hello and welcome uh my name is rob
suarez and i'm the chief information
security officer
for bd
bd is one of the largest
global medical technology companies in
the world and
we're advancing the world of health by
improving
medical discovery
diagnostics and the delivery of care
including the fight against probate 19.
and a little bit about myself and my
background i've been
in in healthcare for
more than a decade and i started my
career actually in software engineering
and then r d
and moved my way into um medical vice
cybersecurity and product security
and um and in recent
years i've been leading cyber street
efforts again across
all of bd and enterprise iit and
manufacturing
and in our products as the the chief
information security officer
and so now fcd
we believe that there is a patient at
the end of everything we do and patients
don't always
have a say in what devices they're
connected to
each hospital room might have 10 to 15
different devices from multiple
manufacturers
in addition you know each of these
devices
very likely contain third-party software
components
and so here's what we
know about all software
it ages like the human body
and instead of aches and pains it
develops
vulnerabilities weaknesses that can be
exploited by cyber criminals
to gain access
to a computer system or to
you know various types of data but in
healthcare
we're not just protecting i.t systems
and data
we're protecting patients safety
and the stakes could not be higher
you know as as manufacturers we
integrate uh and we really need we need
to integrate cyber street into
everything
of our product life cycle
from r d
through supporting the product in use
and customer support
but that's not enough you know criminals
are working 24 7 to disrupt you know the
production and supply of medical
technology
the cause reaches and compromises the
patient information protected health
information
and to disrupt the clinical workflows
and the delivery of health care
it happens
every day and what you see on the news
like the ransomware attacks on
gasoline pipelines and distribution like
on meat manufacturing
you know it's just a small slice of the
cyber attacks that happen on a daily
basis
and you know with hackers working in
real time around the clock
we have to put
we have to up our game
and um and that's why we have to work
together as mobile device manufacturers
healthcare providers
industry regulators security researchers
and other stakeholders
and so now i'm oftentimes asked by
security professionals in other
industries is there any benefit
to participating
in ethical hacking events like the
biohacking village at defcon
and my answer is yes
the biohacking village at def con brings
medical device manufacturers and
security researchers together for one
purpose which is to strengthen medical
device cyber security
and this approach makes us stronger
really in what i see is three different
ways one is that it allows us to
crowdsource
uh cyber security
uh two is that uh you know it allows us
to create a strong community of practice
and three it really promotes ethical
coordinated vulnerability disclosures
so ethical hacking events allow you
to crowdsource
security
and events like the biohacking village
and the medical device lab at def con
you know bring together the security
community in a way that not many others
can
tapping into the goodwill of a large
group of security researchers now that
means accessing a broader set of skills
and expertise
and at bd you know we do our own
security research and vulnerability
assessment and threat modeling but we're
always asking ourselves
what are we not seeing
and as an organization we talk a lot
about having a growth mindset
viewing challenges as opportunities to
grow and improve
having the courage to iterate try new
things and embrace change
and if you've never participated in an
ethical hacking event
because you don't want weaknesses
or vulnerabilities to come to light then
you're missing out
we all need to put customers and
patients first
and what matters is uncovering
vulnerabilities and communicating these
acts the actions
to your customers you need to take
and and also participating in the
biohacking village can literally save
patient lives it's that impactful
so you know instead of shying away and
collaborating with security researchers
we need to build a strong community
practice
for advancing cybersecurity
the reality is that cyber attacks are
happening more frequently
every single year and in fact every
single day
and
you know around the world
many hostels
don't even have a single person
dedicated to
cyber security
which makes it hard to address
vulnerabilities that exist in mental
devices
we can help by creating a strong
community of practice
and i i encourage all of us in the
medical device community to make a
commitment
to be called to being collaborative
not just with our fellow medical device
manufacturers and their customers
but also last but not least
with security researchers
you know there's no
there's there's so much knowledge to
share
and and we work
with healthcare and medical technology
trade association around the world
and the information and expertise shared
helps us respond more effectively to
potential threats and vulnerabilities
and it also becomes a feedback loop that
helps us design
more secure and resilient products and
it allows us
to provide actionable guidance to our
customers and security researchers are
are absolutely a component you know to
to these practices
and to benefit
you we have
we have to really remember that new
cyber security threats
are emerging every single day
and there will always be more to learn
so it's not a matter of if you'll face
cybersecurity threats
but
it's a matter of when
and
defensive strategies are not enough
you know no system can be a hundred
percent protected
against any and all vulnerabilities so
that's why we need to work together to
build a strong community of practice
and events like the biohacking village
promote ethical
coordinated vulnerability disclosures
and and really support improving our
processes for
for doing volatility disclosures
it's time to take the stigma
out of vulnerability disclosures
every security researcher at the
biohacking village you know signs the
hippocratic host for hackers
and and they agree to the biohacking
village rules of engagement
and this includes a court of for
coordinated vulnerability disclosures
so it's important to note that the
discovery of a previously unknown
vulnerability needs to be addressed with
a sense of urgency and due diligence
fda guidance directs manufacturers to
disclose vulnerability notifications
within 30 days
and to remediate or provide compensating
controls within 60 days
and this allows time to confirm the
finding establish any potential clinical
impact if needed and identify
mitigations and compensating controls
that we value the relationship with
security researchers
and and so you know along the way you
make sure to communicate where you are
in this process with uh your
stakeholders including security
researchers
trust goes both ways and remember that
your shared goal is patient safety
it's also important to communicate with
your customers and patients about your
coordinated vulnerability disclosure
processes
when cyber security vulnerabilities
emerge
provide guidance so customers can manage
potential risk properly
and at bd
we do this by posting products through
bulletins and patches to our
cybersecurity trust center and our
website at bd.com
forward slash
cyber security
this is something that health care
providers and patients should expect
from every medical device manufacturer
and posting a vulnerability disclosure
doesn't mean your organization has a
cybersecurity problem
it means that you're enabling customers
to properly manage that through
awareness and through guidance
and coordinated disclosures in fact
a sign of maturity for an organization
so
collaboration and transparency
are essential
to advancing cyber security in health
care
and in health care cyber security isn't
just about protecting systems
it's about protecting patient
patient data patient privacy
and patient safety
events like the biohacking village allow
us to crowdsource cybersecurity
they allow us to build a community
practice
and develop and mature coordinated
vulnerability disclosure and in our
processes
as a result
we can make our systems
products and customers
and our patients more secure
hi i'm scott schindledecker chief
product security office for bd
i wanted to share my perspective on
participating in events like the
biohacking village
it's an exciting opportunity
especially for my team and if you're
looking to motivate your team
i highly recommend getting involved in
the biohacking
village medical device lab
it's a controlled environment
and provides an opportunity for my
security team
to create a partnership with our product
teams and rally around the event
in years past we've been able to
participate in person due to covid we're
participating remotely this year but
still a great event
one of the benefits is being able to
work with fellow medical device
manufacturers and security researchers
it's a lot like having external third
party independently assess
the product
and its internal security controls
we know our products
and we communicate
what we know with customers about how to
use them in a secure environment
but participating in an event like
biohacking village
gives us an opportunity to validate our
assumptions
it provides great feedback for
improvement
put simply it pushes us further on our
mission to control risk
we do our own pen testing and threat
modeling but this goes a step further
event like the biohacking village
really serves our customers
making our products and processes more
secure
so with that i want to turn it over to
anastasia tomorrow
we will tell you a bit about how events
like biohacking village can also help
improve coordinated disclosure processes
across the industry
hi i'm nastasia and i'm a director of
security operations at bd we focus on
security operations for our
manufacturing product and enterprise
environment and at bd our experience
with security researchers has really
been overwhelmingly positive events like
biohacking village really improve
communication between bb and other
device manufacturers
and security researchers and as a result
we're really able to participate in a
more consistent coordinated
vulnerability disclosure process
and what we talk a lot about is that our
customers can't protect what they don't
know and so when security researchers
provide cd and other device
manufacturers with research about
vulnerabilities it's an opportunity to
provide transparency and awareness for
our customers we're always actively
working on releasing vulnerabilities
it's really just something that's part
of the software life cycle and this is
really in alignment with making
information available to our customers
which really kind of shows our
commitment to manage reported
vulnerabilities so we launched our bd
cyber trust center last year in an
effort to increase that transparency and
that collaboration with both researchers
and customers we really want to make it
easy to connect with our teams their
forms on our website where security
researchers can go through and report a
vulnerability and then the biohacking
village allows us to have those
in-person touch bases and so this year
obviously we know there's a lot of
virtual sessions happening and even
virtually we're able to connect with
researchers so it really is um a good
experience overwhelmingly positive for
both cd and researchers alike to be able
to to connect and talk through our
process around coordinated vulnerability
disclosure