Building OSINT and Recon Program to address Healthcare

In this presentation at the DEF CON 27 Recon Village, Mitchell Parker, Executive Director of Information Security and CISO, details the architecture and operational deployment of proactive OSINT and external reconnaissance programs within large healthcare systems. He begins at 06:00 by describing the complex organizational landscape of the healthcare industry, where hospital networks must securely coordinate with fiercely independent clinical practices, academic research centers, and third-party medical partners under strict HIPAA regulations.

Mitchell explains at 12:00 why passive defensive controls are insufficient, presenting a blueprint for building continuous external attack surface reconnaissance programs. This framework systematically monitors exposed medical IoT devices, telehealth infrastructure, cloud-hosted electronic health records (EHR), and public DNS records for shadow IT assets. At 18:00, he emphasizes the critical importance of building positive relationships between clinical staff and cybersecurity teams, warning that executive disconnect leads employees to conceal breaches.

Addressing cultural barriers at 24:00, Mitchell discusses how removing blame and eliminating punitive responses encourages medical professionals to report phishing attempts and suspicious incidents promptly. He shares strategies at 30:00 for translating technical conference research and threat intelligence into risk-quantified presentations that hospital boards and clinical directors understand. He concludes with an interactive audience discussion at 36:00 on navigating clinical workflows during security incident response. (AI summary — Gemini Flash)