Colin Morgan is a key thought leader in the Healthcare Cybersecurity Industry, with over two decades of experience working in technology and cybersecurity. As Managing Director at Apraciti, Colin has helped various medical technology organizations build cybersecurity into their products, gain US FDA approval, and integrate cybersecurity with quality management systems.

Colin authored the cybersecurity chapter of the Global Medical Device Regulatory Strategy (second edition) book published by the Regulatory Area Professionals Society and co-author of the Medical Device and Health IT Joint Security Plan, a voluntary framework for medical device cybersecurity released in 2019 by the US Healthcare and Public Health Sector Coordinating Council. Colin is also an expert trainer and facilitator for the US FDA driven Medical Device Innovation Consortium (MDIC) Medical Device & Diagnostic Threat Modeling Bootcamp training program.

Previously, Colin founded, developed, and led an industry leading Product Security Program at one of the largest healthcare companies in the world. As global leader and Head of Product Security, he helped develop and implement cybersecurity and quality processes, engineered medical devices for cybersecurity, performed security testing, and managed security vulnerabilities with security researchers.

Colin is a former Network & Security Engineer at the Central Intelligence Agency and contractor for a National Oceanic and Atmospheric Administrations’ supercomputing program. Throughout his career, Colin has accomplished the following:

• Built out Product Security Program Capabilities, including development and implementation of policies and processes and the integration with Quality Management Systems
• Provided Product Security Engineering support for products in development, including providing architecture reviews, threat models, documenting requirements, reviewing security test results, and supporting regulatory submissions
• Founded, developed and led a Product Security Program at one of the largest healthcare companies in the world, supporting Medical Devices, Healthcare Technology and Software as a Medical Device
• Built and led a team of Product Security Engineers, Product Security Penetration Testers and Product Security Incident Response Managers working to ensure Cybersecurity was part of the total product lifecycle
• Modified Medical Device Quality Management Systems to incorporate Cybersecurity from design and development through post market management, including regulatory compliance audit programs
• Participated in several industry efforts to improve Healthcare Cybersecurity, including Congressional Roundtables, US FDA Workshops, US DHS Tabletop Exercises and provided training on Product Cybersecurity to the US FDA, Canadian Government and Japanese Pharmaceutical and Medical Device Agency
• Current or former Member of several Medical Device Cybersecurity working groups including International Medical Device Regulators Forum, Healthcare Sector Coordinating Council, H-ISAC, AdvaMed and the Medical Device Manufacturers Association
• Recognized with the O’Reilly’s Security Defenders Award and Rapid7 Customer Award for efforts in partnering with the security research community on Vulnerability Disclosure
• Co-authored the Health Sector Medical Device and Health IT Joint Security Plan, released in 2019
• Member of the Medical Device Innovation Consortium (MDIC) Threat Modeling Bootcamp Training Program, funded and sponsored by US FDA in 2020

Over the years Colin has spoken at a number of seminars and conferences and is considered one of the world's leading authorities on Medical Device Cybersecurity. We invite you to watch/download some of his past talks.

Jon Litchfield is an experienced security architect and engineer committed to defending patients, products, and cloud systems from cyber threats. Jon has architected and engineered several healthcare technology devices, including medical devices, that continue to serve patients today. Jon has demonstrated success in Product and Information Security, Technology, Privacy, Risk Management, and business process improvement.

Jon has helped several medical device and healthcare companies implement regulatory compliance to international standards, certify their security programs, and improve their product’s ability to remain resilient to cyber threats. Jon has also lead entities through damaging security incidents, including malware, botnet infections, and data breaches.

These successes are not the result of working in isolation, but rather executed and delivered as a part of highly functioning teams, where Jon is comfortable as an experienced project manager and leader. This experience translates well to his ability to lead complex projects and process implementation related to new regulatory requirements and cybersecurity frameworks, such as NIST CSF, ISO 27001, Trust Services Criteria (SSAE SOC), HITRUST, GDPR, HIPAA, and other international data localization and data sovereignty requirements.

While capable in the regulatory space, Jon also enjoys working on technology too. He has experience in security testing and defense technologies, using frameworks such as OWASP, SANS, and NIST as well as tools such as FireEye, Qualysguard, Nessus, Nexpose, Veracode, SonarQube, FOSSA, Coverity, Burpsuite, Metasploit, SQLmap, nMap, manual exploitation techniques, as well as other tools. Jon brings a gamut of security experience that will assist you in protecting your IOT devices and Product Clouds.

Notable accomplishments:

• Led successful SOC2 Type 2 certification audits, HITRUST readiness assessments, FEDRAMP+ assessments, HIPAA Security Risk Assessments, and GDPR Privacy Impact Assessments for multiple medical device products and product clouds
• Team member of the MDS2:2019 Working Group that drove updates to the MDS2 medical device security disclosure form
• Managed web applications and cloud security programs across an international footprint, including regulatory and privacy law compliance
• Security architect and engineer on multiple medical devices, medical device data systems (MDDS), healthcare technology products, and product clouds in Azure and AWS that continue to serve patients today
• Received the 2016 ISACA Worldwide Achievement Award for conduct related to the Certified Information Security Manager (CISM) certification

Ian Glassman is an experienced security design, vulnerability management, and security testing engineer devoted to protecting patients, healthcare professionals, and consumers from the rapidly evolving cyber threat landscape. Ian has partnered with many product development teams to ensure Medical and IoT Devices are resistant to potential attacks.  Ian has led development discussions countless times for device cybersecurity hardening techniques and has crafted unique solutions for difficult product security use cases. 

Ian has a proven ability to identify security weaknesses and corresponding mitigations in a wide range of products and development platforms including custom RTOS, QNX, Windows IoT, Ubuntu, ThreadX, and more. Ian has experience with a variety of security tools and testing technology including Qualys, Nexpose, Tenable Nesses, Tenable.io, InsightVM, OpenVAS, Coverity, Black Duck, Veracode, Burpsuite, Wireshark, Metasploit, DirBuster, John the Ripper, Fern Wi-Fi Cracker, arpspoof, Ettercap, and more. 

Ian's experience in security testing includes identifying misconfigurations in device Operating Systems, Applications, Boot Loaders, BIOS, Filesystem, Encryption schemas, network services and transmissions, and more. Additionally, Ian has led Cybersecurity Control Verification and Vulnerability Assessments on numerous Medical Devices, Mobile Medical Applications and Healthcare IoT devices. 

Ian has also demonstrated success in Vulnerability Management by leading a cross-functional team dedicated to ensuring timely vulnerability identification, evaluation, assessment, remediation, and distribution. In addition to secure product engineering and testing Ian has also proven leadership in security compliance and frameworks by being the security point person on numerous compliance assessments for Mergers & Acquisitions as well as GDPR, HITRUST and HIPAA.

Notable accomplishments:

• • Graduate Degree in Cybersecurity & Information Assurance
  • Lead Penetration Tester, architect, and engineer on numerous medical devices, mobile medical applications, healthcare IoT devices, and product clouds in AWS that continue to serve patients today
  • Contributor to HHS working group for penetration testing best practices and vulnerability management for legacy devices
  • Architected end-to-end Vulnerability & Patch Management program, including process and procurement of supporting tools
  • Led successful Medical Web Application HITRUST certification and renewal