all right so thanks everyone for joining
our next talk the economics of cyber
security how market incentives fail to
protect users from cyber security
threats
uh but regulation can so we're going to
pivot a little bit a lot of the other
talks were a little bit more technical
here we're going to bring in some
economic concepts
to how we can hopefully solve some of
our cyber security
issues in health care
but first we'll introduce ourselves i am
a serious
business woman and not a cyber security
professional but i play one on tv
my background is in data science and i
have phd training
in econometrics economics and psychology
so i'll be playing the boring economist
on this talk
set and my name is matt mcmahon i've
worked for a couple different medical
device
manufacturers and i'm a professor in
healthcare and cyber security
and we just want to make sure that
everybody is aware the views on this
this talk are our own and not the views
of our employers
all right so we'll start off the talk
with just some kind of
high level notes uh about cyber security
and healthcare obviously
spy hiking village so we assume kind of
everyone's on the same page but
here's kind of three quick uh cartoons
or slides just
to lead off so the one on the left our
usual
colonoscopy equipment is down today so
we're going to use a tapeworm with a gop
gopro strapped to his head obviously
this is a joke but
you know in iomt you know there's a lot
of
we're using medical devices in many
cases for you know
sometimes for things that they're not
necessarily intended for uh that
that opens the door for some for some
cyber security issues
also the middle slide kind of talks to
that as well as the bonus feature you
can plug your iphone into your new pace
uh pacemaker to charge it
again while this is a joke you know if
you go
into a lot of hospital rooms today
you'll see
devices infusion pumps what have you
that have usb ports that you can plug in
an iphone and it will actually charge
and those do occasionally
bring down medical devices uh and then
the third point i see cyber risk
everywhere
you know it is easy to kind of go off
the deep end and just say you know
cyber security risks and health care are
everywhere
there's nothing that we can really do to
bring them down but i think most of us
that are in this talk
know that with some with some good
thought and
mitigations you can lower that risk to
hopefully a reasonable level so that's
what we'll be talking about here
today how we do that with economics
all right next slide
all right so a few key points again
we're not going to get too deep into
cyber security and health care because
we assume that most of you are working
in that space but
um you know we're all aware there's
millions of insecure devices out there
in operation uh with significantly
outdated
operating systems and we need to have a
little bit more investment
to protect patients as cyber security
risks grow
and the other point i'd like to
introduce here is that it's not a
technology problem
we know how to solve a lot of the
medical device cyber security risks
but we don't as an eating industry
or as an economy because the incentives
in the market are misaligned or they're
insufficient incentives
for manufacturers to invest in the
technological solutions that already
exist
and we'll set about to try to prove that
and show the solutions uh
and the rest of the talk all right so
most of us know the risk is increasing
it's not decreasing the number of legacy
devices
continues to increase unfortunately and
risks are growing
certainly we've seen with kovid the
number of cyber attacks
against the health care sector is
significantly increasing
not decreasing so the risk to broader
healthcare networks
which has a negative or has a potential
for a
adverse effect for patient safety
unfortunately is increasing
so just to give a little bit of
background and we're not going to go
through all these
examples again obviously most of us are
probably familiar with this but
you know wannacry obviously brought down
a significant number
of uk hospitals um completely brought
them down
um and then the the dusseldorf example
which many of us are familiar with
i was the first example where while a
couple wired articles have kind of
walked this
back it was believed to be the first
attack that had that
that directly led to uh patient fatality
but
again there's been some articles that
have kind of called into question if
that may be the case
matt do you want to talk a little bit
more about um the impact of cyber risks
specifically in health care like what's
at risk here it's
not just data privacy right yeah so
obviously certainly data privacy a
health record sells on the the dark web
for anywhere from 10 to 20 times
you know what a credit card record sells
for obviously you can't turn off a
health care record like you can a credit
card record
but also exactly patient safety
you know if if results are changed
doctors can make when doctors diagnose
based on those results
they could they could make a incorrect
diagnosis
prescribe a patient in incorrect
medication based on that
those incorrect results or if the device
simply isn't available
that could lead to patient injury or
even death
like with the case of stroke there's
there's a there's a quick time window or
turn around time
that doctors need to be able to see the
results of certain tests
to be able to then make specific uh
to to to then go and treat the patient
whether one way or the other based on
the results of those tests
and if they don't have those tests then
they're really without the information
that they need to be able to proceed
so that could really affect patient care
so it seems like it's clear that the
risks exist in healthcare
and shouldn't consumers of healthcare
and by consumers of healthcare we mean
hospitals like they're buying medical
devices
and individuals i'm buying my you know
medical device which is in my apple
watch
i'm buying uh probably my infusion pump
or i'm buying it through my insurance
my insulin pump rather so you'd think
that as a buyer
i would want to buy secure products
however the
economic theories we're going to
introduce are probably pretty familiar
to it's pretty obvious
but on a market level make huge impacts
on how
cyber security is or isn't incentivized
so first
information asymmetry consumers don't
know
what a secure product is they can't
necessarily assess
that product's quality for and you know
it's cyber hygiene
um they're unaware of how it
how much it could impact them though the
risk isn't present
and they don't know how to evaluate so
they just don't buy
cyber security there's a couple
exceptions with
hospitals like mayo clinic has been sort
of a standout star
in its cyber security acquisition
program um but
in the end if there's a new device that
improves patient care
and is better for health healthcare
overall
if it's a little insecure they're still
going to buy it
unfortunately it's kind of the way the
market is right now
they're not willing to pay a premium for
security if they can't if a consumer
can't
assess whether or not that security
really is embedded into the device
um another bit of psychological bias you
know we just think where
everything's gonna go well like we're
short-sighted that's what myopia is in
that middle column
um and then tragedy of the commons is
well
somebody's going to make sure things are
secure right we wouldn't put things on
the market that aren't
or that don't meet some securable
patchable
baseline and we look to the fda to do
that
but the fda is doing this for newly too
they need to innovate
we'll talk a little bit more about that
later um
so i hope you pardon me for the
theoretical aspects of the next bit of
the talk
but we're just kind of laying a
foundation of why economics matters for
cyber risk
on the other side why don't
manufacturers do this manufacturers
should just know that they need to
secure their product
it's healthcare after all however
any company is only going to invest to
the level of risk that exists
and if the risk is is to the patients
but the manufacturer doesn't feel the
risk
they're not going to invest it um so
this is the left column the
the those in charge of protecting a
system or reducing risk are not the ones
that suffer if it fall
fails so manufacturers are not
suffering if someone dies
as a result of a hospital being down
because we're not tracing
that risk back to an original
manufacturer um
it probably can't be done anyway they're
not suggesting that's the way it needs
to go
but the problem then is who bears the
risk it just becomes a public risk that
that unfortunately the patient's there
and we can't prevent
matt is there anything else on the slide
that you'd really want to give to this
audience
um i think you've covered most of the
salient points
cool all right so we'll move on
to bear with me
so just um this isn't necessarily in
health care
but we found a paper that showed that
chief information security officers
buy security products or buy security
solutions for two reasons
one perceived risk to the company we
just talked about the perceived risk to
the company not being high enough
for medical debates manufacturers and
two
compliance regulatory compliance they do
it because they have to
and just a quick question matt you've
got experience
inside and outside of medical device
manufacturers have you ever heard of a
company or an individual foregoing a
security best practice like
a risk assessment a robust risk
assessment or
maybe multi-factor authentication
something simple that you'd think
everybody should do
um versus uh instead investing in like
something clinical outcomes more
r d yeah i think
you know it's a there's a belief that as
a company
you know there's endless money to be
able to invest in in cyber security and
the truth is
there really isn't a lot of companies um
drive their business lines is kind of
independent businesses so there's really
limited overhead um and yeah certainly
if there's only a certain amount of
money to be able to invest in the
product and you're looking at you know
potential threat for a cyber security
risk
versus a feature that you know through
customer interactions a number of our
number of the customers have said hey we
really want this feature
you know sometimes it's hard to quantify
cyber security risk
if we don't have like an fda regulation
saying all right you need this or
a known customer requirement saying yes
we will not buy a device like
you had said mayo you know we will not
buy the device if it doesn't have these
say
19 cyber security features
so yeah it's certainly we definitely
have seen
in companies across the board i'm sure
that they're that they're
not implementing certain security
features uh due to this
all right so we've established that
consumers not good enough consumers to
be able to pick out
more secure products medical devices
manufacturers don't have enough
incentive
to get roi on uh security features
how to have other industries solved
similar problems um i think we have
about
10 minutes left matt get check me on on
that timing
yep looks about right sounds good
so we'll go through these relatively
quickly um
the banking industry had a similar
problem with atms
um specifically securing atms
and the market solution in europe and
america was different some european
countries
put the burden of assessing compliance
on the banks
while the u.s gave that power to
consumers through litigation
so if a consumer was defrauded in some
way they would litigate
um and they would get their money back
and banks
uh quickly reacted to that litigation
however with the with the bank sort of
self-regulating
um and assuming with the assumption
that they would reduce their own risk
for fraud um
they didn't solve the problem quickly
enough so it's an example of
giving litigation or regulatory power to
the consumers that bear the risk
kind of solves the the problem in and of
itself
the mortgage industry matt you want to
go through this slide
yeah so unfortunately many of us are
familiar with the the subprime mortgage
crisis but
um basically there was the inability to
uh anticipate the bubble
uh short of a few individuals uh which
um it was
mike michael lewis was the author that
uh that chronicled
those few individuals but um yeah
basically
with the risk we're undertaking with the
incorrect assumption that the conditions
would remain favorable we thought that
you know
mortgages were secure and it would you
know you could keep banking on that and
package it with other
um other financial services
um there was obviously large-scale
fallout millions of foreclosures
short sales yeah did did
you have anything on this shannon two
that you wanted to touch on
no just like that how can huge risk
exist
in a whole economy without somebody
recognizing it and reducing the burden
um we see that in healthcare right now
and it's
we have a very recent recent pretty huge
crisis
um example in our past
i'm going to skip the sterile injectable
but show it on the slide for a minute
just it's another example of how we
think
that the market should sufficiently
incentivize you know supply
of drugs but sometimes
if the company can't get enough roi the
the supply can fall
uh the analogy there being you'd think a
company would secure a product
um but if they can't get the roi
on the marketplace they might leave it
leave it
sort of poor cyber hygiene or or poor
securability in that product
so here's a list of how economists solve
these market incentive problems
anti-regulation is when a regulator has
certain requirements compliance
requirements
before something goes on the marketplace
and what's the analogy
here for the medical device industry
matt
um so yeah this would be essentially the
fda having basic requirements
we do see a number of requirements from
you know again the mayos and some of the
customers out there that
will specifically say we will not buy or
will not purchase medical devices unless
they have these requirements but
yeah an example of exante
anti-regulation
would be like say the fda had a list of
these requirements
yep and that's just for medical devices
that doesn't count the things that fda
doesn't regulate like electronic metal
medical records telehealth solutions
data storage formats etc
exposed liability is when you get in
trouble when you bear a risk
so you know this could be fda
enforcement but
unfortunately the problem there is
somebody has to die
before or or major problems have to
occur
before that liability can be traced back
to medical device manufacturer
or a healthcare product manufacturer and
it has to be a very clear cause and
effect
and unfortunately that's pretty tough
with cyber
information disclosure is another
regulatory trick
so arm consumers with more information
than the manufacturer would be naturally
willing to provide by requiring specific
disclosures and we'll
get into an example of that in a minute
actually just right now so
the ex-ante regulation that matt was
talking about as fda
post-market surveillance or pre-market
surveillance
fba does product benefit risk reviews
and cyber security risks would be
inside of that existing regulation
but you'd expect our regulator to have
just as many cyber security engineers as
they have biomedical engineers
but they're not quite that ready yet
fda is doing an incredible job moving
quickly and has been a
innovative regulator but more
resources would probably be valuable
um an ingredient list is a
is a required information disclosure for
food producers so is the software bill
of materials
for medical devices right now it's
actually voluntary but as soon enough it
will
likely become a mandated information
disclosure and that doesn't solve cyber
security problems in itself but it
solves the market inventive problems
suddenly there will be sort of
transparency
on for example whether or not medical
device components
are reliably patchable
matt you want to speak to some of it
what's going on in the health care
sector with respect to
um market incentives uh sure so
you know is a lot of us that are
involved with a number of the working
groups whether it's health care sector
coordinating council hisac
you know there's a number of initiatives
to try to uh you know bring to the
market
you know more of uh you know
more got at least guidance or
requirements um
whether it's fda health as i said health
care sect health care sector
coordinating council
h.i sac um csa
all of these organizations through
various working groups are doing work in
these sectors
then i'm going quickly but i know we're
tight on time as well
uh yeah it's just not enough um so the
the overall takeaway from this talk is
economics has a role in reducing cyber
risk specific for the healthcare
industry
and there's there's not enough going on
right now the market incentives of
with the current regulatory approach is
not is not sufficient to reduce risk
and the industry's not going to solve it
on its own um
matt you want to close us out sure
yeah so you know i think working in the
industry we keep kind of looking at the
same way we've always done it
in discussing this talk and some of the
other economic approaches to other
industries
i think it's it's nice to be able to
kind of take a step back and look at
other industries see what's worked for
them
um and see what's been you know proven
to work in those industries
um you know healthcare is a little bit
different in that we in
in shannon talked about we have the
different players so it's not like
say an apple watch or i buy the apple
watch and i assess it based on my
requirements but
you know we have medical device
manufacturers selling to
uh health delivery organizations that
are then preside providing services to
patients so there's there's a couple
different players and then regulators as
well so um you know we don't have the
clear incentives uh
everyone does isn't incentivized in the
same way all of those different players
uh to make
uh secure medical devices so um yeah we
just kind of wanted to
open up the discussion which will have a
question and answer soon we can kind of
talk a little bit in greater depth about
that but
yeah we just kind of wanted to present
the some other economic
possibilities for managing cyber
security risk
in health care
thanks