Rivers on Fire; Shaping the next phase of the mission

The session opens by framing cyberattacks on hospitals, water utilities, food processing, fuel pipelines and local governments as a present-day problem rather than a theoretical one. The speakers describe a gap between well-resourced organizations and "target rich, cyber poor" operators who have no security staff. They tie a 2021 analysis of excess deaths to delayed time-sensitive care during ransomware disruption, and they use ICU capacity strain as a leading indicator of that harm.

The middle of the talk reviews nearly a decade of progress. Examples include an automotive safety framework that carmakers and regulators later drew on, FDA premarket and postmarket guidance that mirrors a published oath for connected medical devices, a 2020 US law setting minimum security standards for IoT purchases, and federal requirements for coordinated vulnerability disclosure. The speakers also point to a published list of bad practices, such as running unsupported end-of-life software in critical infrastructure and relying on hard-coded or guessable maintenance passwords, which they hope will shape insurance and legal standards.

The closing segment urges attendees to change how the public discusses attacks, focusing on patient access and public safety rather than record counts or fines. It also calls for tools, volunteer roles and back-office support to help under-resourced operators. The practical takeaway is that practitioners can help smaller organizations by supporting software bill of materials work and by joining local, state or sector efforts.