Sign Ohio Banking Medical History Now

Industry sign banking ohio medical history now

high medical devices are becoming more and more connected they're more connected to each other they're more connected to the hospitals networks they're more connected to patients smartphones and they're more connected to the Internet it's estimated that one out of every four medical devices is now connected if you were to go to the hospital today it's estimated that you would encounter 10 medical devices during your visit it's because of this increased connectedness of medical devices that hackers are starting to target medical devices now when I say hackers are targeting medical devices everyone always immediately jumps to the assumption that hackers are trying to hurt you through your medical devices so while I won't say it's not possible it actually is what I will say is in general there are easier ways to hurt people than through their medical device so take for example a pacemaker this is something that people often think of when they're thinking of a medical device harming someone if I wanted to change the configuration or the codes on your pacemaker I would have to stand right next to you I would have to hold specialized electronic equipment up to your chest for several minutes that's really not the type of thing you can do to someone without them noticing and it's it's not what we call a remote or scalable attack so it's not remote in the sense that an attacker can't do it from the comfort of their couch and it's not scalable because they can't use it to simultaneously hurt numerous people so attackers generally want remote and scalable attacks so for your average person this isn't a threat you need to worry about but that being said former Vice President Dick Cheney did have the wireless connectivity to his pacemaker disabled because for him it was potentially a realistic threat so if attackers aren't trying to hurt you through your medical device why are they attacking medical devices well it seems like every week we hear about some new cyber security breach that affects individuals we all heard about target the DMV and I'm sure there's a number of you in this room that those affected but what you may not know is that last year 67% of the identity records breached in the United States happened in healthcare today on the black market your credit card number is worth only about $2 where your electronic health record is worth anywhere from 10 to 20 so why the big difference well if you were to notice a fraudulent charge on your credit card today you could have the charge reversed the card closed and a new card in your hand in a matter of days it's really not that big of an inconvenience but your electronic health record that has not only your credit card number but your address your social security number your employer and your insurance information so with that kind of information I could use the credit card number but I could also open new credit cards in your name I could potentially take out a bank loan I could get high-priced narcotics on your medical insurance so how do you protect against that how do you change your name your address your employer well you can't and that's what makes that information so much more valuable so we've talked about hackers going after medical devices but there's actually another category of cyber harm that we see more commonly and it's accidental cyber harm a lot of cyber security is just making a system robust to the unknown or the unexpected malice is not always a prerequisite for harm so take for example something that happened earlier this year there was a medical device that's used in a heart procedure that became unresponsive and unusable mid heart procedure now later after investigation it was found that what happened was the antivirus software running on this system started to run mid heart procedure and in doing so it locked up access to data that the medical device needed in order to operate so the device became unresponsive but think about that antivirus softwares sole purpose for existence is to stop malicious things from happening on us so while that that antivirus was trying to stop something malicious from happening it accidentally did something malicious no malice intended now in this particular case the doctors were able to get the device back up and running while the patient was still sedated and finished the surgery but it's so easy to imagine how this could have gone so much worse or another example that happened last year a nurse plugged her cell phone into one of the USB ports on the front of an anesthesia machine trying to charge her phone when she did that the anesthesia machine shut down now I know you're thinking why would you plug your cell phone into an anesthesia machine we probably shouldn't do that and while I agree with you we've all been in those situations where our cell phone is about to die we either need to make a call or we're expecting one and you're looking around desperately trying to find somewhere to plug in to charge now that that nurse there was there was no malice there she was simply looking for somewhere to plug in her phone and in that case the anesthesia machine was not in use so nobody was harmed but again malice is not a prerequisite for harm that system was not robust to the unknown or the unexpected so Who am I and why am I here talking about this well my name is Stephanie I'm an ethical hacker and I'm here to help so what is an ethical hacker well ethical hackers are people who study hacking we practice hacking and then yes we hack stuff but only to test the defenses of that system and only in approve circumstances but what am i doing well my job is to work with medical product manufacturers to help them designed medical devices worthy of our trust the best way to make a system secure is to design it in from the beginning cyber security is not simply a feature we can add to a system it's actually an emergent property of a well designed system a lot of cyber security recall is making things robust to the unknown or the unexpected so take for example an inhaler system I've been working on this inhaler system has a Bluetooth connection to the patient smartphone so the patient can monitor how many doses they have remaining in their inhaler now that Bluetooth connection is a threat to that device an attacker could try to manipulate or steal information from you through that Bluetooth connection so a design time we said well we do have a need to send data out over Bluetooth but we don't really have a need to take any data back so we made the conscious decision at design-time to simply not accept any incoming data over bluetooth by doing that we made ourselves resilient to any known Bluetooth attacks and any future ones robust to the unknown or the unexpected but what if your past is on time so you have a physical device it's either a prototype device or a medical device that's already out in the field well then that's when we try to hack in we're going to try to hack into it see how can we get into it once we're into it what can we change what can I access what can I manipulate having an ethical hacker attack your device is a great way to test its defenses they're going to tell you what type of tax they tried what worked to offer you advice on how to make it better and they'll do it all in your safe circumstances when it's not hooked up to a patient and it's not hooked up to the hospital network so take take for example that anesthesia machine I talked about earlier that couldn't handle a cell phone connection that's the type of thing that could have come up in cyber security testing and then we would have made conscious decisions of what to do so maybe we would have decided there's really no need for us to accept cell phone connections and if we saw one we'd simply reject the connection or maybe we would have decided to gracefully handle it but we would have handled it in a manner that was safe now I don't want to leave you with the impression that connected medical devices are all doom and gloom the truth is connected medical devices allow us to provide a better quality of patient care if I were to suddenly have a need for unique surgery a surgical specialist halfway across the world could either assist in the procedure or perform it I'm in the hospital recovering the connected medical devices that are monitoring me are able to allow my caregivers to see a real-time picture of how I'm doing so if something starts to go wrong in my recovery they know right away when I'm out of the hospital my electronic health record can help look for potential drug interactions for prescriptions I'm a fill at different pharmacies connected medical devices like pacemakers allow someone who may have lived a very dependent life to now live an independent one that connected pacemaker can now potentially call for help if that patient becomes unresponsive think of a diabetic child who's able to go to her very first sleepover because she now has a connected insulin pump that allows her parents to remotely monitor her glucose levels and deliver insulin if she needs it I feel confident in saying that the benefit of connected medical devices outweighs the risks and myself and other ethical hackers are working really hard to make sure that the connected medical devices out there are worthy of our trust thank you