When Cyber Attacks Become Patient Care Events

But building on that conversation, what has changed over the last couple of years that has made cyber incidents more disruptive to health care operations? Can you help us out with that? So I think

I think the shift that I'm seeing and I'm most concerned about actually wrote a white paper last year about the Achilles heel in health care being operational technologies.

And the operational technologies are the air conditioning, the heating control systems in the building, the building management, the things that run the lights, the elevators, the escalators that people take for granted, quite frankly.

And if I look at the landscape of attacks and the number of things that are going on, even in this day, to this day, The cyber physical systems that are being attacked most prevalently are the operational technologies because they're even more legacy, older than the things that we see in healthcare.

And it's only a matter of time before they come after healthcare through those systems.

Six or eight weeks ago, I read an article about an organization in Northern Texas that got breached.

And the screenshots indicated that the hacker had taken control of the reverse osmosis systems.

What does that really mean? Those are the systems that filter the water that go to the dialysis systems for their patients.

That's scary.

The ability to take over the operational technologies in a way that renders you incapable of providing care or harming patients has come to be the reality.

And so I've shifted from the medical device.

Yes, they are still vulnerable.

They are still legacy.

But I'm looking at it more from the, if I were a hacker, what would I do? I'm lazy.

Hackers are lazy.

I learned this from some good friends that were pen testers for me.

They would often say, Skip, we don't go after the most challenging thing.

We go after the path of least resistance.

And if you look at a paper that our Team 82 came out with, I think three weeks ago, about the proliferation of attacks that involved no vulnerabilities, Default credentials, open gateways.

I mean, that's a perfect example of the path of least resistance.

They don't have to do anything.

They just literally walk up to the front of the house, rattle the door to see if it's unlocked, and walk through the door and help themselves to the fridge.

That's a great analogy and a really good background.