I'm Mary Ann Kolpasek Lege, Executive Editor at Information Security Media Group, and I'm here at the HIMS Cyber Forum in Boston, speaking with Ali Yusuf, who is Director of Medical Device and Emerging Tech Security at Henry Ford Health. So Ali, as we know, a funding bill late last year granted the FDA-enhanced authority over medical device cybersecurity, and starting in October, the FDA will apply a refuse-to-except policy under which the agency can reject pre-market medical device submissions that lack important cybersecurity details, such as plans for addressing vulnerabilities and a software bill of materials. How hopeful are you that these new regulatory demands on medical device makers will eventually improve the state of medical device cybersecurity in healthcare settings and why? Yeah, I'm very excited that this is happening.
I think it's way overdue. I do think that the focus is really on the, the FDA's jurisdiction is really the medical device manufacturers, and I think more needs to happen on the HDL end of things. But I do believe that over time this will improve the situation with medical devices. Unfortunately, like people in my position were left dealing with legacy medical devices that may be 10 to 20 years old on our networks that we have to continue to deal with.
It's a very positive step in the right direction. It's very exciting. You mentioned also the legacy devices. That is a top challenge that many organizations do face right now with their current inventory of medical devices and other IoT devices for that matter.
How are you tackling that? What are some of your tips that have been helpful to you that other organizations should really think about? Sure, yeah. I mean, I think when you're dealing with those types of devices, there aren't a lot of ways you can address it.
It's essentially segmentation is what it boils down to. You have to segment them so they're not with a general population of devices, you know, either using VLANs or some other method and really restrict what those devices can have access to on the network. If you were to make a demand on medical device makers in terms of them improving the state of security of their legacy devices, what would you request them to do and why and is it doable? That's a great question.
I mean, unfortunately, I think once they develop the latest generation of devices, really the older legacy devices are no longer top of mind. And I think medical device manufacturers are looking to sell the latest and greatest device. So it's not in their best interest from a financial standpoint to continue to support devices that are end of life. But yeah, I mean, I think they do the best that they can, but really what's ironic about this is where what is happening in this field is essentially there's another type of company that has sprung up, which is the medical device security management organizations and platforms.
And what they're doing is they're allowing healthcare delivery organizations to continue to use legacy devices beyond their normal lifespan. In that way, illustrating some form of an ROI on these types of tools, it's really not falling on the manufacturer to support them because if you're dealing with a Windows XP operating system, they're essentially putting their hands up and saying, you know, you have to update the latest version. We cannot support it in that state. So now besides medical devices, what other IoT or medical IoT sorts of gear in healthcare settings need more attention and sort of keep you up at night?
Yeah, so building automation systems, HVACs, cameras, different types of sensors, like refrigerator sensors were a huge deal, especially during the pandemic. Those types of devices, in certain scenarios, in certain settings, they could be life-critical. Like I'll give you an example. If you're dealing with a temperature system or an HVAC system, in the context of an OR, that could be a life-critical situation.
If the humidity and the temperature are not just right, you don't think about it in that context usually, but when you put it in a hospital, in the context of a hospital, they can have severe ramifications that it wouldn't, you know, elsewhere. And I guess the same would be true for like lighting systems and things like that in the OR and all those other sorts of things. And in terms of looking ahead to next year, overall, are there any top priorities or predictions that you have involving cybersecurity in general and healthcare, but then also when it goes back to the devices? I think things are going to continue to get worse as long as people continue to pay the ransom.
It's just too easy of a way for these criminals to make money for them to stop. I think from that standpoint, I'm not too hopeful, but I am glad that the FDA is being funded appropriately to tackle this. I wish the Joint Commission and other organizations that really deal more with the health delivery organizations can start sort of enforcing some of this as well. And really mandating that healthcare organizations have medical device security programs and things of that nature.
Right now, it's not something that's mandated or enforced. Well, thank you so much, Ali. I've been speaking with Ali, yourself. I'm Mary Ann Kolbasak-McGhee of Information Security Media Group.
Thanks for joining us.