Securing Your Devices for the Quantum Era Mark Omo

Hey! Good morning!

Hey? Good morning! How are you?

Not too bad! How are you?

Pretty good busy. we yeah. We launched a newsletter, and it really just turned out to be a huge bunch of work in Kajabi. It was a nightmare. It's a blog. It's a newsletter. It's a landing page. It's this. It's like, by the time we're done I just want to rip my hair out.

What was this newsletter for.

A different client. About. It's called the EU Mdr. And Ivdr. Insider.

Oh, yes, I saw that is that with Michelle.

No, it's with Basil.

Oh, okay.

How do I have to admit these people? Hmm!

Nice.

Good morning!

I'm just promoting everybody we're trying. Don't know where Joe is.

Because Mark is the star of the show tonight.

I guess I'll do it.

Good morning!

Hey! Good morning!

Hmm. okay.

Everybody.

Hi Michelle!

Is anybody going to matrey in dollars in February? No, okay, just asking. And also with the fire in California. I've never been to 10 x. So I don't know where the location is. How close is it to La Area? Not that.

Close.

No.

Emails.

Yeah. yeah. With any luck, it'll be history. By the time 10 x even gets close. Exactly.

Okay. Just checking.

Oh, yeah. So how's everybody doing? I didn't you go around the room while we're waiting for everybody to join? Still trying to figure out where Joe is.

So far, so good. We've got for South Texas. We have cold weather which equals 40 degrees. Nothing like my old Minneapolis, Boston, North Jersey, stomping grounds.

In North Jersey, Rick.

We're living up we were living up in Packetstown, where that big Hershey's factory is, and the whole town smelled like peanuts and chocolate whenever they were making that.

Right.

Does anybody know anyone in the Los Angeles area been horrific news out of there?

California. Yes, Los Angeles, no, all all my relatives in California are doing okay. So far.

yeah, I know we've got one friend. And she works for the the getty museum and thankfully, she's over, here, but I have no idea. We haven't had a chance to find out whether her neighborhood has been affected.

Well, that museum is pretty close to where the fires are.

Yeah, so.

My brother lived in Studio City, right where I don't know if you saw the videos of it. But right along the canyon there it's all burnt up. It didn't get as close to where his previous house was, but it was pretty close. He would have definitely had to evacuate it.

My wife and I just re-ran 2012 that disaster, that world disaster movie. And when I when I saw some of those pictures of California. It. boy. It looked just like it.

Oh!

Unfortunately, it's not.

Yeah. Well, my wife insists on watching those horrific horrific shows of all that property porn in that Los Angeles area. These 1 million dollar listings, or whatever. and I dread to think what some of those things are now.

Hmm.

I saw on subreddit a lays in fire, and it said. This house is presently listed for 35 million.

Jeez.

And thinking they should have taken 25 million when they could have. and reading about how State Farm recently canceled a whole swap of buy your insurance for the area.

Oh, wow!

Yeah, I saw that post was terrifying. People basically losing everything. Imagine losing your home. so let's go ahead and get started. I'm going to keep promoting people as they join, or Joe can. I'm really pleased to introduce Mark Omo today from Marcus engineering in Tucson, Arizona. And Mark is going to be telling us about post quantum cyber security and what it means for you and your medical devices. And what's really interesting to me is that in in, we're, we're talking about anything, any connected device, any hardware, anything that has any connection to the Internet

whatsoever, or can be connected to the Internet. And so the implications for hospitals and hospital networks as that that have devices that that might be insecure. So anyway, I'm not going to talk anymore. Because that's what Mark's gonna do.

Hey? Good morning. It's great to great to meet everybody. So like John said, we're gonna talk about post quantum encryption. So one of the the things is, if you're planning a device now, or you have a device on the market, it's going to expire. You're gonna have components in it that are not going to be allowed in the future. I hope everybody wants to know when that's going to happen. So a little bit about Marcus engineering. So we do medical device design and development. We make stuff that you can touch. We make real devices. We don't make Samd we don't make things that float around in the cloud. We deal with product security, which is what we call security of physical devices. Physical?

alright, you know things you can hold. And so most cyber security that you see today, most cyber security people do is you know, protecting clouds, protecting websites, networks, that kind of stuff. And that's not where we specialize. We specialize in stuff that you can touch. So I was talking a little bit about cryptography. So it's how we secure sensitive information, protected like pii medical devices, data that flows around. You know everything. Almost everything that you touch today is protected by cryptography. And so its security is really, fundamentally based on these kinds of problems that experts consider very hard. That's how we build cryptography.

And so quantum computers can solve some of these problems a lot faster than traditional computers. And some of these problems include these hard problems that we rely on for security. It makes them not nearly as hard as they were in the past. And so that means that some of this current cryptography creates a need for what we call post quantum cryptography, which is hard problems that are not made significantly easier by quantum computers. So you guys may or may not know that in November, just a few months ago, NIST the National Institute for Standardized Technology released its 1st guide. About what

post quantum, about what post quantum cryptography is required, and the timeline for its rollout. So how long do we have before you have to transition to it? And what are the recommended recommended replacements for it? And so so I'm sure all you guys are familiar with the FDA cyber guidance. It tells you that you shall follow NIST's recommendations. They're not just recommendations from the FDA perspectives. They're requirements. And so it requires you to use cryptography that's going to be that is strong today, and that will be strong through the lifetime of the device. It's OY. Their guidance is going to deprecate

cryptography. That's not quantum resistant in 2030, and you can see here the FDA specifically calls this out that you shall not or should not implement cryptographic algorithms that have been deprecated or disallowed by NIST or any of the other controlling organizations. So there's only 5 years until a large swath of current cryptography is going to become deprecated and disallowed for use and devices, services, all kinds of stuff. And so so I have a question for everybody. What what do you guys think the average age of an on market medical device is? I ran a report to see for devices actively on the market who fall into any of the categories. That means that they have electronics and software inside. They fall under the FDA guidance.

20 years.

20 years.

Upgrade. This is.

Our manual says it's 7 years, and if I think it's at least 15 or 20.

Oh, yeah, I posed this to some other people, and they were like 3 or 5 or something. They're quite optimistic, I think, about the ages stuff. So it turns out that I ran a report. The mean age is 14.8 years, and the Median age is 12 years of on market devices. So you know, we only have. There's only 5 years until this this mandate starts. And so that means that if you have a device that launched, you know, yesterday, it's going to intercept these requirements. And obviously, if you're designing stuff today, it's going to intercept these requirements and even devices that have been on the market for 5 years, are going to intercept.

are likely to intercept these requirements.

But mark, are those connected devices or electronic device.

So these are all. This is the average age of all electronic devices. You know. You see one all the way at 40 years. That's a I, an endoscope with a filament lamp that's still sold today. So you're right. It's a little different for devices with software that are running software. However, in my experience developing devices, basically, every new device is falling under the FDA's cyber guidance, it's pretty broad. And most people today are developing stuff with software stuff that would have been developed without software many, many years ago. So I think the set of devices that are 30 or 40 years old that are gonna need. This is smaller because it's not really running software. But in my experience.

basically, everything people are developing today is going to need this stuff, and people developed it for the last couple of years is definitely falling under that. I wish I had better data about devices that fall under the cyber security regulations. But that's a little bit trickier to tease out. So so one of the things about post content. Cryptography is, it's way harder to implement. So it takes 10 times the space and 100 times the processing power of traditional cryptography. And so this makes retrofitting it a challenging endeavor. And so, you know, if you're planning a new device, you that's and these new devices are almost certainly going to need to support post quantum cryptography. You know, you need to be supporting today

for the storage space and the processing power that's going to be required. And also, even if you have it today. Lots of people. ecosystems of devices. They have a cloud that supports their device and their next device and their next device. we work with lots of customers who create these connected or ecosystems, people who have you know this network effect that they're creating or devices that they interoperate with, you know, lots of like connected hospital patient, you know, inpatient collection, outpatient collection, all that kind of stuff. And not only will those devices, but that whole ecosystem, all the collection infrastructure, all that stuff

is going to need to accommodate this post quantum cryptography as well. And that's 1 of the reasons why it's so important to start now. because it's it's it's quite a complicated endeavor that really pushes the requirements of your device. And for existing devices. You know lots of people and talk with people asking about. Can you add it to existing devices? And this this heavily depends. And really it comes down to 2 questions, do you already have processing power? And you already have the memory space to run these algorithms? You know, some systems that are really just running a full computer. The, those generally have enough extra processing space power memory to accommodate upgrades. It's it's more of a a software patching

rollout plan, activity. slower devices it it might fit into somewhere in between. But the smallest devices like IoT devices, little connected things, microcontrollers, that kind of stuff. We've often found that those can be too small to accommodate it, or they can only be accommodated with some really significant engineering work, you know, trying to shove 10 liters into a 5 liter bucket full of device functions and cryptography and encryption, and all that kind of stuff. And there's some set of devices that really can't be upgraded and that are gonna start becoming obsolete because of these encryption requirements by 2030.

And so we talk about next steps. So really, the the main thing is, you know, looking at your existing cryptography and the new cryptography and your devices. And so we created a tool. There's a whole bunch of overlapping missed guidance. For what in cryptography is allowed today? What's deprecated? What are the timelines? And then also, what are all the transition plans for different types of photography in the future. So we put that all together into a tool that lets you go and select your cryptography. And and it can tell you a little bit about what is and isn't allowed, and what what are the timelines, what are the restrictions? What are the recommended migrations. That kind of stuff.

Mark. Would you click through and and put the link in the chat.

Here, let me and open it up and show you guys what I'll drop in the chat as well.

Wearing the same shirt.

He loves that shirt, he does. It's his favorite shirt.

See.

Or he took the picture this morning.

So one of my favorite things to ask is, people is, do you have your cryptographic bill materials so we can go evaluate. What's your exposure and compliance with the, with, the, with the the cyber security, cyber, security, cryptography, requirements. And most people look at me. There's this deer and headlights look the same kind of look I got from everybody couple of years ago about your software bill materials. And.

Anybody heard of the cryptography bill of materials? Anyone.

I would suggest anyone who's not a hardcore engineer. Don't click on that link. It will dispirit you about how ignorant you are.

Just trying to help out.

Oh!

It's this that definitely generally falls under engineering activity. People that you know. And that's 1 of the things where understanding which button to click requires understanding what's all included in your in your device. And what's all the parts? And just like your software bill of materials? you you might be surprised how many different little bits of cryptography your system uses, and how it works, and what are all the different interfaces? and how how complicated it can be. And really, it's a you know, it's a kind of thing that on the technical side that is still very new as well, and because medical devices

lead from a like a timeline safety support standpoint. This is one of the 1st industries that we're working with to really implement this post quantum encryption. The other one is like critical infrastructure, you know, stuff that's powering like lights. You know, water treatment plants, buildings, that kind of stuff the other classes devices that you're going to install for 20 years. And so those guys today need to be planning and deploying for for all of those things.

Send this link to your favorite engineer. Mohammed. Nice to see you, Mr. Pistachio. Have you some comments on what you're seeing here.

I was just gonna ask actually a question. Do you see a closer tie going forwards between FDA and NIST, particularly when you consider things like the fips programs. you know, NIST has led the way for cryptography. It would sort of make a lot of sense for FDA to basically lean a lot more on NIST for validation of things like this. But.

Yeah. And that's and that's actually exactly how it is today. The post market guidance. They delegate all of the cryptography selection stuff like that, because, you know, the FDA is barely getting up to speed on on understanding how we do cybersecurity for devices, let alone you know this much deeper, even more technical topic of like, what cryptography is. Okay, how do we pick the algorithms? What's good and what's bad? And so the guidance today? Already. I delegates that to NIST it directs you to use the algorithms that are approved by them, and to use the timelines that are approved by them.

And then, also, you know, I think you've seen in the the guidance they direct you to at least reference NIST's cyber security frameworks and their recommendations at a whole bunch of other areas, too. So.

Can you show us little example? I mean, just walk through really quickly in like a I'm just like cause he did it with me, and it was really cool and I I mean, I just thought this tool was.

So let's see. the so one of the things is so Cyclone Dx is a standard for bill of materials, and it turns out. They also have, standards for cryptographic bill of materials, which is a thing in much denser. more technical fields. And it's it's a new, it's a new up and coming thing. And so we can go pick one of the example C bombs and so and see. So this this bill of materials here. Says that it uses one of the algorithms it uses is A. S. 1, 28. So we can go here and look at encryption algorithms. So the aes. And so as 128 here.

You'll actually see that this algorithm is allowed for quantum computing. It is, it is a quantum resistant algorithm already. But if we go down here. So this is shot 5, 12 with Rsa. So if we look at Rsa, we'll see that Rsa. 1024, which we still see deployed has been disallowed since 2014. This is disallowed by existing guidance. And then we have some recommendations about which algorithms should be replacing it. And they're all they're either these 2 algorithms called Ml. Dsa or Slh Dsa. And so today, most devices are going to be deploying something like Rsa, 2048. And so those are going to be deprecated on 2030, and they have some. There's some recommendations here about which.

Sure.

Algorithms you should select. And then they're going to be completely disallowed for all use in 2035. And so that's that's quite similar, for you know lots of these devices. and that's what you'd expect. You know your technical teams to do to go and audit and create one of these cryptographic bill of materials to and check to see. Hey? Is this in compliance with even the current recommendations? And is this in compliance with the post quantum recommendations as well.

But seeing with this one comment on this, I mean, this is, this is good. But your earlier point was really very pertinent, that medical devices have a very, very long lifetime shelf life. And I, I would actually say that this should all be treated as an absolute minimum. So a good example with Aes, I wouldn't recommend going with Aes one time.

Oh, I sincerely agree, I sincerely.

I would go with 2, 56 at a minimum, because for the lifetime of the device. So this is good to set a baseline. But everybody should really be striving for medical to go higher than this. Baseline. In my opinion.

And I and I sincerely agree with that. And I think for some people, security is this like thing that we have to spend money on, and we barely. And we have to do it to the minimum standard possible. And for those people, you know, hopefully, we're pushing the minimum standard to safe, and then but I agree that everybody, if we're going to design for it to be better, it's the Delta. Is not that high to design for the very best. You know I don't. Wanna. I don't wanna skim by on the minimum is good enough. I don't know that if you went to the hospital, and they told you, don't worry. They designed all these devices, the your ventilator to the very minimum standards. I'm sure it's safe.

You know that's that's not going to inspire confidence.

The good thing is hardware vendors for you mentioned IoT also, before. You know edge edge type devices.

Don't have.

Vendors are aware of this, and we've had. We've had conversations with them and push the envelope here, and they are. They are starting to bring out support for native hardware support for things like elliptic curve, for instance, which wasn't there 5 years ago. But you can get processors now that can support it natively. So so that that's always improving, which is another good good factor. So.

And and I agree. The hard part is one of the major pains is that Rsa and Ecdsa are both not quantum resistant algorithms. So we've we've just pushed to the point where everybody has Ecdsa now. And now we gotta push. Now, now, all of a sudden, we have to push for this next generation of encryption all over again. But yeah, like we've we've talking to vendors, and they have it. It's still very new for them. So it's, you know. It's quite complicated rolling out.

That's good.

Before you before you do first.st Really good to see you, and I know Jose is coming to 10 x. Are you coming again this year?

I don't know. Have to ask Jose.

Yeah, I'll probably drag them along for sure.

Okay. Good. Second is Mark. Years ago I had the group for quite a while, and years ago I.

Asked broadly, how concerned basically, people were about cyber security. And it was just crickets they weren't talking about it. Would you say that fear is growing to a point that adoption is following at at a pace other than what you would just normally expect normal growth? Or is it like shit? Everyone's like, okay.

Yeah, I think it's something that we've seen a lot broadly across different industries. You know, in the medical space, it's really driven now by the FDA, like it's required. So everybody's doing it, which is really nice, and we've seen a transition from I have to do it because they say so to. Oh, my investors are asking me how big is my cyber security team because I don't want to invest in somebody who's going to become a giant liability once they're big enough target and we've even seen this across other industries, too, where, like in the data center space, we work with lots of edge IoT devices.

And now, if you want a placement inside of a Google or Facebook or Amazon, or a Microsoft or a government data center, you have to comply with these voluntary standards, and that's where we've seen a ton of legacy vendors come and say, Gosh, I've been making these Hvac Controllers for 20 years. I need. You know, this cyber security thing is is new and required. And I I can't be a liability to someone. So yeah, we've definitely seen, you know, lots of strong growth in that area in concern, but primarily pushed down by large vendors who have large exposure. and other. You know other major players pushing it down. I think we've seen not as much

self selection that, like I need to be secure because it's important to me as as I would have hoped so.

This is pure speculation. Do you think that the new administration will have any impact on Fba cyber rules, etc, for the industry.

I I truly don't know. I hope, that all the agencies are.

Aligned.

Yeah, and separate enough that they're just going to continue their push. And they've all had a strong, steady push towards securing devices, doing better important stuff. and and I suspect we'll see that continue in the future.

Ron, and then Rick.

Yeah, I was wondering. I mean, with the mechanical design stuff that I do. I try to make sure that I can look around corners a little bit to make sure that we don't. to make sure that we don't include something in a device that is going to that is going to cause problems and and cause us to do a reset midway through development or something. So I've got 2 questions. One is, are there hardware access standards, in other words, are, there are there standards in an electromechanical device. a a standard of prevention, of somebody being able to just pop open the case, insert a module which would circumvent security, and you know, and then access that way. And the other thing. And I'm actually more interested in this

is, do you have? Do you have accounts of where somebody got midway through development? Do you have stories of where someone got midway through development took a good hard look at these standards and then realized they'd wasted a ton of money, and they're halfway through. And they have to go back to 10% through to design around these things, whether it be mechanical barriers, or, of course, programming barriers and encryption barriers. Yes, I think I'll I'll start with the the 1st one you said.

Can we have mechanical aspects of device that help with the security and typically, when we design security for devices? I, we design it such that when somebody has a device, you know, even if I make it really hard, really annoying, really frustrating, you can always always take out advice, dump the data access, secure chips, all that kind of stuff. and when you properly design cyber security, it shouldn't matter if you have a device in your hand, and you can do anything you want to it. If it does matter, then you've designed bad cyber security. There are some caveats to that, like patient, accessible devices, you know, like the Iv pumps, monitors, ventilators, all this stuff where

people can walk by change settings. Touch it. Do stuff. You mentioned adding implants. That's quite an extreme version of that kind of the threat model like, can we touch a device and do something bad? And there's certainly mechanical design elements there where and user defined elements, where we want to make it easy to see. And we want to make it easy to to tell that that something has happened. And so that's that's actually where the the military has quite good standards for classified, for for classified areas and systems. About, how do we design devices to make it obvious that somebody's tampered with them, and how often

checking that yeah.

That, Tam, that tamper evidence is is specified, I mean tamper detection.

And and that's the aspect that it should have. But your if somebody takes a device and compromises it to its fullest extent, it should not compromise your cyber security. And that's actually a big error we see in lots of designs. And you talk about. Have we seen large redesigns as a result of bad things. Most of the large redesigns, as a result of failure to plan for requirements is focused around. People come to us both with legacy devices that they're getting. They need 5, 10 k. Level changes to them as well as people who have designed new devices and got rejections from the FDA for cyber security reasons, and they didn't design any cybersecurity in from the beginning. And then the FDA said, Well, where's your cybersecurity, docs? And they're hoping to pay us a couple of $1,000 to like, write some documents so they can get it approved, and they end up doing a large device redesign

because it was wildly incompatible with that, you know, one good example is patchability. You have to be able to patch the software on your device. If it counts as a device with software. And basically every device in our experience has been with any microcontrollers and any software has been falling under the cyber security guidance. And so that can drive large mechanical electrical system changes just to add the patch ability, let alone all the other cybersecurity stuff. That's usually what most impacts form factor.

Interesting.

Yeah.

So. So what you're saying is sometimes they have to. Sometimes the system upgrades required to have patch ability and and be able to reinforce it are so extensive that you actually have to put in different boards different processes, different different computers, just to be able to handle that.

Oh, yeah.

And that would back up, back into the hardware design to design the brackets and inserts for all that stuff.

Yep. Ports, antennas, all that kind of stuff. Yep. Oh, yeah. Oh, yeah.

You could really get yourself in trouble if you don't know this stuff.

And we have had. There's at least one Startup who who failed. They ended up selling all their IP and then going away because they needed that extensive redesign so.

Mark. Very quick question is deprecated and disallowed. Is that for selling the stuff or for using the stuff.

That is for using this stuff. So the yeah.

And that is enforced by.

The. So it's it's so. NIST has no enforcement power at all. It's the FDA whose enforcement authority says you should not use deprecated algorithms, and you shall not use disallowed algorithms.

So what I'm hearing is like from a non engineer perspective. So Mohammed and Jose and Rick, please forgive me. That the key takeaways are for people building devices now or having legacy devices. Now. their investors need to be aware they need to be aware, of the changing requirements, and they need to start preparing for the changing requirements. Otherwise they're gonna find themselves in a in a very difficult place in just a few years with this in the same way that what was it? November of last year that that the FDA instituted the all the new S bomb requirements in the in the 5 10 k applications. So.

planning for this, having an awareness of this, I'm I'm what I'm trying to understand is because mark and another group are gonna be giving a presentation on this at the end of the month. How to talk to regulatory people about this topic. You know that to founders, investors, and regulatory people, what is the message that you're hearing? And so I'm opening that up to the non engineers in the room. or they can answer as well, I don't care.

Is this just? Is this just, too? Is this just Greek? Is this just.

I'm I'm actually super interested in that question, too, because, you know, like we. you know to your point when we tell companies all the time, just just as Mark is saying, I mean, you want to start this very early in the process, because if you don't incorporate those controls, you know, early in the architecture phase, you might get a big surprise which is going to cost you a lot of time and money later in the game. But you know, in the whole regulatory and field. I'm really curious. Yeah, how regulatory affairs folks are looking at this because it it feels like the kind of thing that's I mean, I guess, in regulatory like you think of categories like biocompatibility, and you know, sterilization, and like different things where it's like it requires a very technical area of expertise. It's not just reading the regulations and understanding it. You have to understand it at a very technical level. And I'm also curious to see what on the regulatory side a lot of the folks are seeing, you know, for their for their clients, and the projects that they're involved in.

how, how companies are looking at it. Where's all our regulatory people today?

Sorry I heard regulatory. Bye, bye, I was tuning up.

Actually, I was. Gonna add Sean to your statement. And I'm interested also in the answer here. But add to your statement maybe something that's that's I don't know if it's different, but certainly feels different about cyber security specifically in medical is is that this is not a static situation. This is a very dynamic one, and even if you think you know the answers today, they will change in a year or 2. So so you kind of have to take a different posture from now on. This. This has to be a very actively managed you know situation right? Because again, E, even this themselves in a couple of years will change what's allowed, what's not allowed? It's it's this, is, this is not a fixed. This is not a fixed thing. So you you from now going forwards from now on.

this has to almost become like a discipline by itself that's tracked. And and you know someone has to be aware of everything happening around it all the time. Unlike sort of something where you say I've made a decision now, and that's it. I'm done. I don't have to look at it again. You with cyber. You really can't take your eye off the wall anymore.

It's it's interesting. You say that I think that's been kind of part of the ethos of cyber for a long time, is it's constantly evolving. We're always in this cat and mouse game. and you know we'll do evaluations like penetration testing. And we'll tell you. We'll look at it today, and it will pass. And we could evaluate it a week from now, and it could fail because we've made some new discoveries. We've had some things we've. You know, things have evolved and changed. And it's it's something that evolves and changes all day every day. And it's it's not a yeah. It's not like biocompatibility. Like we tested it. We forgot it. It's done. It's

you know. Yeah, it's just like, just like software. It's we have to constantly update it, check it, change it all the time.

Yeah, your system might be completely safe today, and and attackers, threat actors will change their techniques. They'll improve their tools. And in a year's time your system will no longer be okay, and you can't. Just you can't just stop but this is a new sort of paradigm that you're it's almost like you submit, you know, in in the password, if you'd submit and you'd be done because you get clearance and you're finished. But until you make some changes. But here you don't have to make any changes, and you could be noncompliant.

In the future. Oh, yeah.

Without doing anything. In fact, you can't do nothing, so you have to almost like constantly be changing, going forwards.

Right. So what I'm interested in is that we shift the conversation a little bit to marketing these hard topics. And we're and we're looking at this, and we're saying so on January 8th the quote of the day in my new journal was, it's not the strongest of the species that survive, nor the most intelligent, but the ones most responsive to change, and that was Charles Darwin and the if I were to pitch this to hey, we're doing this, webinar. I would talk about how you know the world is changing so quickly. And cyber security and cryptography are no exceptions to that. So what a device

manufacturers, innovators, investors need to know, to protect themselves from ugly surprises of being unprepared for the pending changes and the and just just even even meeting the requirements. And the same is true for regulatory fairs. So regulatory fairs wake up and and and say. This is this is a huge pitfall. This is a way my company could find itself in a lot of trouble with a huge re-engineering bill in front of it, in the very near future if it doesn't

wake up and say, Wow, this is something that I need to start considering and building into my plans and make management aware of as as unfun as the topic may be.

I'm calling.

Or as or as technical as the topic may be. How do I impress upon them the urgency? And that's why you know, the FDA is going with the NIST requirements, you know, and they're going to be required. So when you tell regulatory people it's a requirement. It is now a requirement. You know the FDA now requires this, and the FDA is going to be requiring this in in the very near future. So you know, taking that message to market, and then saying to the marketplace. You know, how how do? How do we bring this story to life, you know, and that's something that

that that we all struggle with is is how to take complex information and communicate it to the people that need to know at a level that they're able to understand it, appreciate it, and take action. No sorry.

From from my perspective. I'm just waiting for more information that connects dots and make sense. Right now, we have this engineering algorithm speak across the entire world. I'm not talking about this environment I'm talking about in the entire world, and all we see is Warning signs, lots of blaring warning signs right? And we've seen like airlines shut down, bank shutdown, so on and so forth. So we know that there's a problem there, right? But we don't know how to get there. and if we need somebody to connect the dots for us to demonstrate a this is how much it's going to cost like quality management has done, you know, quality management, their their protocols and procedures in place.

and there's somebody responsible for it. A. We have to hire somebody new to run the show right? So we have to have the funding and from startups. That's not entirely possible. We need somebody that is going to translate for us. These are the extreme ramifications. And here's the percentage of probability that you are risking. If it's a 99% risk, people will do it. But right now it seems like the most. It seems like a one to 5% risk. So do we dedicate a hundred 1,000 to something that we don't have. and when the risk is so low, when we're just trying to get to market and stay on market.

There is a hundred percent, though, like, that's the thing that I think that's how you have to tell companies now is, if your medical device has software. That's pretty much the decision tree. If your medical device has software, you have to submit a cyber security package when you submit your 5 10 k. Through the Easter system. And so it's a hundred percent risk that if you don't do this, you're not going to get cleared because you're not even going to get past.

What's up? Risk sounds like it's an either, or you could just say, Hey, it's mandatory. You're not.

Exactly. I mean, that's what it remains for the risk to be 100% from a regulatory business standpoint like you just won't get your device to market if you don't do the cybersecurity piece of it. Now, the actual risk of like, let's say that your company eventually gets hacked, you know, gets caught in a ransomware attack or something like that. Obviously, that's very different. But in fact, even there, you know, it's interesting cybersecurity. There's a paradigm shift in how you think about risk, because.

Paradigm shift, shut them off.

Oh, come on!

Alyssa.

I'm on mute.

You. You talked about the risk. And and one of those things, I think, is the cyber. Security is right sized right? I'll be not. Everybody's making a really complicated, expensive device. And lots of people will try to cyber security everything for a really expensive thing. And when in reality, if you're making a simple device, the simple software, it really doesn't need expensive cyber security. It can be a much, much shorter, easier, faster. I'm approach.

That's the thing that companies need to understand. We don't have a site. We just need cyber security protection right? And we have insurance for that, and all of that good stuff. But and our device doesn't require that. But eventually we want it to. So we're looking at channels and pathways, and it would probably be a simplistic one. And so that's the message that needs to be conveyed to anybody developing is, there's there's a myriad to choose from. And here is where your device is placed, and that might be a really good presentation to do like. Here's an example of a device. This is how much it costs. This is how much it costs to maintain it. And and to the extreme, you know. So people can see that it's not so far out of reach and out of touch.

Yeah, I really like that, because one of the things is when we help people design their devices is, everybody wants this like phone app Internet connected, you know. Whiz, bang, Bluetooth, everything. And we'll often walk them back from that towards something that's that's not the best in the world, because, you know, it's like, can you support paying real cyber security professionals on staff all the time, all every year for 10 years? If if the answer is no? Then you really can't afford to have, you know, a web connected Internet connected thing. And if that's only you know. helping you, helping you, you know, with the whiz, bang thing, but not really helping your customers.

You can't afford it. And if you don't need it. So yeah, I really like that that thought process and communicate.

I would look at it, maybe slightly differently, and say that security is really part of your system. And you could, you could change how you're approaching your system to make you less vulnerable. So it isn't all about, is it? Isn't just about I go do what I want to do, and then I try to secure it sometimes just looking at looking at what you're trying to do, and coming up with a different way of doing it might make it more secure. You may end up saving money, not actually spending money. So it's it's you have to sort of take a holistic view. But I think, Alyssa, the point you're trying to make is that

there isn't this clear picture to someone developing a device of what is the what is it that they need to secure. And how much does it cost to secure it? And I I think it's is is that correct? Because I I think the was trying to go.

If there was just like a cheat sheet. Here's how to save money on your cyber security. you know, like that would be a great meeting you knew. You know you need it, you know you're gonna or you're gonna need it. Here's the cheat codes on Pearl's tips and tricks, tricks of how to save money as you're working through your build out.

I have a vision of a locomotive at about 25 feet.

Yeah.

You know.

Yeah, cause I think I go ahead.

So. But I think there's there there are 2 different, all the different 2 different domains to consider here. There's the domain of FDA, and what FDA is expecting. and how and what you need to do for that. And and I'm just gonna put that to one side and say, that's some that's 1 piece. And then there's the domain of the product itself, and the company, and the market, and all of that side. And there's that as well, because because I think one of the things that, for instance, isn't mentioned a lot is FDA may be looking at this from a security perspective in terms of patient, patient safety. And that's their focus. And that's the right thing. But companies need to consider that threats can cause massive distress to a company independently of whether it harms a patient or not. So so security has to be looked at from both facets. You can't just look at it purely

from what does FDA need? You know? It may be that what you need to support what you need for FDA is minimal, but but the harm to you as a company of not having security could be massive, and it could be it could be the other way around, too.

And one of the one of the easiest areas where we put the where we communicate. What's the P. And L of your cyber security is with disposables and accessories, which is an area we do quite a lot of work in. If you make an accessory or a disposable for your device. And you know you're making 90% margin on your disposable. The FDA doesn't really care how secure your ecosystem is. You can have a reprocessor. Come in and reprocess your single use disposable and sell it again. And they're they're only making. They're selling for half the price. They're only making 40% margin. But now they're cutting out a big chunk of your business. And all of a sudden the cost of having really good product security, really good ecosystem security or revenue protection is much higher. It's very important. And you know, if you're going to lose a hundred dollars a device on a thousand dollar disposable

because of the processors. Well, now, you can afford to put in a $4 security chip with hundreds of thousands of 1 million dollars of nre to protect your 100 million dollar disposable revenue. you know, because lots of companies selling disposables with these ecosystem approaches. That's where all their profit is coming from. It's coming from the disposable sales. And all of a sudden you're going to gut yourself if that cyber security, that revenue protection isn't top of mind for you.

Interesting.

Unfortunately, most of the time. It's not that clear cut, but.

Yeah. Yeah. And and there's complexity, too. Don't mute me again, Joe. Lick you off again. because sometimes there's business decisions there where, for example, like adding cloud connectivity, maybe does create additional challenges on cybersecurity. But even on the cybersecurity side, there's there's requirements that if there's a vulnerability that's found, and it's critical that it be updated, you know, patched. you know, in a quick fashion. Well, if you don't, if you have a cloud connected device that can do an over the air software update. That's a means by which to fairly, inexpensively update all your devices in the field. If you don't, then you got to figure out another means like, maybe it's a recall. Or maybe it's like, you know, a technician going out and updating things. So it is, you know, it's a overall system. From a business standpoint. It does get complicated estimating all the overall costs and trade-offs.

But I do think there are. Yeah, some questions that you could be asking like, do we need this? What's the what's the cost? Or Hey, I want I need in cloud connectivity. How much is cloud connectivity cost from a cyber perspective?

I think, to address Alyssa's. The initial comments. I think you could pretty easily come up with a I'm thinking of it now. A sort of a cheat sheet on at least where to find the costs and what what are the trade-offs? And maybe you just start with that sort of as a matrix and say, You know, this is how you should approach it now you may not. Someone who is not knowledgeable may not be able to instantly get all the answers, but at least they know where to go. Look for what the questions are and where to go. Ask, because it is, it is multifaceted. And you do have to look at this from a lot of different. And it's constantly changing. So it's it's it's a difficult one to sort of PIN down with a single like. Here's the answer, because I, you know. But but I could see a path to slowly improve the conversation, so.

Yes, thank you for the wonderful discussion. But I just have really simple questions. So like our devices is already in the market. Those in us, and well, actually, worldwide for the last 30 years. And they're very simple. We call them firmwares. So they really just do the Ios and control the the unit. Would this be forced to have to be in compliance with this new guidance as well? Or it will be sort of somewhat exempt.

Well, a device that really is very simple and doesn't do very much. Should be exempt. especially, you know, if it doesn't have any any Axite ports, or any communication, or anything like that. And that's a that's a strategy that we work with people to divine their devices, to to go under that line the hard part is, the FDA right now is very conservative with their determinations about what is and isn't cyber security exempt? And so if you want to be, have software, that's cybersecurity exempt, you really have to try hard to angle that way. And it's definitely worth a pre submission. Call with the FDA to say, Hey, we want to do this. Here's why. Here's what we want to do.

You know, how do we do that? Hi! We. We haven't seen it be terribly effective for devices to try to fly under that line. But it it is possible.

Well, we have 3 product lines. One of them is silicon. Legacy is being in the market for 30, some years, and we have 2 different devices. Just clear 5, 10 k. Maybe within the last 5 years, even though we call them firmware. But we still have to submit the software. Dnv. According to the Iso standards, because that device was same for Ce. Mark for Md. Well, it was Mdd. Class 2 a. So it's still, I mean it's not terribly complicated being an it professional for 28 years before moving to medical device, I mean, software is quite straightforward. Just I/O interrupts, but we still were asked to do this web. So with those 2 devices need to have those

new guidance to. I mean to be in compliance with those 2 new guidances.

Yeah. And the answer is, maybe, and I'd love to. Yeah, it it may be. And it could be hard to to fly under the guidance. It definitely takes some work. So yeah, I'd have to see.

For you.

And understand, more.

Mark, where are you located?

I'm in Tucson, Arizona.

Oh, right, he did say that. Well, it's not too far to get to Newport Beach. Maybe you can collaborate with Mohammed and Jose, and be part of our conversation in California in May. If that's an option for you.

Yeah, well, I'd love to. I'm not. I'm not familiar with you guys doing. I'd love to learn more. So it sounds like fun.

I'm getting a lot of comments here in the chat about presentation today. So thank you very much.

Thank you. Thank you.

This is very informative, and it was far more informative to those who understood what the fuck you were talking about than it was for me, but I can tell by the faces that you educated people who know what you're talking about. So that's good. That's my so glad.

Yeah, I'm so glad to meet all you guys had a great time chatting to all you guys.

Luke.

I still have a question. You say that the crypto graphic algorithms, they they are depreciated after some time, because then they are easier to crack. What about the dangers of harvesting now the data and decrypt them later? Should we data we produce now.

Oh, yeah. And that's the main reason why the why NIST has set the deprecation dates for the quantum so so early is because not because we think we're going to quantum computers in 5 years that can actually perform these attacks, but because quantum computers in 10 or 15 years that can do these attacks. We're worried about that attack. Vector the harvest now decrypt later, where we know we can do it in the future. So we're going to gather everything we can and decrypt everything when we get there. And that's especially relevant. For you know, Pii, health information, storage systems, all that kind of stuff. So.

And what Mohammed said, that the the requirements can change over time. Should we design now with a lot of headroom on bandwidth and computing power.

Yeah, I think that that's a device to device. I decision to make about how much, how much swap. You know, how much space, weight power, extra space that you have design into your device. You know, if you're what I expect to happen is that these 1st generation post quantum algorithms are actually going to be the most complicated, the most costly from a computing power space perspective. And just like we saw with other encryption algorithms over the past 25 years, where we actually got better at making faster, smaller algorithms that were just as secure. I expect that to happen with the post quantum encryption, so I don't know how, if I would include

a huge amount of extra space for that beyond what's required for post quantum. But certainly I would be budgeting some, for you know, first, st for cryptography and all of the other cybersecurity changes that are going to happen, you know, as attacks get better defenders get better. All those kinds of things.

Thank you very much.

So, Amir, you're new to me, or I don't know that you've joined us before. Where are you located? And what do you do?

Yeah. Hi, everyone. My name is Amir. I am a dentist.

Nice.

But I used to be a biomedical engineer beforehand. And I live in DC, so I am a practicing dentist. But I also started kind of a startup. A few few years back, during Residency I saw a lot of shit, and so I figured we need to find solutions. So I started inventing a lot of things for the world of hospital dentistry. and I, someone led me to your your group, and so I figured I'd say, Hello.

Hello! Oh, we do this every week. You're very welcome here. Luke is responsible for next week's guests. Can you tell us a little bit what we can expect. Luke.

Get me off mute. Benjamin represented a company that designs a chip, especially for physiological measurements. So it's a and it's it's I think it would be great for Jose and and others for variables. because the chip is running around all the the great chips from Ti and analog devices. And he probably also tells something about how it is to run startup like that. He's not the CEO. He's the the How do you call it?

Chief technology officer.

No, it's not technology. It's more in sales and marketing.

Oh, okay.

But he but he is an engineer, though.

Eckhart? Yes.

At heart, and he's a nice guy.

I was going to conclude our call here. But Frank is someone who doesn't join us often. So, Frank, I unmuted you, and hoping you'll come on camera because you had a question for Mark. He may be having some technical difficulties. In the meanwhile he wrote up, here he is. Frank. We can't hear you, but we can see you.

Oh, that works! Yes, so I had a question.

Where are you? Where are you located? What do you do? Tell the folks.

I'm in Pasadena, California, south of the fires. So I'm working on a instrument that's using an infrared camera to do current quality monitoring. do all vital signs and looking at implementing this on a cell phone and potentially small laptops. And my question relates to, if if you were implementing this on a cell phone? How would you implement these security measures that you're suggesting.

Yeah. So I think a cell phone. It depends how how important your cell phone is to your product. If it's like a user uses their own cell phone as an accessory. There are some well defined ways to. I pass data securely from a device up to a cell phone up to a server and out. And if a cell phone is part of your device, then that makes it a lot more complicated because the cell phone is quite a complicated piece of technology with a very large surface area for attack, and so it can be one of the hardest things to secure and to prove that secure if you kind of adopt it into your device. So we would always recommend to people when you're designing devices, you know. We'll often design custom versions of android that have just the minimum set of things. You need to make it as easy as to secure or to delegate that, you know, make the device

the U you know. Bring bring your own from the user perspective and try to make it the whole system secure, no matter what, even if the user's device is compromised. And it's.

Yeah.

Adding a cell phone into your device can be, can be quite a large scope expansion. But it can be quite useful for like quick, prototyping Demos. That kind of stuff, you know, on your way to a full device, that kind of thing as well.

Well, the cell phone is using the processing power of the cell phone. We use infrared camera and the audio from the phone to be doing all this this work? I mean, we're identifying parts of the body that we're looking at and doing the thermal analysis, you know, of an artery to be looking at the thermal facsimile of what the blood pulse wave shape is and using that to predict blood pressure. So it's and then we're just using the communication facilities of the phone to be passing this information. So it's an integral part of it. Whether it was a cell phone or a computing system. So I think you're saying, if you were using a cell phone and make life a lot more complicated.

It, it definitely can. Yeah.

Would you have to restrict the make the phone dedicated and restrict it from all the other functions? The phone would normally do. Would that be a way around it.

Well, potentially. And one of the other things that you can do is Instead of making this a device. You, it's a Samd. It's an app for a phone and that would be that that might be more for some types of devices that might be a better fit where you're making an accessory. And and you also have a a Samd that gets installed on the user's phone. Instead of the phone is part of your device. Cause that that might be closer to essentially what you're doing with that where it's kind of like a the USB connected ultrasound devices. Things like that.

Yeah, okay, well, I'm gonna need your help.

Yes, on that note, Mark, why don't you go ahead and put your contact information.

Yeah.

And for Frank and Amir I put a link to what 10 x is. If you're completely unfamiliar, this will be our 15th annual. Get together. You'll see that it's more of a coffee clutch among friends that we.

Talk, about.

Relevant things while enjoying camaraderie and ice cream.

Yeah, I like your walk sign in the background. There.

Yeah. Frank.

I posted also in chat because I didn't. I didn't want to talk over Mark. But yeah, there it. There are techniques where you can. For instance, if the phone is just a transport, if all you want to do is move, move data through it. There's ways of of still keeping it in the system and securing it. And and even if, as Mark said, even if even if it needs to display some information, there are also techniques we can use to lower the threats, but you know, still make keep it secure. So there's lots of approaches. Just have to look at how your system is structured.

There's a lot of expertise in this group for you, Frank, so very quick I'll be back.

All right. Well, good.

If you ever want to put it in your sensor in the mouth, let me know if you ever want to put that sensor in the mouth. Let me know.

Okay.

Reinforce what you were saying, Frank. It's easier when we see.

Oh, I'm sorry. Yeah, no. As I said, I, I actually put it in the chat. But basically, if if you're using a phone as we use this all the time we have phones are very common devices to use as as transports where data medical data can go through a phone to a cloud. As an example, it it doesn't mean the phone can be very insecure. In fact, phones typically are very insecure. But there are ways to securely move medical data through a phone. You can basically tunnel like tunneling. Imagine tunneling through a phone. So the phone isn't really seeing the data, the data data just passes through it. So that's just a technique. But.

And for context for those who don't know you and Jose, when you say we use it all the time. Who's we? And how are you using it?

Sorry we as in as in bowl type, in medical device products that we create and the projects we've worked on. So yeah, it's that.

What's our phrase, Jose wireless connected medical devices.

Yeah, I mean, largely, we do like apps embedded in cloud. So the types of systems that go from embedded software all the way through the cloud. That's kind of our bread and butter.

Why don't you go ahead and put your contact information in there as well? And I'll pause just a moment, because once the webinar ends all that nice chat stuff goes. and you.

Causing a meeting start, interrupting, how's that sound? So

We are.

launching this weekend, I swear to God I'm getting caught up on the entire launch of 10 x this weekend and How you can help when you decide. So 1st of all, if you're uncertain about attending, please contact me. Sean at Ver 2 b 2 b.com and have a call, and let's talk about what you want to get out of it and and what would make it valuable to you because we are restructuring the event to be a lot more interactive with shorter presentations, more workshops. And the goal is to have everyone in the room meet everyone in the room.

you know, and that means moving them through a series of discussions. If any of you are interested in leading a discussion group, you know you don't need to be a speaker. You can be a workshop leader. Please reach out to me. We want to provide as many opportunities for the loyal Mdg, participants. And and and returning participants as well as the new participants. And so it's gonna be a lot more involved, a lot more hands on a lot more interactive, as Joe and I have discussed, you know, as

as a marketer, as a presenter as a trade show sponsor. It's oftentimes a disheartening thing to go to trade shows. And what has impressed me about the 10 X group and going last year is this opportunity to approach it very, very differently. So what we need to do is we need to get some more. Start up some more oems, some more investors in the room, so that everybody gets a a 360 degree exposure to the the medtech ecosystem, if Joe will excuse that expression.

I'll let that one go. I'll say that. I've always felt that everyone in the room has something con to contribute, which is why, I've always tried to get as many people in front of the room typically in a fast round. which is a 5 min interview with me. Which we record, and you can use on your website. But yeah, you don't have to be the CEO of something. And you know, a known thought leader to know something that we don't know. So you know, even somebody like Andre Khadijah something. But he categorically refuses to come because of this anniversary of his every year. and then his wife doesn't want to come, which I think is bullshit.

just to throw it out there.

Can I just have a quick question.

Is it for Andre.

No, for myself.

That guy right.

Go on!

I did say that you say that good.

So I never been there. So do we have to book our own hotel, or does that include it?

No, it's not included. But I have a link which I'll put here for you. I typically.

That's what I thought. I don't want to go out there and have no place. I don't want to be home.

Have a place the Hyatt is already. That link is already set up for our group rate. It'll be cheaper than anything you'll on another site. We have a block of rooms.

And it's super easy to book. I was worried about that, too, and Joe made it really easy. You just click, and then you pick the room that you want and then the discount is applied.

Thank you.

You're coming back this year, Patricia.

I'm try. I'm gonna try to. I gotta see where I am exactly.

What the My policy is that if you're not coming you don't need to pay. So a lot of people in industry have these, you know, cancellation policies like either you can't, or you know you get 50. I don't need your money. If you're not coming. I don't need to pay for you if you're not coming. So I give you everything back. If the week before something happens, just let me know I'm not a big enterprise, I'm just now. I'm just 2 guys, me and Sean, which I'm very grateful for.

Yeah, thank you. I.

Gentlemen, thank you for. Thank you for celebrating Lucas's birthday with me. You are again welcome to pay at a discount today, and we will see you same back time next week for Joe Hage and Sean Smith Enterprises. This has been Joe Hage and Sean Smith, with special guest, Mark Omo, who may join us in may.

Thank you, and we'll see you next week.

Bye, everyone.

Bye.

Well.