IEEE World Technology Summit on AI Infrastructure, November 12-14, 2024 at the San Jose Convention Center

A lot of conferences are about the What of AI. This one was about the How – that is, the underlying infrastructure needed to support AI.  This means the silicon, systems, and applications, plus security, standards and regulations to provide the framework for success.

The event featured top executives from around the world discussing how to solve our immediate problems, focusing on these core areas:

• Al applications and their required infrastructure
• Silicon to support Al applications
• Systems to support Al applications
• Security & Standards & Laws

 I moderated the session on Security & Standards & Laws.

All of the speakers were from industry, except one from UC Berkeley and one from the National Science Foundation.

Attendees came away with increased understanding of challenges and solutions in providing the infrastructure needed to support the fast-growing AI industry.

TUESDAY November 12

Event Reception

WEDNESDAY November 13

Morning:

Welcome & Keynote

AI Applications

Applications utilizing Artificial Intelligence are growing rapidly but to enable them the suitable infrastructure must be there. Key growing areas including Large Language Models, Medical applications (consumer and professional), Electronic Design Automation, and Digital Twins are greatly influencing the requirements for infrastructure. This session will examine these and other topics to understand their possible growth and infrastructure needs. 

Afternoon:

Silicon

The underlying silicon is a critical enabler for computing in Artificial Intelligence and its infrastructure.  This session illustrates multiple perspectives on challenges in silicon technologies for AI/ML and its impact on AI/ML solutions.  We will consider different aspects including silicon architectures, development and verification challenges, packaging, and aspects of energy consumption and cooling.

THURSDAY November 14

Morning:

Systems

Although there are many elements to providing AI solutions from servers to edge to client, one of the key current challenges rests in the server technology.  Servers provide the backbone necessary for complex computation and data management that AI needs to provide its services.  Both power and cooling are critical elements that if not available and managed, we will not be able to provide the computational power needed to make them happen.  This session considers the challenges spanning from server to edge to client, but the primary focus is keeping the servers operating.

Afternoon:

Security & Standards

There are concerns about risks involving both the development and use of AI. Everyone working on AI Infrastructure needs to be mindful of these concerns. With respect to Security, this session considers cybersecurity risks affecting the computation involved in providing AI products and services and also possible adverse impacts from the use or abuse of AI. With respect to Standards, this session includes work by IEEE on the development of standards for AI and also covers international, national, and state government activity to create laws and regulations to guide and control AI.

Details are available at https://wts.ieee.org  

See https://californiaconsultants.org/events/

Communications, Computing, and Power during Disaster Response

Date: Sep 9, 2022

MOVE Community Outreach, an IEEE-USA Initiative, is an emergency relief program committed to assisting victims of natural disasters with short-term communications, computer, and power solutions. Services include phone charging, internet & communications support, and lighting to disaster victims. MOVE also offers educational outreach.

In conjunction with the presence of the MOVE  truck at the IEEE Global Humanitarian Technology Conference (GHTC), this is a panel discussion among representatives from organizations involved with emergency response and disaster recovery. The focus is on communications, computing, and power, but expanded from there. After a brief description of the MOVE truck, the emphasis is on stories about what works and lessons learned.

• see link above for photos and biographical paragraphs for moderator and panelists.
• this video from Zoom contains
  • first few minutes: introduction about the Consultants’ Network of Silicon Valley (CNSV)
  • speaker presentations starting at about 4 minutes
  • panel discussion starting at about 59 minutes
• use link below to access video

This event was organized by the Consultants‘ Network of Silicon Valley (CNSV) as part of its sponsorship of the GHTC, which was held September 8-11, 2022 at Santa Clara University.

Defcon 30, Black Hat, and BSides Las Vegas are all happening August 9-14 in Las Vegas! The Diana Initiative, too. Check out these links to read about “Hacker Summer Camp.” Great opportunities to keep up-to-date on cybersecurity and network.

Closer to home, check out the IEEE Global Humanitarian Conference September 8-11, 2022 at Santa Clara University. See my Presentations page for links to the sessions I am helping to organize.

A lot continues to happen in the cybersecurity field and here are a few things I think are worth highlighting, plus some notes on my current activities.

– As of the writing, the situation in Ukraine is awful and still could have cybersecurity implications for the U.S., as well as Ukraine. See DHS bulletin at https://publicintelligence.net/dhs-ukraine-invasion-cyber-attacks/.

– federal Cybersecurity and Infrastructure Security Agency (CISA) (https://www.cisa.gov) continues to generate advice, including a series of insights at https://www.cisa.gov/insights

– ECRI Top 10 Health Technology Hazards for 2022 – https://www.ecri.org/top-10-health-technology-hazards-2022-executive-brief. (Number 1 is “Cybersecurity Attacks Can Disrupt Healthcare Delivery, Impacting Patient Safety”)

– I’m assisting a medical software startup with setting up its cybersecurity program for its Software as a Medical Device (SaMD) product. 

– I’m doing program management work related to Public Key Infrastructure for a large Silicon Valley technology company. Lots to do to maintain compliance with WebTrust and CAB Forum requirements.

– RSA Conference (https://www.rsaconference.com/usa) and BSidesSF (https://bsidessf.org) in San Francisco are deferred from February to June 2022. I’ll probably volunteer again at BSidesSF, assuming it is reasonably safe with respect to COVID-19. Maybe hang out on the exhibit floor at RSA for a day.

This Spring and Summer there’s a lot going on relative to cybersecurity for medical devices. Check these out…

FDA Document Details Cyber Expectations for Device Makers – https://www.govinfosecurity.com/fda-document-details-cyber-expectations-for-device-makers-a-18863

Senators Introduce PATCH Act to Ensure Medical Device Security – https://healthitsecurity.com/news/senators-introduce-patch-act-to-ensure-medical-device-security

Model Contract-Language for Medtech Cybersecurity (MC2) – https://healthsectorcouncil.org/model-contract-language-for-medtech-cybersecurity-mc2/

CyberMed Summit: Policy Prescriptions & Pandemic Lessons Learned (April 14) – https://www.cybermedsummit.org

Defcon 30 Biohacking Village – is targeted for August 11-14 in Las Vegas. We’ll see whether that actually happens and how risky it may be to attend, depending on the status of COVID-19. https://www.villageb.io

It’s been a whirlwind week and it’s not over, yet. Defcon29 (aka “hacker summer camp”) was August 5-8 in Las Vegas. HIMSS21 (the Health Information Management Systems Society’s global conference) started August 9 and runs through August 13, also in Las Vegas. Temperatures have been as high as 108 degrees F. Both have been hybrid conferences with some online and some in person.

I volunteered with the Biohacking Village at Defcon29, which this year mainly involved monitoring the online discussion boards in case there was any inappropriate behavior. The in person things included villages regarding IoT Hacking, Car Hacking, Voting Machines, Cryptocurrency, Satellite Hacking, and a new group called Security Leaders. There were also some good sessions on Public Policy pertaining to cybersecurity.

I co-authored and co-presented a short talk at HIMSS21…

This talk was based on the paper posted elsewhere on this web site.

Key takeaways…

• equally important with designing, implementing, and maintaining online systems securely is the need to anticipate and expect failures and malicious attacks that will require response and recovery. Sure, cyber defense, but plan for cyber resilience [recover quickly]. Offline backups, emergency contact lists, contingency plans, legal and technical consulting standby contracts, and table top practice session are essential.
• there is a shortage of trained cybersecurity professionals, so start investing in training for your existing staff while continuing to seek the expertise you need
• <probably more – I may edit the to add items…>

More and more RPM devices are being introduced for healthcare providers to use in managing post-acute and chronic care patients. The diagram below shows the variety of ways in which these devices may transmit information from the patient’s home to the clinician. Other posts on this site discuss cybersecurity relative to RPM.

Cybersecurity risk management for supply chains with multiple vendors is complicated. Each vendor is clearly responsible for its own system, but who minds the overall end-to-end concerns? This article asserts that coordination across organizational boundaries is needed to assess and mitigate cybersecurity risks in remote patient monitoring (RPM) systems.

Examples of network-connected RPM devices include wearables (e.g., smart watches), glucose monitors, pacemaker monitors, blood pressure cuffs, pulse oximeters, continuous positive airway pressure (CPAP) machines, scales, and more. Such devices are part of the family of the Internet of Things (IoT).

A 2019 survey of physicians showed “Two in three, or 68 percent, of physicians surveyed strongly intend to use remote patient monitoring technology…” However, the survey report also indicates “Health care professionals view data security as the main barrier to technology uptake.”^[1]

The majority of recent cybersecurity analysis for medical devices has focused on devices used within hospitals and clinics. Cybersecurity for RPM is different in a number of ways.

RPM is a “system of systems” – a physical and digital chain consisting of devices connected to networks, connected to other networks. Typically, there are multiple stakeholders involved in the provision and operation of these systems These include device manufacturers that depend on a supply chain for software and hardware components, communications networks, data integrators, and the clinicians who are the ultimate users of the data (Figure 1). Also, various interfaces with humans, including patients, caregivers, developers, network engineers, and system administrators. 

Attacks on healthcare delivery organization (HDO) networks via device or interim partner vulnerabilities are a bigger concern than attacks on individual devices. This is because more harm can be done if a healthcare delivery organization network is compromised. Attacks on these networks can not only result in theft of personally identifiable information, but also interruption of service, such as what occurs in a ransomware attack. 

In a RPM digital supply chain with multiple vendors involved, it is necessary to take a “trust, but verify” approach. Clauses can be put in a contract or a “Business Associate Agreement” to require a supplier/partner (vendor) to maintain a good cybersecurity posture, but it is unlikely that the vendor can absolutely guarantee protection. When only written assurances of “best efforts” to prevent cybersecurity incidents are provided, it behooves the buyer/user to perform due diligence and monitor whether these efforts are effective.

One possible solution is for the healthcare delivery organization that is the receiver of the data to oversee the end-to-end process. Alternatively, the data platform vendor that consolidates, analyzes, and formats the data may be in a position to provide the needed coordination. On the other hand, it is difficult to imagine how device manufacturers could coordinate all of the stakeholders.

As a final thought, remember that the ever-changing cybersecurity landscape means it may not be possible to anticipate and mitigate all threats. In the event an incident occurs, there needs to be a plan to respond and recover. In an environment with multiple vendors, response coordination has to be planned and rehearsed before something happens. The objective is to make sure the entire remote patient monitoring system is resilient.

If you work for a health care delivery organization that is on the receiving end of a remote patient monitoring system, what are you doing to make sure all of the components in that system are secure and that you are ready to respond to problems?

If you are one of the vendors in remote patient monitoring system, what are you doing to make sure your upstream and downstream partners in the system are secure?

If you are not sure how to do this, you’ll probably want to obtain assistance to reach out to each of the organizations that comprise the end-to-end system and figure out an approach to make sure a holistic security framework is conceived and implemented.

* * *

David Snyder is a cybersecurity professional experienced at facilitating discussions among ecosystem members, analyzing complex processes, and orchestrating cross-functional and cross-organizational efforts.

Inquiries: https://42tek.com/contact/

^[1] CTA Survey Finds High Demand for Remote Patient Monitoring Devices, 11 April 2019, https://www.cta.tech/Resources/Newsroom/Media-Releases/2019/April/CTA-Survey-Finds-High-Demand-for-Remote-Patient-Mo#/

An updated and shorter online version of my well-received December conference workshop. Noon (Pacific) on May 12, 2020.

Factors driving increased adoption of RPM. RPM as a “system of systems” requiring coordination among stakeholders. Cybersecurity best practices.

A version of the slides is posted at https://42tek.com/RPM_Cybersecurity.pdf. Video at https://www.youtube.com/watch?v=iZ-QUo8XTPA&feature=youtu.be

This 3-hour workshop on December 10, 2019 in San Francisco explored similarities and differences between network-connected medical devices in clinical settings versus residential environments, relative cybersecurity challenges, and best practices throughout the lifecycle of remote devices.

See https://connected-devices-summit.com.

Several trends are driving increased interest and adoption for using network-connected medical devices outside the clinical environment to diagnose, monitor, and treat patients. These include an aging population living longer, often with multiple chronic illnesses, looming shortages of doctors and nurses, and incentives to reduce hospital readmissions.

“88% of health systems and hospitals surveyed have invested or plan to invest in remote patient monitoring solutions to support their organizational transitions to value-based care.” (Spyglass Consulting Group)

The FDA, hospitals, researchers, and device manufacturers have been working hard to define best practices for cybersecurity for network-connected medical devices in hospitals. Attend and see what you need to consider.

Longer description at https://42tek.com/Cybersec_RPM.pdf.