CHC Academic Symposium 2025
Aaron Shulman, PhD - Finding Single Points of Failure in Healthcare Infrastructure Through Dependency Measurement
Hospitals run on vendors and upstream platforms they do not control. This talk shows how to measure those dependencies and find the failure points that turn incidents into widespread outages.
Show MoreHospitals increasingly rely on external service providers and shared infrastructure that sit outside traditional enterprise security boundaries. Aaron Shulman proposes a measurement-driven approach to identify and prioritize third-party dependencies that can create systemic, cascading failure. Using observable digital signals, internet measurement, and wireless data sources that adversaries already use for reconnaissance, the work aims to map operational reliance on vendors and upstream platforms. The goal is to surface central points of failure, quantify concentration risk, and produce actionable dependency maps that help reduce outage and ransomware blast radius before disruptions occur. The talk closes with practical considerations for validating dependency graphs and integrating application and infrastructure perspectives.
Deepak Kumar, PhD - Using Social Media to Measure Real World Harm From Hospital Ransomware
Official reporting is slow. This work uses Facebook and Reddit signals to detect ransomware impact sooner and to capture what patients and staff actually experience during disruptions.
Show MoreRansomware attacks against healthcare delivery organizations are increasing, yet evidence of patient and provider impact is often sparse, inconsistent, or delayed. Deepak Kumar presents a measurement approach that uses social media as an external lens to study ransomware impact at scale. The work analyzes six years of data from official Facebook pages for roughly 4,000 healthcare organizations and discussion across 73 Reddit communities from 2018 to 2024, linking posts to known attacks assembled from multiple public incident datasets. The analysis shows that platforms provide different types of visibility, with Facebook skewing toward rapid operational updates and short-lived communications, while Reddit supports longer, more detailed discussion including help-seeking around billing and downstream disruption. The findings support using these signals to improve situational awareness, guide triage during acute incidents, and inform resilience planning beyond technical remediation.
Hannah Neprash, PhD - Healthcare Economics: A Powerful Tool for Cybersecurity Research
Ransomware is measurable harm, not a vague risk. This talk links attack windows to Medicare outcomes and then applies the same lens to what the Change Healthcare disruption reveals about emergency financial relief.
Show MoreHospitals face growing exposure to ransomware, yet policy and investment decisions often lack quantified evidence of patient harm. Healthcare economist Hannah Neprash presents research that links precisely timed hospital ransomware events to Medicare patient outcomes using a curated incident dataset designed to capture when an attack materially disrupted operations. Using a quasi-experimental design comparing affected hospitals to matched controls, the analysis finds a substantial increase in mortality among patients treated during ransomware attack windows, alongside shifts in admissions and case mix consistent with disruption and diversion of time-sensitive care. The talk then turns to a second question driven by the 2024 Change Healthcare incident, examining what the federal response reveals about how financial relief is delivered during healthcare cyber disruptions. The discussion highlights timing and targeting challenges in emergency payments and offers practical lessons for designing faster, more equitable support that stabilizes care delivery during large-scale outages.
Miro Moffett - Building Hospital Digital Twins for Frugal Testing and Detection of Legacy Device Risk
Legacy devices are hard to replace and even harder to test realistically. This talk shows how low-cost rigs and digital twins can surface risk under real use conditions and support practical resilience.
Show MoreMedical devices and point-of-care edge systems often depend on legacy protocols, default configurations, and postmarket practices that leave real operational exposure after deployment. Miro Moffett describes research directions within the InCypher program at Imperial Global Singapore aimed at improving security for both legacy and next-generation medical devices. A central case study examines continuous glucose monitors, showing how low-friction test rigs and physiologic simulation models can support dynamic security testing that better reflects real use conditions. The discussion connects protocol design choices to clinical consequences, including how unencrypted short-range communications can enable manipulation of glucose readings and unsafe patient behavior. The talk also introduces hardware-rooted trust using physically unclonable functions for lightweight keying and group access, and argues for scalable synthetic data and digital twin platforms to enable continuous testing, collaboration, and better intrusion detection for nonstandard hospital networks.
Zhengzi Xu, PhD - AI Agents for Medical Device Security, From SBOM Inference to Vulnerability Discovery
This talk connects device-level attack paths to software risk at scale, using AI agents for component inference, vulnerability discovery, and more trustworthy, privacy-aware deployment.
Show MoreHealthcare security increasingly depends on both legacy-connected medical devices and emerging AI-enabled workflows. Zhengzi Xu describes research underway at Imperial Global Singapore within the InCypher program spanning device security, software risk analysis, and trustworthy AI. The presentation begins with a continuous glucose monitor case study, showing how wireless traffic monitoring and data manipulation can translate into life-critical consequences when readings influence insulin delivery. The talk then introduces hardware-based authentication using chip-level fingerprints that enable device identity without stored passwords. Moving up the stack, Xu presents AI-agent approaches for software composition analysis that infer components and vulnerabilities from observable features, plus AI-assisted static analysis that broadens vulnerability candidate discovery while reducing false positives through program analysis. The talk closes with privacy-preserving model training using differential privacy and a trust-agent framework that evaluates whether AI-generated recommendations are correct and practically useful, paired with an explainable stepwise agent architecture intended for healthcare settings.
Geoff Voelker, PhD - Remote Measurement of Hospital Network Outages Using Web Services FHIR and NTP Signals
If you cannot see inside the hospital network, you can still measure disruption. This talk shows how probing public services and FHIR endpoints can detect outages, estimate duration, and support a national view.
Show MoreHospitals have limited uniform reporting on when ransomware events begin, which services fail, and how long recovery takes, creating a situational awareness gap for researchers, responders, and policymakers. Geoff Voelker presents a measurement-driven approach to infer disruption from a remote third-party perspective by continuously probing internet-facing services and healthcare-specific endpoints. The methodology combines availability signals from standard services such as web and mail, domain-specific probing of FHIR endpoints across vendors, and corroborating telemetry from network time protocol traffic that can drop when organizations take infrastructure offline. The talk describes how the project identifies hospital networks and services at scale using domain expansion and certificate-based discovery, distinguishes on-prem and cloud-hosted services, and converts probe streams into down and recovery events. Case examples show how the system can surface early disruption signals before public communications and detect non-malicious systemic outages such as the CrowdStrike update. The presentation concludes with a prototype dashboard that visualizes national availability and supports longitudinal analysis of healthcare disruption patterns.
Kevin Fu, PhD - (Keynote) Twenty Years of Medical Device Security, From Pacemakers to Ransomware and Systemic Failure
From early pacemaker demonstrations to modern ransomware-driven downtime, this keynote traces how the field shifted from device bugs to system-wide resilience and patient safety outcomes.
Show MoreMedical device cybersecurity has shifted from isolated vulnerability research to a broader resilience problem that touches hospitals, regulators, and national incident response. Kevin Fu reflects on nearly two decades of work that began with early pacemaker security demonstrations and traces how the field matured into coordinated vulnerability disclosure with active participation from manufacturers, regulators, and agencies such as CISA. He argues that the center of gravity has moved from firmware bugs in a single device to systemic failure modes that can take clinical operations down, including ransomware events and fragile shared dependencies. The keynote emphasizes patient safety outcomes, noting that availability failures can matter more than confidentiality in acute care. Fu highlights practical priorities for the healthcare ecosystem including threat modeling literacy for engineers, reduction of default credential exposure, and procurement language that prevents hospitals from being misled about device security capabilities. The result is a call to align incentives so safety-critical technology is built, bought, and operated with measurable resilience.
Nastassia Tamari - SBOMs, Vulnerability Management, and Least Burdensome Evidence, How FDA Reviews Cyber Devices
What does FDA actually want to see for a cyber device submission. This talk walks through Section 524B expectations, SBOM quality, and the postmarket plan that separates strong packages from slow reviews.
Show MoreNastassia Tamari, Division Director of Medical Device Cybersecurity at FDA CDRH, explains how FDA is operationalizing Section 524B of the FD&C Act for cyber devices and what manufacturers should include in premarket submissions. She walks through how the latest FDA premarket cybersecurity guidance incorporates statutory documentation expectations, with emphasis on traceable cybersecurity evidence that supports safety and effectiveness across the total product lifecycle. Key topics include SBOMs as a foundational tool for vulnerability awareness and remediation, common SBOM quality issues that slow review, and the expectation that SBOMs be maintained and updated as part of configuration management. Tamari also outlines expectations for a postmarket vulnerability management approach, including coordinated vulnerability disclosure and clear reporting of critical vulnerabilities that could drive uncontrolled risk. The talk closes with practical guidance on modifications and how recommended documentation varies based on whether a change affects software, connectivity, or cybersecurity risk.
Pat Pannuto, PhD - Solving Embedded Operating Systems and Firmware Challenges for Medical Devices
This talk breaks down how secure systems earn trust from power-on, then applies those ideas to medical devices that must run for years with limited ability to patch, redesign, or isolate components.
Show MoreMedical devices and the systems around them increasingly resemble general-purpose computing, but they are often built on embedded platforms that lack the isolation and safety mechanisms common in laptops and servers. Pat Pannuto frames cybersecurity as a question of trust foundations and walks through how modern systems establish that trust starting at power-on. He explains hardware and firmware roots of trust, how verified boot chains protect firmware and operating system integrity, and why firmware update mechanisms must be designed to prevent cross-component compromise. The presentation then connects these principles to the realities of medical devices and hospital-adjacent embedded systems, where resource constraints and long lifecycles complicate patching and redesign. Pannuto argues that stronger isolation and memory-safe development are becoming non-negotiable for safety-critical products, and discusses approaches such as Rust-based embedded systems and operating system designs that support multiple mutually distrustful applications on microcontrollers.
Ronald E. Thompson - Clinician and Patient Perceptions on Security Failures and Trustworthiness
Cyber incidents do not stay in IT. This talk shows how availability and integrity failures break clinical workflows, reshape risk perception, and raise hard questions about what patients are owed when care is disrupted.
Show MoreHealthcare cyber incidents rarely stay confined to IT systems. Ronald E. Thompson frames cybersecurity as a patient safety problem and shows how technical disruptions cascade into clinical workflow and communication failures. He opens with a real-world ransomware event in which loss of network availability disrupted centralized fetal monitoring, contributing to delayed clinical response and severe downstream harm, despite bedside devices still functioning. Thompson then presents research on clinician risk perceptions using structured scenarios that isolate confidentiality, integrity, and availability impacts to understand what clinicians fear most and which failures immediately stop care. He emphasizes that frontline teams prioritize availability and integrity, and that workarounds often introduce new safety risks. The talk also examines cybersecurity-informed consent, arguing that patients are frequently unaware of cyber-related operational disruptions that can meaningfully affect care and decision-making. The overall message is that resilient healthcare requires designing for human behavior under pressure and aligning device makers, clinicians, patients, and operators around measurable safety outcomes.
Digiheals Sessions
Andrew Hindella (KARAMBIT.AI) - Beyond SBOM, A Software Bill of Behaviors for Medical Device Cyber Risk and Safety
SBOMs tell you what is inside. This lightning talk focuses on what the software actually does, producing behavior reports that support faster triage and clearer postmarket decisions.
Show MoreSBOMs improve visibility into third-party components and known vulnerabilities, but they do not reliably answer what hospitals and regulators often need most, what the device software will actually do in the real world and what risks that behavior creates. Andrew Hindella proposes a complementary approach he calls a Software Bill of Behaviors, automated firmware and binary analysis that characterizes observable behaviors such as network activity, update mechanisms, and other embedded capabilities that can affect cybersecurity and patient safety. Using medical device firmware analysis, including the CMS8000 Contec monitor case, he shows how behavior-based reporting can reveal risky functionality that may not surface in SBOM-based review. The talk connects behavior reports to practical workflows such as faster risk triage, improved postmarket vulnerability management, and clearer evidence of what changed between firmware versions so teams can prioritize testing and accelerate safer patch cycles.
Tom Sherman (STR); Ricardo Barato (Aarno Labs) - Securing Legacy Medical Devices, From Vulnerability Discovery to Binary Patching
Legacy devices stay in service, even when the patch does not. This session lays out a pragmatic path from finding vulnerabilities to deploying compensating controls and binary fixes when source code or vendor updates are not available.
Show MoreLegacy medical devices stay in service for years, often run outdated firmware, and sit on networks ransomware actors routinely penetrate. This session outlines why long device lifecycles and secondhand markets amplify risk, and why waiting for a vendor patch is not a sufficient strategy for availability-driven clinical environments. The first portion, Tom Sherman from STR, frames the problem including opaque vendor updates, limited visibility into device software composition, and the challenge of isolating devices that are operationally essential. The second portion, Ricardo Barato from Aarno Labs, presents a technical path forward once vulnerabilities are identified, including firmware and software composition analysis, matching against known code bases, and binary analysis and patching approaches that can enable compensating controls when source code or vendor fixes are unavailable. The emphasis is on practical security improvements for real hospital conditions including reducing blast radius, improving detection, and enabling safer operations for devices that cannot be replaced on the timeline security teams would prefer.
Ashkay Kumar (Trail of Bits) - Patch History: Making Binary Software More Patchable Without Source Code
A framework that lifts binaries into higher-level representations so fixes can be inspected, modified, and validated without source code.
Show MoreLegacy medical devices often need security fixes, but hospitals and researchers frequently lack the source code, build system context, or vendor support needed for traditional remediation. This session presents Patch History, a framework designed to improve patchability by lifting binary code into higher-level representations that are easier to inspect, modify, and validate. It connects that technical workflow to real postmarket needs: faster triage of what a firmware image contains, clearer evidence of what changes between versions, and a more repeatable path to implementing fixes with confidence. The goal is not “patching for patching’s sake,” but enabling safer, more auditable change in environments where the alternative is prolonged exposure.
Christopher Stricklan (Kraetonics LLC) - BINDIV-MD: Software Diversity to Disrupt Mass Exploitation
Generate multiple functionally equivalent binaries so deployed fleets are no longer uniform targets for large-scale exploitation.
Show MoreMass exploitation succeeds when thousands of devices behave identically, allowing attackers to reuse the same exploit with near-zero marginal effort. This talk introduces BINDIV-MD, an approach that generates multiple functionally equivalent binaries from a single source codebase so deployed devices are no longer uniform targets. It frames diversification as a practical passive protection strategy for medical and embedded systems where patch timelines are slow and homogeneous deployments are common. The emphasis is on shifting attacker economics: reducing exploit reliability at scale, increasing effort and operational friction, and making large-fleet compromise harder even when individual vulnerabilities still exist.
Fish Wang (ASU) - Rapid Firmware Vulnerability Discovery for Medical Devices at Scale
Automated methods to understand and test firmware at scale when source code is unavailable, surfacing high-risk conditions earlier.
Show MoreModern medical devices rely on firmware and embedded software that can be difficult to analyze, difficult to update, and easy to overlook until something goes wrong. This talk focuses on automated methods to understand and test device firmware when source code is unavailable, including fast techniques for vulnerability discovery that can operate across many firmware images. It discusses why security through obscurity does not eliminate attacker capability and may widen the defender’s understanding gap. The emphasis is on scalable analysis that supports practical outcomes: reducing uncertainty about what device software does, surfacing high-risk conditions earlier, and creating a foundation for more reliable mitigation and patch planning.
(Margin Research) - A National View of Healthcare Exposure: Measuring Risk from the Outside
Population-level exposure measurement across healthcare IP space to support prioritization, benchmarking, and defensible “fix first” decisions.
Show MoreAttackers don’t need internal access to begin prioritizing targets—they start with what’s visible from the internet and scale from there. This session presents a population-level view of healthcare exposure using passive assessment methods to identify externally visible services and vulnerability signals across U.S. healthcare IP space. It introduces a risk indexing approach that combines exposure and severity to support prioritization, benchmarking, and decision-making at scale—especially where leadership needs defensible answers to what should we fix first. The focus is on turning external visibility into action: reducing preventable exposure, improving triage speed, and providing evidence that can inform both operational investment and policy discussions.
Prashant Anantharaman (Narf Industries) - Interoperability Under Stress: Testing the Reality of “Standards-Compliant” Healthcare Systems
Why certification and “claims of compliance” miss edge cases, and how to measure real interoperability under imperfect conditions.
Show MoreHealthcare standards are designed to enable safe and predictable data exchange, but real-world implementations can diverge in subtle ways that create reliability and security risk. This talk examines interoperability across widely used standards, focusing on how edge cases, inconsistent parsing and validation, and implementation variance can produce failures that certification or claims of compliance don’t capture. The emphasis is on closing the gap between specification and reality so organizations can trust data exchange when conditions are imperfect, not just when everything behaves as expected.
Kevin Leach (BALAM-D) - Practical Paths to Patching and Repairing Vulnerabilities in Medical Device Firmware
Linking the technical challenge of firmware repair to the operational reality of deploying fixes safely across device fleets.
Show MoreHospitals operate large, shifting inventories of connected devices, but the ability to remediate vulnerabilities is constrained by clinical downtime, vendor processes, and regulatory realities. This session introduces BALAM-D, a research effort aimed at making vulnerability mitigation more achievable across medical device firmware, linking the technical challenge of constructing patches with the operational challenge of deploying them safely. It addresses real frictions: liability questions, FDA scrutiny, and the logistical complexity of patching fleets without disrupting patient care. The talk also connects research to manufacturer workflows by working with device partners and exploring repair not only at the binary level, but also earlier in development where fixes can be validated and carried forward more reliably.