Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Beau Woods on Medical Device Security, Hacker Culture and Cyber Psychology
Guest:
Beau Woods
Published:
Updated:
Duration:
41 min
Episode summary
Beau Woods knows firsthand how every moment counts when it comes to medical cybersecurity. He launched his career in a hospital, where it wasn’t always possible for doctors to punch in complex passwords or spare a second thought for cybersecurity. Beau went on to found I Am the Cavalry, a group of cyber ambassadors dedicated to improving the security of devices ranging from pacemakers to connected door locks.
In his current role as senior advisor for the Cybersecurity and Infrastructure Security Agency, Beau helps fill gaps in U.S. cyber defenses by boosting organizations that may not have the resources or knowledge needed to secure critical connected equipment like insulin pumps.
“If you can get ahead of things and help them to build better procurement processes, help them to identify more securable technologies that have better business models, that will have greater longevity, then you can stop the flow of inbound, insecurable devices and – over the next decade or two – eventually that cyber hygiene tide line can rise,” he said in this episode of WE’RE IN!
A few more reasons to listen:
Learn Beau’s tips for making cybersecurity issues more engaging, from gamification to building empathy
Hear about his unconventional career path from psychology to security
Build awareness on the state of healthcare cybersecurity and CISA’s role in government
Security must fit the clinical workflow In an emergency department, clinicians move between several workstations and a forgotten password can cost fifteen minutes. Proximity cards, smart cards, and single sign-on reduce friction while keeping authentication in place.
Procurement is the heart of supply chain Beau argues that better selection criteria at purchase time stop the inflow of insecurable devices, so security teams should work with procurement, legal, and executives.
Medical devices outlive their software An infusion pump can stay clinically relevant for twenty years or more, long after its operating system and firmware age, so hospitals rarely replace working devices for security reasons alone.
Start with the bad practices CISA's bad practices list, the Known Exploited Vulnerabilities catalog, and the Get Your Stuff Off Search guidance help smaller organizations prioritize a few high-impact actions instead of hundreds of best practices.
Architecture changes the real risk Remote code execution on a device's telemetry component may matter little if the patient-facing part is isolated and the device reboots to a static image, which is why findings need context beyond a CVSS score.
Notable quotes
If you can get ahead of things and help them to build better procurement processes… then you can kind of stop the flow of inbound insecurable devices.
We tell our kids stories about Alibaba and the 40 thieves when they're two to five years old, right? It's about bad password management.
One of the things that one of my mentors used to say is business is in the business of taking risks.
I think empathy is an underdeveloped skill in our community and I'd like to see us all try and develop it a little bit more.
Questions this episode answers
What is the Do No Harm event at DEF CON?
Do No Harm brings together hackers interested in healthcare with doctors, hospital administrators, patients, medical device makers, and regulators. It started around 2013 or 2014 as an informal meetup and grew into a panel and lounge event. Read this section
How can hospitals handle authentication without slowing down doctors?
Beau described low-tech options like removing barriers in physically separated environments, and frictionless options like proximity cards or single sign-on that open several clinical applications at once. Read this section
Why don't hospitals replace insecure medical devices?
A device that still saves lives competes for budget with protective equipment, nurses, and training, so replacing it does not serve the hospital's mission. Beau recommends improving procurement so fewer insecurable devices come in. Read this section
What does target rich, cyber poor mean?
It describes organizations that attackers find valuable but that cannot afford large security teams. Beau sees a role for government and CISA in supporting them with guidance and help. Read this section
What advice does Beau Woods give security professionals?
Ask more questions than you give answers and build empathy with the people you are trying to help. He called empathy an underdeveloped skill in the security community. Read this section
About the guest
Beau Woods is a hacker focused on medical cybersecurity and a founder of I Am the Cavalry, a grassroots initiative working on the security of connected devices that affect public safety. At the time of recording, he was a senior advisor with the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security. He started his security career at a hospital, holds a psychology degree from Georgia Tech, and helped found the Biohacking Village Device Lab.
And I'm Bella DeShantz-Cook. Today, we're gonna talk to Beau Woods, a senior adviser with the Cyber Infrastructure Security Agency within the Department of Homeland Security.
Beau has done a ton of interesting things in cybersecurity, presented regularly at DEF CON, and he has a purple mohawk, so he definitely stands out in Washington DC. We'll talk about how he's trying to educate lawmakers on all things cyber right after a short word from sponsor.
We're in is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pentesting, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at synack.com. That's synack.com.
Hey, Beau. Welcome to the show. Really appreciate you joining. Thanks so much for your time. During DEF CON this last year, you got to participate in several things, one of which that I had the pleasure of sitting into, which was the Do No Harm panel. I was wondering if you could tell us a little bit about that and how that experience was for you.
Yeah. Sure. So Do No Harm is a long standing event out at Hacker Summer Camp. We started it actually I think in 2013, 2014 and it started as just an informal meetup that happened in my room out at BSides. And as it grew over time, we expanded it. And the first time we did it at DEF CON, it was a nighttime lounge event. And we had like 200 or 300 people. We actually had to get a bigger room and they had to go clear packet hacking village out. And so we jumped in there, they were gracious enough to let us have their space. And we had Jeff Moss came by, the founder of DEF CON. We had actually representative Langevin, a member of Congress who we had brought out for a different thing came in and we had a ton of reception. We just kept doing them. They've kept getting bigger, becoming more fun and we've got kind of a rotating cast of characters that we bring in.
But at its core, Do No Harm is an attempt to bring together people from the hacker community who are interested in healthcare, who are working in healthcare or around healthcare, who have healthcare concerns, not necessarily just I've got a device in my body, although we've got several hackers who have implanted medical devices or wearable devices like insulin pumps or ICDs, but people who really see healthcare and public health as kind of a bigger mission for them to serve as a part of what they do in security. So the panel is always a mix of hackers, of doctors or hospital administrators, of patients, of people who work on medical devices, work in healthcare. We've had folks from the Food and Drug Administration and HHS, a couple of anchors.
Interesting that you said too with Congress and then some of the HHS representatives. I saw that you work on a project called DC to DEF CON as well. Is that part of that flow?
Yeah. So DC to DEF CON is something that we started a few years ago where I was working at the time, the Atlantic Council, which is a Washington DC based think tank. We said, what would be the craziest thing we could do? Maybe it's to get a couple of members of Congress to come out to DEF CON with us and just immerse themselves in Hacker Sauce for the weekend. And so we had representative Langevin, representative Hurd came out and we did a variety of events and activities with them, had them in some conversations for a full day basically with members of the hacker community. Brought in a bunch of people who are really interested in policy, had them sit down and have conversations. They did a full talk out there, did like an interactive Q and A session. And then when they got back, actually representative Langevin on the floor of Congress gave kind of an impassioned plea in one of the hearings for why Congress and the government should look to hackers as leaders of cybersecurity community.
I live in DC, so I'm allowed to say cyber without drinking. So that other fellow congresspeople of the representative could understand that hackers are not a monolithic thing. That security researchers can be a net benefit and net gain for the country and for national security, not just something to be feared.
And do you think experiences like that are really starting? I feel like I hear a lot of small experiences like this where folks in government are exposed to quote hackers and then it sort of changes their mind. But I feel like I've been hearing these experiences for kind of a while. Do you think we're finally starting to see a broader shift now more than just these one offs?
Yet it was not a static thing, right? So if you go back and look at the cast of characters for the very first DEF CON, one of them was the FBI agent who was in charge of tracking down legitimate criminals and bringing them to justice. And the DEF CON crew recruited her to come out and give a talk on that because they said, Look, we need to work together in this society in order to make it safer for the things that we all want. And so there's been an undercurrent of this kind of collaboration that's been going on even through the tough times. Hackers and the government have been working together to influence the way that certain law enforcement things are carried out, to be a helping hand in informing congressional staffers and members of Congress, to team up with agencies, the White House, as well as governments around the world to really help raise the tide line and to distinguish between the positive good faith work and the truly, you know, truly the things that we want to weed out of our society and out of our community.
Yeah, that's really interesting. It's interesting to think about the distance that we've come so far, I guess on that. So before we get too deep into what you're working on today, I wanted to ask you a question. I noticed that you have a degree in psychology from Georgia Tech. And when I read that, I thought that was just really interesting because I think I imagine there are probably a lot of interesting ways to sort of look at cybersecurity, look at hackers and from a psychology perspective. Is that something that has influenced your career in cyber?
Every day probably in various different ways. So you're right, I have a degree in psychology. I started out college thinking that I was going to be the best computer scientist in the world and I was going to learn all the things and be great at it. And I got in and I realized that I was way far behind the power curve. Right? I was I was kind of technical and I liked computers, but then I got in there and I saw that everybody else was way more technical than me. I said, all right, I'm gonna be behind my entire career if I go down this path and just go down in this one way. So I started taking the basic classes, ended up really enjoying the knowledge, the education, the capabilities that psychology courses brought me. And so I decided to get a major in that. Now, I graduated, I took a non traditional path for psychology graduate, which usually that means master's and university.
I ended up getting a job at a hospital and really, really quickly on the job at the hospital, my psychology training kind of kicked in and allowed me to see things a little bit differently, right? So working with doctors and nurses where every second counts, if you ask them to have a really long password that's really complex and change it all the time, then they'll look at you kind of funny. And then fortunately, my boss at the time invited me to go hang out at the emergency department and just watch the workflow, right? And so what I saw was doctors and nurses going up to these workstations all the time. They would pop between four or five or six, just depending on which one was closer to the patient. And if they had to put in a complicated password every time they jumped into the computer, they would have had a lot of issues, right?
If they forgot their password or needed to reset it, then that's a fifteen minute cycle. That's fifteen minutes out of somebody's day when they can't be helping patients in a place where seconds count, right? So it gave me an appreciation and ability to see things through a different lens and start to build some empathy with the position that other people are in and then start applying that to myself and say, what can I do as an engineer in order to build something that works better for them, not just whatever is maybe the standard practice of doing security in a financial services organization or in a manufacturing organization or in aerospace aviation? Every place has its different trade offs and considerations. And how can we bring a better set of security tools in a way that's psychologically acceptable, which is one of the original principles that helped launch information security back in the 70s is this idea that things have to be acceptable to people so that they'll actually use them and not try and circumvent them.
Just real quick question on that around authentication because that resonates with me. Right? You know, I've had past experience inside the government, inside of government contracting. I come from the Red Team operations space myself, and I've always been a supporter of passwords. Right? Just super complex passwords that help you to authenticate. And that particular problem is not one I've thought of. And as you were talking, it kind of resonated with me for a moment there because these are critical times for patients, especially in that moment. I mean, it can be. And any delay in time from treating the patient until when a doctor can see them and and get on the computer systems or or things that they need to access to be able to treat them is critical in my perspective. In doing that, are there current solutions out there to this problem, this authentication password delay problem that are currently in effect?
Yeah. I mean, there's some really high-tech approaches. There's some really low tech approaches. Like low tech is you put as few barriers between the doctor and the patient as possible. And that may mean for certain capabilities that are computer connected, that may mean no password. And the protection that you might fall back on is, well, it's in a physically separate environment where there are other more dangerous things that some bad actor could use if they really wanted to. It may be things like more seamless authentication, frictionless authentication. So a proximity card instead of a password or a single sign on throughout logging into the computer, getting into one, two, three, five clinical applications at a time and having them bring up the connections.
So thinking through what that workflow needs to be in order to serve the mission of the organization, whatever that mission is, and the requirements that they have, the things that keep them going. I think that's really key and critical to building any part of a security system, whether it's authentication or intrusion detection or antivirus.
So by proxy card, just because I don't necessarily know exactly what you mean by that, but in my mind, like, I'm holding up a credit card that happens to have a Wi Fi or wireless authentication piece that's attached to it. Right? And anytime I go into a wireless authorized paying system, I can just kinda swipe my card and it authenticates and uses uses the stuff that's embedded inside the card, and then it authorizes and charges my account. Are we talking about something like that?
Yeah. Something like that or even easier. I won't hold the front side up to the camera, but this is my DHS identity card, my CISA identity card. It's got a chip, like your credit card that you plug it into the computer and it reads it. And that gives in addition to my pin, which I know, something I know and it never changes. This gives me the ability to really quickly and easily authenticate. There are also systems where it's a prox card like badging into a building, right? And so you get close to it and you can uniquely identify yourself. And there's some challenges with some of these approaches but by and large those are overcomeable with a little bit better engineering. We just have to apply ourselves to that. And I would take a different perspective of you as loving passwords.
I don't love passwords at all. I kind of hate them. And I think that passwords, when you had very little memory space, we had very few inputs, passwords were a simple approach to being able to secure authentication. But we tell our kids stories about Alibaba and the 40 thieves when they're two to five years old, right? It's about bad password management. We've been doing this for a couple of thousand years and getting passwords wrong. Why would we think that introducing more complexity in more technology would all of a sudden fix that basic fundamental underlying thing? Because again, going back to psychology, passwords tend to be harder to manage than something you might have on you.
It's not always about the particular technology or tool that you're focusing on behind those things. It's a human. And so human values, I think, that come to the core of a lot of these things. And how do we solve the human, the human humanistic approach to these things? That's interesting.
I think this anecdote of, like, experiencing first or secondhand, like, what it's like to work as a doctor in the ER and understand the needs of the technology. I think it's really I always find it really important to talk about the like practical sense of security. I think like it's stories like this that remind me why it's really important to get folks from all different backgrounds into this industry. And like, you know, I have I have very strong feelings on the kind of some of the gatekeeping that happens in this industry about, you know, requiring certain formal education and whatnot. And I think it's it's stories like this that remind me like we need everyone with all different backgrounds so that we can approach real problems with the background to know the requirements.
Yeah. And a quick little story. So in '20... I think it was 2020 at the RSA conference, RSA has sandbox spaces and they're little self contained subject matter areas where you can go in and learn about things. In some ways it's a respite from the RSA vendor floor where you're just walking a gauntlet to get through to go to the place you're trying to go and getting a lot of sales content around you. But these are much more community led, community driven. And of the things that they recognized was that there wasn't any content really like this for supply chain and supply chain was increasingly becoming prominent. And so Cecilia who headed up RSA Sandbox said, Beau, why don't you come and create something for us? And so supply chain security was at that time not really sexy.
It wasn't the thing that was on the tip of everybody's lips. And so the challenge was how do you make supply chain security interesting? You can try and scare people. That's one way to go about it. That's the typical way that we try and bring people into something and get them interested. But we took a different approach, which we said, if we can bring people in and get them to have fun and enjoy this and learn things as a byproduct, then that would be really cool. Yeah. We're gamifying it. And so we went a 100% games. What we found is that we created something that really drew people in and and caused them to stick around for a little while. And then also it sent them back to their offices, back to their businesses, thinking about supply chain security differently and understanding that they had to team up with their procurement officers.
Procurement is the heart of supply chain. And when you're buying things, you can either try and secure it once you get it or you can build better selection criteria for what you get so that it's more secureable or ideally do both. Right? So how do you work with your supply chain people, your procurement people? How do you work with the CEO, the CIO, with your legal team, all of these other constructs? We actually built some of that into a game where we had three roles, CIO, CEO, and CISO. They had three different win conditions and we had them compete with each other. Right? You can win alongside each other, but you can also win at the cost of someone else. And what was really fun and interesting is to see CISOs just light up like, Oh, this is what a CEO values and this is why they've made some of those decisions, right?
So we kind of put them in, it was like a role playing game. We put them in these decision paths where they had a little bit of cognitive dissonance, right? They could go down the path they would go down as a CISO or they could go down the path they would go down as a CEO. And then they became a lot more aware of those types of trade offs and decisions that a CEO might be facing. That was very widely liked. It was one of the reasons why I got recruited to come into CISA to bring some of that private sector knowledge and experience, that creativity, that imagination and the playfulness into CISA to help out to transform the culture within the organization.
That's interesting. Certainly always been a fan of gamifying things and I've seen huge value. From some of the experience perspective, I was wondering if you could talk a little bit more about that. I know, as you said, you've gotten the opportunity to work or take a look at some of the medical devices or medical medical industry, and you're currently working on some of the medical devices and other kinds of IoT research. Is that correct?
Of my first jobs, I alluded this earlier, but one of my first jobs in the infosec field was at a hospital. So I've got a little bit of a background in medical and healthcare. So a few years ago, some friends of mine and I started building an initiative called I Am the Cavalry, which several of the listeners might have heard of. It's essentially an attempt to kind of change the way that we do things with insecurity so that we're getting more on the side of solving problems rather than pointing out problems and building with nontraditional teammates to come to common objectives more quickly. And that led to some work with the FDA, Medical Device Makers, with the Biohacking Village Device Lab, which I helped stand up and found and brought everybody together under that. When I joined CISA, it was during COVID and we pivoted really quickly from a generalized help CISA become better at private sector engagement into let's build a COVID task force to help across the entire healthcare ecosystem.
Everyone get a little bit better, a little bit smarter, a little bit more safe. And there was a number of things that we did there including some pioneering work working across CISA, across government to identify the top supply chain organisations that could have an impact on vaccine delivery and healthcare delivery during the time of the pandemic, including building out some new capabilities and ways of working within CISA to engage those communities where they were rather than kind of hoping that they would come to us. We built out some new guidance documents like the bad practices, like stuff off search, like some of these other things that were a little bit more healthcare targeted and focused or at least inspired by healthcare. Even though everybody has some of the same common issues, it kind of started with that. And we worked really closely across the healthcare ecosystem, not just hospitals, not just pharmaceutical manufacturers, not just medical device makers, but bringing in doctors, talking very regularly with different parts of HHS, that is the US Department of Health and Human Services, to ensure that we've got a whole of industry, of community, whole of nation, of world approach to really solving some of these common issues.
You mentioned something like to meet companies where they currently are rather than expecting them to come to you. What do you mean by that approach and why is that important specifically within the health care field?
Yeah, so the traditional government approach is if we put it out there, they will come. And I think that's been something that at CISA we've tried to change that dynamic because we recognize that in our role, which is a little bit different than other government agencies, we have to be a little bit more proactive. Right? We're we're tasked with partnering up with the private sector, with going and and meeting them where they are. And so we've got actually a really large field team that's out in the regions. We have 10 regions across the country. We have hundreds of people out in those areas where we can send them out and they'll go and they'll talk to people in the region. Know they know the common zeitgeist in those areas. They know what's going on. They can identify a little bit better. So we do things like have those regional teams host some meetings and some other little groups in the area.
We also have made a big push particularly in healthcare, particularly during the pandemic to reach out to other organizations that are already doing stuff in this area, right? In healthcare.
And it sort of sounds like I think there's a big trend right now that I hear about a lot in security too. I mean, there's like a bunch of different buzzwords for it, basically to move away from identifying the problems that already exist and move more towards coming up with solutions beforehand, I guess. I think that particularly in healthcare, that's got to be really important to try to shift away from like, Hey, look at all this stuff that's broken and move into that more proactive approach.
Yeah, it's hugely important. I mean, if you look at the lifetime of a medical device, let's just take an infusion pump, it's like a digital IV. It's probably the most common medical device in hospitals. And that device will be able to save patients' lives for twenty plus years. Now, it might not be what we would think of traditionally as securable for twenty plus years because the operating system will age, the firmware will age, the software on it will age. But it will be clinically relevant a couple of decades before you have to replace it. So if you go to a medical director of a hospital and say there's a small chance that if this series of events happens, it could result in worse patient conditions one day.
And the alternative that they see is, well, let me take a bunch of my budget that I would put into personal protective equipment or bring on new nursing staff or new training on lifesaving procedures and use that money instead to replace this still clinically relevant device. It doesn't serve their mission. And so that's what you see a lot in healthcare is that they're looking at some of these trade offs and they're not willing to replace systems that still work to serve their mission. On the other hand, if you can get ahead of things and help them to build better procurement processes, help them to identify more securable technologies that have better business models that will have greater longevity, then you can kind of stop the flow of inbound insecurable devices. And over the next decade or two, eventually that kind of cyber hygiene tideline can rise.
Right? You can equip them to be better able to defend so that when they do have budget for security things, they can pretty quickly put them towards those.
How do you address some of the concerns that I think others in the federal space have raised around inability to shift left. Right? There's a quote that's out there of of an individual that has stated our capacity in cyber from both a federal and DOD perspective when compared to the commercial sector is that of a kindergartner. Right? And I only ask that because from a process perspective, like, what are some of the things that are inhibiting us from moving in a more agile fashion?
So I've worked in private sector most of my career. I've worked a couple of stints in government. I've worked closely with government agencies, with folks in Congress. And I think that there are misperceptions on both sides about the capabilities that the other has. Right? I think government has a lot of incredible capabilities to bring to bear in cybersecurity. They've got a lot of different types of levers that they can pull that the private sector just can't. At the same time, the private sector has a lot of levers that the government just can't pull. They've got different motivations, different incentive structures, right? So where private sector generally is profit motivated, they're trying to serve the most profitable markets. Government has to look across all of society and say how do we ensure that we take care of the needs of everyone at the same time. And so they've just got different spaces which doesn't mean that there's not room to learn, each learn from each other.
So there's definitely things that government can learn from the private sector. There's things that the private sector can take direction on from government and there's things that the government can do to encourage and nudge a greater improvement across the private sector. I think if you look in terms of raw capacity, what is the best of the best, I think that private sector has a lot of just amazing capabilities. There's no doubt about that. But if you look across the entire ecosystem, what you tend to see is that even though the best capabilities exist, not every organization is or can take advantage of them. There's organizations that we call target rich and cyber poor. And these are organizations that maybe they can't afford to have a large team like some of the private sector companies spend hundreds of millions of dollars on security a year.
Now, if you go to a company that's making a couple of million dollars a year and say, well, you got to spend $400,000,000 a year, they look at you like you're crazy. Right? It's just it doesn't even make sense to think about it that way. And I think that's where actually government and CISA has a great role to play is to help bolster those organizations that maybe can't afford to spend a ton of money that maybe are kind of lost to begin with. We also put out a lot of guidance. And when a private sector company says something, it gets a certain amount of attention from a certain type of group. When the government says something, it gets different types of attention from different groups. So one example is the bad practices that we put out. The bad practices document, everybody has best practices or good practices. There's hundreds of different lists that you can look out. CISA has its own set of good practices, effective practices.
But the bad practices is meant to help prioritize. These are the things that we know reliably fail or that reliably allow adversaries to gain a foothold in an organization or cause some type of harm. So even if we can't do all of the hundreds of things that are in the best practices, can we just avoid doing these three things or five things? Right now, the list is at three, but there are some candidates to grow that. And they're generally unambiguous. They're not technically complex things to do in most cases. They're not expensive in most cases. They're just things that we know work really, really well. So let's put that out. Or the known exploited vulnerabilities list that we put out. You know, of all of the vulnerabilities that you might find in your systems, and there's, you know, hundreds of thousands of vulnerabilities published every year that have deep supply chain roots, these are the ones that are actively exploited by adversaries for some gain on their part and some harm to organizations.
Can we just start with patching those and make sure that they don't exist or don't exist on our perimeter? We've got a document, get your stuff off search. And the idea behind that was a lot of organizations don't know their footprint out there. So how can we help those smaller organisations to get better at that?
I think these kinds of conversations are what I like most about talking about cybersecurity, not just what's bad, what's scary out there, but how do we actually make use of all that information? And it reminds me a lot of something that... So I have a background as a penetration tester. I've gotten to interface with a lot of customers about how to secure their stuff. I feel like something that I consistently get to teach or discuss with customers is the idea of risk focused or risk informed security. And so like this concept of customers or organizations are really everyone being so overwhelmed by these massive lists of like, here's all the good security stuff that you could be doing. It's so important to get to cut that down and say like, Okay, sure, there's everything that you could be doing. But let's talk about the actual risk posed to your organization based on the things that you have, the assets, the the technology, the infrastructure, whatever.
Yeah, I think you're absolutely right. Like so I I also have a background. I started in penetration testing, know, some blue teaming, also some red teaming, and had to transition into talking to to my clients, my customers about risks because, you know, the risks from one type of vulnerability, let's say it's a CVSS 10, the risks from that might be significantly less than the risks from what would be a CVSS five in a different system that's part of a different value chain for them and part of a different business line. It forces you to understand their perspective a little bit better. One of the things I used to love doing, I did probably 40 to 50 different clients a year, is just going in and learning their different business models.
There's a bunch of different things that people do out there. There's a bunch of different ways to make the world a better place. And if you can learn from those individuals and those organizations what they do and how they do it, then you just you're a lot better at doing what you're supposed to be doing for them which is to really help manage rather than eliminate risk. One of the things that one of my mentors used to say is business is in the business of taking risks. So if you're trying to eliminate risk from what they're doing, then you're not helping them.
Yeah. I mean, the birth of innovation is with risk inevitably. And so how are you gonna innovate, and how are you gonna grow, and how are you going to bring value to the marketplace and expand upon current products if you don't if you don't take risk? And so I totally get that. You mentioned something which is really interesting, and I kinda wanna quickly circle on that, which is CVSS ranking. Right? Like, that's a guideline. It's not necessarily meant to be like, if you find something that's a CVSS 10, then sure it might be a CVSS 10. But at the same time, if you've got current mitigations and defense and depth put in place, then that CVSS 10 might drop to a CVSS five. Who knows? It just depends on your specific environment. And I really like the fact that you said you spent some time getting to know the business processes because that directly relates to what these things can be from a risk perspective to the organization.
And separately, a lot of individuals don't necessarily pay a lot of attention to, say, CVSS 3.5 and CVSS fours. Once it gets to a five, they start looking at it and beyond. But you can chain things together that are three point five and four to get it to be a 10, especially if you can get that remote code execution, which is interesting in and of itself. I don't know what you think about that. But
Yeah. Absolutely. And, you know, different different architectures, architectural designs will give you different types of results. So, you know, what I'm thinking about here is is, like, there are a lot of medical devices out there that are built with a principle of separating the network connectable piece to the patient care delivery piece. So there's a telemetry that goes out potentially and there's some ability to communicate with the device to get that telemetry so that for instance, can report it back to a nursing station. But the part that interfaces with patients doesn't connect to the network or it's not supposed to connect to the network at any time. And so sure, like this is something I see all the time in healthcare and in other spaces as well is, sure you got remote code execution on that thing, but that doesn't really matter.
Like you're going to be able to get some telemetry data that doesn't have patient information in it. You can't shut the whole device down and cause harm. So like what's the real risk there? It's being able to interrupt the flow of information and you increase costs because a nurse has to come up and go check every once in a while. But it's also fairly fixable because you can just reboot the device and it comes back with a static image, there's no persistence. And so like some of the treatments that we have for that type of capability, by the way, was not put in for security reasons. Solid engineering teams have been doing that isolation, separation, containment for many, many years just so that things don't accidentally fail or so that when one system fails, there's a backup process or something that's more robust.
So with these risks and the complexities of dynamic environments that that you work in and that, Bella and I have seen in the past, is there a place for more cybersecurity regulations to force, if you will, organizations to comply with certain things with regards to breaches or implementations of certain security measures?
Yeah. So CISA is is not a regulatory organization. It's our charter to work with private sector as well as government in a more collaborative way. So I think that there's a lot that we can do from that standpoint in order to improve cyber security, information security and really safety and resilience of our nation, our national critical functions that don't involve regulatory requirements at all. I would love to see more people from our community, the hacker community, the security researcher community come and work with government, whether it's from a position inside, whether it's working together on the outside and advising, whatever the role is. I think that there's a lot of strength in being able to team up with government agencies, with congressional groups, with whatever state, local, territorial, tribal or even going international, the local government wherever you happen to be.
There are some really, really good programs to bring folks like nontraditional hires like myself into roles at CISA, into roles at Health and Human Services, the White House, Congress, etcetera.
Well, I think that's one of the first steps that government's doing right. You know what I mean? It's bringing folks in like you and wanting to partner with influencers in the industry like the hacking community and those who are who are having an impact and are passing great advice. I think that's kinda like step one in trying to trying to change the culture and trying to do what's right.
The last question that I wanted to ask just kind of reflecting on a lot of the stuff that we've talked about today, we've kind of discussed this idea of understanding risk and kind of, I want to say like a smart way to approach security, which sounds really cheesy, but it's fine. I'm wondering if you have any last thoughts or last advice for folks that are in the security industry, but ideas on how to better perform our jobs and responsibilities in security in that smart risk informed way?
Yeah. I'd say no matter what you're doing, ask more questions than you give out answers. You know, none of us is an expert in everything even in our very narrow fields. And if you can better understand and empathize with the people that you're working with, that you're trying to help, you'll do a much better job and you'll come away from the experience knowing a lot more and having built better rapport with the folks that you're working with. I think empathy is an underdeveloped skill in our community and I'd like to see us all try and develop it a little bit more both with ourselves and encourage it a little bit more with our peers and the others that we work with.
One last question, from our side is, something we ask, you know, everyone that comes on the show. What's something people wouldn't be able to identify about you based off of your LinkedIn profile?
Oh, tough. Tricky. Well, now that I've updated my LinkedIn profile, I've got a, you know, dyed mohawk, they can identify that. Let's see. God, that's such a great question. How about that I was taught how to throw a curveball from a professional Major League Baseball player? Nice. That's cool.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating people that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's we're in [email protected].
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
