ISMG Editors: How Will the Quantum Era Reshape Cybersecurity?

Transcript

This transcript has been edited and refined for clarity.

Anna Delaney: Hello, and thanks for joining us for the ISMG Editors' Panel. I'm Anna Delaney, and today we're covering everything from RSA 2024 to the latest guidance on web trackers from federal regulators, alongside developments in quantum computing. Our merry team today includes Tom Field, senior vice president of editorial; Marianne Kolbasuk McGee, executive editor for HealthcareInfoSecurity; and Michael Novinson, managing editor for ISMG business. Great to see you.

Michael Novinson: Thanks for having us over.

Marianne McGee: Thanks.

Delaney: Tom, I can't quite believe I'm saying this. But RSA 2024 is right around the corner. Very much. So I've been receiving few emails wanting to set up interviews. And I'm saying, hold fire for now. I haven't seen the schedule yet. But it's exciting. It's exciting then also to bring the team together again, always the best meals and in between moments that we can grab and build a team but speak to a whole range of people from academics to anybody in the legal profession to of course, security leaders, and people in government. So I'm looking forward too.

Tom Field: Just over a month away? Can you believe it? It just ... preparation for you. I have just received a list of folks that we're going to be going after to bring into our studios. So we'll be talking about this with you very soon, in quite detail. RSA is coming. This is going to be - I say it every year, it's going to be probably the biggest, most focused team we send to the event. And our mission is to go there and talk with the movers and shakers and make sure we're talking with people about the topics that matter most. Now, we're not there to cover every session, nobody is. But if we can get some of the most important people from around the world plugged into the cybersecurity/technology space and bring them into our studios, studios, plural, to sit down and have some discussions and engage in some panels and create some new content. Well, I think we're going to have a grand time and I very much look forward to it. So how about you, Anna? That's why I wanted to talk about it today too to let our audience know that this is upcoming. We're starting to fill our studios now. And we're interested in a couple of things, your recommendations, who do you think should be visiting with us at RSA studios or are you going to be there? In which will to come and join one of our discussions. We post this panel on our sites, we post it on social media, there's plenty of opportunity to respond and comment, let us know who you'd like to see in our studios and whether you'd like to visit as well. And we'll show you a teaser because we had the opportunity to sit down with so many thought leaders over the course of the three or four days. I think we did what, Michael, north of 150 interviews last year.

Novinson: That sounds correct to me.

Field: And guess what we're going to top that this year. So it's luminaries, we talked with CISOs. As Anna said, we talked with academics, researchers, government officials, I want to share just a teaser of one of the discussions I had last year with White House advisor, Anne Neuberger. Now the setup for this is we were talking about accomplishments so far and the Biden administration. I asked her what she felt the administration had done the first two years of his tenure when it comes to cybersecurity. So I'm going to share here, her response to me.

Anne Neuberger: It's a great question. I think to your point, the executive order said two core messages. One, we will practice what we preach. And we set aggressive guidelines for improving cybersecurity across federal government networks. That was in the aftermath of SolarWinds that compromised quite a few sensitive federal government networks. The second piece was we said, we in the U.S. government buy large amounts of technology and we buy the same tech. Americans are buying, American companies are buying, let's use the power of the purse to say we will only buy software that meets these critical security standards. Let's establish that standard. And buy our own purchases, lift that up. There were many elements of the executive order. Those were two key ones that we focused on. When we look at the National Cybersecurity Strategy. You have, of course, that first piece where it captures the work done to improve the security of critical infrastructure I mentioned a moment ago, it focuses on our international partnerships. And it focuses as well to say there's a shared partnership between the companies who build tech, and the companies who use tech. And as tech is a bigger part of our economy, it is a bigger part of our critical infrastructure that companies who build tech need to recognize their role in building tech that's as secure as possible.

Field: And boy, that last topic hasn't become any more critical over the past year, there's going to be a lot to talk about. Think about it. Ever since we were at RSA last year, AI has exploded more than had even then we have seen China exert his muscles in terms of incursions into us critical infrastructure. And we've seen an explosion of ransomware that Marianne has talked about, specifically in her sector every week recently. Lots to talk about with our constituents this year.

Delaney: it's the best gauge of what's happening in the industry. It's the event of the year. So as you say, lots to talk about looking forward to see you there in May then. Well, Marianne federal regulators have issued some updated guidance regarding the use of web trackers on patient portals and health related websites. And I know this topic has been on your radar for a while now. So I'd love to hear your insights and maybe initial impressions of the updated guidance. Lots of acronyms to get through that, well-done. But so Marianne, what do you think the broader effects on of this guidance will be on the healthcare industry or patient privacy rights? Do you have thoughts of your own on that?

McGee: Sure, well, first of all online trackers such as Megapixel are widely used in many websites in and outside the healthcare sector, but in the healthcare sector, they're very common on hospital websites, patient portals and other health related websites. But those online trackers pose privacy concerns because they may share sensitive information about individuals from the hospital websites and portals with third-party vendors such as the tracking vendors, and that sharing might involve unauthorized disclosure of protected health information under HIPAA. Now, this week, the Department of Health and Human Services updated controversial guidance that they first issued in December of 2022. That earlier guidance warned that HIPAA regulated entities that use online trackers in their websites and patient portals to collect and transmit protected health information, including IP addresses of users devices, could constitute HIPAA violations subject to enforcement actions such as civil monetary fines. Now on Monday, HHS OCR backtracked that 2022 guidance a bit by providing some new scenarios illustrating when the use of web trackers to collect and transmit certain user information may or may not constitute a HIPAA violation. For instance, depending on the scenario HHS OCR now says that not every IP address is considered protected health information and IPS address may be PHI only in certain circumstances, when an individual is visiting a website in relationship to their past present or future health care. HHS OCR clarified that the intentions of the website visitor also matters when making that determination. So if an individual is accessing a website or using an app for information regarding their own healthcare needs, while using their own device, the collection of that person's IP address is still considered PHI. However, if the user is visiting a website of a hospital and they're looking at job postings, or maybe just the visiting hours, the IP address of that user would not necessarily be considered HIPAA PHI. Now, this all gets pretty complicated, but a lot of this matters a lot to certain entities such as hospitals who are frequent users of these tracking tools. Now after HHS OCR issued its earlier guidance in December 2022, broadly warning about the use of tracking tools. The American Hospital Association filed a lawsuit against HHS demanding that the agency rescind or amend its guidance. Now, the HAA contends that, among other allegations that HHS OCR is broad guidance in December of 2022 exceeded the agency's authority under HIPAA and the First Amendment. The AHA said that the earlier guidance upended hospitals and health systems' ability to share healthcare information with their communities to analyze their own websites to enhance accessibility and to improve public health. Now, the AHA told me this week that HHS OCR modifying its earlier guidance this week, in response to the group's lawsuit last year, concedes that the original guidance was flawed as a matter of law and policy. But even saw the AHA complained still that the updated guidance still suffers from the same basic defects as the original one and that the agency cannot rely on these cosmetic changes to evade judicial review. So the AHA says that HHS' modified guidance will continue to chill hospitals use of commonplace technologies such as web tracking that they do need to use in order to effectively reach their patients. Now the lawsuit by AHA against HHS as of yesterday was still playing out in federal court. In the meantime, several U.S. healthcare organizations are also facing proposed class action lawsuits by patients involving privacy concerns over their current or previous use of online trackers on their websites and patient portals. Many of those lawsuits were filed after HHS OCR issued its original HIPAA guidance about web trackers in 2022. Also, Facebook parent company of Meta faces a proposed consolidated class action lawsuit in California, alleging that it violated privacy law by collecting patient information through its pixel tracker on hospital websites. Now that class action came into play even before HHS issued that original broad web tracking guidance. So now we have to see whether HHS OCR takes any future enforcement actions against regulated entities that continue to use these web trackers. The agency has been warning about possible enforcement actions in these cases for more than a year now but so far has not issued any maybe because of the AHA lawsuit but it kind of kind of chilled everything for a while. Well soon after HHS, OCR issued that initial guidance and even before that there was an investigative report by, I think it was markup and some other agent or some other organization, your nonprofit organizations that basically did some sort of analysis and found that thousands of hospital websites use these trackers and , many patients they just don't know that they don't know that , certain information if they're looking up symptoms of cancer or whatever on a portal that this could be then sent to Facebook and then all of a sudden they get these weird ads and , whatever else happens. So it's kind of spooky, I think, to some people, but the hospitals that use these trackers say, well, we need to use these in order to see what our patients are concerned about. And when that investigative report came out, that's when you started seeing some of these hospitals report HIPAA breaches involving their own use of these online trackers just to kind of cover themselves hey maybe this is a breach, we're not sure we're using trackers, and they reported these large breaches. So I think it's hard to tell what's going to go on, because you have these crackers are pervasive on all websites you go online, look for sneakers, and all of a sudden you get 20 ads sending you recommendations for pink sneakers so these things are not unusual. But when it comes to collecting sensitive information about patients, and then maybe being able to link who these patients are, that's where it gets kind of creepy. And I don't know what you can do about it, other than to kind of threaten these organizations not to use these trackers, because they're so embedded now, I don't know what it would take to pull them out. And yet some of the damage has already been done.

Delaney: It's a complex story. Well, thank you so much, Marianne, for that. Michael, we're talking quantum computing inspired by a feature you've written this week. And the industry has long discussed the emergence of quantum computing. But the question remains, just how imminent is the threat it poses to current encryption standards and digital security?

Novinson: It's a good question. And thank you for asking it. So as you said, this has been on the radar, a theoretical question dating back to the 1990s. And that being the question of once we have computers that are powerful enough to decrypt RSA to break RSA, what does that mean for our ability to secure the internet traffic to secure network traffic? But what was once a hypothetical scenario is increasingly becoming real that experts today believe that within the next decade, we will see advances in quantum computing to the point where RSA or the modern cryptography standards can be broken. So what does that mean? It means a couple things for offense, a couple of things for defense - on the offensive side, we're seeing a lot of these steal now, decrypt later schemes, where adversaries are just collecting data -data they can't view today, but in hopes that once RSA is able to be broken, they can decrypt and enjoy all the goodies then. So part of this is figuring out what types of data should you target? Where is this relevant, and essentially, you're looking for pieces of equipment that have a long lifespan, so they're likely to steal, or at least have a chance of still being in use once RSA is broken. So think, pieces of medical equipment, think automobiles, stuff that's used often for decades, rather than very years. So that's what we're seeing adversaries going after? What can defenders do now? , yes, there's certainly it's a bit of a game of latency that we're still waiting in the United States, at least for the adoption of new cryptography standards, that the private industry that would adhere to that would be considered quantum proof. They're working on them. Folks I spoke to for this story said that there's four algorithms that are currently under consideration, decision expected soon, but nothing today. , some private industry has gone ahead and you look around and press releases, you can see it that folks are already advertising that they have, that they're building hardware, they're building technology with quantum resistant algorithms. You've seen Apple advertising this with some of their most modern phones. Cloudflare advertising this, also some of the technology they have. , today, that's not backed by any government agency, they haven't had to get certified by anyone, but that will change soon. So from the standpoint of individual contributors, chief information security officer, what should you do now? So it's a matter get your house in order to prevent any bleeding if offense beats the defense, so segmentation, isolation, air gapping, do all that type of stuff. So if there is some type of a compromise, you can minimize the extent of the damage. But also, it's about a ton of acid inventory, figure out where within your organization, you're using cryptography, which isn't something folks have thought about too much to date. But figure out not only were you using cryptography, but what secrets are being guarded by cryptography, which of those secrets are a) most sensitive and b) most likely to be relevant several years down the road? So that you can have a prioritization list in effect once there is more robust quantum resistant defense that you can adopt. And so yeah, a lot of that is also just trying to future proof so that what Once there are quantum resistant, quantum resistant encryption that you can put in place that it's a seamless transition that you can remove your current cryptography replace it with, with the more advanced cryptography, and that you can do that with minimal disruption to your organization. And then it's about also just thinking about employee of thinking about your workforce, not in terms of just the corporate life, but also in their personal life that if you're thinking about PII and HIPAA, that this isn't just an enterprise consideration, but if you're an HR department and you have are you in payroll, and do you have credit card information, you have personal health records, medical records for your employees, what are you doing to keep their personal data safe, not just corporate data for your customers, so there's multiple different spheres. So it's about trying, today, just trying to get those ducks in a row so that once more modern algorithms are available, that they can be implemented quickly and done in the most important areas first.

Delaney: Lots of sound advice there. Thanks, Michael. How do we see different regions approaching the readiness for quantum computing? And how does it affect cybersecurity?

Novinson: Good question. And I do think we're seeing some variation in terms of compliance-driven approaches versus risk-driven approaches that some of the folks are speaking to said that this that which is the U.S. National Institute of Standards and Technology is focused on a compliance driven approach to quantum safe cryptography. And that other regions, Europe and Asia have been focused more on risk minimization, rather than more of a compliance framework. So that's certainly a piece of it, and then, from a cybersecurity standpoint, I know cryptography originally was its own world how RSA was a cryptography conference before it morphed into a cyber conference. But yeah, I think it's just a back to basics approach and making sure that, that you're doing the bread and butter. And that in particular, that if you're in a less regulated industry, that your financial services and your healthcare companies and your retail where a lot of them have more robust protections in place right now. But if you're in sectors particularly like enterprise software, where there's not a regulatory party forcing you to do certain things from a cryptographic standpoint, that you voluntarily up your game, so that you're not too far behind the curve once this quantum Armageddon hits.

Delaney: Michael, you've done a great job tackling a very meaty topic in less than five minutes so thank you. Finally, and just for fun, what would the soundtrack for a day in the life of a cybersecurity professional sound like. Name three tracks that would feature.

Field: I think it'd be Guardians of the Galaxy. We tap right in the classic rock.

Novinson: Classic rock.

Field: Start the day with the Beatles Helter Skelter. I think that sets the scene very well for what someone faces at the start of a day. By midday, we're going to call it Billy Joel's Pressure and by day's end, I'm hoping that we've done just enough that we can all be talking about - wait for it - Good Vibrations.

Delaney: Can you sing it?

Field: I'm picking up Good Vibrations.

Delaney: Very good. Yeah, that's very good. Well thought through. Marianne, go for it.

McGee: Well, believe it or not, I picked Pressure for one; as you're going through an attack, Tie a Yellow Ribbon by Tony Orlando and hope that you'll get your data and systems back and hopefully by the end of that episode, you can sing I Will Survive by Gloria Gaynor.

Delaney: Michael?

Novinson: This is a fun one, man. I did have to put on my thinking cap here. So some of mine are touch more current, no offense to Tom and Marianne here. So I was thinking about maybe a bit more of a morose state that I wanted to start with Billy Eilish's Bad Guy in terms of fighting the adversaries. Then assuming an adversary gets in I was thinking of the old rock band Silversun Pickups and their song Panic Switch, got to flip that panic switch and then if the cyber adversaries are aware that you're going after them that they may just slashed and burned everything and shut all your systems down which made me think of the Beastie Boys on Sabotage. So my day does not have a happy ending, but lots of good music along the way.

Delaney: Michael, I'm going to have to pick up the mood here, but I love this like pressure and panic and sabotage and then survival mode. I haven't chosen any backgrounds, but I've chosen the Matrix main theme for the morning just to build up some suspense for the day, midday crisis will be the Chain by Fleetwood Mac. So we'll be there in the race against time to mitigate the potential threats. But also, I'm going to say we avert disaster because I want to end on a positive note and then we're ending on Always Look on the Bright Side of Life, just because we got to keep that positive outlook.

Field: There's an RSA connection because Eric Idle performed that at RSA 2023.

Delaney: There you go! Well, thank you so much for your insight. It's been informative and entertaining as always, loved it.

Field: Always on the bright side of life.

Delaney: Absolutely. And thanks so much for watching. Until next time.