Woods 1

Loading...

Del curso dictado por University of Florida

TECH MeD: Transdisciplinary Education for Critical Hacks of Medical Devices

3 calificaciones

Explore Related Videos

At Coursera, you will find the best lectures in the world. Here are some of our personalized recommendations for you

University of Florida

TECH MeD: Transdisciplinary Education for Critical Hacks of Medical Devices

3 calificaciones

This course seeks to create an informed public, aware of the technical, medical, legal, and ethical issues associated with implantable medical devices. The course features conversations with experts from a variety of relevant fields to discuss the present and future technological, ethical, legal, and social challenges associated with implantable medical devices. DISCLAIMER: This course is intended for educational purposes only. None of the information provided in this course constitutes medical or legal advice. If you have medical or legal questions, contact your physician or attorney.

De la lección

Technical Issues Part 2

Radcliffe 11:00

Conoce a los instructores

Lauren Solberg
Assistant Professor
University of Florida, Department of Community Health & Family Medicine
Michael Bachmann
Associate Professor
Texas Christian University, Department of Criminal Justice
Adam Shniderman
Assistant Professor
Texas Christian University, Department of Criminal Justice (Former)
Molly Weinburgh
William L. & Betty F. Adams Chair of Education
Texas Christian University, Andrews Institute of Mathematics & Science Education
Brittany Bachmann

Texas Christian University

Yeah, sure, so when we first started chatting,

I said that one of the things that makes this problem tricky, and hard, and

different from earlier instances of data security is attribution.

So if you think about, the data security problem that a hospital faced 50 years

ago, it was basically people gaining unauthorized access to the building,

right?

And if you had cameras, you could see who was coming and going, and maybe a badge

system would help, but you sort of knew who was going into which rooms, right?

And if it turned out that a room had been broken into, you could go back and look at

the logs and see who had gained access to that room at a certain time, right?

And it wasn't too hard to attribute the source of the problem,

you had a high likelihood of knowing who caused the problem.

That's really not true in the cyberspace.

You look at your logs, if you are even lucky enough to have discovered that

there's been a breach of your security.

And it will appear as if the attacker is coming from my grandma's house.

I mean, because now the attack will be routed through a hop, and

then a hop, and then a hop, and then a hop.

So it'll look like it's coming from a nice person,

a law-abiding citizen's house in Sweden, and

if you were to respond to that, you would be responding to the wrong person, right?

It was actually a state actor who routed it through a private home in one country

to a business in another country to attack a government entity in another country.

That problem is very real, it's not limited to medical devices, but

it's a very real problem in all cybersecurity contexts, right?

How do you respond to an intrusion if you aren't certain about where it comes from?

And certainty in this space is something that you never have,

all you can do is have a high level of confidence about the source.

But let's say, even hypothetically, that you had a very high level of confidence

about where the source was coming from.

Who's the right actor to respond to a cybersecurity attack?

That's another open and tricky question, right?

Say that it's an American company that makes a medical device that has been

hacked to learn about the vulnerabilities in the devices, right?

That's a very scary and real possibility, maybe the intruder was actually just

looking for intellectual property because they wanted to copy the design and

sell cheaper devices, right?

But they also learn about vulnerabilities, and the company brings this information.

They discover that there's been a breach, and

they bring this information to the American government.

And the American government says, it's a little bit like when you show up at

the cops, at the police station, and you say, my bike was stolen, right?

The guy, he's drinking his coffee and he kind of chuckles and says, yeah, you and

everybody else.

I mean, what do you want us to do about it?

There's only so much we can do,

we're dealing with just untold numbers of intrusions.

We'll deal with yours when we get to it, which may mean never.

This is starting to be addressed and fixed, and

there's a closer relationship between private companies and

the government than there has been in previous years.

But private companies very much feel like their hands are tied and

they can't go to the government to get help when there's been a cyber intrusion.

And a number of people have floated the idea that these private companies could

attempt to hack back at the person who attempted to gain access to their network,

or maybe gained access to their network.

So the so-called hack back debate is happening now,

it's incredibly complicated.

So, first of all, under American law it's probably illegal to launch a hack back.

I mean, however you gain access to that person's network,

even though they've intruded yours.

You're very likely violating the Computer Fraud and Abuse Act because

you're gaining unauthorized access to their network, right?

That's the law that we were talking about earlier.

Suppose it's an international actor, or suppose this all happens outside the US,

and the CFDA doesn't have extraterritorial reach,

so this is happening outside of the realm of the law.

But if an American company responds to an attack, That they think came from,

let's say, the Chinese government, right?

So they respond by attacking an IP address that they know is linked,

or they think was linked, to an attack on their servers.

What's the Chinese government's response going to be?

They're going to say the Americans are attacking us, right?

And they may launch retaliatory attacks on the US, not necessarily aimed at that

company, and the American government is going to be very concerned about that.

And so you could have two private entities, right?

An IP thief in one country who routes, let's say, they're not in China,

they route the attack through China to make it look like it's a Chinese company.

The American company thinks it's the Wild West, there are no laws regulating this.

We've got the advice of smart lawyers who told us that we can do this.

They fight back, right, and now the Chinese government takes it seriously,

defends their companies, and attacks back, and now we're talking about cyber warfare.

I mean, that's a fancible scenario, but it's not impossible to see, and

the reason it's so scary is because attribution in this space is so tricky.

Explora nuestro catálogo

Inscríbete de manera gratuita y obtén recomendaciones personalizadas, actualizaciones y ofertas.

Coursera brinda acceso universal a la mejor educación del mundo, al asociarse con las mejores universidades y organizaciones, para ofrecer cursos en línea.

© 2019 Coursera Inc. Todos los derechos reservados.

Descargar en la App Store

Consíguelo en Google Play