SFS Podcast Episode: 189

Medical Device Security

1. Intro
   1. Hospital devices (infusion pumps, CT, MRI, etc)
   2. Personal devices (pacemaker, insulin pumps, etc)
2. Medical Devices are a broad category
   1. Discussion of Sentinel Events...
3. This has some of the same threat landscape as the IoVCT, but the consequences can be much more serious.
   1. Lead times for device approval
   2. Fixed configurations / FDA compliance
   3. Working life of devices
   4. “Well just replace them all!” Cost of devices (esp for small/struggling hospitals)
   5. Sheer number of devices can be overwhelming when looking to upgrade/replace
   6. Vendors that bring in things for a trial w/o involvement of IT/IS
4. Challenges to Fixing The Problem:
   1. Vuln Disclosure  
   2. 1. Muddy Waters / St Jude
      2. 1. Problem there wasn’t disclosure it was the look of the profit motive
         2. August 25, 2016 > http://www.muddywatersresearch.com/research/stj/mw-is-short-stj/
         3. SJM sued in early September >> http://www.wsj.com/articles/st-jude-medical-sues-short-seller-over-device-allegations-1473258343
         4. http://www.marketwatch.com/story/short-seller-muddy-waters-renews-claims-of-st-jude-medical-cyber-vulnerabilities-2016-10-19
         5. Goes beyond Vulnerability Disclosure and Muddy Waters claims SJM is attacking their First Amendment - Right to Free Speech - rights >> https://www.bloomberg.com/news/articles/2016-10-24/muddy-waters-fights-st-jude-lawsuit-over-pacemaker-reports
         6. Muddy Waters report from Bishop Fox >> http://www.reuters.com/article/us-st-jude-medical-cyber-muddywaters-idUSKCN12O1O1
         1. http://www.csmonitor.com/World/Passcode/2016/0210/FDA-presses-medical-device-makers-to-OK-good-faith-hacking
      3. Bug Bounties
   3. FDA Task Force - http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm481968.htm
      1. I Am The Cavalry - https://iamthecavalry.org/oath
         1. HIMSS Cyber Security Community - http://www.himss.org/get-involved/community/cybersecurity
         2. Archimedes Center for Medical Device Security - https://secure-medicine.blogspot.com
         3. NH-ISAC - http://www.nhisac.org/
         4. MDISS - http://www.mdiss.org
      2. Other interest groups
   4. Other groups
5. How Can it Get Better
   1. Sometime, somewhere, somehow something bad is going to happen and somebody is going to die.
   2. There will need to be more market pressure - http://thehill.com/blogs/congress-blog/technology/278712-a-new-narrative-on-cyber-security
   3. What will regulators do?  (eg DLink and the FTC)
6. What’s the Future?
7. Outro & Credits

Andy and Martin close out 2016 with a quick run through of the major stories of the year and look forward to what's to come in 2017.

Thanks to everyone who came to BSides Atlanta!

Martin, Steve, and Yvette discuss the recent DDoS of the DNS provider Dyn and what information security people should be considering in a world where terabit DDoS is a reality.

Martin, Steve, and Yvette talk about recent events at Yahoo and the moral compass questions information security professionals and leaders may be forced to face when their employer appears to be doing something they shouldn't...

For the first time we can think of it's just Yvette and Martin on this episode.  The two of them talk about what to think about and what you might do if you run into some extra budget at the end of the year.  Do you invest in shiny? What about services? Some training might be nice?  Or so you score points with the team down the hall?

We interview Nick Selby (@nselby) about a recent blog post where he had a less than optimal experience with a managed security service provider.

https://nselby.github.io/When-Security-Monitoring-Provides-Neither-Security-Nor-Monitoring/

Martin, Andy, and Steve talk about third party risk programs in light of breaches at Target, Banner Health, and other unfortunate souls.

Joseph is on sabbatical but the rest of the crew talks about how infosec professionals should focus on their problems and how to effectively interact with "the business".

Guillaume’s last visit to the show: Episode 167 Last year’s WWDC episode

WWDC 2016 Security Rumors and Wishes Possible Touch ID changes Touch ID for the Mac?

Wishlist Encrypted iCloud Backups Permissions and Pairing Granular Location Access Better Public Wi-Fi, VPN And SSL/TLS Handling

Reduced Annoyances and Increased Security on iOS

Find us on Twitter: @gepeto42 @SFSPodcast @armorguy @jsokoly @andywillingham @SteveD3 @jetsetyvette

And if you have any feedback, questions, or comments, drop us a comment or find us at @SFSPodcast on Twitter. And if you’ve found our Facebook page, we’re sorry. We’re going to fix that up.

This evening, Martin sat down with Patrick Heim from Dropbox. Enjoy the interview, and the gang will be back next episode.