I'm Mary Ann Kolbasak-Migay, executive editor at Information Security Media Group, and I'm speaking with Mitch Parker, CISO of Indiana University Health, about so-called smart contract security in the healthcare supply chain. So Mitch, for starters, briefly describe what so-called smart contract security is and how does that pertain to the healthcare supply chain? Smart contracts are pieces of executable code that can run as part of a distributed ledger technology system, and they're relevant to healthcare supply chain because a lot of the new enterprise resource planning systems that we're putting in actually support those as a way of doing data interchange. So what we're trying to do here is explain how to secure those so that you can have workflows more secure than what you have currently now for electronic data interchange.
Mitch briefly described how these smart contracts work. So the latest works is that these distributed ledger technologies, usually based on either a theory and more hyperledger, have the ability to run executable code based upon certain triggers, such as when a transaction occurs, and what that allows you to do is take actions based upon the conditions of that transaction or of other certain external factors so that you can, instead of just having a transaction occur, have a number of subsequent actions also take place. So Mitch, as the supply chain is moving from an era of customized enterprise resource planning and manufacturing resource planning systems to cloud-based technologies, what are some of the biggest security risks that healthcare sector organizations face and how does smart contract security fit in with this? We originally designed security for our supply chain based upon point-to-point interchanges.
Over the past 25 years or so, we've moved towards what are called consortia. So a big example of that in healthcare is actually Visian, where you have group purchasing organizations, you have organizations partnering together for financial advantages. So we've built security around point-to-point security, we haven't built it for consortia. And so the aim of what I'm trying to do here is illustrate how to build security in for consortia so they can more efficiently operate and protect their interests assets.
And what are some of the security concerns related to supply chain consortia and some of the things that the smart contracts could help with? Is it a matter of protecting the data related to the supply chain transactions? Is it a matter of actually protecting the supply chain? Give me some samples.
So example is that your legal contracts now can actually be executed as code. So there's been rulings that I believe in state of New York that say a smart contract is actually a legal binding document. So what you have in place here is you have a lot of code that was at one time developed for these point-to-point systems and you have this large concurrent environment that codes expected to run in. And the challenge is that code and processes that work in a what I call single thread environment don't work very well in a multi-threaded, multi-player environment.
So the approach we're talking about is putting processes in place to protect that code, protect your processes and protect your network so that you can efficiently operate in a multi-stakeholder environment. So Mitch, overall, when it comes to this supply chain, what do you think are some of the most concerning cyber threads and risks facing the healthcare sector right now? I think the biggest one out there is the fact that we have an approached security for this with, at the same level, we have medical devices or we get it out of things. I think that there's a lot of people that think, oh, blockchain distributed letter technologies, because they use technology and cryptography, they're actually secure.
The truth is that there is a whole new class of vulnerabilities that we have to be aware of and a whole different set of processes we have to be aware of to be able to successfully integrate these into our environment and be able to do so without putting the organization at additional risk. So Mitch, how should healthcare sector entities be preparing themselves for cyber attacks and other cyber incidents that do impact their supply chain partners? I think the best thing these organizations can do right now is to find themselves a very good business partner. People that understand this sector very well are rare and there's a lot of very good companies out there that have experience with this that are willing to share and, more importantly, are available to assist your organization and I think fighting that good partner is going to help you get on the right path to be able to address these issues.
Mitch, in terms of distributed ledger, blockchain technology, aside from the supply chain, are there other promising areas where you think those technologies need to be applied to help security or are there any other promising areas that the organizations like your own and other healthcare sector organizations are testing right now to see how they work? I think one of the other promising areas is potentially used in trusted exchange framework to facilitate data interchange between different healthcare organizations and being able to do so while being able to track data problems. I think that approach along with some of the work you're doing with centralized identifiers could really have significant benefits for interoperability in the future. I think those use cases are being explored right now and there's numerous companies doing so.
Some of the work that's being done in that area, very specifically the integration of blockchain with fire and some of the work that the fire chain group out of Vanderbilt is doing. I think there's a lot of promise there with TEFCA. I think there's a lot of promise with decentralized identifiers. I think that there's potential for those use cases.
I think there's a lot of broad basis cases out there, but centralized identifiers not actually had one other one on, which is pharmacovigilance and provenance of ingredients and drugs is also significant as well. I think this year we're going to see a lot of companies talking about what they're doing in the areas of interoperability, data interchange, cold chain, and obviously tracking of drugs and drug ingredients. And finally, Mitch, one last question related to smart contract security in the supply chain. If an organization deploys this process or this sort of concept and procedures in their organization, does it mean that they need to replace, for instance, existing ERP systems or is this sort of a compliment to that?
Do they work together? What's involved? Well, one of the things is talking about the need to evolve the ERP system and we look at this from the evolution of where computers came from. The whole purpose of developing the cobalt language back in the 60s was for the sole purpose of doing data interchange on behalf of DOD.
It was originally to help out their supply chain and to be able to help them with their business operations. So if you take a look at that and evolve into the future, you can't build a modern system based on technology from the 1960s. And we look at this as you've got to have the right system in place to be able to take advantage of this and keeping a legacy system means that you're keeping your business processes back in the past as well. Your old ERP systems from 20, 30 years ago, it's great that you can keep them operational.
However, the continued operation of a lot of these older systems actually presents additional risk to your organization. So moving up to more efficient cloud based technologies and where ERP is going allows you to open up and innovate and think about utilizing some of these newer technologies to improve your business. Thanks, Mitch. I've been speaking to Mitch Parker.
I'm Mary Ann Kolbasak-McGhee of Information Security Media Group. Thanks for listening.