Latest / CareTalk: Healthcare. Unfiltered. / Healthcare AI Has a Cybersecurity Problem

Transcript

Healthcare AI Has a Cybersecurity Problem · CareTalk: Healthcare. Unfiltered.

• 0:00
  David: A year ago, if you went to a healthcare cybersecurity conference, AI was still something that was out there on the horizon.
• 0:06
  David: It's kind of interesting, a little speculative.
• 0:08
  David: Uh, people could understand why it would be useful for writing better phishing emails, but it's just not the case anymore.
• 0:14
  David: AI agents are front and center.
• 0:16
  David: They're breaking out of their sandboxes and hacking organizations in healthcare and beyond.
• 0:21
  David: The attackers are ready.
• 0:23
  David: Can defenders say the same?
• 0:33
  David: Welcome to Care Talk, America's home for incisive debate about healthcare business and policy.
• 0:37
  David: I'm David Williams, president of Health Business Group.
• 0:41
  John: And I'm John Driscoll, the chairman of the UConn Health System.
• 0:44
  John: David, we are in a crisis, evolving crisis situation with AI security and healthcare.
• 0:51
  John: What can we do about it?
• 0:55
  David: Well, I guess we could start to talk about it for one thing.
• 0:58
  David: But, uh, I mean, the challenge, John, is that healthcare is a soft target in this, in this space.
• 1:04
  David: The data is valuable, security hasn't been that consistent, and people are trained on things like reviving somebody after their heart stops or, you know, curing cancer, not really on watching for phishing emails.
• 1:18
  David: So there's no, you know, simple answer.
• 1:20
  David: Although, I guess the good news is in healthcare, John, we're not used to a simple answer working anyway.
• 1:27
  John: Well, how big a problem is this?
• 1:30
  John: We know that historically, healthcare information has been one of the most e- one of the most valuable in- sources of information to steal, because with healthcare information you can create identity.
• 1:44
  John: Uh, we know that healthcare has been breached, whether it's the big Optum change healthcare, uh, ransomware attack that took down a big, a l- a lot of the ability of primary care doctors to actually practice.
• 2:00
  John: Uh, healthcare is a soft target.
• 2:03
  John: It's been attacked plenty.
• 2:05
  John: What-- How has AI changed the game?
• 2:10
  David: So the, what's genuinely new about having AI is the autonomy and the speed.
• 2:17
  David: So it's not just like a new kind of attack.
• 2:19
  David: You still might do phishing, you still might do prompt injection.
• 2:23
  David: There's a variety of things that you would do.
• 2:24
  David: It's just much, much faster, uh, so you don't have to have a human that's at the keyboard, and then they can just go super fast.
• 2:33
  David: So that is something that's, that's new.
• 2:36
  John: Pause for a second and explain for those of us who aren't as in the, in the weedy details as you are, um, what does autonomy mean?
• 2:49
  David: So it means that, uh, rather than having a tool in somebody's hand, the tool itself can go and do its own attack.
• 3:00
  David: So it's similar to comparing a, a, a drone that has its own navigation system, and it already has its own kind of instructions or just its objective, comparing that with a fighter jet.
• 3:12
  David: Uh, it's hard to launch a fighter jet.
• 3:15
  David: There's only a few countries that actually have them, and they need people, training, all the support.
• 3:21
  David: Whereas drones, everyone seems to have them.
• 3:24
  David: And so it's kind of like that.
• 3:27
  David: Instead of having one hacker you had to worry about, "Oh, I know who that guy is," you know, some guy sitting on his couch somewhere, it's actually could be an almost uncountable number, John, uh, that could come at you because unlike the drones actually where you could have hundreds or thousands, you could have even a lot more when it comes to bots.
• 3:43
  David: So that's autonomy.
• 3:46
  John: And, and why … how has the speed changed things?
• 3:50
  David: W- typically what happens is if I'm … If, if a human attacker comes in, they're gonna look at something.
• 3:55
  David: They're, they're gonna probe something.
• 3:57
  David: They're gonna see how it comes back.
• 3:59
  David: They're gonna analyze it.
• 4:00
  David: If they're very good, they can use their intuition and move along, uh, quicker.
• 4:04
  David: And so they might work on, you know, a hacking, let's say a hospital system.
• 4:08
  David: Might take them a couple weeks to do it, one person who's fairly skilled and to make a real, real effort at it.
• 4:15
  David: And the computer could just move that much faster, you know, the speed of a, of a machine.
• 4:20
  David: It could go 10 times, 100 times, 1,000 times, um, faster.
• 4:24
  David: There was an example, uh, recently that a, a healthcare security company published where there was a threat actor, that's what we call a bad guy, and he gave an A- an AI agent just some stolen credentials and just some details about the target in the healthcare system and let it run, and it did the whole chain of attack on its own.
• 4:45
  John: Just to be clear, the credentials would allow you access to the, to the healthcare system.
• 4:51
  John: It could be a hospital system.
• 4:53
  John: It could be an insurance system.
• 4:55
  John: And once that door is open through that kinda software handshake, how bad can it get, Dave?
• 5:05
  David: Well, they sometimes talk about things like, you know, getting the keys to the kingdom.
• 5:09
  David: So it can be bad.
• 5:10
  David: Now, in this case, what happened was you've got… You may have, you know, like username and password, so someone can get in, and just one user, they could be isolated.
• 5:20
  David: You see a user doing strange things.
• 5:22
  David: But there's a variety of things that you could do.
• 5:25
  David: Once you are a user, things like privilege escalation, so going from being a regular user to being an administrator or super administrator with kind of the keys to the kingdom.
• 5:34
  David: Um, they can go out and map the network.
• 5:38
  David: They can encrypt files.
• 5:39
  David: They can write ransom notes and send it out.
• 5:42
  David: In this case, there are about 600 different coordinated actions with almost no human input.
• 5:48
  David: So it's, um, I don't wanna say a nightmare scenario, but that gives you, that gives you a sense of what to do.
• 5:55
  John: No, but I, I think it is, it, it is a nightmare scenario.
• 5:58
  John: W- what I, I think it's really important for people to understand.
• 6:01
  John: You know, historically, people would try to steal healthcare information because you could create identity, but you can also ransom, uh, hospitals, doctors, um, cancer facilities.
• 6:14
  John: All of healthcare runs off of information.
• 6:17
  John: If you can encrypt, which is to say lock down and, and, and sort of make it code specific whether you can get access to that information, healthcare sto- stops being delivered.
• 6:30
  John: If you can't get access to cancer scans, it's really hard to treat cancer patients.
• 6:35
  John: And these are things that have historically happened with humans, um, whether it's criminal gangs in Eastern Europe or wherever for hire, um, uh, or Africa, or frankly any part of the world, or state related actors.
• 6:53
  John: Often some of the most talented criminal software networks actually work with state sponsors.
• 7:01
  John: That's true in Russia, it's true in China, it's true in Iran with the Revolutionary Guards, um, or whether it's just a criminal gang or a, a, a, a, a c- a clever criminal working out of his basement.
• 7:14
  John: Uh, what scares me is that you can create almost a robotic twin or clan of agents that can make those kinds of penetrations, create those kinds of blocks faster, and potentially in a more sophisticated way.
• 7:35
  John: And we know, I mean, as you know, David, healthcare is not hardened the way the banking or national security system is.
• 7:43
  David: So John, I'm gonna tell you something that's gonna make you feel a little bit better momentarily, and then we'll, we'll go deeper into the bad stuff.
• 7:50
  David: How's that?
• 7:52
  John: Well, it's rare that you make me feel better, so I'm looking forward to it
• 7:56
  David: It's gonna be brief.
• 7:57
  David: So historically, as you say, healthcare has been an area to attack.
• 8:02
  David: You could ransom a healthcare facility, you could cause a lot of disruption, it is a soft target.
• 8:06
  David: Now, what's happened with AI, it, it's not specific to healthcare at all.
• 8:11
  David: This is just, uh, something across all, all sectors of the economy.
• 8:15
  David: And the current, um, organizations and governments that are most motivated to cause damage, uh, in the US are targeting other sectors that would be called critical infrastructure.
• 8:27
  David: Now, healthcare is actually part of critical infrastructure, but the sort of things I'm talking about are energy facilities.
• 8:33
  David: You will have read information about, uh, water systems and so on.
• 8:38
  David: Those are the sort of things that seem to be under the most stress at the moment, because you can draw your own conclusions, but those are, those are things where you're seeing, you're seeing some activity from foreign actors.
• 8:51
  David: And also because everything's exposed all at once, then, well, we're no worse off than somebody else.
• 8:56
  David: It's not like healthcare got, got any worse.
• 8:59
  David: So that's the, that's the brief p- piece to make you feel better.
• 9:01
  David: Now, it won't make you feel that much better because healthcare is still a big part of the economy, and also you live in the rest of the economy and presumably need your water and to… even if you don't need to fill up your, uh, you know, your gas guzzler, you need to, you know, charge up your electric vehicle.
• 9:14
  David: So, uh, do you feel better or worse?
• 9:17
  John: Don't make fun of my truck.
• 9:18
  John: I mean, Dave, let's, let's focus on healthcare.
• 9:21
  John: The scale of the number of penetrations, I mean, all of us are sort of getting, getting to the point where we don't even pay attention to your privacy information may have been compromised.
• 9:35
  John: But just to give people a sense of the scale of it, in the f- it's-- we're only throu- through six or seven months of, of, of measuring this, but I think it's 1,800 compromises and something like over 470 million notices to individuals.
• 9:54
  John: So we're, we're, we're, we're, we're effectively, the ent- the entire country is getting compromised every six months, and that's compromised meaning your pri- your private healthcare information may or may not have been, uh, shared, uh, stolen, or manipulated.
• 10:12
  John: Um, hopefully not manipulated, but used in a way that, that, that, that was not intended, and certainly not without your, with, with your voliti- voluntary choice.
• 10:23
  John: I mean, that is just a stunning number, and you're trying to make me feel good about my… And by the way, I, I, I, I, I drive a hybrid, Dave, just to be clear.
• 10:35
  John: I don't feel good about this.
• 10:37
  David: Yeah.
• 10:38
  David: So you need both gas and electricity, so good luck for you.
• 10:41
  David: So, um, I'm actually gonna say something to make you feel, uh, not necessarily better, but also for people listening in, a little less hopeless about this.
• 10:50
  David: And, and I'm glad you raised this point about the number of breaches and, you know, victim notices.
• 10:55
  David: It's like, like you say 471 million.
• 10:57
  David: So it seems a lot of times at this point, people will kind of ignore a breach and say, "Well, you know, my data's already out there, and I already got one notice, and I was breached before," so kind of like who cares?
• 11:08
  David: There's nothing more that I can do about it.
• 11:10
  David: It's not actually quite the case.
• 11:12
  David: So these, not all breaches are created equal.
• 11:16
  David: So if you think about the full range of information about you, you know, your name, your phone number, your Social Security number, your work history, medical record, et cetera, et cetera.
• 11:27
  David: There's a lot of different elements, and when a breach occurs, uh, most commonly it's… Yep, most commonly not all information is actually, uh, being shared at one time.
• 11:42
  David: And so what sometimes occurs is let's say you had a username and a password and a birth date, uh, that was from some years ago that were, you know, that were, uh, that were breached.
• 11:52
  David: Now, the username and password are probably, probably been changed.
• 11:56
  David: Doesn't matter that much.
• 11:57
  David: But then let's say your-- let's say somebody got your birthday one time, and then they got your driver's license another time, your phone number another time, and your Social Security number.
• 12:07
  David: Okay, now they have enough information across those different breaches actually to be able to, um, you know, to, to do identity theft, for example.
• 12:16
  David: And so that's why even though, you know, it's not just like, okay, the horse is out of the barn when your birth date, uh, was known, but it's these things cumulatively.
• 12:24
  David: So it does make sense to try to, uh, to protect them, and it's not hopeless.
• 12:27
  David: Not all the information, uh, is out there now.
• 12:31
  David: Okay, let's talk about healthcare.
• 12:33
  David: So John, one of the things we've been talking about on this show about healthcare is that, that healthcare's been a little slow in some ways to d- to deploy AI, so maybe that's good.
• 12:43
  David: But you see, it's not just the attackers that are using AI.
• 12:47
  David: Of course, it's, let's say, the hospitals too.
• 12:50
  David: So one of the things is agentic AI.
• 12:53
  David: So hospitals are trying to d- you know, deploy all these agents out there, and they could do things like it's hard to get a primary care physician, so the agent can, you know, help you with your intake and, and be your primary care.
• 13:04
  John: Hold on for a second, Dave.
• 13:05
  John: What does agentic AI mean?
• 13:05
  John: What is an agent?
• 13:06
  John: Does that mean, like, you know, James Bond?
• 13:11
  John: Like, what are you talking about here?
• 13:14
  David: Well, James Bond is an agent, so, uh, yes.
• 13:17
  David: Uh, but he's- As is Maxwell Smart … previous AI.
• 13:20
  David: Yeah.
• 13:21
  David: That, uh, Maxwell Smart.
• 13:22
  David: Uh, he had the shoe, right?
• 13:24
  David: Um- He
• 13:25
  John: did.
• 13:25
  David: I remember Maxwell Smart.
• 13:27
  David: So An, an agent is something that does something on your behalf.
• 13:35
  David: So like my agent John, uh, negotiates my outrageous compensation to co-host this podcast, as an example.
• 13:41
  David: It
• 13:41
  John: hasn't been
• 13:42
  David: successful yet.
• 13:43
  David: But the agent isn't… Yeah.
• 13:46
  David: Yeah.
• 13:46
  David: Well, that's 'cause that's, uh, outrageous to begin with.
• 13:48
  David: Failed agent.
• 13:49
  David: Um, yeah.
• 13:51
  David: But an agent is something that's gonna do something for you.
• 13:53
  David: So you could imagine an agent that is going to, let's say, uh, do something simple for you like book an appointment.
• 14:00
  David: Okay, now this actually-- So it's difficult to schedule something in the hospital, so patient calls in and you wanna… Or a patient is in contact, and you can book an, you can book an appointment on their behalf, or a patient could do that.
• 14:13
  David: Now John, I'm gonna take a little digression on the agent path because I saw something interesting today that's happened in Australia.
• 14:19
  David: So there was somebody that was using, um, they were, they were using OpenClaw, which is a way to deploy, uh, AI, AI agents on your behalf, and they used it to go and book a session at the gym.
• 14:34
  David: Okay?
• 14:34
  David: So they went and say, you know, "Get me a session on Thursday," but it was probably Tuesday and the sessions were booked.
• 14:39
  David: So the AI agent had an objective in mind.
• 14:43
  David: This wasn't meant to be a hacking agent, but it had an objective in mind,"Get my client an appointment," right?
• 14:48
  David: And so instead of saying, "Hey, I'm important," and all this, it found a flaw in the scheduling system, it broke in, it canceled somebody else's appointment, and it put this person's appointment in.
• 14:59
  David: Now this is humorous, right?
• 15:01
  David: But imagine it wasn't a gym appointment, but it was something else.
• 15:06
  John: So the way to think about a-- The way I think about agentic AI, AI, and tell me whether I'm wrong, is you're basically creating a robotic bot that once you program it with an objective, it will continue to poke, probe, or try to solve for the problem you've programmed.
• 15:25
  John: And so what it allows, uh, all agentic means is you've created an independent piece of software that can continue to work autonomously like a robot would once it's programmed in a certain way.
• 15:40
  John: Because of the power of compute and the fact that it can dynamically change the way it's trying to execute its work, it's a more powerful version of what people typically have, which is, you know, a piece of software that's, let's say, set to figure out your accounting system and keep it up to date.
• 16:01
  John: You know, tracking or delivering information to one place or another so that you could bill, like Epic.
• 16:07
  John: What's different about agentic is that there's a, a level, to your point about autonomy here, and also to some degree of programmed creativity that allows it to adapt to the situation and respond in, in what we would think of as almost an intelligent or logical way.
• 16:25
  John: And what that- What that can create though is a fair amount of chaos because unless you build something that's called a harness to kinda limit it, it will continue to your point to drill into its objectives, and that objective might be to get your information, uh, uh, steal it, or to make it inaccessible to others who need it in healthcare
• 16:49
  David: John, there's so many ways to go with this, with this conversation, so let, let's explore some of them.
• 16:53
  David: So one of them, think about it, an agent like hiring an assistant.
• 16:58
  David: So if you hire an assistant and they're supposed to book schedules.
• 17:01
  David: So you can imagine an assistant making an appointment at the gym, but they're never gonna go and do the sort of things that we talked about there.
• 17:07
  David: But think about hiring an assistant who's a sociopath or has some other, you know, other issues, and think about what they might do.
• 17:15
  David: It seems like unlikely, right?
• 17:17
  David: But in this case, they may, they may do it.
• 17:19
  David: In this case, you're giving it to a non-human intelligence the same kinda credentials, like your username and password, and they can go and do things, and they have an objective, and they're not hold, they're not held back by social norms, uh, or their conscience or anything like that.
• 17:34
  David: And so we're starting… Uh, and then the other piece about the objective, John, is I think we can relate now to something that people can understand, which is about social media.
• 17:43
  David: So one of the things that's occurred with social media is you see that its ob- its objective is engagement.
• 17:49
  David: They just want, want people there, more eyeballs for longer, and that's led to… It was when you look at some of the things that happened with Facebook, like with the Rohingyas and in other areas, you know, it's focused on getting you, it's focused on keeping your engagement.
• 18:02
  David: The AI has a similar kind of obj- objective, uh, often, and so that needs to be, to be understood.
• 18:10
  David: Now, let's get to the first actual good news in this here, which is that some of the approaches to dealing with this are actually your basic blocking and tackling, the same sort of thing.
• 18:21
  David: Like you wouldn't, um, give your new assistant, you know, unlimited access to everything you're doing.
• 18:26
  David: You wouldn't give them certain, uh, tools that they might deploy in the physical world.
• 18:30
  David: And same thing here, so this kinda harness that you're describing.
• 18:33
  David: A lot of what's happened is from agents that are granted more access than they need or so they, they, they have more of a ability to do different kinds of functions, like beyond booking, like actually, let's say, making diagnoses, and then they may have access to data they, that they should not have.
• 18:51
  David: And so this is your basic stuff within cybersecurity, restricting access, revoking access, having configurations done right, patching vulnerabilities when they come in.
• 19:01
  David: So that's the first part of the good news.
• 19:04
  John: But I think that when you, when, uh, you made a number of interesting points about agentic AI.
• 19:12
  John: And just to give people a sense of how freaked out healthcare IT experts are who are dealing with this every day, I think close to 50% of, of IT objec- uh, executives in healthcare have identified agentic AI as the most dangerous threat vector.
• 19:31
  John: So h- half of the people think about it as the most likely threat vector for having their, your s- your personal information shared inappropriately or their healthcare facility being attacked.
• 19:44
  John: And 92% are worried that they can't-- they don't necessarily have the tools to stop it.
• 19:51
  John: The, the power-- I, I think the, the tricky thing about AI, which I think we're dealing with it as a society, is it is an incredibly powerful technology that if you don't use, you're gonna feel like you're not going to be competitive with your other, whether it's a country or a company or a hospital or a doctor.
• 20:14
  John: And yet we don't-- We're, we're, we're only learning the power of these tools, uh, the, the power of these agents while we're testing them, and that can lead to problems like, you know, your Open Claw example.
• 20:29
  John: Open Claw is a particularly powerful piece of software that was not built with harnesses, uh, that was actually programmed by, uh, uh, I think, I think a programmer in Australia.
• 20:39
  John: Um, and it is incredibly good at self-organizing your information and being an agent for the user, but it doesn't have any common sense.
• 20:50
  John: To your point, it's not constrained by social norms, and it doesn't have a social context, um, that would give it the ability to kinda work within the norms, expectations, and laws.
• 21:02
  John: And that's, that's the danger here.
• 21:03
  John: But I think we're already in a, uh, use it and figure it out phase.
• 21:09
  John: I think that, you know, close to 80% of all doctors are using open evidence right now, which is a, an AI-enabled, uh, information resource.
• 21:19
  John: And now other information organizations like ChatGPT and OpenAI are trying to, I think will v- very effectively compete there.
• 21:26
  John: So doctors are already using it.
• 21:28
  John: The bad guys are building dangerous ag- dangerous agents, what are the practical things, Dave, if you're a healthcare worker or just a healthcare consumer, you can do to protect yourself against the threat that I don't think is gonna get smaller?
• 21:50
  John: I think it's gonna grow potentially by leaps and bounds over the next few years.
• 21:56
  David: So John, let's talk about some, something that they're trying to do in healthcare, let's say with scribes and, and co-pilots, which is an AI thing healthcare's trying to do, and then let's talk about how that can go wrong when AI gets involved in it.
• 22:11
  David: So maybe I'll ask you to start talking some of the things maybe you're seeing- So, so more bad news Uh, yeah, but let's say, let's, let's say what we're trying to do in, in healthcare with, with AI, with s- you know, on the clinical side, scribes, co -pilots, that sort of thing.
• 22:25
  David: What, what are you seeing there?
• 22:26
  David: And then I'll tell you how it can go wrong.
• 22:28
  John: Well, uh, one of the fastest growing applications for AI in healthcare is what we call scribes.
• 22:37
  John: Historically, those were younger medical interns effectively who would write down what the, the conversation of the doctor and the patient during those patient visits, because so much of what a doctor thinks about in tuning diagnoses comes from the actual conversation.
• 22:55
  John: But if you're spending your time typing it into a computer, which is what too many doctors have done over the last five or six years, they're not actually connecting with patients and have a hard time actually br- getting as much information as they should.
• 23:09
  John: So AI has come up with… A number of AI companies, um, have come up with Suki, Abridge, and others.
• 23:17
  John: These are software companies that deploy, uh, a form of, uh, artificial intelligence software in the, the, the, the patient exam rooms with the doctor so that the doctor can focus eyes on the patient, and the scribe can capture the information and then upload it into the medical record.
• 23:36
  John: Uh, this is incredibly fast-growing.
• 23:40
  John: Unclear whether it's actually helping the doctor-patient relationships,'cause we're sort of at this early stage of using scribes.
• 23:48
  John: But a little bit like the use of open evidence to, for doctors to figure out what actually, what actually they can learn about the data and information available to help cure a patient, we're sort of, um, in an era where I think everyone's, every, every doctor's office, or certainly every hospital, is going to have a scribe, an automated, automated way to capture information and build it into your medical record.
• 24:12
  John: But I don't think we've yet figured out what the impact's gonna be.
• 24:17
  David: So Sean, in, you know, th-there's, there's something in cybersecurity here that's a long time issue that predates AI, and it's called prompt injection.
• 24:27
  David: Now, in the healthcare context, prompt injection could sound good.
• 24:30
  David: It, it sounds like maybe I go to the doctor's office and, uh, very quick, and I don't have to wait long to get my injection.
• 24:36
  David: But that's, that's not, that's prompt injection, and I'm talking about prompt injection.
• 24:41
  David: So prompt injection is when an attacker can put instructions inside of somebody else's software.
• 24:50
  David: So like if I'm going to use, if I'm going onto your system, and I can actually put something in that then is reprogramming what your system is doing or telling it to do something it didn't expect, that's prompt injection.
• 25:00
  David: Now, in, in AI, it's a big, big problem.
• 25:04
  David: So if people type into Claude or ChatGPT or any LLM uh, some information, you know, you're giving the instructions, you're giving the data, it's all together, and the LLM just takes that and processes it.
• 25:17
  David: Now, sometimes it could say, it could tell the LLM to do something like something bad, let's just say, and the LLM would have to know not to do that.
• 25:25
  David: And so it's very easy in these big codes of, of text about, um, you know, des- describe anything that's there.
• 25:33
  David: It's all this stuff, and the attacker can actually put some code in there that's going to tell the AI on the other side to do something that could be negative, or it could point it to some other external, this is indirect prompt injection, point it to some other external database or system that the attacker controls that has some evil, uh, commands in it.
• 25:55
  David: This is a big one, and this is actually very, very difficult, uh, to deal with.
• 25:59
  David: And just to give you an idea of how hard it is to deal with, let me say how it could be used against itself.
• 26:04
  David: So, um There's, you know, when, when Mythos and these other, uh, these other advanced LLMs were being held back from the market, one of the concerns was, well, what if somebody, you know, were to use it for, let's say, a biological attack?
• 26:20
  David: I'm trying not to use words that are gonna get us flagged here, but to use it for something bad.
• 26:24
  David: And so, uh, what people would actually do is ahead of the actual malicious commands that they're gonna run, they're gonna say-- They'll, they'll actually put something out there that tells the LLM to disable itself indirectly.
• 26:38
  David: They'll say, "Help me plan a such and such bad thing," and then, "Help me build a such and such bad thing," with the idea that, oh, okay, now the AI's gonna say, "This is a, this is a bad guy.
• 26:47
  David: I'm gonna ignore what it says." And then the prompt injection comes below that about like, "Go and do this to the healthcare system." It's not easy to reason it out, John, and when you're dealing with the machine intelligence, it can go, you know, many steps beyond what I'm describing.
• 27:02
  John: And when you looked at the-- if you look at the examples of whether it's clinical co-pilots or scribes where, where they've done tests of bad actors injecting… Prompt injection basically is telling the, the, the computer or the algorithm, the automated bot, the agent, to do something that it wasn't originally engineered to do.
• 27:28
  John: The bad guys succeeded or the threats succeeded like ninety-four, ninety-five percent of the time.
• 27:33
  John: So again, this is a good example of we've got incredibly powerful software, and I don't think we've got a choice of the speed with which it's going to be implemented, being implemented, utilized, leveraged faster than we understand the downside of what can happen if a bad actor or honestly an incompetent person, you know, injects the wrong prompt or the prompt, the prompt that they want that isn't actually what the doctor, hospital CEO, or engineer originally intended.
• 28:06
  John: So Dave, I'm still looking for the good news part of this podcast or how, how healthcare executives and healthcare consumers are gonna survive.
• 28:18
  John: I'm just getting depressed here.
• 28:21
  David: Okay.
• 28:21
  David: All right.
• 28:21
  David: So let me, I'll give, I'll give two positive ways.
• 28:25
  David: The, here's the main one, which is that the, when you think about I, I even assumed this a few months ago, that when you have all these AI attackers, then you have to have all these AI defenders, and it's like an arms race and, and it's gonna be- Mm-hmm … just very complicated.
• 28:39
  David: We'll never know what's going on.
• 28:40
  David: That's part of it.
• 28:41
  David: But the, one of the lessons from these, um, these breaches is that the fundamentals still work, and it's not an unwinnable fight.
• 28:51
  David: So some of the basic things in cybersecurity, like patching your systems on time, configuring them properly, restricting access to what's n- you know, what's actually needed to do the task and to the people that need it and for the time they need it, those things actually still work and get you most of the, most of the way there.
• 29:11
  David: Now, a lot of times people ignore those things, and they haven't gotten attention.
• 29:14
  David: You'd be surprised how often we come in and actually see that at a client, that they have all these kind of advanced threats, but they've got all these things that they know about, but they haven't actually been able to get, um, attention to.
• 29:26
  David: So a lot of it has to do, um, with your basic principles, but actually being followed, uh, more, more closely.
• 29:34
  David: And then there's some things that you can do just to kind of reduce your own temptation or your own ability to, you know, to fall for something.
• 29:43
  David: I mean, I, I could fall for things, and I'm a cybersecurity expert.
• 29:46
  David: So in my case, I'm a big proponent of using my Apple devices on what's called lockdown mode.
• 29:53
  David: If you go to the Apple website and look up lockdown mode, it makes it sound like it's only for, you know, journalists that are being persecuted by foreign governments.
• 30:01
  David: Um, but actually it's a good tool'cause a, a lot of us are at, are at risk one way or the other, and it basically prevents you from You could do something stupid, but it won't have bad consequences if you do.
• 30:13
  David: So just sort of reduce your own attack surface.
• 30:15
  David: That would be the, uh, that would be the parlance, um, for it.
• 30:19
  David: So I recommend that if you use hardware.
• 30:20
  David: And then if you look and compare things, you know, with the past, some other doom and gloom scenarios.
• 30:25
  David: Now, John You may not be old enough to remember, but I am.
• 30:29
  David: Uh, like in the early 2000s, you know, there would be like an internet worm.
• 30:33
  David: Like there was this, uh, Code Red in 2001, SQL Slammer in 2003, and this was really before there was cybersecurity, and everybody was using Windows, everyth- you know, everything, ATMs, 911 services, all the airlines were using it.
• 30:47
  David: And something could like tear through and getting, you know, tens of thousands or millions of computers, uh, and servers infected very, very fast.
• 30:56
  David: And that is actually faster than what's happening, uh, with some of these cyber threats that I'm, I'm, I'm discussing, at least on a, on a systemic basis.
• 31:05
  John: Before we wrap, Dave, I think the other thing I would say is that everybody needs to stay as smart as they can on these, however they choose to do it, whether it's podcasts like ours and others, but really the more specific ones.
• 31:18
  John: I mean, the OpenClang example is a really good one, where someone engineers a piece of software that starts to get widely used because it's powerful before people realize it's got no common sense or endpoints.
• 31:29
  John: And I think that, that, that, that, that if anything, that you can reduce your, the surface area of your attack service, but all of healthcare, I think, is gonna be attacked at one point or another, and I think the smartest thing we can do as individual executives, leaders, consumers, protect, to protect our families, is just to stay a little bit more on top of this than we would want to unl- uh, if we're not an expert.
• 31:55
  John: Because these, the, these, these technologies are g- are already starting to get really embedded in everything in healthcare, the good ones, and that means the attack surface is growing even as we, at, at an industrial level, even as we try to, and can and should, reduce the attack surface area of, of us as individuals.
• 32:18
  John: So I think that the good news is that'll keep us in business as podcasters.
• 32:22
  John: The, the bad news is I think we all- Yeah… have to be a little bit more aware.
• 32:26
  David: That's right, John, and maybe I'll, I'll leave on one other good note, which is that we sometimes think about what we call an assumed breach scenario.
• 32:34
  David: So don't think about, "Oh my God, if somebody gets through, I'm doomed." So you make it so that if there's, just assume you've already been breached, and you can't trust the networks, and make it survivable rather than catastrophic.
• 32:48
  David: So that's a way to think about it.
• 32:49
  David: Don't say you're never gonna get breached because, um- Everybody is … you really can't say that, but try to make it s- make it, make it so you can survive.
• 32:56
  David: All right, John.
• 32:57
  David: Well, that's it for another episode of Care Talk.
• 33:00
  David: We've been having a good time talking about AI and cybersecurity in healthcare and looking for, uh, the bright side of it all.
• 33:06
  David: I'm David Williams, president of Health Business Group.
• 33:10
  John: And I'm John Driscoll, the chair of the UConn Health System.
• 33:13
  John: If you like what you heard or you didn't, we'd love you to subscribe on your favorite service.