Developing & Implementing New Technology • Data Security • Program Management
Cybersecurity
42TEK, Inc. is a California S Corporation providing business and technology consulting to help organizations conceive, develop, implement, and maintain secure technologies in healthcare, payment processing systems, critical infrastructure, and environmental systems. Program management, project management, and compliance experience at Apple, Google, PayPal, Yahoo!, First Data, and Kaiser Permanente, as well as startups.
Certified Information Systems Security Professional (CISSP). Experience at First Data, Apple, Yahoo!, Kaiser Permanente, and others protecting credit card data under the Payment Card Industry Data Security Standard (PCI DSS) and personally identifiable information under the Health Insurance Portability and Accountability Act (HIPAA) and other laws and standards. Researching cybersecurity for network-connected devices ("Internet of Things" / Remote Patient Monitoring / Environmental Sensors).
Using clinical and engineering experience to help securely architect and implement technologies for mobile health, remote monitoring, and healthcare payments. Helping clinicians and technologists understand each other. Respiratory therapy experience in Intensive Care Units. Healthcare financial systems at Kaiser Permanente. Telemedicine at AppMedicine, Inc. Organizer, moderator, or presenter at more than 20 conferences and seminars on digital health, data security, and payments topics.
Over 20 years of experience in the payments industry at Apple, Google, PayPal, Kaiser Permanente, ViVOtech, Yahoo!, and BBPOS, ranging from transaction processing to card issuing, merchant card acceptance, POS equipment deployment and service, and PCI DSS compliance. Special experience in contactless (NFC) and healthcare payments.
An updated and shorter online version of my well-received December conference workshop. Noon (Pacific) on May 12, 2020.
Factors driving increased adoption of RPM. RPM as a “system of systems” requiring coordination among stakeholders. Cybersecurity best practices.
A version of the slides is posted at https://www.42tek.com/RPM_Cybersecurity.pdf. Video at https://www.youtube.com/watch?v=iZ-QUo8XTPA&feature=youtu.be
This 3-hour workshop on December 10, 2019 in San Francisco explored similarities and differences between network-connected medical devices in clinical settings versus residential environments, relative cybersecurity challenges, and best practices throughout the lifecycle of remote devices.
See https://connected-devices-summit.com.
Several trends are driving increased interest and adoption for using network-connected medical devices outside the clinical environment to diagnose, monitor, and treat patients. These include an aging population living longer, often with multiple chronic illnesses, looming shortages of doctors and nurses, and incentives to reduce hospital readmissions.
“88% of health systems and hospitals surveyed have invested or plan to invest in remote patient monitoring solutions to support their organizational transitions to value-based care.” (Spyglass Consulting Group)
The FDA, hospitals, researchers, and device manufacturers have been working hard to define best practices for cybersecurity for network-connected medical devices in hospitals. Attend and see what you need to consider.
Longer description at https://42tek.com/Cybersec_RPM.pdf.
This is where hackers had a chance to explore medical devices to discover potential cybersecurity vulnerabilities and, hopefully, how to defend against them. Read more at
https://www.villageb.io and https://www.defcon.org
I volunteered at the Biohacking Village and was able to network with some excellent people about developing and maintaining network-connected medical devices securely. Ten medical device manufacturers provided approximately 40 devices for hackers to examine and explore. There were about 30 workshops, presentations, and panels, including some of the premier security researchers in this space and representatives from the FDA.
http://connected-devices-summit.com
December 11-12, 2018 at the Hotel Kabuki in San Francisco.
On December 11th, I was joined by a great team to conduct a 2.5-hour workshop entitled “Cybersecurity for Medical Devices is a “Team Sport.” Assisting with the workshop were:
The workshop focused on how device developers can collaborate with hospitals and clinics to help make sure medical devices are set up and managed to protect patients’ privacy and safety.
The highly interactive session was conducted by a team with diverse backgrounds, including a hospital CIO, a clinical engineer, a hospital information security officer, and two neutral cybersecurity consultants to facilitate and moderate. Topics covered included:
Group exercises and case studies were included.
There are over 5,000 hospitals in the U.S. and I’ve seen the number 6,000 as the number of medical device manufacturers. Medical devices are increasingly built with network connectivity. Examples include heart monitors, infusion pumps, glucose monitors, and assorted other treatment and diagnostic devices.
Cybersecurity has traditionally been concerned with Confidentiality, Availability, and Integrity of data. However, in medical devices and critical infrastructure (such as the electric power grid), the potential for harm means we have to include Safety when we think about cybersecurity.
On December 11, 2018, I’ll be leading the INTERACTIVE WORKSHOP: Cybersecurity For Medical Devices Is A “Team Sport” at the Connected Devices: Cybersecurity & Compliance Summit in San Francisco at the Kabuki Hotel. See http://connected-devices-summit.com. This interactive workshop will focus on how device developers can collaborate with hospitals and clinics, who purchase network-connected medical devices and need to operate them in their complex networks. This highly interactive and hands-on session will be conducted by a team with diverse backgrounds, including a hospital CIO, a clinical engineer, a hospital information security officer, and two neutral cybersecurity consultants to facilitate and moderate.
My collaborators for this workshop include:
If you’d like to read more on the subject, see the following or contact me for more references.
The Symposium on Securing The Internet of Things (http://securingthenet.com) took a deep dive on what it will take to protect the billions of devices on which we depend for critical infrastructure, healthcare, and our homes. I led a panel discussion on Security for Network-Connected Medical Devices.
The event was March 5 – 7, 2018 at the Crowne Plaza Hotel in Burlingame, CA (near San Francisco Airport). [See agenda at https://42tek.com/STIOTAGENDArev6.pdf] 
My session addressed security topics in medical device design and manufacturing, usage in hospitals, remote monitoring, and related legislative, regulatory, and standards initiatives. Bill Saltzstein of Code Blue Communications, Peyton Paulick Kochel, Ph.D. of Proteus Digital Health, and Eric Pancoast of Medcrypt participated in the panel and May Wang of Zingbox gave a keynote presentation.
Please use the contact form if you would like to request the slides.
Some references on the medical devices topic may be found here.
I gave a webinar on Blockchain and IoT at Global IoT DevFest Virtual Conference Nov 7-8, 2017. See http://globaliotfest.withthebest.com [link to video]
I gave a presentation on Blockchain and IoT for the Silicon Valley Insurance Accelerator Blockchain Bootcamp in Palo Alto on December 6, 2017. See http://sviaccelerator.com/insurtech-bootcamp-block-chain-01/.
I am helping a Fortune 500 company prepare for its annual assessment for compliance with the Payment Card Industry Data Security Standard (PCI DSS). I should be done with this around May 2018.
Did you know that Northeastern University has a Silicon Valley campus? Not only that, but they offer a 13-week course on the Internet of Things (http://info.leveledu.com/iot). I’m just wrapping up the capstone project for the class. Among other things, we did some interesting work with small sensors and some Arduino devices, worked with networks and Raspberry Pi devices, and explored Fog Computing. My capstone project involves a sensor to detect when a collection box is full. Of course, one of my main interests in this is how to design and maintain security for Internet-connected devices.
YouTube
“Blockchain 101 – A Visual Demo” at https://www.youtube.com/watch?v=_160oMzblY8 and a great interactive tool to try out at https://anders.com/blockchain/hash.html (click on the tabs at the top to see different parts)
How Bitcoin Works Under the Hood: https://www.youtube.com/watch?v=Lx9zgZCMqXE
Building a Blockchain in Under 15 Minutes – Programmer explains: https://www.youtube.com/watch?v=baJYhYsHkLM
Books
The Business Blockchain: Promise, Practice, and Application of the Next Internet Technology by William Mougayar
Blockchain Revolution: How the Technology Behind Bitcoin Is Changing Money, Business, and the World by Don Tapscott
Blockchain and IoT
Trusted IoT Alliance: https://www.trusted-iot.org
More Articles & Blog Posts
A Beginner’s Guide to Blockchain Technology: https://www.coindesk.com/information/
https://hbr.org/2017/01/the-truth-about-blockchain
http://fortune.com/2017/08/22/bitcoin-ethereum-blockchain-cryptocurrency
http://fortune.com/2017/08/22/fortune-500-blockchain-ledger-delaware/
http://www.newsweek.com/blockchain-technology-will-remake-global-financial-system-462537
https://www.coindesk.com/us-centers-disease-control-launch-first-blockchain-test-disaster-relief/
http://fortune.com/2016/05/23/blockchain-definition/
http://www.cio.com/article/3055847/security/what-is-blockchain-and-how-does-it-work.html
http://www.kayescholer.com/docs/IntrotoBitcoinandBlockchainTechnology.pdf
Courses
The Basics of Blockchain: https://www.udemy.com/the-basics-of-blockchain/
Blockchain 101: https://www.udemy.com/blockchain101/
Bitcoin and Cryptocurrency Technologies: https://www.coursera.org/learn/cryptocurrency
Blockchain for Business – An Introduction to Hyperledger Technologies: https://www.edx.org/course/blockchain-business-introduction-linuxfoundationx-lfs171x
Blockchain Basics: A Practical Approach: https://www.creded.ai/Course/udemy/blockchain-basics-a-practical-approach-by-toshendra-sharma
“$700 Billion Senate Defense Bill Calls for Blockchain Cybersecurity Study”
https://www.coindesk.com/700-billion-senate-defense-bill-calls-blockchain-cybersecurity-study/
“A $700 billion defense bill passed by the US Senate includes a mandate for a blockchain study to be conducted by the Department of Defense.”
“Yesterday, the US Senate passed a massive defense spending package that provides hundreds of billions of dollars to the US military. Public records show that an amendment included in that bill, proposed by Senator Rob Portman of Ohio, would “require a report on cyber applications of blockchain technology” if signed into law.”
Perhaps a good idea, but probably deserves some discussion.
The amendment specifically calls for
“…a report on the potential offensive and defensive cyber applications of blockchain technology and other distributed database technologies and an assessment of efforts by foreign powers, extremist organizations, and criminal networks to utilize these technologies. Such report shall also include an assessment of the use or planned use of blockchain technologies by the United States Government or critical infrastructure networks and the vulnerabilities of such networks to cyber attacks.”
For one thing, I would recommend deleting the option for the report to be submitted in classified form, while possibly still allowing it to be submitted “…in unclassified form with a classified annex.” I hope people will discuss this, or at least get the issue into the legislative history, before this goes through. It would be a shame to spend taxpayer dollars for such a study, only to have it buried as a classified document.
Here’s an excerpt from the Sept 18, 2017 version of the proposed amendment to the National Defense Authorization Act for Fiscal Year 2018:
https://www.congress.gov/amendment/115th-congress/senate-amendment/1055/text
AMENDMENT NO. 1055
(Purpose: To require a report on cyber applications of blockchain technology)
At the end of subtitle C of title XVI, add the following:
SEC. 1630C. REPORT ON CYBER APPLICATIONS OF BLOCKCHAIN
TECHNOLOGY.
(a) Report Required.–Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense, in consultation with the heads of such other agencies and departments as the Secretary considers appropriate, shall submit to the appropriate committees of Congress a report on the potential offensive and defensive cyber applications of blockchain technology and other distributed database technologies and an assessment of efforts by foreign powers, extremist organizations, and criminal networks to utilize these technologies. Such report shall also include an assessment of the use or planned use of blockchain technologies by the United States Government or critical infrastructure networks and the vulnerabilities of such networks to cyber attacks.
(b) Form of Report.–The report required by (a) may be submitted–
(1) in classified form; or
(2) in unclassified form with a classified annex.
(c) Appropriate Committees of Congress Defined.–In this section, the term “appropriate committees of Congress” means–
[[Page S5795]]
(1) the Committee on Armed Services, the Select Committee on Intelligence, and the Committee on Homeland Security and Governmental Affairs of the Senate; and
(2) Committee on Armed Services, the Permanent Select Committee on Intelligence, and the Committee on Homeland Security of the House of Representatives.
The Equifax data breach is another wake-up call regarding the security of personal information. Perhaps it will add impetus to the idea of enhancing ways for individuals to safeguard their personal information that is stored by institutions. Maybe some of the ideas for using blockchain technology will be helpful.
SC Magazine published an article detailing what is thought to have occurred in the Equifax breach: “Apache Struts vulnerability likely behind Equifax breach, Congress launches probes.” (https://www.scmagazine.com/apache-struts-vulnerability-likely-behind-equifax-breach-congress-launches-probes/article/687955/) The author notes,
“The incident could also ‘have wide-reaching implications for how Americans identify themselves in the future, such as when applying for banking and credit services – simply knowing a name, date of birth, address and Social Security number shouldn’t ever be enough,’ says [Alex] Smith. ‘This breach could finally be the security wakeup call the US needs to widely adopt digital identity tokens, and potentially a digital national identity scheme similar to other countries such as Belgium.’” [see “The Belgian Electronic Identity Card (Overview)” https://www.esat.kuleuven.be/cosic/publications/article-769.pdf]
There are two reasons why a national digital identity scheme may be a long time coming in the US. First, it would run into conflicts with our having 50 states and other jurisdictions like the District of Columbia, Puerto Rico, and Guam, each issuing identity credentials, such as driver’s licenses. Second, we have a history of shunning national identification (paradoxically for fear of privacy concerns), as evidenced by Congress specifically saying that no federal funds shall be spent on a national health identification number (see PUBLIC LAW 105–277—OCT. 21, 1998, “None of the funds made available in this Act may be used to promulgate or adopt any final standard under section 1173(b) of the Social Security Act (42 U.S.C. 1320d–2(b)) providing for, or providing for the assignment of, a unique health identifier for an individual (except in an individual’s capacity as an employer or a health care provider), until legislation is enacted specifically approving the standard.”).
Given these national obstacles to updating how identity is managed in the US, it seems we may have to rely on the marketplace to come up with solutions, instead of waiting for government to take the lead. I expect we’ll see some Congressional hearings as a result of the Equifax breach, but probably no meaningful legislation.
One possibility for marketplace activity is for institutions that rely on identity, such as banks, insurers, and so on, to adopt blockchain technology. Earlier this year, there was an article in Forbes on this: “How The Blockchain Will Secure Your Online Identity” (https://www.forbes.com/sites/jonathanchester/2017/03/03/how-the-blockchain-will-secure-your-online-identity/#e9d4bda55234).
I can imagine organizations making it a selling point to be able to provide customers with apps that allow them to control who and when their information can be accessed.
The idea is not new. It is discussed in “How GDPR plus blockchain leads to the future of self-sovereign identity” (http://www.janrain.com/how-gdpr-plus-blockchain-leads-to-the-future-of-self-sovereign-identity/). This article references a 2015 paper that concludes, “Personal data, and sensitive data in general, should not be trusted in the hands of third-parties, where they are susceptible to attacks and misuse. Instead, users should own and control their data without compromising security or limiting companies’ and authorities’ ability to provide personalized services.” (“Decentralizing Privacy: Using Blockchain to Protect Personal Data” http://web.media.mit.edu/~guyzys/data/ZNP15.pdf)
[Update 9/15/17: “Equifax has confirmed that attackers entered its system in mid-May through a web-application vulnerability that had a patch available in March.” (https://www.wired.com/story/equifax-breach-no-excuse/) and “Equifax (EFX) says its chief information officer and chief security officer are leaving the company…” (https://www.cbsnews.com/news/2-equifax-executives-exit-after-massive-data-breach/).
If you want to hear more on blockchain technology, here are a couple of opportunities:
I am available for presentations and consulting on blockchain technology and data security: david@42tek.com.