1
00:00:00,000 --> 00:00:10,560
Hi everyone, and welcome to How Do We Uniform November Foxtrot Uniform Charlie Kilo Unfuck Things.

2
00:00:11,880 --> 00:00:16,360
Can we really unfuck these things, or is it GARFU?

3
00:00:16,800 --> 00:00:24,120
And for those that don't know the military slang, this is... well, go Google it.

4
00:00:24,120 --> 00:00:26,020
It's more fun, right?

5
00:00:26,020 --> 00:00:28,060
I don't want to tell it all to you guys.

6
00:00:28,460 --> 00:00:30,020
Just go Google that.

7
00:00:31,100 --> 00:00:34,520
This talk is not your normal talk, right?

8
00:00:34,520 --> 00:00:36,280
This is an interpretive dance.

9
00:00:36,280 --> 00:00:42,440
This is me getting on my soapbox because I'm five foot nothing and tell you all the things that needs to be unfucked.

10
00:00:42,680 --> 00:00:44,560
This is my own opinion.

11
00:00:44,560 --> 00:00:46,020
This is no one else's opinion.

12
00:00:46,020 --> 00:00:47,700
This is conversations that have been had.

13
00:00:47,700 --> 00:00:49,360
This is observations that have been made.

14
00:00:49,360 --> 00:00:53,760
So if you're easily offended, this is not the talk for you.

15
00:00:53,760 --> 00:00:57,020
Scroll past, go do some other fluffy stuff.

16
00:00:57,520 --> 00:00:59,540
So who am I?

17
00:00:59,600 --> 00:01:02,100
I am a DEFCON goon.

18
00:01:02,100 --> 00:01:05,520
I'm the founder of DEC2751.

19
00:01:05,620 --> 00:01:11,880
We solely focus on reverse engineering medical devices and making things better.

20
00:01:12,040 --> 00:01:15,940
I'm also an avid biohacker village supporter.

21
00:01:15,940 --> 00:01:19,020
I think this is the best village at DEFCON.

22
00:01:19,020 --> 00:01:21,880
It's the one I certainly most enjoy.

23
00:01:22,000 --> 00:01:25,860
I'm also a current and independent researcher for Medtronic.

24
00:01:25,860 --> 00:01:32,060
And as you can see in the beautiful picture on the right, that is my Medtronic ICDR.

25
00:01:32,660 --> 00:01:37,620
It's what keeps me breathing and kicking and doing all the things.

26
00:01:37,820 --> 00:01:40,760
I'm also a DFIR lethal forensicator.

27
00:01:40,760 --> 00:01:43,940
I've been doing forensics and incident response for many, many years.

28
00:01:43,940 --> 00:01:48,200
Yes, I look very young, but I'm much older than I look.

29
00:01:48,440 --> 00:01:50,460
I'm a member of I Am The Calvary.

30
00:01:50,460 --> 00:01:54,320
I'm a patient and I proudly refer to myself as a cyborg.

31
00:01:55,920 --> 00:02:05,640
Now, I wanted to do a different talk this year because I believe that if we know what is wrong, we can find ways to fix them.

32
00:02:05,780 --> 00:02:09,540
So this is the talk for all medical device enthusiasts.

33
00:02:09,540 --> 00:02:14,550
Those that want to unfuck the things, those that want to fix it and make it better.

34
00:02:16,080 --> 00:02:20,360
So let's talk about the legacy of all problems, right?

35
00:02:20,360 --> 00:02:22,600
I sat down the day and I did the maths.

36
00:02:22,600 --> 00:02:29,140
In the US alone, there are 600,000 new implantable devices every year.

37
00:02:29,340 --> 00:02:34,300
These devices last for approximately a decade.

38
00:02:34,300 --> 00:02:44,420
So you start adding these up, we have a whole sea of devices that sooner or later will add to our technical debt.

39
00:02:45,220 --> 00:02:56,540
In a single hospital, if you put all the devices together within a hospital in the US, we'll have 10 to 15 million connected medical devices.

40
00:02:56,540 --> 00:03:00,880
That's about 10 to 15 connected devices per patient bed.

41
00:03:00,880 --> 00:03:06,340
To give you an example, I was in ICU because often than not, my heart's an asshole.

42
00:03:07,010 --> 00:03:11,000
And it lands me into ICU for some TLC, right?

43
00:03:11,000 --> 00:03:12,760
So I go have my holidays.

44
00:03:12,760 --> 00:03:23,060
If you look around, you have infusion pumps, you have monitors, you have external monitors monitoring your pacemaker or your ICD.

45
00:03:23,440 --> 00:03:25,900
And you have central stations.

46
00:03:25,960 --> 00:03:30,760
It is this big ocean of leaping lights.

47
00:03:30,840 --> 00:03:35,640
I know Jason Street always refers to it as a box with lengthy lights.

48
00:03:35,640 --> 00:03:39,060
Well, go be in an ICU bed, you'll see lots of those.

49
00:03:39,500 --> 00:03:49,060
So when we start realizing how many hospital beds there are, how many devices are attached to those beds, we start seeing the magnitude of the legacy.

50
00:03:49,300 --> 00:03:54,200
We see the ocean of devices we are faced to protect or to fix.

51
00:03:54,740 --> 00:04:00,720
Now, this is what led me down this path, is that I think we should start fixing the ship now.

52
00:04:00,720 --> 00:04:05,840
We can't wait for another year, can't wait for two, because we're adding to our problem.

53
00:04:07,380 --> 00:04:11,460
And now as we've seen COVID, healthcare has changed forever.

54
00:04:11,820 --> 00:04:15,720
The boundaries have been broken, the perimeters no longer exist.

55
00:04:17,900 --> 00:04:20,540
So you wonder why I say the legacy.

56
00:04:20,540 --> 00:04:24,640
Well, in case you did not know, most medical devices are coded in C.

57
00:04:25,180 --> 00:04:28,000
So I decided to do a dad joke.

58
00:04:30,490 --> 00:04:34,830
The question is, how are we getting it so wrong?

59
00:04:34,870 --> 00:04:38,330
And yeah, this someone said that someone was me.

60
00:04:39,050 --> 00:04:46,190
I want to know why in three years we've made no strides or why in three years we're doing the same things over and over.

61
00:04:47,230 --> 00:04:49,350
Well, let's start at the beginning.

62
00:04:49,490 --> 00:04:51,450
Lack of clear definitions.

63
00:04:51,710 --> 00:04:55,050
There's no consistencies in the terms that we use.

64
00:04:55,650 --> 00:05:10,690
I often go to talks and I realize, well, we're talking about medical device security, but the more that we are listening, I realize it is a Windows 10 endpoint within a healthcare establishment that we're talking about.

65
00:05:11,050 --> 00:05:16,930
Surely that's not the same as an insulin pump, an infusion pump, or even a pacemaker.

66
00:05:17,190 --> 00:05:19,770
Those things don't even look or act the same.

67
00:05:20,030 --> 00:05:24,590
So I decided to do what any good researcher does and I went to the dictionary.

68
00:05:24,590 --> 00:05:26,310
I looked up the terms.

69
00:05:26,870 --> 00:05:28,630
So let's explore healthcare.

70
00:05:29,430 --> 00:05:35,250
The field concerned with the maintenance and restoration of the health of the body and mind.

71
00:05:37,330 --> 00:05:41,530
It's hard, but this is what healthcare does.

72
00:05:41,530 --> 00:05:43,490
This is what hospitals do.

73
00:05:44,010 --> 00:05:51,510
So surely any device that they put there to help facilitate this should be called a healthcare device.

74
00:05:52,570 --> 00:06:00,710
So let's explore what is the meaning of medical relating to medicine or the practice of medicine.

75
00:06:01,130 --> 00:06:04,990
So it is something that allows us to practice medicine.

76
00:06:04,990 --> 00:06:08,090
Healthcare is something that we give to our patients.

77
00:06:08,830 --> 00:06:14,330
For me, I started to see the clear separation between the two.

78
00:06:14,530 --> 00:06:16,850
Each one has different responsibilities.

79
00:06:16,850 --> 00:06:18,770
Each one has a different function.

80
00:06:18,770 --> 00:06:23,090
It is very important that we start differentiating from the two.

81
00:06:23,750 --> 00:06:25,730
An interesting useless fact.

82
00:06:25,730 --> 00:06:29,210
Did you know that a cotton swab is seen as a medical device?

83
00:06:30,250 --> 00:06:33,490
Yes, that is for ICD-10 and billing purposes.

84
00:06:34,310 --> 00:06:36,350
I sure as hell don't think it's a device.

85
00:06:36,350 --> 00:06:37,970
I think it's a disposable.

86
00:06:38,010 --> 00:06:40,050
It's something we only use once.

87
00:06:40,730 --> 00:06:42,270
So let's see.

88
00:06:42,270 --> 00:06:43,970
What is a device?

89
00:06:43,990 --> 00:06:49,430
Something contrived for a specific purpose, usually a simple mechanical apparatus.

90
00:06:49,970 --> 00:06:57,250
Okay, so your insulin pump, your pacemaker, those are all a device, right?

91
00:06:57,790 --> 00:07:00,990
Well, now the question is, is it medical or is it healthcare?

92
00:07:01,030 --> 00:07:11,130
We need to start differentiating because each one of the two have different controls, different threats, different weaknesses and vulnerabilities.

93
00:07:11,390 --> 00:07:14,450
In fact, they have different operating systems.

94
00:07:14,450 --> 00:07:19,110
We need to clearly understand what we are dealing with.

95
00:07:19,950 --> 00:07:23,850
Now the question is, is it a healthcare or a medical device?

96
00:07:23,850 --> 00:07:25,970
Which button will you choose?

97
00:07:26,070 --> 00:07:28,010
Which one will you use?

98
00:07:28,430 --> 00:07:39,370
I get very confused because we're using the same terminology for everything because medical device sounds much more sexier than a healthcare endpoint or a healthcare device.

99
00:07:40,010 --> 00:07:52,690
But that leads me to the point that if we don't start defining these things out and understanding the ecosystem we are set to protect, we are setting ourselves up for a hiding.

100
00:07:52,810 --> 00:07:56,350
We are literally looking to be spanked.

101
00:07:59,450 --> 00:08:01,890
This is something that I'm living my life towards.

102
00:08:01,890 --> 00:08:07,670
When you talk, you are only repeating what you know, but when you listen, you learn something new.

103
00:08:07,890 --> 00:08:13,230
So I went on a year-long journey to understand what devices are telling me.

104
00:08:13,230 --> 00:08:17,370
I wanted to know what secrets they hold.

105
00:08:20,220 --> 00:08:26,300
Why things are so wrong is that we're not assigning responsibility accurately.

106
00:08:26,500 --> 00:08:34,840
I know it's a word that everyone fears because no one wants to be accountable or responsible for decisions or things they fault.

107
00:08:35,460 --> 00:08:41,100
So let's explore the MDM or the medical device manufacturer's responsibility.

108
00:08:41,300 --> 00:08:50,380
They have a responsibility to create devices that aren't unhackable because let's face it, nothing's unhackable.

109
00:08:50,380 --> 00:08:54,200
Everyone gets bored and someone figures out how to hack a device.

110
00:08:54,280 --> 00:09:02,320
But they need to have a device that is secure or as secure and safe as you can have it.

111
00:09:02,320 --> 00:09:08,460
But their responsibility is to deal with the devices both pre-market and post-market.

112
00:09:08,680 --> 00:09:15,900
Meaning that if a vulnerability is found pre-market, they need to fix it before going to market with the device.

113
00:09:15,900 --> 00:09:28,540
They need to do everything in their power to make sure what they are building, both on a firmware and a hardware level, takes into consideration the security challenges as well as the clinical features.

114
00:09:28,640 --> 00:09:34,120
Because let's face it, security is not a functional requirement for medical devices.

115
00:09:34,120 --> 00:09:37,080
They are there to offer medical care to patients.

116
00:09:38,000 --> 00:09:48,500
Often we see that security is slapped on after the fact, where it should be coming from design throughout manufacturing to when it goes to market.

117
00:09:49,180 --> 00:09:52,860
Now we have a fairly secure device that's gone to market.

118
00:09:52,960 --> 00:09:56,860
For example, an ICD lasts for 10 to 15 years.

119
00:09:56,860 --> 00:10:01,300
I can almost guarantee you that in that time, someone will find a vulnerability.

120
00:10:01,940 --> 00:10:04,500
Now we need to fix that vulnerability.

121
00:10:05,200 --> 00:10:14,760
The hospital or healthcare establishment has no power to fix the firmware or even fix the physical device if there's a vulnerability found.

122
00:10:14,800 --> 00:10:17,690
This remains the MDM's responsibility.

123
00:10:18,420 --> 00:10:25,660
Part of their responsibility is having a catalog or register of the information on everything that goes into their products.

124
00:10:25,760 --> 00:10:32,560
For every product they put on market, they have responsibility towards the end of the lifetime of that device.

125
00:10:33,380 --> 00:10:38,040
If it breaks, they are the only ones that have the power to fix it.

126
00:10:38,040 --> 00:10:39,280
No one else.

127
00:10:41,200 --> 00:10:44,780
Now we get to what is the FDA's responsibility?

128
00:10:45,560 --> 00:10:53,740
Well, I say the FDA because it's a US conference, but everyone follows suit of the FDA.

129
00:10:53,740 --> 00:11:04,820
If you start researching medical legislation around the world, you will see the terminology used by the FDA being rolled out in other countries, meaning they are the leader in this.

130
00:11:04,820 --> 00:11:07,220
They are the one that everyone looks up to.

131
00:11:07,720 --> 00:11:10,740
They need more legislative power.

132
00:11:10,740 --> 00:11:12,560
They need more teeth.

133
00:11:12,800 --> 00:11:18,280
They need to be an enforcer of what the standard is.

134
00:11:18,320 --> 00:11:22,300
They're the one that has to keep the MDM's on track.

135
00:11:22,420 --> 00:11:26,440
They are the ones that gatekeepers to the market for products.

136
00:11:26,440 --> 00:11:30,260
They are the ones that need to enforce the fixing of the problem.

137
00:11:31,220 --> 00:11:37,940
I know that they're currently working on new guidances, and I surely hope that it's got more teeth.

138
00:11:37,940 --> 00:11:44,960
An example of this is in the guidances currently at state, reasonable risk analysis needs to be done.

139
00:11:45,020 --> 00:11:52,580
However, the reasonable analysis that is required for it to meet the reasonable test is not specified.

140
00:11:53,400 --> 00:11:59,040
So again, we have guidances that don't have enough detail or standards out.

141
00:11:59,060 --> 00:12:11,640
I'm hoping that from a legislative point of view, we can actually start setting the tone of what is expected from a medical device, both on a clinical and both at a security level.

142
00:12:12,000 --> 00:12:14,440
And this is not just for implantables.

143
00:12:14,440 --> 00:12:22,480
I know it's a little bit harder when it's inside someone, but let's start categorizing it.

144
00:12:22,480 --> 00:12:27,080
Let's start standardizing the things and setting up the rules of engagement.

145
00:12:28,020 --> 00:12:30,300
What is expected of a device?

146
00:12:30,300 --> 00:12:34,360
How should it be used and how it should be updated?

147
00:12:34,520 --> 00:12:37,600
These are things that only can be done by the FDA.

148
00:12:38,020 --> 00:12:39,780
They are the rule setters.

149
00:12:39,780 --> 00:12:41,520
They are the rule enforcers.

150
00:12:41,520 --> 00:12:47,580
Let me look at what is the HDO's responsibility.

151
00:12:47,840 --> 00:12:51,880
Their responsibility is to keep their patients alive.

152
00:12:51,880 --> 00:13:14,240
Their responsibility is to have these diversities of devices on their networks, but they have to implement them in a safe way, taking into consideration the type of device it is, how it communicates, and how they are going to introduce it into their ecosystem.

153
00:13:14,600 --> 00:13:18,320
Those are the responsibilities of the HDO.

154
00:13:18,320 --> 00:13:27,040
They do not hold a responsibility for updating firmware or even vulnerability management of devices.

155
00:13:27,040 --> 00:13:30,200
That should be a manufacturing role.

156
00:13:30,720 --> 00:13:36,100
We've seen that during COVID-19, HDO's are crumbling globally.

157
00:13:36,100 --> 00:13:39,460
Healthcare is fracturing.

158
00:13:39,820 --> 00:13:45,980
And the fact is that they are designed, their purpose is to deal with pandemics and viruses.

159
00:13:46,240 --> 00:13:54,680
We are now expecting them to take on board cybersecurity and do the job of the manufacturer or do the job of the FDA.

160
00:13:55,280 --> 00:13:57,740
That is not what they're designed for.

161
00:13:57,800 --> 00:14:02,800
So how can we expect that they will not crumble and break even further?

162
00:14:02,820 --> 00:14:08,980
As a security researcher or a hacker, I don't want to be responsible for breaking healthcare more.

163
00:14:08,980 --> 00:14:11,620
I want to be responsible for making it better.

164
00:14:12,080 --> 00:14:19,080
So we should take into consideration that the decisions they make on a daily basis are life and death.

165
00:14:19,460 --> 00:14:22,040
They have patients connected to them.

166
00:14:22,040 --> 00:14:25,240
We shouldn't be making things harder for an HDO.

167
00:14:25,240 --> 00:14:30,020
We should be supporting them and making it safer for them to implement.

168
00:14:30,480 --> 00:14:36,500
The last thing I want is for someone to have a device breached and a patient to lose their life.

169
00:14:36,500 --> 00:14:39,760
It puts signs back tens of decades.

170
00:14:40,060 --> 00:14:44,700
And the fact of the matter is I would not be here without my device.

171
00:14:44,720 --> 00:14:47,020
I would be dead at the age of 19.

172
00:14:48,160 --> 00:14:52,740
It has extended my life and for that I'm grateful and thankful.

173
00:14:53,200 --> 00:15:00,500
So we cannot go forward and break things more until we have an understanding how we can build them up.

174
00:15:01,880 --> 00:15:15,700
Now the third problem is two worlds colliding, meaning we have this complex ecosystem that has different devices but we have one way of implementing them.

175
00:15:15,700 --> 00:15:24,900
We have a cookie cutter approach when it comes to infusing medical devices into a hospital because we don't define these out properly.

176
00:15:25,840 --> 00:15:31,260
Are we heading for a big bang or is it going to be a meeting of the minds?

177
00:15:32,260 --> 00:15:44,260
I think we are facing a situation where we're going to have a big bang because all we need to happen is for these controls to fail.

178
00:15:45,080 --> 00:15:57,600
And can you honestly tell me that you have the same controls for a Windows 10 machine versus a patient bedside monitor running something like BusyBox, VXWorks or proprietary software?

179
00:15:58,500 --> 00:16:00,240
Are these the same?

180
00:16:00,240 --> 00:16:01,520
Do they look the same?

181
00:16:01,520 --> 00:16:02,620
Do they sound the same?

182
00:16:02,620 --> 00:16:04,180
Do they crack the same?

183
00:16:04,180 --> 00:16:05,940
I don't think so.

184
00:16:05,940 --> 00:16:09,360
I think each one comes with different sets of challenges.

185
00:16:09,820 --> 00:16:19,360
I found that a hospital is the most complex sea of devices that I've ever seen and this is just me walking through a hospital.

186
00:16:19,480 --> 00:16:24,080
Have you ever noticed how many different manufacturers can be under one roof?

187
00:16:24,800 --> 00:16:30,400
Do you think that those devices are all made equally and the same?

188
00:16:30,400 --> 00:16:35,180
Do you think every manufacturer implies the same controls?

189
00:16:35,320 --> 00:16:37,740
Has the same way of thinking?

190
00:16:38,180 --> 00:16:42,540
No, everyone functions in a silo because there's no clear standard.

191
00:16:42,540 --> 00:16:50,580
The standards we are using are those for IoT devices or for regular computers or laptops or endpoints.

192
00:16:50,600 --> 00:16:55,820
There's no set of standards specifically catering to medical devices.

193
00:16:56,320 --> 00:17:02,280
And to be clear, when I say medical device, I mean that thing made by a manufacturer.

194
00:17:02,860 --> 00:17:05,560
Not a Windows 10 running software.

195
00:17:05,700 --> 00:17:07,740
That's a different conversation.

196
00:17:11,090 --> 00:17:16,510
Again, leading into this, it's the diversity of it all.

197
00:17:17,730 --> 00:17:29,250
Have you ever spent time in a hospital and just looked around and then think to yourself, I wonder how they've implemented this?

198
00:17:29,250 --> 00:17:32,770
A lot of hospitals will offer Wi-Fi.

199
00:17:33,590 --> 00:17:37,330
Those systems are often not segmented.

200
00:17:37,330 --> 00:17:41,610
There's the saying in security, trust but verify.

201
00:17:41,830 --> 00:17:42,670
Right?

202
00:17:42,670 --> 00:17:44,730
We just give everyone access.

203
00:17:44,730 --> 00:17:49,990
All the systems have access to everything because we want to make it easier.

204
00:17:51,430 --> 00:18:00,730
Now I ask you, if you look at this picture, most of those devices are connected onto the hospital network.

205
00:18:01,170 --> 00:18:04,910
These devices all have communications.

206
00:18:05,710 --> 00:18:12,710
But all these devices are most likely very different in how they apply security.

207
00:18:12,750 --> 00:18:20,790
And let me tell you, often we do this thing where security is an afterthought or a post-market situation.

208
00:18:20,790 --> 00:18:34,430
We don't give developers or hardware engineers the information to become security-minded developers, security-minded hardware engineers.

209
00:18:34,670 --> 00:18:40,670
Security can be built into every portion of your pipeline and should be.

210
00:18:40,670 --> 00:18:45,290
We should be taking this as a requirement to look at.

211
00:18:45,630 --> 00:18:49,650
I'm also big that one day these devices will be hacked.

212
00:18:49,650 --> 00:18:57,910
In fact, they might already be hacked because we don't have the data to pull from to say whether or not the device has been hacked.

213
00:18:58,490 --> 00:19:06,630
Always in incident response, we come after the fact and say, oh, if I only had logs, oh, if I only had this piece of evidence.

214
00:19:06,630 --> 00:19:13,410
We should be building in these controls to be able to visualize what's going on on the device.

215
00:19:13,690 --> 00:19:16,210
Now you might ask how I know this.

216
00:19:16,210 --> 00:19:20,410
Well, I have a whole room filled with medical devices.

217
00:19:20,490 --> 00:19:23,410
I have a whole library filled with firmware.

218
00:19:23,650 --> 00:19:26,310
I have been doing forensics for the last year.

219
00:19:26,310 --> 00:19:34,430
I'm trying to determine whether or not there's any logging or whether or not I even have the ability to do a forensic investigation.

220
00:19:34,430 --> 00:19:45,610
And I can tell you that no, because no one considers the fact that these devices will inevitably one day get reached if they have not already.

221
00:19:46,850 --> 00:19:53,650
A big thing that I want to see change is that we have proper standards and rigorous guidances.

222
00:19:54,030 --> 00:19:56,950
These things should be enforced.

223
00:19:56,950 --> 00:20:00,730
They should not be if you want to do the following.

224
00:20:01,080 --> 00:20:07,220
There should be repercussions for MDM not following standards and guidances.

225
00:20:08,310 --> 00:20:14,360
I have spent significant time looking at the NIST standards currently used for medical devices.

226
00:20:15,250 --> 00:20:24,500
These things are referencing machines that have Windows or Microsoft or different protocols.

227
00:20:24,500 --> 00:20:29,820
They don't take into consideration what a medical device is.

228
00:20:29,980 --> 00:20:32,040
I want to see controls.

229
00:20:32,140 --> 00:20:38,640
Controls are there for specific devices, but we need to categorize these first.

230
00:20:38,840 --> 00:20:50,720
And I think before we get ahead, the first and foremost thing that needs to change is the fact that we need to start understanding what a medical device is as well as subcategories of that device.

231
00:20:51,460 --> 00:20:57,800
I think once we have clearer understanding, we can have better standards.

232
00:20:58,040 --> 00:21:08,720
I would love to see a NIST standard specifically catering to medical devices, specifically taking into consideration the unique challenges they face.

233
00:21:12,040 --> 00:21:14,560
And how do I know these things?

234
00:21:15,440 --> 00:21:17,500
Data never lies.

235
00:21:17,600 --> 00:21:21,000
It's the one thing that you can listen to.

236
00:21:21,000 --> 00:21:28,260
Yes, data can be manipulated, but this is data that's collected over long periods of time.

237
00:21:29,040 --> 00:21:33,160
Healthcare has become the biggest target at the moment.

238
00:21:33,160 --> 00:21:39,920
Not only are they facing keeping people alive, they are facing attacks from all avenues.

239
00:21:40,340 --> 00:21:46,640
The internal threat or the malicious actor from within has certainly taken a rise.

240
00:21:46,640 --> 00:21:57,160
I was very shocked to learn the other day that 18% of healthcare workers stated that they would sell patient records for the right price.

241
00:21:57,460 --> 00:22:01,580
We never consider that the greatest threat might come from within.

242
00:22:04,130 --> 00:22:09,730
So now we've spoken a lot about the problems, but there is a saving grace.

243
00:22:09,730 --> 00:22:19,590
There's something that I really believe has the right approach to dealing with the complex problem that is medical devices within a hospital.

244
00:22:19,870 --> 00:22:22,750
It is called the Zero Trust Network.

245
00:22:23,530 --> 00:22:26,170
Trust is neither a zero nor a one.

246
00:22:26,850 --> 00:22:32,010
This turns the whole security on its head, where we no longer just trust but verify.

247
00:22:32,010 --> 00:22:34,210
We verify but never trust.

248
00:22:34,370 --> 00:22:40,010
We no longer have this perimeter-based defense structure that we used to have.

249
00:22:40,390 --> 00:22:59,840
I think most hospitals build this huge wall and make their perimeter hard, but never considering that patients walk in and out of a hospital wearing wearables with embedded devices or, you know, introducing medical devices that are connected.

250
00:23:00,590 --> 00:23:13,050
I've often seen that hospitals get breached via a phishing email or via a system that should not have access to the whole entire network.

251
00:23:13,610 --> 00:23:25,550
This is a very important thing for me, because this could lead to us defining that, you know, the least privilege and the least access that a device should have on a network.

252
00:23:25,750 --> 00:23:34,910
And especially with electronic healthcare records moving to the cloud, not every system needs to have access to that.

253
00:23:35,030 --> 00:23:40,510
We should be limiting what devices have access and how they have access.

254
00:23:40,850 --> 00:23:54,090
And I think one of the biggest things and the most promising things is if we find that a device is no longer conforming to the rules and the controls we've set up, you can revoke the access for that device.

255
00:23:55,190 --> 00:23:59,750
It breaks down the perimeter and makes it more secure.

256
00:23:59,750 --> 00:24:14,270
It makes it more manageable, because now we have the ability to differentiate between devices and we don't have to have a cookie-cutter approach to healthcare security.

257
00:24:15,630 --> 00:24:24,390
Another big thing I realized is us as researchers or the FDA or the MDM, we don't like to play nice together.

258
00:24:24,430 --> 00:24:29,550
We don't like to listen to someone that has a difference of opinion than we do.

259
00:24:30,130 --> 00:24:32,310
We don't like criticism.

260
00:24:32,430 --> 00:24:35,230
We don't like to debate situations.

261
00:24:35,250 --> 00:24:41,230
But the fact remains that working together is the only way that we get to solve healthcare.

262
00:24:41,230 --> 00:24:47,170
After all, it takes a village or even two for that to even happen.

263
00:24:48,150 --> 00:24:56,990
I think it's a smarter way to pull resources together and hit this problem from all sides.

264
00:24:56,990 --> 00:25:04,970
It needs to be a multidisciplinary approach to solving the problem that is healthcare and medical device security.

265
00:25:05,130 --> 00:25:07,910
So let's see some solutions.

266
00:25:07,970 --> 00:25:10,310
We need to define things better.

267
00:25:10,590 --> 00:25:15,410
We need to assign the responsibility and accountability to the parties involved.

268
00:25:16,190 --> 00:25:19,590
We need to not trust implicitly.

269
00:25:19,790 --> 00:25:26,830
We should not put devices into our networks and trust them with the keys to the kingdom.

270
00:25:27,010 --> 00:25:34,930
We should assume that a device is breached at all times, because most likely it is, because you don't know otherwise.

271
00:25:34,930 --> 00:25:40,330
At one point of time, we are gonna see medical devices breached.

272
00:25:40,670 --> 00:25:43,070
Well, they might already be.

273
00:25:43,530 --> 00:25:51,310
We need to standardize and set the tone, the rules of engagements, the rules that are expected from someone.

274
00:25:51,310 --> 00:25:53,830
And by someone, I mean the MDM.

275
00:25:54,130 --> 00:26:01,690
These things need to be defined and clarity needs to be given to what the expectation of a secure device is.

276
00:26:02,390 --> 00:26:05,990
I want to see these things on black and white.

277
00:26:05,990 --> 00:26:09,250
I don't want to have the conversation anymore.

278
00:26:09,350 --> 00:26:17,270
I want a call to action to make things better, to change it now before legacy comes and bites us in the ass.

279
00:26:17,910 --> 00:26:26,870
Because every year we wait, every year we take, it adds so much more to the problem.

280
00:26:27,430 --> 00:26:33,030
At one point, the problem will become unmanageable if we don't do something now.

281
00:26:33,830 --> 00:26:48,050
If you as a researcher find a vulnerability, do the proof of concept, reach out, make things better, but don't just find a problem, find a solution.

282
00:26:48,890 --> 00:26:59,210
Because finding problems are easy, breaking in is easy, but it's finding a way for things to work better that is going to change the world fundamentally.

283
00:26:59,210 --> 00:27:08,890
And it's not one person or two people, but a whole collective effort that will change the future of connected devices.

284
00:27:12,170 --> 00:27:16,270
Thank you very much and please feel free to reach out.

285
00:27:16,610 --> 00:27:21,750
Hit me up on Twitter, email me, go comment on my blog.

286
00:27:21,750 --> 00:27:25,810
But I'm looking forward to your questions and I'm looking forward to the discussion.

287
00:27:25,990 --> 00:27:34,110
And thank you for giving me an opportunity to get on my soapbox and for once be taught, shout in a room about things that are making me angry.