139: The FDA's Biggest Stick: Medical Device Cybersecurity with Billy Rios
From (CS)²AI Podcast Show: Control System Cyber Security · 42:23
Show by Derek Harp
Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, & Co-Founder of QED Secure Solutions, joins Derek Harp for the audience Q&A after presenting his team's research on a connected wheelchair that was later recalled. Billy explains why the FDA's power to keep a device off the US market is the biggest stick in any industry, what a recall means when the problem is software, and why a manufacturer can't simply switch off a core feature to fix a flaw. They get into legacy "big iron" devices (Billy has bought a CT scanner and a C-arm), why the FDA's guidance works even though it isn't prescriptive, and how manufacturers' behavior has changed in about ten years. Billy also gives advice to researchers: bug bounties, making a living as an independent, how the CFAA and DMCA good-faith exception affect legal risk, and a plain-English explanation of side-channel attacks.Watch the wheelchair clip: https://youtu.be/6-iBC5ugiSoMore from (CS)²AI on YouTube: https://www.youtube.com/@cs2aiGuest: Billy Rios, (CS)²AI Fellow, Cybersecurity Researcher, Author, and Co-Founder of QED SolutionsHost: Derek Harp, Founder and Chairman, (CS)²AIRecorded live during a (CS)²AI Online webinar on October 21, 2026.Chapters:00:42 Welcome from Trisha Harp and the wheelchair research02:01 Who decides whether a manufacturer reports to the FDA?04:44 Are manufacturers getting better? Why the FDA matters08:43 The FDA's biggest stick: keeping a device off the market09:16 What a recall means when the problem is software11:15 Guidance that isn't prescriptive14:16 Controlled vs. uncontrolled vulnerabilities, and the wheelchair dilemma17:30 How the FDA process changed manufacturers20:11 Legacy "big iron": CT scanners, C-arms and VBScript24:08 Standards, secure by design and the "soup" analogy26:10 Connected devices multiplying inside and outside the hospital28:24 Advice for researchers: the 300 backdoor passwords and the PATCH Act30:58 Bug bounties and making a living as a researcher34:55 Legal risk: the CFAA and the DMCA good-faith exception37:11 Side-channel attacks explained38:56 Why only the FDA can do this 41:13 Parting wordsLegal topics in this episode are Billy's views, not legal advice.Produced by (CS)²AI (Control System Cyber Security Association International).
More episodes of (CS)²AI Podcast Show: Control System Cyber Security
More episodes
- 138: From Army Engineer to Critical Infrastructure Security with Marcus Sachs
- 137: From Conference to Change: Asset Owners on What They Actually Did After Level Zero
- 136: Inside the Tabletop: What an Airport OT Incident Taught Us About Command, Cost, and Chaos
- 135: The Cassandra Panel: OT Threat Intelligence from April to September 2026
- 01: Introducing the (CS)²AI Podcast
- 02: Practical Takeaways from the Cyber Security Report with Walter Risi of KPMG
- 03: Innovations and the Value of Teamwork in Cybersecurity with Katie Pehrson
- 04: The Pros & Cons of a Narrow Niche in Cybersecurity with Marty Edwards
- 05: Navigating the Modern Cybersecurity Landscape with Dr. Eric Cole
- 06: The Continuous Adaptability and Improvement of Cybersecurity with Professor Harry Wingo
PodSearch is a free, independent podcast search engine. Read about PodSearch, the privacy policy or contact us.