Signature ODOC Made Easy

Signature odoc

all right thank you my name is Mike Kujawski I'm one of the cofounders of make crypts let's see nice very good so in 2014 I was a product manager at a medical device company talking to an administrator from the hospital and I will attempt to tell this story in a HIPAA compliant fashion this administrator was concerned about a nation state using a cybersecurity vulnerability any medical device in an attempt to assassinate a foreign dignitary that was a current patient and I said there's no way that's possible that's BS this is ridiculous and then I started to research the field of medical device cyber security and learned that at least at the time few if any medical devices had any cybersecurity features built in because the medical device vendors when they were building these products thought who's ever going to hack a medical device that's ridiculous right so we don't know if any hackers have actually heart physically harmed a patient using a cybersecurity vulnerability because these devices haven't been designed to detect intrusion yet but what we do know is that medical device vendors have spent more than hundreds of millions of dollars dealing with cybersecurity issues in the last five years and this is about to get a lot more expensive for them in the coming years so the first is the FDA released guidance documents last year asking medical device vendors to bake cybersecurity features into the design of devices this is something that is difficult for them to do is not their core competency and while cyber security vulnerabilities in medical devices have been reported as early as 2008 the number of cyber security alerts around medical devices has increased exponentially over the last six months in fact even the last three months it's been sort of sort of crazy in this area so a typical connected medical device will send data back and forth between itself in a clinical information system using some network protocol like Wi-Fi or Bluetooth and one of the problems becomes when there is a vulnerability in that communication protocol all of that data is out there in the clear and a hacker can either capture that data to do something bad financially with it or they can manipulate the data to make the device do something it shouldn't so one of the best ways to protect the data that these devices use is through the use of cryptography things like encryption and signature verification and medical device vendors could theoretically implement all of that on their own but it's a very time-consuming process it's complicated it's not a medical device vendors core competency and it's really easy to get wrong so med crypt makes it possible for a medical device vendor to secure their devices with a couple of lines of code in this particular example the instructions being sent to a CT scanner are being protected with encryption and signature verification and other things using five lines of code one of the biggest challenges that medical device vendors face on the cybersecurity front is their inability to patch their software in a timely fashion so recently a medical device vendor announced a vulnerability of one of their products and they assured their customers that the software would be patched quickly it turns out that quickly meant nine months and the medical device industry thought that this was a good turnaround time and I feel pretty strongly that if you can make a new human faster then you can go and stop at your software there's something wrong with your software development process one of the benefits of med Krypt is that you can patch many security vulnerabilities just by fixing the med crypt layer and incrementing medic rip from version 1.1 to 1.2 without touching any of the business logic of the medical device which decreases the testing requirements and makes it possible to release a patch in a couple of days instead of nine months finally when med crypt is baked into a medical device that device starts sending us usage data so we can look for anomalous behavior and proactively alert a medical device vendor to the fact that one of their devices is currently under attack and by the way that feature is something that the FDA has been asking medical device vendors to do and to date no medical device vendor has successfully done it internally estimates for the size of the medical device cybersecurity market currently range between 800 million and 2 billion it's projected to exceed 10 billion in 2022 and while our current focus is medical devices we see an opportunity to be the de facto cybersecurity technology in all of healthcare this is obviously a very large market that niche product requirements that are not being currently met by enterprise network security companies our founding team has backgrounds in medical device development software development and cryptography and we have previously founded and sold a healthcare IT company successfully our advisory board includes a chief information security officer from a major medical device company as well as a CSO from a major Health Network lots of cybersecurity experts feel that it's inevitable that we will see a patient die as a result of a cyber security vulnerability and a medical device and it made correct we're working to prove them wrong Thanks oh goodness I have lots of questions I guess the the first question would be how does FDA feel about this because a lot of times if you change anything on a medical device FDA isn't really happy so the FDA actually has the the opposite opinion about that when it comes to cybersecurity in fact they've put out many documents that say if you are updating your software specifically to address a cyber security vulnerability you do not need to resubmit and medical device vendors are using this perception that the FDA requires this long reapplication process if you update the software as an excuse to not fix cyber security vulnerabilities so the two people at the FDA most involved in their cybersecurity efforts spend all of their time dispelling that particular rumor Mike if if I may call this incorrectly but security as a service model for med device companies are you looking to capture other data coming out of these devices if you're already in there and you're doing a software-as-a-service eventually it's going to grow what other data can you be capturing yeah this is security data this is a good question so here's some things we don't want we don't want pH I if there's a cardiologist updating data on a pacemaker we don't want the patient's name we don't want the actual settings well what we do want to know is that a given pacemaker has received an update from a device with a serial number X at this time and just by looking at trends in that data we can spot a lot of anomalous behavior what we have found is when we tell medical device vendors about that Yusuke they say that's great can you also give us an API so we can throw some engineering data in there and you guys can get that and then you can feed that back to us and we say of course so one of our big barriers to entry started to preempt your question is the data that we're amassing about what these devices are actually doing and the the kind of data that we need to amass is actually relatively innocuous we don't need pH I we just need to know when the devices are functioning and and what those patterns look like Thanks can you go a little bit more into the sales process how you plan on bringing this out and you have to go talk with these medical device makers you have to convince them to add this line of code into their software firmware I'm not sure which one yeah but tell me a little bit more about your experiences with that and how is it that process is going yeah so when we first sat down to figure out how to best address this problem we thought we should make some software that can be bolted on to a device after it's been released and sell it to a hospital we found that that is not the right approach for a bunch of reasons number one as hospitals are reluctant to pay for this they just spent a million dollars on a CT scanner why should they spend an extra dollar securing the thing number two you're really limited in terms of the behavior you're really limited in terms of what you can change about the way a device functions after it's been approved without making a new medical device so we've we recognize that it's going to be longer sales cycle to go up up hill to the medical device vendors and if we get Medtronic as a customer on day zero it's a year before that device actually hits the market and that's one of our challenges is one of the challenges of our approach the good thing is number one we can actually make significant changes to the way the device functions to make it much more secure by working with the device vendor and number two is really sticky all right once our code is in a medical device and it's cleared it's going to be in there for 10 to 20 years which is another whole security issue in a whole other security issue of how long these devices are out there functioning so the sales process is harder on a marginal basis and selling to device vendors but the end effect is much better we think you