Do You Understand the Words That Are Coming Out of My Mouth

Che' Jackson's Proving Ground talk at BSides Las Vegas examines the top security vulnerabilities facing healthcare organizations during the COVID-19 surge. The opening lays out the stakes: disrupted operations, ransomware recovery costs, harm to patient care, exposed records, and lost trust. Employees are presented as the first weak point, with phishing, insider threats, and missing security education cited as common entry paths.

The middle section walks through concrete scenarios. Phishing emails posing as HR or IT, and personal email opened on work laptops, are shown as routes for malware. Small practices are described as easy targets. Cloud misconfigurations are tied to HIPAA Security Rule risk-management duties, and multi-factor authentication, least-privilege access, inventory management, and layered defenses are proposed as safeguards. Connected medical devices, such as insulin pumps, are presented as a patient-safety concern, with network segmentation and tracking of patches and unsupported operating systems recommended.

The closing pushes for framing security in business terms, tying each risk to organizational goals and scaling controls to organization size. The Q&A covered segmenting medical devices from IT, the gap between news of attacks and executive action, and vendor compliance claims. The takeaway: compliance alone is not security, and someone must own the work.