Abstract: Medical cyber-physical systems (mCPS) occupy a fairly unique sub-area of CPS -- the number and diversity of stakeholders and technologies is truly massive. All stakeholders have an interest in improving the security of mCPS, so why has there has been little progress in the area? My recent experience at the FDA sheds some light on this mystery. In this talk, I discuss the diversity of stakeholders and the effect on progress in the field, the lack of trained personnel and the reasons behind it, as well as one of the most fundamental problems -- the ineffectiveness of inter-stakeholder communication. I touch on the particular hardware and software engineering challenges of mCPS, where devices range from those which must run for a decade on a tiny non-replaceable battery, to mains-powered workstations and even mini-clusters. Finally, I talk about the difficulty of moving academic research into practice (and the reasons behind this phenomenon), and also cover some myths about FDA's regulation of medical devices, especially security and software updates.

Biography: Eugene Vasserman is an Associate Professor in the Department of Computer Science at Kansas State University, specializing in the security of distributed systems. He is also the director of the Kansas State University Center for Information and Systems Assurance. He received a B.S. in Biochemistry and Neuroscience with a Computer Science minor from the University of Minnesota in 2003. His M.S. and Ph.D. in Computer Science are also from the University of Minnesota, in 2008 and 2010, respectively. His current research is chiefly in the area of security for medical cyber-physical systems, security usability, and user education. His past work spans the gamut from security vulnerabilities emergent from the BGP infrastructure of the internet, to energy depletion attacks in low-power systems, to secure hyper-local social networking, to privacy and censorship resistance on a global scale (systems capable of supporting up to a hundred billion users). In 2013, he received the NSF CAREER award for work on secure next-generation medical systems. He spent the 2016-2017 academic year on sabbatical at the FDA, serving as a security subject matter expert, taking regulator certification classes, and organizing and running a public workshop focused on regulatory science gaps in the way medical device security is handled. He has served on numerous program committees, including USENIX Security, ACSAC, PETS, USEC, ASIACCS, HotWiSec, WPES, SecureComm, and chaired the 2014 USENIX HealthTech Summit. He is a member of the UL 2900 standardization process for cybersecurity of network-connectable devices, the AAMI interoperability working group, and the AAMI / UL 2800 standards effort for medical device interoperability.