hi and welcome to our biohacking village
panel um my name is mike murray i'm the
founder and ceo of a company called
scope security but more importantly um i
wanted to pull this panel together
because i'm really excited to hear the
conversation that we have with all the
folks on the on the call and anybody
who's dealt with medical device security
over the last few years
has probably heard the varying opinions
that come from
uh alternate alternately the regulators
the medical device manufacturers and the
people who have to live with the
regulation and the medical devices the
hospitals themselves
and so i thought it would be really
great to put a panel together where we
could have folks from the fda
folks from the medical device
manufacturers who have to build medical
devices according to fda regulations and
folks from the hospital who have to take
the security patches and
um and apply them to the devices and
really get to the bottom of it you know
the fda has been long on record as
saying security patches don't require
fda approval and if you talk to the
device manufacturers they have a very
different story and if you talk to the
hospitals they hear both the fda and the
device manufacturers telling them
different things and they have to live
in this ambiguity and frankly live with
a risk that is hard to manage so we want
to get to the bottom of this so today we
have literally all three groups on the
phone and i'm not going to introduce the
illustrious panelists i'm going to let
each of them introduce themselves but
maybe we can start with the folks from
the fda afton did you want to start by
introducing yourself
thanks mike and thanks for giving us an
opportunity to participate in the panel
my name is afton ross and i'm a senior
special advisor for emerging initiatives
and fda's cdrh i'm had the opportunity
to work on quite a few cyber security
policy and collaborative initiatives
over the last few years so very happy to
be on the piano today
matthew
hi everyone i'm matt hazlett i'm the
cyber security policy analyst within the
office of product evaluation and quality
within cdrh so i work on cyber security
policy development and implementation
across the various review offices
and our medical device manufacturer
expert
i am tara larson i've been in medical
device security for going on 15 plus
years now so i i feel like i'm
well-versed enough to talk about this
challenge and how it impacts both sides
of the fence
and now from the hdo side of the world
and actually eric you're you you've
straddled both you've actually led some
regulatory style initiatives and worked
on some projects there and you're a cso
at a major health system so maybe you
want to start out sure so
uh i'll start off with the day job you
know the thing that
gives me bread for my butter
uh that would be on the ciso for
intermountain healthcare which is an
integrated delivery network uh located
in the mountain states so primarily in
utah salt lake city that's the home base
but surrounding areas in nevada idaho
and others
um my uh my pro bono work is what you
just described so i i am uh a couple of
things on the health sector coordinating
council i am an executive committee
member of the executive council there
and uh specifically within one of the
task groups that is organized under that
uh initiative i'm the co-lead for the
industry league for the 405 d initiative
45d is a
joint partnership with health and human
services i have a government counterpart
julie chua
we've been established for about
four years now produced a document
called hiccup the health industry cyber
security practices
which we talked about medical device
security in there and that was recently
recognized as a cyber security best
practice under a new law
public law 116 321 which ultimately
amends high tech and instructs the
office for civil rights to consider
recognized practices during any
enforcement actions so
long-winded way of kind of getting into
some policy stuff kind of getting into
some of the industry stuff but there's a
lot of work that i do on that side
great and last but not least sam
hi guys i'm dr samantha jocks i'm the
vice president for clinical engineering
at mclaren health we're a 15 hospital
system in michigan and in ohio and my
role is to maintain all the medical
devices throughout our entire integrated
system as well so
i too like eric work very closely with
the healthcare sector coordinating
council on their subgroup around legacy
medical devices and you know devices
that are no longer supported so
i appreciate mike you're you're pulling
all this all together and i'm ready to
get started
me too me too and so let's let's just
dive right in and at fda folks the the
first ones to you
what does it mean when the fda says
security patches do not require fda
approval
thanks mike for the question and i think
it's very timely question to start the
panel with i'm going to start and then
i'll turn to my colleague matt to add on
so first i think it's very important
that we emphasize that fda's approach is
really meant to benefit
public health and safety by trying to
incentivize incentivize manufacturers to
respond quickly to identify and address
cybersecurity concerns
we really think that doing so is in the
best interest of patient safety and
patients really are at the center of
everything that we do and i think both
the government and manufacturers can
agree with that
um fda requirements sometimes were put
forward as rationale for not addressing
a cybersecurity vulnerability and so we
thought it was very important that we
clearly articulate
that fd requirements should not be a
barrier for addressing cyber security
concerns and we do this in a bunch of
different ways certainly in talks like
this um but also on our webpage we have
a myth buster sheet
as well as in our guidance where we have
tried to incentivize um in our guidance
for manufacturers to again identify and
address
issues quickly um and i really try to
emphasize in this that fda does not
typically need to review
on the changes that are being made as a
result of a cyber security concern and
i'll turn to matt now let him talk a
little bit more about those policy
implications
sure thanks clapton
um so as she said typically if a change
is made solely to address the cyber
security concerns those typically don't
require an fda submission
we definitely want to make sure that
manufacturers are able to
address cybersecurity concerns quickly
and with
as little regulatory oversight as needed
that being said there definitely are
instances where a submission may be
required if there's a substantial change
to the system so if you're changing your
authentication protocol or if there's
something where
the change being made introduces other
potential safety breaks where fda would
be
concerned about what those risk could
impose on the patients that's where you
start getting into that area of fda
wanting to see that in a regulatory
pre-market submission
that being said um we also do encourage
that if manufacturers find themselves in
that type of situation to reach out to
us quickly as we definitely want to
facilitate those review processes when
they're there as quickly as possible to
ensure that
we're not the long hold out in terms of
the delay getting those patches we want
to work with you on trying to
get those released as quickly as
possible
tara you were smiling through that and
uh and i i think you knew i was going to
call on you next because i i think
especially a lot of our audience and a
lot of our audience has heard you know a
lot of those sorts of points before but
very few of them probably understand
what it's like on the inside of a
medical device manufacturer to try and
respond to this right and to try and be
on on that side of the fence maybe you
can tell that story
i just i'm not laughing at a disrespect
i promise i'm laughing because i'm like
oh this is so common um
i think the challenge obviously the
medical device manufacturers we would
love to just push a patch out but those
matches said it's not always that simple
um patches don't just patch an operating
system they manage services they manage
calls they manage medical device
functions they manage multiple different
things in that ecosystem so if we patch
something and we don't break and we
break it and we haven't tested it now
we've got a bigger problem so that's why
the timing is timeless is such a
challenge is we have to test we have to
validate only then when that process is
completed are we then able to say we
know this is just a straight up security
patch and that way we can follow the fda
guidance for patching directly
if that patch impacts more than just
cyber security though obviously we have
to go through the submission process
working with our counterparts at fda to
kind of say you know what is the balance
here what does the timeline look like
and work with them to do a submission or
not do a submission to drive it so the
process internally
to apply a simple patch is
awesome but it's never quite that simple
so then we get a lot of the feedback
from customers asking well how come i
just can't apply that patch well because
if you do and you break it we have to
work with the fda to understand what
happened and why that happened so that's
where people hear about recalls
happening it's not necessarily recalls
but it's more a matter of what broke
down and why didn't you catch it sooner
does that
sam how how does that play out on the
other side or eric whoever wants to jump
in i i don't have to i don't have to
moderate
everything whoever wants to jump in and
respond to that go for it so so i
appreciate afton because she has a
mythbusters kind of mentality that goes
on in the fda and i think one of the
things that people don't understand on
our side from the medical device side is
right the myth is that there's one
process for us to patch there's not one
process there's probably 15 different
processes that we have to follow and so
right if a vulnerability comes out right
we can follow either a proactive or a
reactive right stance if it's proactive
right and we know we have devices that
are affected by this obviously we'll
work with our mdm partners to try and
figure out when which is always our
question when am i going to get the
patch when is it going to be available
um but if it but if we don't necessarily
know that the the vulnerabilities were
part of some of the devices we have we
might end up in a reactive stance where
all of a sudden we'll just get a
security patch that pops up right on a
vendor portal or an email from a vendor
saying hey you need to implement this
that communication can sometimes be very
challenging right there's no standard
way for mdms and hdo's to communicate
which is very problematic in the
security world
and then after we actually know
something needs to be done how you go
about doing it is incredibly painful
right so
do my staff go out and physically touch
every device does the vendor have to
come out and we've got a schedule for
them to touch every device
patching in the medical device world is
not like patching your laptop where it
can sit in the in the dark room and hit
a button and via the network everything
goes out 99 of our patches you
physically have to touch every device we
have to patch it and so the simplicity
and the idea that patching is a panacea
solution from a security perspective is
just false
we can't patch everything we don't have
any uh ability to monitor and to
proactively go out and say all of this
stuff needs to be patched uh to go ahead
and reduce the risk we have so we just
end up juggling that risk the best we
can
yeah i totally begin to build on that
sam i think i think the reality that
you'll understand also is medical
devices aren't just in hospitals they're
in bodies their homes and until that
gets connected you can't apply that
patch so until and we don't have the
authority to say to somebody you have to
connect this system every day of your
life this is not our right so that's the
other challenge that people don't always
recognize
yeah so i'm going to jump in on this as
well and and
talk about maybe two challenges in this
space so
um
so first of all i i certainly respect
the
the progress that has been made over the
last several years both uh from the fda
providing you know very clear guidance
on uh what what we should be doing to
the mdm's coming to the table you know
and recognizing you know we've got to
solve for the problem and the hdo is
honestly stepping up and saying hey this
is part of our issue as well
uh you know
five seven years ago it was like a
knuckle fight you know drag out fight on
who's doing what who's responsible and
and everybody was pointing at everybody
else so it's gotten way better like
that's not happening anymore so that's
good
um there's some challenges
so you know sam just talked about the
operational issues i actually didn't
know how how hard it is on that side of
the house to actually get the patch in
um we you know i i want to sort of
from an hdo's perspective there's
obviously a lot of things that we need
to do to protect devices and
um you know at the end of the day the
patch is the thing that we want to get
in there to inoculate it's like the
vaccine you know so um we
we we will put other risk compensating
controls in place to make it work in a
in a temporal you know bridge type of
solution but we need an end state where
that the the final patch can get
deployed we don't want patches to cause
harm to the patients we don't want it to
you know disrupt the clinical
effectiveness of the device there's
obviously got to be quality control and
all that stuff has to happen
one of the challenges that we have today
um is
the the the signal for
uh the the vulnerable the criticality of
that patch is entirely driven by the
mdms
so if something if there's a new
vulnerability that pops out and you know
there's and it's bad you know maybe
there and there's my gosh there have
been so many bad ones this year i i just
can't i'm so surprised by it uh
especially like so many zero days within
microsoft and and so forth
uh you know the mdms will take this tara
maybe correct me if i'm wrong uh the
mdms will take this
conduct the risk analysis determine you
know uh pursuant to the fda post-market
guidance determine if the there's a
underlying critical effectiveness you
know issue
and if it deems if it's deemed as uh an
uncontrolled risk then they'll go
through their process of like emergency
off emergency processes
if it's a controlled risk it sort of
falls into a normal cycle now here's the
problem
the uncontrolled risk is specifically my
mind's eye is specifically designed
around can you tamper with the device to
have the device cause direct harm
the issue that we are facing within
hdo's is not so much the direct harm on
the device connected to the person as it
is the device is part of an ecosystem
that when it's weak breaks the entire
system and then suddenly we're unable to
care for our patients because that one
device that's over here in a corner that
was deemed as a controlled risk was used
as a beach head and you know blew
through everything
and so it's it we're not having the risk
conversation at the ecosystem level and
and the both post-market guidance isn't
you know driven that way
the mbms are you know are talking about
it again pursuant to the guidance
and um
and and then we're stuck with this sort
of quagmire of of vulnerability and the
answer is well just put a firewall in
front of it and you're fine and it's
like oh my god you know and oh by the
way us mdms we're going to use our
remote access tools and we're just going
to connect into that thing that you're
not even going to know about it and
we're going to manage it and so then
again go oh my gosh you know like how
how much stuff is happening in my
environment that i don't even have
visibility into control over
and what happens if it's in the middle
of an or when a surgery is going on and
you know and we're not controlling for
that so
um
yeah that's so that's that's my sort of
challenging statement and of reality
so i can i can build in a little bit i
think you know i think a lot of the
larger mdm's you know the bigger ones
not the smaller the big ones are really
really cognitive that fact and as they
do their csras they're really looking to
make sure they don't become that pivot
point into your network not not just
because patient harm they don't want the
reputational risk either um i know that
i've been pushing really hard to look at
the entire ecosystem and not just the
device itself so we're trying to help
i agree that putting a firewall in front
of it is a band-aid it doesn't actually
solve the problem it just pushes it down
the line longer so i think the way to
really solve that is as devices do more
of the csras they need to cyberkey risk
analysis they need to look at all the
way this ecosystem interfaces interact
with that device and then even if it's
not being used for patient care at that
point in time they need to make sure
that it's not being used as a way to get
to another patient and care on another
system and i think that's what the csas
are starting to really get to the bottom
of so i do see a lot of changes
happening there and i do think it's
going to get a lot better soon
so fda let me pull up that some more
sorry
i think as you see more connected
systems coming on board with the with
iot being everything you can't just say
it's a standalone device anymore nothing
is standalone anymore
everything connects to the ehr these
days pretty much right so um fda folks
i've noticed we've started to talk about
postmarket guidance eric brought up
controlled and uncontrolled risk there's
probably a lot of people in the audience
that don't actually understand the
post-market guidance or what what is
different about controlled and
uncontrolled risk and what even that
means and i i don't know if you guys
want to stop and explain and maybe talk
a little bit about how that has how that
has gone how that whole process has
played out
sure um so
largely when you're looking at
controlled and uncontrolled there are
kind of these terms that we introduced
in the post-market guidance to discuss
the way to characterize the residual
risk from the vulnerability so if you're
in
the controlled level you have an
acceptable level of residual risk with
the vulnerability existing in the system
and naturally with uncontrolled it's an
unacceptable residual risk so that
increases the priority in which
those issues should be addressed by the
manufacturer one of the common kind of
misconceptions that we've seen with the
implementation of the guidance is that
some manufacturers will classify
something as a controlled risk and they
view it as okay this never needs to be
addressed in my system ever um that's
not the intention of the guidance the
guidance is meant to address the
priority so it's expressing the urgency
with which a uncontrolled vulnerability
needs to be
um addressed um definitely with the
greater safety risk those
um risks should be handled faster but it
definitely is not intended to be a we're
in the controlled section this never
needs to be addressed and that
definitely points to
some of the discussions around the
larger system
and definitely from the direction the
fda's been going and how we're
addressing cyber security both in the
pre-market space and also in the
post-market space we're definitely
looking at the larger ecosystem
um and more and more of our interactions
so a lot of our messaging is around
looking at the ntn system looking at all
the different pieces that come into play
looking at those
remote support interfaces looking at
the connections to the network to the
cloud
services that are being used so we
definitely are
um
ramping up and increasing kind of our
cyber security considerations beyond
just the end device and really looking
at that system level approach
of how these different elements come to
impact those risks
so in the post market guidance there was
the 30 and 60 day time frames for
security assessment and and patch
delivery um
do you all believe that that's still an
appropriate time frame how did that how
is that working out in practice
and
you know start with the fda folks but
then i i really want to talk about what
that looks like on the inside of all
these organizations
yeah
so i can start so definitely from
the standpoint of the 30 day timeline
30 60 day timeline we know that there's
very few instances where these
criteria have been met to meet that
enforcement discretion barrier of not
issuing a recall
there's been a lot of maturity
developing over
the medical device sector since that
guidance went out i think when it came
out we knew that that was
a high bar but
trying to drive that evolution from the
ecosystem to better
message and also start
driving for movement from manufacturers
to give them a reason to start to move
faster put that um essentially an
incentive there to drive
um culture changes to be able to more
rapidly
respond and address cyber security
vulnerabilities as they come out so
definitely we acknowledge it hasn't been
hit much
there's definitely been
um significant strides in the sector to
drive in timelines and better approach
um being able to meet those thresholds
and definitely every vulnerability is
different you're not going um to address
every vulnerability in 60 days we know
that there's somewhere in order to
develop a patch and
be able to test and deploy it it's just
going to take longer with some of
these different types of systems if you
have an implant it's definitely a
different time frame than if you're a
software as a medical device application
existing on a mobile phone um so there's
different considerations there but i
think we're definitely
seeing a lot of movement in terms of
companies getting closer to that bar
but we definitely acknowledged that it
was a aggressive change from the status
quo when we released the guidance in
2016.
tara maybe you can give some shed some
light on and and i i'll i'll throw i'll
throw some color in of my own i remember
when we when i when that guidance came
out i was still at ge and
i
i will say that the 30-60 day thing
almost provoked laughter in uh some of
my colleagues because
you know when you get a vulnerability
report for a product that was developed
in 2008 and there's not anyone who's
written a piece a line of code on that
product in a decade
you know even finding someone who knows
what knows about the software can take
more than 30 days so i i'd love to hear
tara's experience on that same sort of
space yeah so um
so i think you know i was at a large
manufacturer when the first guidance
came out and there was definitely a lot
of what and again about this
um and it wasn't that it was impossible
but like you said there was there was
code that people hadn't looked at in 15
years because they had all retired so
the challenge was not only finding
finding someone who knew it but figuring
out what was actually going on the first
process if it was controlled or
uncontrolled or whatever was going to
happen i think you know fast forward 10
years from that point or whatever five
years we're out now but i think we're
starting to see that while 30 and 60
days is not easily attainable it has
opened up the conversation to where now
we actually have cyber security releases
planned in our development cycles we
never had that before so we are looking
at all of those vulnerabilities that
we're finding and scanning and you know
our penetration tests whatever else and
we're actually looking at all of that
finding ways to slot those in for
development fixes which is a huge
improvement i mean i'm sure ge when you
were there mike you remember
we didn't have that kind of r d didn't
think like that r d never considered
going back and touching an existing
product that was a sustaining initiative
and that was somebody else's problem so
that mindset my
shift has happened um most medical
manufacturers now have slotted plans
where every release is planned to either
bring in cyber security updates or
address legacy cyber security design so
that's happening is it going to happen
in 60 days i don't know about that you
know because then it comes down to
balancing the other product feature
needs so we're in that same conversation
of balancing all of the needs of that
feature set of products that you know
other customer asks all the things that
go into that and i think that is where
we're seeing the improvements but it's
going to be more realistically every six
months that will push out an update and
then you get into the whole marketing
side of who pays for that and how that
happens but that is not on my plate so i
mean yeah i think it's it's definitely
it's better it's getting better but 60
days is going to be very difficult to
meet
i can
go for it sorry so i'll be brief and
then maybe um
so something that i've done in my past
lives was uh embedded that 30 60 90 into
contract which is always an interesting
conversation when we got down with the
mdms so some of the mdms and there's
there's a lot you know so some of them
signed it you know and they're like yep
we'll do it no problem no questions
asked and the way that i did it by the
way was
stipulated uncontrolled risk you know
and then in that uncontrolled risk
category it's like straight out of the
fda you know post market guidance you do
this within 30 days you do this within
60.
um the more sophisticated mdms turned
around and said we're not actually
required to fix this within 60 days for
an uncontrolled risk
we'll recall
and and so i
responded back to that with you know say
say like a linear accelerator you know
like we build rooms around linear
accelerators like you're not recalling
that thing
you know so
but you know and it's
it's like okay
so that's fine but you're telling me now
then that you've got essentially uh as
much time as you possibly want
uh to work through this issue and what
am i doing in the meantime i'll just put
a firewall in front of it and and that's
the the mitigating control so
some vulnerabilities that's fine um i i
know this is
really old at this at this point in time
but
the
when wannacry happened many many years
ago um i was working with
all the mdms to try to get the patch
installed for for the underlying issue
there and none of the mdms deemed that
as an uncontrolled risk and
you know and i responded back with i'm
sorry this was like at the time the most
impactful cyber attack that the globe
has ever faced and you don't see that as
an uncontrolled risk so
you know so again still in a little bit
of this state of flux of you know like
what's the actual reality here and how
how we define it i will say though just
to be positive um you know the mdms have
actually done a really good job of
notifying and pushing patches and
notifying customers of this is something
that needs to happen because of you know
our own determinations of risk so they
haven't ignored the issue uh it's it's
really more of a precision point i think
at this point anyways sam
yeah so i'm gonna i agree with your
beginning points because that's exactly
what i was going to say right like you
know
i completely agree 100 but i'm going to
disagree with your last point because i
do think
the mdm ecosystem out there is very
different as you go from mdm to mdmdm
you know you have you have a true bell
curve there are ones that are out there
leading trying to get us to where we
need to be and truly partnering with
hdos to to you know sign agreements and
get us communication channels and figure
out how that goes and then you have mdms
that really haven't started that process
that tara talked about we still don't
have you know security as a forethought
we don't have security as part of design
and there's stuff rolling off the the
construction belt today that i'm
purchasing today where we have mdms that
still haven't haven't bought in they
haven't figured it out and we have to
deal with those just as well as we have
to deal with the ones that are ahead of
the curve and so you know the majority
of them i would tend to agree we're
moving in the right direction um you
know but but those of us in the hdo
world we've got to deal with all of it
not just one individual mdm and that can
be incredibly challenging when you're
trying to mitigate risk on an ecosystem
level
so i wanted to respond to one point from
eric and then one point from sam so the
first thing i just wanted to clarify is
that a recall does not necessarily mean
removal there are lots of different ways
that you can address a recall
and a lot of those actually involve the
product potentially staying right where
it is and having some other
fixes that don't necessitate it coming
out so i just want to make sure that one
point is clear and then with regard to
you know what sam you know is saying
about there being you know a bell curve
um a manufacturer's um with regard to
their maturity um this is part of the
reason why we have said from the very
beginning that we think that
collaboration is key here because there
are a lot of different maturity levels
in the various stakeholder groups that
we have from the mdm side from the
hospital side and that's why we think
collaborations um that have happened for
example under some of the different
healthcare sector coordinating council
efforts some of the work that eric
helped to
coach here and lead through the 405 d
and the other collaborative you know
workshops and things that are happening
it's very important for the ecosystem as
a whole to be engaged so that if you
have a little bit less experience you
can get some additional insights from
those who might have a little bit
greater maturity and i think that that
has been one of the benefits for our
sector part of the reason we have made
um such positive progress in a
relatively short amount of time is
because there has been a lot of
collaboration among those who have a
little bit more maturity trying to bring
along those who might not have as many
resources or as much awareness to try to
level the playing field a little bit but
certainly there's still um quite a bit
of work to do
maybe i could throw a a bit of a
fall into the air and see if it would be
caught
um so there was awesome work that was
done under the healthcare sector
coordinating council specifically around
uh product lifecycle and security
product lifecycle management of medical
devices the the joint security plan and
afton was a co-lead on that and we had
representation you know from hdos uh the
mdms and the fda
why can't that just be a requirement
like why do we have to fight
for that on that bell curve for those
who haven't adopted those who are
rejecting and look at that and say well
that's nice guidance
i'm not going to use the word guidance
because that means something very
specific in federal parlance that's a
nice idea you know uh but we're not you
know focused on that i find that
in some cases you just need you know the
rules to be set and and then that's and
that's where it goes so are we
is it is it possible no
no it is possible here's the challenge
and i'm just going to speak freely um so
mike left medical devices and went to go
start his own company and after that
everyone else left too we have a
resource problem um there's
i get calls constantly from those
smaller manufacturers asking if i can
come work for them or consult them or do
whatever else and obviously i can't
because of other issues but there's just
not enough people that do it and the
challenge is medical devices aren't
enterprise security and until you can
make that shift in your mind to
understand that you don't own where this
thing is going to live it's very hard to
design security in and people don't have
that skill set so it's it's a huge
challenge for the smaller manufacturers
but so that's why we have to use those
frameworks and all the other things that
we've done the last five years to help
them understand how to at least build it
without having dedicated cyber folks
they just don't have those people and
there's just not enough of them out
there um i think that there's a lot
happening in some of this and well at
least here in twin cities at the
university level to get more people
focusing on just medical device security
because it's such a huge challenge and
that's i think honestly what the problem
is going to be the resources
so
just i'm throwing a random question in
here because it's ultimately the hdos
who have to live with all of these
these levels of maturity like how how is
sam and eric how do you live with you
know i have one vendor that issues my
patches within 60 days and i have
another vendor who has decided that
there's no such thing as an uncontrolled
risk in their world unless the entire
machine explodes you know and and so i
never issue patches like
you all live with the insecure things on
your network every day what do you do
so
you know i think ultimately just like
the medical device manufacturers we have
to risk rank things right everything is
is a risk and you've got to figure out
what the highest risk is and that's what
we're going to truly focus on but right
in eric's perspective i agree with him
ultimately everything sits in an
ecosystem and i could argue the point
that even if i don't risk rank one
device high it's still an entry point to
my network and it can completely take
down our entire system and so you know
we struggle truly on a daily basis when
we look at risk to decide what we're
going to focus our resources on because
tara's right we don't have enough
resources as well on the hdo side um you
know we need to figure out what truly is
is the risk we're willing to accept and
i hate to tell you everything else falls
off the table right and we'll get to it
someday and we hope that there's not
going to be an issue and and we hope is
not a plan like we're all very aware
that hope is not a plan but we have no
other mechanism at this point besides
hope uh and so you know we'll do the
best we can and we have been for years
and everybody on this panel is correct
it's getting better it's better than
it's been in the last five years but
it's still not great i don't even know
if i'd call it good at this point
yeah so i'll plug uh hiccup here for a
second and then i'll talk about reality
um
so so hiccup um
practice nine uh is talked about medical
device security and you know you can
almost think about it as like hygiene
you know there are absolutely things
that we have to do within the hdos we
are we have accountability
uh you know network segmentation
changing default passwords
inventorying and you know having asset
you know components
understanding the vulnerability posture
of these things you know these are all
things that we need to do to do exactly
what sam just talked about
uh we have to treat medical devices as
part of an iot you know ecosystem you
know just like
you know we're concerned of the medical
devices is uh we're also concerned with
the cameras that are connected onto the
network and the building you know hvac
systems i mean you could think about it
this way you could break into a building
hvac system crank up the heat in an or
and suddenly boom you got a huge problem
uh on your hands
um
so so that's you know there there is a
pathway there is a statement you know a
document that you can pick up and and
follow
uh and and you should
uh the the challenge that we have is a
telemetry issue and an operational issue
so we
so there's so much of these devices that
are out there and and having visibility
into those in real time is a big problem
and it all starts with that inventory
uh and how accurate you can keep it in
real time through automation and sam i'm
sure knows hard
uh
so so there's that right you know and
you know cmms systems are very good at
you know helping with that and and
should be used
uh then it's a segmentation issue and
and this is where i'm gonna call it a an
operational challenge
it's it's a process problem so you have
things that should be segmented but
segmenting means that you need to like
actually understand flows and data paths
and all that in order for it to work or
you know sometimes things just magically
show up on a general access network
because lo and behold it's accessible
you know and so then you're playing this
game of like trying to understand where
it is where it's at and yank it out and
move it over and and these are
these are cat and mouse games you know
and it's and it's hard to play and you
need systems to be able to do that
so i mean there are tools that are out
there these days that um that do
discovery and and can help you sort of
understand placement
uh you have to have solid architecture
in the hdo to know like where your
segment zones are you got to have solid
education with your clinical engineering
folks your architecture folks and
everybody with your supply chain people
so as things are coming in you know you
know where they're going and how you're
how you're tying it together
and it's you know i'm gonna just call
this a standard process issue
uh you know you can set all the right
designs uh but you gotta you gotta apply
that scrutiny on this continually
otherwise entropy enters the system and
it just things just happen
so i'm going to switch gears a little
bit we've talked a lot about past and
we've talked a little bit a lot about
the present let's talk a little bit
about the future so fda folks there's a
new pre-market draft guidance that is on
the way at some point there's also the
recent executive order pushing the use
of s-bomb how how do you all see the
future of this and and especially those
two developments but anything else you
all are working on to to how is that
going to change the hdo experience how
is it also going to change the mdm
experience as as time goes forward
sure um i can start i'll probably start
with discussing the guidance and then
pivot to afton on some of the s-bomb
pieces
um in terms of the pre-market guidance
definitely there's been a lot of
discussion across the sector around
um getting the revised pre-market
guidance out we've indicated previously
that we'll be re-releasing it in draft
from a high level in terms of what
we're looking at in terms of
the guidance definitely clear messaging
in terms of cyber security is a part of
your safety and effectiveness evaluation
um that when you're looking at these
device risks safety and effectiveness
are the core of what fda's evaluation of
cyber security are
um
definitely looking at m10 connections
and the various use cases
of how cyber security risk can impact
the system um definitely threat modeling
and looking at the entire system for
identification of threats and
mitigations is definitely um central to
both how fda is approaching reviews
currently and also will be central to
um how we're looking at things moving
forward um i think kind of one of the
largest character
characterizations is
the current 2014 final guidance that's
out there is very high level it says
essentially you should be addressing
cyber security and your risk management
i'd say that this
next revision is definitely going into
far more detail around exactly what that
those documentation expectations are
exactly what those design considerations
are going to be
um if
uh you consider the
2014 guidance to be an x-ray of cyber
security this is the mri um we're
definitely getting into the details
getting into the nitty-gritty uh in
terms of how both cyber security fits
into design considerations but also how
it fits into the quality system
regulation compliance aspects
ashton do you want to take the f-bomb
piece
absolutely
and you're going to hear a similar i
think refrain with regard to some of the
things i'll say about you know s-bomb
here similar to how we worked in other
challenging areas um for medical device
cyber security um certainly have tried
to take collaborative approach here as
it relates to s-bomb um as well trying
to get feedback and insights from
various stakeholders by participating in
different collaborative
efforts
we recognize really very much the
criticality
of having an s-bomb because it helps
organizations understand
their cyber security risks and whether
or not they might be impacted and this
is critical to taking action if you
don't even understand
potentially what's in your what's in
your system what's in your network and
so we have been very much proponent um
of um s bomb and participated in a lot
of collaborative activities such as
ntias um trans software transparency
activities as it relates to the
healthcare concept um i think there have
been definitely some strides made as a
result of that because basically this
group said we're not going to sit here
and um debate all the house let's just
talk about what it needs to do and let's
actually you know pressure test it and
see what we get out of it i think that
really has helped to make a lot of
positive
progress because now we're not talking
about if we need s-bomb but we're
talking about actually how to do it how
to operationalize it um we also
on fda's side recognize that cyber
security bits are not
constrained to the u.s and that this is
an international cyber securities
international challenge so we've also
been working as a co-chair of the
international medical device regulators
regulators forum on a cyber security
work group that's actually working on a
work product related to
s-bomb as well as a best practice um
trying to get additional insights um out
to the global community as it relates to
that because we know it's easier
in particular for some of the larger
multinationals um to have some um
regulatory you know convergence on what
some of the at least some of the general
principles are
going forward and so we definitely think
you know s-bomb is one of those items
and then even thinking about you know
what's been happening you know
nationally um with some of the recent
executive orders that have come out such
as the one on improving on the nation's
cyber security which includes s-bomb as
a component i know that um that one is
very much you know focused um has one
component that's talking about how do
you enhance um the software supply chain
um security and um s-bomb certainly is
called out there and while this might
not be explicitly um you know directed
to an individual sector because it's
focused on um the government working
together the private sector as it
relates to government systems certainly
um as various parts of critical
infrastructure
are implicated here that this has um
downstream implications for other parts
of critical infrastructure um as well
and there can only be benefits for the
health sector as a whole if we all think
about um the power of an s-bomb and how
that can help us um increase our
maturity our response our risk
assessment and to better again protect
patients which is our all of our goals
so tara i i know
s-bomb especially has its own has uh
has some implications for medical device
manufacturers what what are your
thoughts
i have many you know uh s bond has
actually been a blessing and a disguise
and i say that kindly actually because
so
it forced medical device manufacturers
to really look at what they're using in
their design and force people to
simplify because if they started to have
to maintain the s-bomb for all of these
devices it got pretty big
um so for me i'm using it
in my future designs as a way to reduce
complexity to say you know what let's
only use stuff that we know has a good
supply shine behind it so we don't have
to manage more vendors um let's actually
use this to make our designs better so
that's what i'm using it for on the
other hand the the other side is oh my
god we found a lot of stuff out there
that has not been you know people use
open source software for everything and
that's been a challenge
because to help to the hdos when they
say you have to give us an s bomb it's
like okay you know so you're giving them
the zest bomb with open source software
in there and that you know hasn't been
touched in a long time and that's a lot
of uncomfortable conversations of how
you man do that so i think it's really
helped
open up our eyes as to what's actually
gone on in the past and in the cowboy
way if you will
and what are we going to do about in the
future to make it so that we actually
have less
intensive designs and less complexity in
our system so that we do know what's
actually in there so that when a
vulnerability does happen we can say 100
certainty that it is either controlled
or uncontrolled what never gonna do
about it that's the part of it um
personally what i would love to see from
my friends at the fda though is to get
this guidance out because the
uncertainty of everything going on is
giving design teams the ability to say
well we don't have that yet we don't
have that enforced yet so we need that
so that we can continue making the
progress to go forward
um because the s-bomb's in there and
they're like well no one said anything
we have to say yeah it's like yes it's
coming we know it's coming we know it's
going to be the mri if you will and we
need that because that detail's got to
be there again
so please hurry please
but that's just my two cents i mean
s-bomb is good and bad and there's a lot
of benefits to it and i fully support
doing it actually
i don't think there's anyone that wants
this guidance out faster than fda does i
am trust me i know man i know i'm sorry
anything i can do i am doing it let me
know if i can help
uh the hdo folks how do you plan to use
s-bomb i mean i i think i have a hunch
but let's let's hear what you're
thinking as far as some of this new
stuff that's coming out
so i can let eric go first because you
know my perspective is very operational
right i i want to see it because it's
going to be very helpful to us but i
also manage a ridiculous number of
manufacturers in a ridiculous number of
devices so i have truly operational
concerns about how i'm going to ingest
this information and actually mine it
for useful pieces of data um you know i
really want to start having some initial
conversations with cmdb and cmms vendors
right how are we going to make this easy
because at this point you know we're
going to get it and it's going to be
great when we first get it and then
we're going to have a stack of paper
this high trying to figure out okay well
again how am i going to risk rank right
when everybody gives me the same type of
information it's not going to be in the
same format it's not going to be you
know easily ingestible so you know i i
applaud all the work moving towards
right and s bomb because that's exactly
where we need to go um but we still have
work to do from an operational
perspective on actually making it very
useful for those of us in the hdo world
that's exactly where i'm at sam
so uh i i've seen some early iterations
of s-bombs that uh some of the leading
manufacturers have produced and that's
it's pretty cool you know seeing sort of
the format of it and the componentry of
it and we now have a massive data
problem
you know which is how does this all tie
i mean i i actually you know to a degree
think about it as like the passive
vulnerability scanners of old like
old nessus if you recall it did banner
grabs there was a database in the back
end it said you know these are the
vulnerabilities of this particular
system spits out a report and then you
go out and rationalize that you're like
oh now the banner was off or oh you know
that we didn't update that field sorry
you know and and so the reality of the
vulnerability was sort of in question at
times
i don't want to poo poo the the
initiative though i mean it is it is
absolutely the first step in unpacking
the problem but now we have a large data
problem that has to come at hand
and i agree with sam this is entirely
like an operational challenge so we need
a
a consistent way of bringing this in
from multiple sources
we need
uh
trust and fidelity of the data elements
itself to know that it's actually up to
date and accurate so whatever that cycle
is going to be that the mdms are going
to be producing this is it going to be
the same 30 60 90 patch cycle you know i
mean are you when when there's a new
component that happens does it
automatically push and come over or do
we have to wait a quarter or two you
know for that for that information so
there's a there's a lag sort of
challenge in inside of it
um
we all like i said at the beginning we
have issues just around inventory in the
first place you know so like tying into
the inventory and and and all of that uh
and
and then the telemetry associated to it
now there are um
there are products that are out there
that are already thinking about this you
know there's there's like the
the medical device specific iot
management devices that
are out there already trying to
understand the flows and and the
vulnerability status of those things and
those you know those
more forward-thinking companies are
looking at how to incorporate s-bomb
into the mix of all that and that's
exactly what you they should be doing
um you know
my perspective is i'm looking for a a
service or a product that's going to
manage all that work underneath it for
me because back to the
challenge of resources that we had
before if we have to put people on this
you know to pick apart all the data
inside of it
i don't know you know so
um
and then i'll say you know i i predict
putting my future lens in place that
we're going to come back to some of the
same challenges that we have today
which are the s-bomb is going to expose
a vulnerability and there's going to be
a disagreement about is that
vulnerability controlled or uncontrolled
and then we're going to be going back to
the manufacturers and having the same
conversation again we just have more
data you know at our hands which is good
we always should have more data uh and
and but we're gonna we have to work out
a a new process on sort of what that
means
all right we're coming up on time and i
want to i want to leave a couple minutes
for everyone to go around we're going to
go around and and i want you all to do
two things one
one or two sentences of the the point
you want to leave the audience with and
then more importantly where can the
audience find more of each of you
because i'm sure there are people who
are going to want to talk to you all on
social media or email or find you out in
the world and so um
we'll go around and maybe we can go in
uh
in a different order i'm just gonna go
sort of counterclockwise sam let's start
with you
yeah so probably the one thing to take
away from this is you know we've made
progress right i don't think any of us
on this panel can disagree with the fact
that it is a vastly different ecosystem
than it was five years ago but we still
have a long way to go and so i think
these types of talks getting the
information out there so that everybody
understands exactly where we are and
exactly where we want to go is the best
thing we can do at this point we need to
continue to communicate and collaborate
uh and we need to continue to make
things better and easier for all of us
uh in this entire ecosystem so thank you
mike for putting this together that's
awesome um you guys can find me uh i'm
at mclaren my first name samantha dot my
last name jocks at mclaren or i'm on
linkedin if you guys want to connect on
linkedin that's great
matt
sure um i'd say from my standpoint
definitely in terms of the sectors
getting better i'd say manufacturers are
doing significant culture changes that
continuing support to taurus point
earlier
was not really built into the business
model so companies have been doing a lot
in terms of changing their team
configurations to
support devices so that's definitely a
critical piece to getting patches out
quickly so where you've come a long way
but still have a ways to go
um and definitely i think in terms of
the broader ecosystem with the
threats that we're seeing with all of
the different attacks we've been seeing
in healthcare it's only going to be a
more critical process moving forward and
i think that the industry is going to
have to
continue to step up and make sure that
we're able to address these uh
vulnerabilities quickly to ensure that
patient safety is continued
in terms of finding me i'm on linkedin
or my
fda email
which is easily findable
because government employees
so either of those locations
sorry
yeah i mean so i think that the uh
the divide that we used to have five
years ago between manufacturers
fda and hdos has gotten a lot smaller
and not a moment too soon because as
moved to connective care and everything
that we do we've got to continue that
partnership i think our engineers
internally are much more advanced now as
understanding cyber security and they
definitely realize that they have to do
it and that's been huge i mean i
personally got to watch this journey and
believe me it's huge that those
engineers are now on board um i think
going forward that partnership and
engineering background is going to just
be going it's going to be necessary and
that's going to help people be able to
grow cyber security internally and not
have to have dedicated cybersecurity
resources for every team that's going to
be the way it goes forward
and if you want to find me i'm on
linkedin everyone knows where to find me
eric you're up
um
i would just uh encourage you to look at
the health industry cyber security
practices or hiccup
practice nine is the medical device
security state you know htos we have an
obligation here and and that is your
path if you haven't set a path yet
uh
if you you could find it by uh you know
google 405d hhs 405d it'll take you to
phe.gov and and the publication is
located there
um you can find me on linkedin that's
mostly where i'm located i have like the
tiniest of twitter presents i haven't
really gotten into twitter yet but i am
eric decker13 on twitter you'll see that
i have like five people following me
it's better to follow me on like that
and
the last word to afton
thanks mike
so i think that my last words are going
to really um focus on the whole reason
that we're all here that we all
recognize that medical device cyber
security really is a patient safety
issue and it's complex and challenging
which means that we need to continue
these
multi-party
multi-stakeholder collaborations
to bring forward the different
viewpoints so that we don't build tools
processes
or bring on people that are not going to
benefit what actually some of our key
challenges are
and so really want to make sure that
we're actually building solutions that
will be helpful in advancing us forward
and continue to accelerate on the pace
at which we are acting because the
threats continue to accelerate and so
we've got to try to match that pace as
much as we can and then um for me
certainly you can find
me at my fda address my my name at
fda.gov and then also we have a team
cybersecurity mailbox too that's staffed
by several um people cyber med
fda.hhs.gov
and that's also a good way to get in
touch with the team and certainly like
everyone else are on linkedin and i'm
like eric i haven't got to twitter yet
all right i'm gonna wrap this up and say
thank you again to all of you i know how
busy each and every one of you are doing
the work of of health care cyber
security so to take an hour to talk to
to me into this audience is incredible
and i thank you all again also let's
just shout out for a second how awesome
it is that this even exists
and the work that nina and all the folks
behind the biohacking village have put
in over the years you know 10 years ago
this would have been
this forum didn't even exist for us to
all come together and and for people to
even want to listen to us so
uh real shout out to to nina and the
work of of that whole team and and thank
you for having all of us and thank you
to the audience for showing up and
listening to us all so thanks again
everybody and
i'm sure we'll talk a lot more in the
future
thank you mike
thanks thank you enjoy the conference