260 You know, we need to go all the way down and all the way up. 10:32.260 --> 10:38.620 And we also need, I know in the standards work we're doing, we're saying that we need to be able to look forward too. 10:38.620 --> 10:41.440 I'm an old rocket scientist, or experienced. 10:41.440 --> 10:44.960 My girlfriend's saying not to use the term old, but I'm an experienced rocket scientist. 10:44.960 --> 10:46.800 I used to work on future missions around Jupiter. 10:46.800 --> 10:48.100 Did we know exactly what we were doing? 10:48.100 --> 10:52.020 No, but we had a planet, you know, and you look forward, you say, what's going to happen? 10:52.040 --> 10:59.220 So in the standards work that we're doing, we're agreeing that it has to be a standard that is extensible into the future. 10:59.400 --> 11:04.720 You know, so what we're also doing is envisioning, well, how can we use artificial intelligence and machine learning better? 11:05.020 --> 11:09.420 What about when it's a hologram and the doctor's like, oh my gosh, she's right here. 11:09.640 --> 11:10.700 You look a little jaundiced. 11:10.700 --> 11:12.060 I'm like, how do you know that? 11:12.060 --> 11:13.280 You know, I'm in my pajamas. 11:13.280 --> 11:14.280 How did that just happen? 11:14.280 --> 11:14.700 Right? 11:14.720 --> 11:19.740 So when we're in XR, AR, VR, how's all this stuff going to play? 11:19.800 --> 11:25.660 And then if you want to get excited about protocols, think of what, you know, communications protocol, that's going to be all about. 11:25.660 --> 11:31.680 You know, that's going to get into your EHR or how they're going to read, you know, from your, from your little devices. 11:31.680 --> 11:34.260 So we're also trying to think of what could happen. 11:34.260 --> 11:42.820 So being an aerospace engineer and designing, you know, not just spacecraft, but also planes and jets, you have your heads down display, right? 11:42.820 --> 11:43.520 Your altimeter. 11:43.520 --> 11:45.360 And then you have your heads up display. 11:45.420 --> 11:46.500 We need both. 11:48.640 --> 11:59.150 I am in full agreement with you and can tell you the biggest challenge I saw with all these years of working for healthcare and hospitals. 11:59.150 --> 12:02.290 I've been in the provider space for about a dozen years as a CISO. 12:02.290 --> 12:15.790 And biggest challenge I've always found has actually been paying for it all because a lot of, a lot of hospitals out there, especially with COVID, have significant financial challenges these days. 12:16.090 --> 12:20.710 And right now, I mean, every hospital has a problem paying. 12:20.790 --> 12:31.210 Before January or February of this year, you still would have had about, I'd say about half the hospitals in the United States, whereby I asked them to update a good chunk of their clinical engineering equipment. 12:31.470 --> 12:38.930 They would have likely looked at me and said, when I can fix my roof, when I can fix my floor, and when I can patch the hole in the boiler. 12:39.510 --> 12:40.690 And what do you want? 12:40.690 --> 12:43.330 Do you want a roof over your head or do you want secure medical devices? 12:43.330 --> 12:55.910 And I've actually once had a clinical chair from the department sit me down and say, I'd like to update my devices, but I need to get different ones in here because I'm not able to do women's health properly. 12:56.710 --> 13:01.910 And to me, that put a lot of items in perspective. 13:01.910 --> 13:11.470 And I've always worked with my customers to make sure that we can get them on at least a good path to where they need to be using minimal cost solutions. 13:11.470 --> 13:16.470 Because to be very blunt, it's 15 to 20 years also, because it's all I have money for. 13:16.490 --> 13:19.550 And that's sadly the situation in the United States. 13:19.550 --> 13:31.310 And after things happen, after we have some leveling off with COVID, we're going to be in a much different place, more like 2009 when it comes to the economy. 13:31.490 --> 13:34.650 But to get these good items in place, you need to have standards. 13:34.650 --> 13:42.030 And that leads me to the second question, which is, what standards efforts are in play for medical device security that you're currently working with? 13:42.030 --> 13:45.850 So again, to you, Florence, because of all the IEEE work. 13:47.030 --> 13:47.690 Absolutely. 13:47.690 --> 13:48.810 I have to apologize. 13:48.810 --> 13:50.910 I have a robo caller who won't give up. 13:50.910 --> 13:53.550 So you're going to hear my phone in the background. 13:53.830 --> 13:55.190 So anyone else been through this? 13:55.190 --> 14:03.310 So the standards efforts, we have a number of standards efforts in play, and we're trying to hold hands and work together. 14:03.350 --> 14:13.250 So at IEEE, we have this IEEE UL P2933, which is the for clinical IOT data and device interoperability with TIPS, as we discussed. 14:13.250 --> 14:17.230 There are also efforts on blockchain for healthcare and how that plays in. 14:17.230 --> 14:24.090 There are efforts going on with ISO and IEC and open mobile health and communications interoperability. 14:24.090 --> 14:37.670 So we actually just had a really cool session last week, where Mitch and I presented along with a number of our colleagues from around the world regarding addressing clinical IOT interoperability and security challenges globally. 14:38.390 --> 14:52.650 And so one of our colleagues representing Underwriters Laboratories, after we each spoke about P2933, you know, this kind of IOT thing, and then open mobile health, and a few other things, he got up and said, okay, here's one page with like all this stuff on it. 14:52.830 --> 14:56.830 You know, we have a pyramid here, we have a triangle, and we have all these other pieces. 14:56.930 --> 14:59.310 We have to figure out how we're going to work together. 14:59.410 --> 15:07.470 So if any of you out there are interested in getting involved in this, we're actually hoping to have a longitudinal plan here. 15:07.530 --> 15:14.730 We had Julian Goldman from Harvard, and Mass General, who was on the panel, and Ida Sim from UCSF. 15:14.730 --> 15:22.150 We had Mitch, me, Ken Fuchs, McGregor, Anura, Fernando from Underwriters Laboratories. 15:22.510 --> 15:24.730 And I always forget at least one. 15:25.050 --> 15:27.230 Oh, and Ken, I think that's most of it. 15:27.230 --> 15:30.050 And so we're all going to be getting together again in the fall. 15:30.050 --> 15:33.050 And we're interested in anybody else who wants to join us. 15:33.050 --> 15:37.370 So Mitch, I don't know if we're giving out our email addresses or how you want to do that. 15:37.510 --> 15:49.350 But, you know, we'll find a way to make the P2933 web page completely accessible and get information over there. 15:50.070 --> 15:57.190 So in the meantime, you can send me an email along with my robocaller at florence.com. 15:57.950 --> 16:02.570 And I think I'm going to give them my email address so they're not so disruptive the next time. 16:04.090 --> 16:12.030 Hey, Florence, I'm really excited to hear that IEEE is getting involved in this space. 16:13.230 --> 16:16.650 And, you know, it's exciting to hear that. 16:16.650 --> 16:28.250 There's not enough that we can do actually to really formalize the process of multiple device cybersecurity across the lifecycle of these technologies. 16:28.410 --> 16:42.870 I would like to also recognize, you know, a lot of the work that the FDA has done in producing cybersecurity guidance documents over the last, oh my gosh, you know, many years. 16:43.130 --> 16:52.490 And so, you know, whether it's pre-market requirements for submissions and cybersecurity, or it's post-market surveillance, right? 16:52.490 --> 16:58.070 And knowing how to do coordinated vulnerability disclosures, those guidance documents are very helpful. 16:58.070 --> 17:05.470 Also very relevant today, you know, is cybersecurity for off-the-shelf software components. 17:05.470 --> 17:11.310 Again, you know, FDA has some good guidance documents, a good guidance document on that. 17:11.510 --> 17:19.890 Recently, and, you know, they've taken a very collaborative approach to cybersecurity engaging very different stakeholders. 17:19.890 --> 17:30.790 And a great example of that, you know, FDA has engaged NTIA on creating a software bill of materials standard and a set of deliverables around that as well. 17:30.790 --> 17:44.510 And it's all around how manufacturers can be more ready to identify vulnerabilities in third-party components, and then extending that capability out to hospitals, you know, who have this technology in an operational environment. 17:45.070 --> 17:53.110 And, you know, the last two things here I'll mention is International Medical Device Regulators Forum. 17:53.110 --> 17:55.030 You know, it's not just the U.S. 17:55.030 --> 17:56.770 and FDA that's going through this problem. 17:56.770 --> 18:00.670 This is a global issue in medical device cybersecurity. 18:00.830 --> 18:16.710 And the International Medical Device Regulators Forum, INDRS, has come together to produce a cybersecurity guidance document that really sets to harmonize... provide harmonized guidance to regulators globally. 18:16.710 --> 18:26.030 So, you know, different countries and regions can set up their own guidance documents and map that to their own regulatory bodies. 18:26.490 --> 18:36.550 And the last one here I'll mention, I have to mention it because, boy, it was a lot of work, but the Healthcare Sector Coordinating Council. 18:37.050 --> 18:50.670 And, you know, Michael also and Mitch, you know, were contributors to this effort as well, produced what's called the Joint Security Plan, the MedTech Joint Security Plan, otherwise referred to as the JSP. 18:50.990 --> 18:54.310 And, you know, in this document, you know, anyone can find... 18:55.170 --> 18:57.470 it's not just... it's not standard. 18:57.470 --> 19:15.890 It's actually a plan, a way to put in motion a security program from design, development, all the way out to, you know, complaint handling for medical devices, and what to do when these devices are out in the field, and risk management, again, throughout the continuum of care. 19:15.890 --> 19:29.710 So if you want to know how to do a risk assessment on medical devices, if you want to know, you know, when to do a penetration test, what types of design requirements are helpful for medical device and cybersecurity, how to structure your organization, 19:29.710 --> 19:33.110 you know, those things you can find in the JSP today. 19:33.110 --> 19:41.910 And working with MDIC, we're also developing an effort to actually benchmark against those different capabilities. 19:41.910 --> 19:52.470 So that way, if you're a small medical device manufacturer or a large one, you want to know where to go next, and how to build out your program, and what's good enough. 19:52.470 --> 20:12.130 And so this benchmarking initiative with MDIC will help us create that set of metrics, and again, the benchmark itself, so that we can share it openly across our industry stakeholders, and collectively improve our programs, be able to speak to our executive leadership, 20:12.130 --> 20:18.010 too, as well, that have to pay and make and commit to this investment in medical device cybersecurity. 20:18.010 --> 20:19.130 That sounds really cool. 20:19.130 --> 20:22.630 Do they have guidance for manufacturers as well as providers? 20:24.350 --> 20:32.530 So, Healthcare Sector Coordinating Council also has, yes, guidance for healthcare providers, too. 20:32.530 --> 20:36.030 It's called HICP, H-I-C-P. 20:36.150 --> 20:45.090 And then you have the Joint Security Plan, which is focused on medical devices and healthcare IT solutions. 20:45.510 --> 20:50.430 And so, yes, they have guidance for both sets of stakeholders. 20:50.430 --> 20:51.110 Right. 20:51.110 --> 21:15.190 And yeah, so as Rob stated, the IMDRF, also, the way it was documented, it addresses, here's what's the pertinent areas for the manufacturer, the health delivery organization, the different stakeholders, even patients, as it pertains to the different topics that was put into that type of guidance. 21:15.190 --> 21:17.770 And again, that one was global. 21:17.770 --> 21:38.510 A couple of others that I would just want to make sure that we have included when you talk about health delivery organizations, MIDA has always championed and updated their, you know, MDS2 documentation, which is utilized for the procurement process with health delivery organizations. 21:38.510 --> 22:04.330 And that MDS2 is something that has been maintained as a part of the release schedule and with the inclusion of the SBOM as a component and a deliverable of that, it gives organizations like Mitch's the ability of being able to understand the ingredients of the product and the solutions that they are acquiring and how they need to develop and execute that. 22:04.330 --> 22:23.950 And then as Rob said, the AAMI organization has taken on the ability of taking a look at some of those, you know, pre-market and post-market type of guidance documentation, and then they created their technical, you know, references in their TIR 57 and 97, 22:23.950 --> 22:36.650 which allows you to provide some of the how-to on those different stakeholders in the industry, how they need to execute against those particular technical references and standards. 22:36.650 --> 22:42.630 So I think that kind of, we gave you the alphabet soup and then some in response, Mitch. 22:43.070 --> 22:44.250 Yeah, absolutely. 22:44.250 --> 22:45.850 No excuses now. 22:46.970 --> 22:51.490 I can tell you that that 2019 MDS2 form, thank you very much for that, Michael. 22:51.490 --> 22:53.870 That's been incredible in our organization. 22:54.090 --> 22:56.410 We've actually started using that a lot. 22:56.410 --> 22:58.810 The first vendor that actually gave us one was Philips. 22:59.210 --> 23:04.150 So very happy that... I'll take the old pats on the back for that. 23:04.150 --> 23:08.130 We're starting to get those in from our vendors and they've been helping us out with a lot of different purposes. 23:08.370 --> 23:17.030 So my next question here is, what are the most difficult medical device security issues to solve? 23:17.030 --> 23:19.190 I want to throw a real ringer in there. 23:22.670 --> 23:24.210 I'll take the first. 23:24.490 --> 23:25.790 Okay, go ahead, Rob. 23:25.790 --> 23:29.510 Yeah, I'll take a first stab at that. 23:29.510 --> 23:36.450 So I think one of the most difficult issues to solve, just to change it up here, aside from... 23:37.010 --> 23:55.270 and it does relate to the issue of legacy medical devices, is also that hospital environments may have hundreds of thousands of connected medical devices at one time and from thousands of different vendors. 23:55.430 --> 24:10.930 And so while I may not directly feel that pain, I feel for our customers at BD that are healthcare providers and have to manage this tremendous complexity. 24:11.710 --> 24:28.690 And what compounds this situation is that not every medical device manufacturer is doing things like patching of their medical devices or routine updates to their medical devices. 24:28.790 --> 24:38.650 And also, that's why transparency is so important, because these new threats emerge daily. 24:38.750 --> 24:58.210 And boy, I'm sure there's a lot of homework that healthcare providers have to do when a new security vulnerability pops up and you don't find a timely and effective or meaningful communication from a medical device manufacturer to facilitate a response. 24:58.210 --> 25:06.690 So yeah, I think those are really, really important issues that we need to address. 25:07.450 --> 25:28.030 You know, one of the things I would add on where Rob is at, and again, I do agree that the level of connectivity and the complexity of the type of solutions is definitely a critical one, but let me be a little bit more provocative and throw something else out there. 25:28.030 --> 25:40.890 I think when you look at potentially, and again, and this gets back to, again, I think where Florence was at when we talk about taking it down to the chip level. 25:40.930 --> 25:57.570 I think when I look at the greed that exists in society around the revenue that either wants to be made or maintained on devices, and then what that would be from your brand and impression. 25:57.570 --> 26:26.950 I think one of the best things that happened was the fact when the Health Sector Coordinating Council and HISAC and others have come together and petitioned organizations like Microsoft, especially during this time of COVID, to extend the patching and the updates for Windows 7 and to make that date in the hospital sector not to extend it. 26:26.950 --> 26:43.190 So the more that we can do activities as a community like that to either extend the life or to be much more economical around how these products and solutions are being used. 26:43.190 --> 26:49.990 And again, my provocativeness, get away from the potential greed that might exist out there. 26:49.990 --> 26:59.190 I think that'll help us to try to address some of the issues that might exist in the ecosystem. 26:59.190 --> 27:00.750 It's one thought. 27:04.470 --> 27:13.110 Yeah, greed and jealousy are motivators that we can use in business to get people to do things. 27:13.950 --> 27:18.790 And so it's the human condition, I think. 27:18.890 --> 27:24.070 So if we could figure out how to leverage that, I think that would be good. 27:24.110 --> 27:34.030 So in the standards work that we do, you know, it's IEEE, it's at the individual level, it doesn't cost anything to join the working group. 27:34.110 --> 27:43.470 And what I tell people is, you know, this will be like a take-home test if you get involved now, because you can help define it, you know, and then you could be the first ones to have it. 27:43.470 --> 28:03.490 And you could be at the leading edge when, you know, I was at Yale New Haven a couple years ago talking about this tips framework, and very bright as they are, the chief information and chief medical officers looked at me and said, so do you have a tips maturity model that you could hand us today that we could use tomorrow to look at all these hundreds of thousands of devices in our hospital and our patients? 28:03.490 --> 28:08.790 Like, whoa, I wish the answer to that was yes, but it's going to take a village, right? 28:08.790 --> 28:11.670 Ah, the biohacking village, look where we are, how handy is this? 28:11.670 --> 28:14.770 So maybe that's something, you know, we can end up working on together. 28:15.090 --> 28:27.150 And people can get involved in creating this tips maturity model, validating it, certifying it, you know, maybe that's, you know, what we can do is get other people jealous, like, ooh, you know, I want to go to the head of the class. 28:27.150 --> 28:28.390 That would be great. 28:30.130 --> 28:32.410 I, I agree with you. 28:32.410 --> 28:34.990 And I think, and again, there's other challenges as well. 28:34.990 --> 28:42.450 And I'm going to be just as provocative as Michael right here and bring out another big one, which is the electronic medical records systems of record themselves. 28:43.490 --> 29:00.030 So we have to make sure that these systems of record that we eventually store all this information in, we have to make sure we keep them as updated and up to date and able to support these devices just as much as the devices themselves. 29:00.030 --> 29:15.230 There was actually an interesting paper I read from the late Michael Sinow and some other people that had put together the best model for electronic medical record system implementation at a health system in New Jersey they were at. 29:15.230 --> 29:19.490 And what it came down to is that 25% of the cost was the EMR. 29:19.490 --> 29:25.370 75% was the cost of the ancillary devices themselves. 29:25.550 --> 29:39.990 So I think we could stand to make sure that we have a good budgeting model that we make sure that we understand what devices work, what version of an EMR and be able to cost it all out. 29:39.990 --> 29:51.930 And we can solve that challenge with simply doing a lot of good financial work and making sure also that the system of record aka the EMR also stays updated. 29:51.930 --> 29:54.110 Easier said than done. 29:54.310 --> 30:07.930 So talking about other challenges to your future leads to question number four which is how do you solve the challenges today with an anticipatory eye and what the next threats may be? 30:07.930 --> 30:11.110 First on that right here I'll start off again with Florence. 30:11.970 --> 30:14.050 Oh heads down display heads up display. 30:14.050 --> 30:16.210 What is it you're trying to deal with today? 30:16.470 --> 30:22.970 And we have we'll start with with that and we have to have the guts to look at what we haven't done yet. 30:22.970 --> 30:28.210 Now we're all talking about standard this you know we haven't done with SNOMED and low ink and this and that and fire and HL7. 30:28.210 --> 30:31.970 Oh my god this stuff is so incredible because people who are brilliant who created it right. 30:32.390 --> 30:39.870 But it's not done and it will probably never be done right because there's a lot of hacking that you know continues to evolve as we know. 30:39.950 --> 30:45.290 The the bad dudes and dudettes and robots are just as smart as the good ones unfortunately. 30:45.530 --> 30:49.990 So what we have to do is not be afraid to look at what haven't we done yet. 30:49.990 --> 30:55.390 So as an example so we're talking about trust and identity and security and devices. 30:55.630 --> 31:06.650 So what if we had you know what if we figured out a federated identity management system for devices with you know digital identifiers, decentralized identifiers, and we try to do that globally. 31:06.650 --> 31:08.950 People go oh we haven't done that yet. 31:08.950 --> 31:12.010 I'm like exactly that's exactly the point. 31:12.110 --> 31:14.230 So is that exactly what we need? 31:14.230 --> 31:15.390 Maybe not. 31:15.410 --> 31:20.010 But go wide and then decide you know how we start today and where we need to go. 31:20.010 --> 31:25.270 So we have the guts we have to have the guts to say we haven't figured it all out yet. 31:25.810 --> 31:30.770 Figure out what we can do today and then build a step function you know a plan going forward. 31:31.090 --> 31:39.650 And you know you should we should do some brainstorming like I was about holograms and VR and AR and XR and your R and my R and all this other kind of stuff that's going to happen. 31:39.730 --> 31:42.030 And stuff that we don't even have terms for yet. 31:42.210 --> 31:43.790 They're going to be part of this. 31:43.950 --> 31:54.790 So I'd say that you know we have to start by being brave enough to understand what we already have from AIME and ISO and IEC and IEEE and all this other cool stuff and all the providers and all the manufacturers. 31:54.910 --> 31:56.810 Then look at what we haven't done yet. 31:56.810 --> 31:58.250 Have the guts to do that. 31:58.250 --> 32:01.150 Figure it out and then create a step function toward the future. 32:01.150 --> 32:02.450 So that's my recommendation. 32:03.020 --> 32:08.770 Yeah I love the comments from Florence and the direction. 32:09.170 --> 32:13.130 I've built a few homes because of having to relocate. 32:13.130 --> 32:19.950 And I always look at what your current environment is as an organization, as a team. 32:19.950 --> 32:23.730 And to her point, I want to make sure that foundation is in place. 32:23.730 --> 32:35.670 And one of the biggest hurdles is to be able to consistently execute in a number of these organizations that foundational piece that she described. 32:35.670 --> 32:43.090 In terms of making sure that we're doing consistently the activities and efforts that we should have in place right now. 32:43.090 --> 33:03.250 And so when you have multinational organizations, different business units, different variations of releases and schedules of products and devices, different mixes of solutions, whether or not they're capital related or implantables. 33:03.250 --> 33:11.870 And I mean, there's a myriad of things that exist out there, but you have to be pretty consistent with how am I developing that solution? 33:11.870 --> 33:13.170 How am I maintaining that? 33:13.170 --> 33:14.930 How am I updating that? 33:14.930 --> 33:25.310 How are we interacting and getting the right information at a consistent level like those MDS2s updated on that entire product portfolio? 33:25.310 --> 33:36.310 That's the basics in terms of the blocking and tackling that usually isn't the most sexy thing that you think of, and sometimes is really overlooked. 33:36.310 --> 33:48.130 And so we really need to get that foundational areas in place across all of the elements of, as we say in the ecosystem, for devices and solutions. 33:48.130 --> 34:09.010 And even as Mitch just pointed out from his earlier statements around the electronic health and medical records, Rob and I know that our counterparts in some of those entities, when we were on the cybersecurity task force, it was like pulling teeth to get them to want to even come to the table and having the discussions. 34:09.150 --> 34:24.150 And even when you have certain solutions where we're there was astonished to say, man, you had the ability to maintain the certain level of the release and not go back multiple inversions. 34:24.150 --> 34:39.550 But you did that to want to be supposedly in compliance and supporting your customers, but you were doing a total detriment to the industry by not aligning and forcing that you couldn't have stuff out there. 34:39.550 --> 34:46.490 But they were in a much easier position to maintain their devices at the most current levels and updates. 34:46.490 --> 34:49.090 And we were sitting there like, man, are you kidding? 34:49.150 --> 35:00.030 Because we don't have that luxury when it came to some of the devices, especially for organizations that had implantables and pumps and other things of those natures. 35:01.890 --> 35:04.090 So... Don't hold back, Michael. 35:04.930 --> 35:06.670 It's DEF CON. 35:07.650 --> 35:17.350 So when I think about what we can do right now, I think about the current environment that we're in. 35:17.350 --> 35:23.990 And it touches on a little bit of what you've heard from others on this panel, actually. 35:23.990 --> 35:31.150 We're in an environment where I think most of our organizations, if you work in healthcare, we're distracted. 35:31.150 --> 35:32.850 Really distracted. 35:32.850 --> 35:36.770 If you're even just the general public, you're distracted. 35:36.770 --> 35:37.270 Okay? 35:37.270 --> 35:44.410 COVID has taken a lot of the focus away from other things like cybersecurity. 35:44.410 --> 35:56.910 If we're not careful in tying the story behind how cybersecurity is the underpinning to providing a resilient and thriving healthcare system. 35:57.030 --> 35:58.370 It's just essential. 35:58.370 --> 36:05.690 We can't have resilient and effective healthcare without securing it. 36:05.690 --> 36:07.790 They go hand in hand. 36:07.790 --> 36:21.690 And I say that because the other issue we're facing here is that most healthcare delivery organizations don't even have a single person dedicated to cybersecurity. 36:21.690 --> 36:31.810 And this is one of the findings of the Healthcare Industry Cybersecurity Task Force report that went to Congress in 2017. 36:32.130 --> 36:58.290 So there's not enough people working in this space we need to bring in more stakeholders from different backgrounds into the healthcare industry and into the cybersecurity industry to really... and even if it's not their title, but to build a community of practice around everyone's shared responsibilities around cybersecurity. 36:58.710 --> 37:22.610 And the last thing I'll say from the stuff that we can control as the cybersecurity professionals, I think especially Michael and Mitch and myself, we need to as healthcare and medical technology companies, as healthcare providers, we need to look at our investment in security and ask ourselves this, 37:22.610 --> 37:27.490 are we protecting what society values most? 37:27.490 --> 37:44.450 And if you ask anyone, what is important to protect in healthcare to protect, they will tell you most likely, even if it's my mom, all right, she will tell you, it's probably going to be patient safety, patient health, right? 37:44.450 --> 37:47.590 And probably also patient privacy. 37:48.510 --> 37:56.910 And so look at our investment today and figure out if there's changes that we need to take in our approach. 37:56.910 --> 38:09.390 And maybe touching on Florence's idea there to make it even more tangible around creating some sort of model for identity management in healthcare, you don't have to go too far. 38:09.390 --> 38:17.890 I mean, for many years, the cybersecurity industry has been talking about what's called zero trust principles. 38:18.330 --> 38:32.970 And so the idea behind zero trust principles are instead of trusting devices inside the network, you know, in this approach, it means trusting no one by default and operating as though the network had already been compromised. 38:33.230 --> 38:40.210 And so this means incorporating different types of criteria for authenticating and authorizing users. 38:40.210 --> 38:43.110 And the fundamental technologies exist today. 38:43.110 --> 38:50.450 It's just changing your strategy as a cybersecurity professional to focus on the idea that you've already been compromised. 38:50.450 --> 39:00.290 And how do we strengthen authentication through multi-factor authentication, through conditional access for devices and users connecting to the network? 39:00.950 --> 39:03.350 And so those types of technologies exist today. 39:03.350 --> 39:08.890 There is hope in, again, what's available to cybersecurity professionals today. 39:08.890 --> 39:13.390 But I would also go back and say, we need to expand our community of practice. 39:13.630 --> 39:20.430 So if we get all geeky-weeky, which we could do with each other, fire this and HL7 that, and we're so cool, you know, trust zone and hardware. 39:20.490 --> 39:26.530 I got upgraded for free one day on a plane when I was flying planes. 39:26.650 --> 39:29.450 And I was sitting next to a guy who runs a hospital, a doctor. 39:29.470 --> 39:30.730 And I was telling him what we're doing. 39:30.730 --> 39:31.750 He said, well, you know what? 39:31.750 --> 39:35.790 I'm glad you're working on that because my job is to keep that patient on the table alive. 39:36.310 --> 39:38.110 That's what I focus on all day. 39:38.770 --> 39:50.890 So in our working group, 2933 working group, actually it's all about, we always talk about it, protecting the humans, keeping the humans alive. 39:50.890 --> 39:52.730 That's why we're doing this. 39:52.810 --> 39:56.210 That's exactly why, you know, my background, my mother died the day I was born. 39:56.210 --> 39:58.450 It was a medical error, you know, whole stuff here. 39:58.450 --> 40:00.090 So I carry this with me. 40:00.090 --> 40:01.970 How do you keep the humans alive? 40:01.970 --> 40:03.330 And that's what we're focused on. 40:03.330 --> 40:08.810 And if you actually read our project authorization request at IEEE, it says to improve health outcomes. 40:08.810 --> 40:11.070 We're not doing this for us geeky weekies. 40:11.070 --> 40:14.670 We're doing it to improve health outcomes and to keep the humans alive. 40:14.750 --> 40:27.110 And eventually what I would love to see, and we actually had a meeting at my last firm and with Microsoft a few years ago, we were talking about creating like a cybersecurity learning hub for humans, you know, normal people. 40:27.110 --> 40:28.870 And we said, oh, cradle to grave. 40:28.870 --> 40:29.990 And we said, oh, that's kind of rude. 40:29.990 --> 40:32.150 Let's say pre-K to AARP. 40:32.150 --> 40:35.430 And we're going to teach them what TIPS is. 40:35.430 --> 40:38.450 You know, so when I was a little girl, remember I'm a geek, I was a rocket scientist. 40:38.450 --> 40:42.630 So I used to look for the little UL tag on my, on my electric cords. 40:42.630 --> 40:43.490 Any of you guys? 40:43.490 --> 40:44.010 I did. 40:44.010 --> 40:47.090 I always look for them because that meant safety, right? 40:47.350 --> 40:51.690 And so what we want to do is teach them why they should ask for this. 40:51.690 --> 40:58.870 So someday, I don't know if it's two, three or five years from now, some little five-year-old is going to be at the doctor and they're going to try to give her an insulin pump. 40:58.870 --> 41:01.490 And she's going to say, does that have TIPS? 41:01.930 --> 41:04.530 And she doesn't need to know what it stands for. 41:04.530 --> 41:05.350 We do. 41:05.350 --> 41:06.390 We're the geeks. 41:06.390 --> 41:10.770 We need to understand that it's trust and identity and federated identity management. 41:10.770 --> 41:20.890 And when the doctor, you know, goes into the little device next to grandma's bed that goes into her implanted pacemaker, you check the credentials of that doctor every single time. 41:21.110 --> 41:25.290 You make sure they're still, you know, related to whatever their provider is. 41:25.290 --> 41:27.670 You make sure they still are credentialed. 41:27.670 --> 41:31.170 You make sure it's really the doctor and you have to figure out how to do it. 41:31.230 --> 41:36.670 So that's our vision is that we really want this to protect the humans and make the humans aware of it. 41:36.670 --> 41:50.170 Just like I looked for that little UL tag, which not everybody did, I know, but you know, how do we teach them and then make sure that the manufacturers are delivering that because then you have demand, you have push and pull from the citizens, from the patients, 41:50.170 --> 41:50.790 right? 41:50.790 --> 41:53.650 And then the providers and the payers should care about this. 41:53.650 --> 41:55.350 It reduces their liability. 41:55.350 --> 42:01.710 You know, I used to work on smart buildings years ago when we were first creating a smart building strategy when I was a VP at IBM. 42:02.170 --> 42:08.290 And I remember, you know, we were talking to these building management system companies and one of them said, oh, you know what? 42:08.390 --> 42:11.970 Security is like number 11 on my list of top 10 things to worry about. 42:11.970 --> 42:15.750 And their device was hacked nine months later and the whole leadership team was out. 42:15.990 --> 42:18.770 And now it's part of their brand promise. 42:18.770 --> 42:20.210 Oh, imagine that, right? 42:20.250 --> 42:23.070 So we need to make that a requirement. 42:23.070 --> 42:30.430 You know, we need people to be incented to do that and to have the citizens and patients asking for it. 42:31.650 --> 42:33.030 Absolutely, Florence. 42:33.030 --> 42:51.990 And also one other thing that my organization's had a big challenge with has also been privacy because one of the areas we've got to worry about is not only do we have, we're collecting all this data on people and we have numerous data points on all the people we're collecting from these devices. 42:51.990 --> 42:54.670 And we need to make sure that we're protecting that. 42:54.670 --> 42:58.930 So important question I have here is what about privacy? 42:59.570 --> 43:01.910 How are we incorporating this into our products? 43:01.910 --> 43:04.830 How are we incorporating it into our data governance plans? 43:04.870 --> 43:10.770 So to lead off here, I believe this is going to be our final question for the three of you. 43:11.130 --> 43:14.170 So start off with Michael. 43:14.710 --> 43:15.230 Sure. 43:15.230 --> 43:39.070 I think that the, you know, privacy takes on, you know, from a legal perspective, you want to understand, you know, the requirements by the different geographies, by the different jurisdictions, by, you know, what the hospitals and, you know, the different entities have in terms of managing that type of information. 43:39.070 --> 43:45.010 But to me, Mitch, it's nothing more than another component of your requirements. 43:45.150 --> 44:03.110 So if you design privacy as you would security by design in your development process, you take into account what are those sets of requirements and you have to harmonize for, you know, some of us, you know, like, you know, Rob and I and others out there that deal in multi, 44:03.110 --> 44:13.130 you know, geographies, you know, multi types of regulatory and compliance environments, and you have to develop what your baseline is. 44:13.130 --> 44:27.530 And then once you develop that baseline, and you include those sets of requirements, I would look at the steward of, you know, the CISOs, you know, and it's three of us on the call to be able to make sure that we're executing against that. 44:27.530 --> 44:45.250 We go to our legal teams and the privacy organization, really for that foundation to make sure that we're interpreting those requirements, and we're executing those requirements, you know, effectively with the tools and the solutions that we then deploy out in the marketplace. 44:45.490 --> 44:57.530 And so I have always had, you know, kind of a mix of the privacy and the data protection elements kind of be able to be co-mingled within, you know, the team. 44:57.690 --> 45:13.530 Operationally, if you do it right, you want the CISO side of the house to be managing that, and you want your legal and your compliance arms to be able to help you develop and, you know, and document what those requirements need to be, you know, from a privacy perspective, 45:13.530 --> 45:14.650 in my opinion. 45:18.280 --> 45:24.400 So I got to tell you, I don't think I could describe it any better than Michael, or I should say Professor McNeil. 45:27.980 --> 45:32.280 It's so well said, really, I can't do better than that. 45:32.280 --> 45:40.000 I mean, you know, to address privacy requirements alongside security requirements, I absolutely agree. 45:40.000 --> 45:45.400 As security professionals, like, you know, bring your privacy friends along with you. 45:45.800 --> 45:55.880 And absolutely right that, you know, there's things that, you know, we think of in security that sometimes are counterintuitive to privacy. 45:55.880 --> 46:15.180 And then also, again, what Michael said around, you know, treating, bringing your legal professionals, especially, you know, when you're addressing privacy requirements, the complexity is, as he mentioned, this is different across every single country. 46:15.480 --> 46:29.860 And you do have to, you know, establish as a company, a common foundation, based off of values, based off of values and principles, you know, as a company, what do we stand for? 46:29.860 --> 46:38.220 What is it that we want to do when it comes to this huge civil rights issue, you know, of privacy? 46:39.020 --> 46:54.860 And sometimes that means we want to do everything that we can, and we are going to establish, you know, the strictest, you know, governance of privacy across all of our technologies and product platforms, you know, that is, again, a decision that companies need to make. 46:54.940 --> 47:09.200 And I got to tell you, I don't think there's many customers that would complain, you know, about a company creating a position and a very robust and comprehensive position on privacy across their different technologies for customers. 47:10.180 --> 47:11.680 So... Agreed. 47:11.680 --> 47:13.120 So I'll make a couple of comments. 47:13.120 --> 47:13.740 I'm sorry, Mitch. 47:13.740 --> 47:14.520 I couldn't agree more with you. 47:14.520 --> 47:15.360 So what do you think? 47:17.140 --> 47:19.360 Oh, you know, Mia, I always think something. 47:19.360 --> 47:20.680 So there are a couple of things. 47:20.900 --> 47:28.320 One is on the privacy side, it's one of our subgroups, it's part of TIPS, you know, Trust, Identity, Privacy, right in the middle, Protection, Safety, and Security. 47:28.320 --> 47:37.220 And we have a woman from the European Union who's leading that subgroup, which is great, because she actually found the privacy rules by country in Europe. 47:37.940 --> 47:39.400 Not surprising, right? 47:39.400 --> 47:50.740 So what we're doing is making sure that we're going deep on those, identifying the patterns, and then figuring out what are the little things we have to worry about here if we're creating a standard that's international. 47:50.900 --> 47:57.120 So if I'm wearing an implanted device, I'm in the U.S., I'm in the U.K., I'm in Russia, I'm in China, I'm in South Africa, am I going to be safe? 47:57.120 --> 47:58.500 You know, is my data going to be private? 47:58.500 --> 47:59.460 What does that mean? 47:59.460 --> 48:00.600 What are the implications? 48:00.720 --> 48:04.020 So we're already baking that in to the plan. 48:04.240 --> 48:11.680 The other thing is that I was at an event at my alma mater at Princeton, and Sonia Sotomayor was there. 48:11.740 --> 48:13.360 She's a Supreme Court Justice in the U.S. 48:13.360 --> 48:14.540 for those of you who don't know her. 48:14.540 --> 48:15.320 She's brilliant. 48:15.700 --> 48:21.400 And so I asked her, what do you think about privacy and security and the Internet of Things, all these devices all over the place? 48:21.400 --> 48:22.740 I said, I'm working on security. 48:22.740 --> 48:29.640 She said, that's good because I'm working on privacy because I don't think the citizens realize the human rights that they're giving up. 48:30.000 --> 48:31.260 Very interesting. 48:31.320 --> 48:35.760 So she's on it, and she's already written a couple of things on it if you want to look at what she's done. 48:36.220 --> 48:41.300 And then the other thing I just want to mention very quickly, we were talking about, you know, what's our goal here? 48:41.300 --> 48:52.000 I spoke at an event at Academic Medical Center Conference a few years ago, and then about a year or so ago, a gentleman reached out to me and said, oh, I wrote a book, and I found your presentation, and I referred to you in my book. 48:52.060 --> 48:53.640 I was like, oh, I'm so honored. 48:53.640 --> 48:54.920 What's the name of your book? 48:54.920 --> 48:57.180 The Doctor Will Kill You Now. 48:58.500 --> 49:09.900 And he talked about the security and privacy issues, and this guy who, like, you know, lives in his mother's basement and then moves to another state. 49:09.900 --> 49:25.540 It's not bad living in your mother's basement, I have that going on too, but moves to another state, fakes a PA license, gets into a doctor's office, gets into the system, actually turns off the power in the hospital so someone on event dies. 49:25.540 --> 49:32.200 Then he gets into somebody's personal medical record, changes his blood type, they're given a transfusion, and they die. 49:32.200 --> 49:35.640 And then his next target is a children's hospital. 49:36.320 --> 49:42.380 So if anybody is looking at, so why should I worry about this security and privacy stuff? 49:42.380 --> 49:43.480 That's a good book. 49:43.480 --> 49:44.780 It's only 15 bucks. 49:44.780 --> 49:51.400 And the guy who wrote it is an MD, and he used to lead the IEEE chapter in Rochester, New York, years ago. 49:51.400 --> 49:53.900 So he, you know, he's on both sides. 49:53.900 --> 50:00.020 He's an electrical engineer, computer scientist, more double and then he's also a doctor. 50:00.020 --> 50:01.680 So we all have to work on this. 50:01.680 --> 50:03.040 This is serious. 50:03.080 --> 50:04.900 It's just going to get worse. 50:05.220 --> 50:07.260 A lot more things are connected. 50:07.260 --> 50:09.360 There are attack surfaces all over the place. 50:09.360 --> 50:11.400 We need a defense in depth strategy. 50:11.740 --> 50:16.920 And it's for privacy and security and protection and safety. 50:21.830 --> 50:25.450 I'm impressed by the depth of knowledge everyone brings here. 50:25.450 --> 50:28.030 And I speak from the provider perspective here. 50:28.030 --> 50:32.750 I'm very happy to be working with you all, especially from the standards perspective as well. 50:32.750 --> 50:35.050 I think we have a good foundation. 50:35.270 --> 50:38.970 We just all need to continue to keep working together. 50:38.970 --> 50:46.010 And you have my commitment and for all of you in the medical device industry know you have my organization's commitment as well. 50:46.130 --> 50:49.290 So thank you so much for all taking the time today. 50:49.290 --> 50:55.190 This is incredibly appreciated and hope all of you out there appreciate this today as well. 50:55.190 --> 50:58.090 So thank you all so much for taking the time. 50:58.590 --> 51:00.430 And this is the group here signing off.