Who Pays When Nobody Can Prove It? C2PA & Content Provenance with DigiCert's Mike Nelson

You know, so 20 years of connected medicine, is there a material improvement in the sort of security that surrounds it? I mean, you touched on something that I think is true broadly, is that security was always an afterthought to a large degree within tech, right? It was fast, cheap, effective, good UX, you know, QA doesn't create liability, but keeping it secure was not something that was paramount by any measure.

Healthcare being maybe the biggest example of this because of the scale of healthcare, but also the price of when it doesn't work and the vulnerability, the problem with vulnerability in that space.

What about the, like a hospital imaging system and MRIs and those sorts of things? What does that stand now? What should people know about that space?

Yeah, well, I would just say starting at a general level, the industry has gotten much better.

You know, as of 2016, the Food and Drug Administration released guidance for medical device manufacturers of things that they needed to do from a cyber perspective to ensure the security of medical devices.

Medical device manufacturers at that point started acting with responsibility in the development, and they began building security into the workflow, the design, and how they built medical devices.

As of several years ago, the food and drug went from guidance to actually regulatory.

where they could deny submissions of medical devices that are coming through for approval that don't meet cyber resilience.

And so today the FDA can actually say, sorry, this device can't go to market because it's not adequately secure.

So significant progress has been made in health care.

Around, you know, around the imaging systems, I think it's still a little bit of a mixed basket.

And the reason for that, Martin, is that those devices are not short-lived devices.

You know, I mean, those are big pieces of capital equipment that sit on a hospital floor for 15, sometimes 20 years.

And the FDA's guidance is for new devices coming off the manufacturing line.

And so devices that are out there, legacy is how we refer to them, are really where I see still significant challenges.

And so what we see is manufacturers doing things around like network security, data and transmission, making sure encryption is being used, authenticating connections to the clouds, doing things around access controls.

But the devices themselves still carry significant vulnerabilities.

And I think the controls that they're putting around it are good, but there's still improvement that needs to be made.

And this is not, you know, we single out

hook here, but this is a problem that exists through a lot of legacy tech specs, right? I mean, the thing that jumps to mind, and as long as I've been doing this, I still become befuddled by the vulnerability the Internet of Things creates.

All these Internet-connected devices that we have that we don't realize have passwords that we have to change and all that sort of thing.

You know, any device that might have Sort of, you know, an MRI machine might be hooked to the Internet so they can update its software automatically, for example.

Right.

And that connection is a doorway that if it's not secure properly, creates a vulnerability that in likelihood makes you get you into the entire network of a health care facility or any other organization with a similar type of device, a copier, for example.

So it is one of those interesting things as we've sort of steadily and in our current era of apparently we are pumping the brakes on certain technologies.