Vulnerability Disclosure Panel: Healing the Healthcare Immune System
Chloe Messdaghi, Eric, and Bugcrowd founder Casey Ellis discuss the legal perils and necessity of coordinated vulnerability disclosure in healthcare, introducing the disclose.io project.
Summary
The Legal Chill Over Medical Vulnerability Research
Despite good faith efforts by security researchers to discover flaws in healthcare technology, legacy legal statutes like the CFAA and DMCA Section 1201 create severe chilling effects.
The Reality of Hospital Asset and Vulnerability Management
Panelists examine operational vulnerabilities within healthcare networks, from absent device inventories to unpatched clinical systems where uptime and patient availability supersede security maintenance.
Standardizing Vulnerability Disclosure with disclose.io
Casey Ellis outlines the evolution of disclose.io, an open-source initiative providing standardized, legally protective vulnerability disclosure program (VDP) terms and safe harbor language.
Fostering an Internet Immune System for Healthcare
The panel outlines practical steps for hospitals, medical device manufacturers, and security researchers to establish trust, streamline triage, and protect clinical patient safety.
Related talks
Biohacking Village·26 min
Mixæl Laufer
Four Thieves Vinegar Collective founder Mixæl Laufer shares open-source medicine projects, decentralized hardware, and grassroots biohacking initiatives.
Biohacking Village·1 hr 29 min
Nina Alli
Biohacking Village Executive Director Nina Alli interviews clinical professionals, patients, and hackers on the future of healthcare security.
Biohacking Village·27 min
Mo Ali · Amy Abernethy
FDA Principal Deputy Commissioner Amy Abernethy discusses medical device cybersecurity, big data, and regulatory collaboration.