In part two of this conversation, John Riggi, the AHA’s national advisor for cybersecurity and risk, talks with the FBI's Brett Leatherman, assistant director, Cyber Division, and Gretchen Burrier, assistant director, Office of Private Sector, about how nation-state actors are leveraging cybercriminals and AI to disrupt health care. They also discuss how hospitals and health systems of any size can build trusted, local relationships with the FBI before a cyber crisis hits.
View Transcript
00;00;00;01 - 00;00;17;26
Tom Haederle
Welcome to Advancing Health. In this second of a two part podcast, FBI leaders share details of a new national effort involving everyone to help defend against the latest malicious cyber threats that continue to plague all sectors of society.
00;00;17;28 - 00;00;48;13
John Riggi
Hello everyone. This is John Riggi, your national advisor for Cybersecurity and Risk at the American Hospital Association. Welcome back for part two of our conversation with FBI Cyber Division Assistant Director Brett Leatherman and FBI Office of Private Sector Assistant Director Gretchen Burrier to discuss all things cyber information sharing and AI. So, Brett, back to our discussion. We talked a little bit about the nation-state threats to criminal groups,
00;00;48;13 - 00;00;58;26
John Riggi
but some of the groups that are actually being used as proxies and being directed by nation-states. Can you tell us a little bit more about that connection?
00;00;58;28 - 00;01;29;11
Brett Leatherman
Yeah, we're really focused, John, on the blended threat right now. And that is, how nation-states are leveraging criminal groups and/or industry in their country to help facilitate their cyber network operations directed at the United States. And so we talked a little bit earlier about the PRC and this whole of society approach that they take. We have named companies in China who have helped procure access to US networks as a result of their hacking campaigns.
00;01;29;11 - 00;02;01;12
Brett Leatherman
Flack's Typhoon is an example of that, where they leveraged Integrity Technology Group, a company within China, to provide access to networks here in the United States. Assault Typhoon, one of the most consequential, the most consequential cyber espionage campaign launched against the United States was facilitated by multiple companies in China. And so we continue to see this blended threat where nation-states use these companies to facilitate that access, but they also work within the criminal ecosystem as well.
00;02;01;14 - 00;02;22;06
Brett Leatherman
DPRK is a great example of that, where they continue to do cryptocurrency thefts or place IT workers in networks here in the United States, remote IT workers. These groups are very aligned with criminal groups to understand tactics, techniques and procedures and how they can advance their geopolitical ambitions.
00;02;22;08 - 00;02;49;21
John Riggi
And we know first hand of the North Korean remote IT worker threat. Almost weekly, I received some report from a hospital or health system that they identified a suspicious remote IT worker and have limited their access, actually actually ended their access. And of course, we're concerned with the fact they have access, they're raising funds for their programs back in North Korea, potentially even nuclear weapons programs.
00;02;49;27 - 00;03;09;10
John Riggi
But the fact they have that access to steal data and/or deliver malware. Can you talk to us a little bit about threat hunting? What do you think some of the best practices are to identify the threats as well, in case they were already in our networks, both from the criminal hacker perspective and, from the nation-state perspective?
00;03;09;12 - 00;03;36;26
Brett Leatherman
Yeah. Well, first and foremost, we should be looking at the indicators of compromise that the FBI and our partners put out on a regular basis to identify where those emerging cyber threats are. So it's incredibly important to look at those joint cybersecurity advisories that we put out there that help you understand both the technical information and the contextual information to hunt through your environment and try to detect an adversary or to block at your perimeter some of the things that we see.
00;03;36;29 - 00;04;14;09
Brett Leatherman
But, you know, no podcast in today's day and age is complete without talking a little bit about artificial intelligence. We saw in November of this past year, Anthropic put out an advisory about the PRC's use of Claude, their artificial intelligence platform, to target industry. And what Anthropic put out was that 80 to 90% of the kill chain activity that happened there, from reconnaissance to identification of targeting to lateral movement, privilege escalation was done agentically through AI.
00;04;14;11 - 00;04;54;24
Brett Leatherman
And we've got to start to employ similar capabilities defensively to look at deviations in behavior. And that's where we have to move. And I know that no organization in health care is likely ready to apply artificial intelligence to the totality of its infrastructure. It's just too, too soon to do that. But there are ways that we can start surrounding key user accounts that have privileged access, key network devices or key data stores within our environments, and we can start to pull the logs off of those environments, run them through approved artificial intelligence devices to try to find those anomalies in behavior.
00;04;54;24 - 00;05;07;14
Brett Leatherman
And so behavior based detection is kind of the wave of the future. We're doing it now, but we have to do it much more efficiently through artificial intelligence. And we can start with baby steps doing that.
00;05;07;16 - 00;05;32;18
John Riggi
There is in a presentation, a discussion I have with leaders in the health care field where AI does not enter into the conversation. We talk about how the bad guys are very nimble and absolutely very quick to adopt AI. Takes us more time. Obviously we have to test it. We have to ensure that it does not corrupt our data or expose us to security and privacy issues for that data.
00;05;32;21 - 00;05;55;08
John Riggi
But I've always said I 100% agree with you, Brett, AI is fueling the next generation of the cyber arms race. We are not just at the beginning. We are, I think beyond that. And we've got to make sure we are using AI in our defensive measures just as the bad guys, as you said in the Anthropic report, which we published, are already using it to conduct these attacks.
00;05;55;10 - 00;06;18;21
John Riggi
Gretchen, the American Hospital Association, I've had this tremendous opportunity to work together with the FBI for the last several years. I've heard you describe our ongoing information exchange as the gold standard for private sector relationships. From your and the FBI's point of view, could you tell us why you believe that and what you believe the successes of our relationship have been?
00;06;18;24 - 00;06;41;27
Gretchen Burrier
Yeah, absolutely, John. You know, I do describe our relationship with the American Hospital Association as the gold standard because it reflects exactly what effective public private partnerships should look like. And I do talk about it all the time. I even brought it up at the SAC conference recently. But first, it is built on consistency and trust, right? We're not only meeting when there's a crisis and it is not transactional.
00;06;41;29 - 00;07;08;08
Gretchen Burrier
We have an established cadence of engagement that allows for real dialog with hospital CEOs and our FBI senior leaders. And to me, that continuity builds confidence on both sides. And second, right? It's genuinely two way. Hospitals are on the front lines of cyber threats, ransomware, foreign adversary activity. What they share with us helps the FDIC trends earlier and warn others before the damage spreads.
00;07;08;10 - 00;07;33;23
Gretchen Burrier
And in turn, the FBI has an ongoing dialog with them to ensure they're tracking various threats. What I see is the real roll up your sleeves, get to work action on challenges impacting this country's national security. And most importantly, John, the life of patients. I can't thank AHA and our nation's hospitals enough for the work that they do and for the willingness to lean in and work with us in the FBI.
00;07;33;25 - 00;07;47;14
Gretchen Burrier
I really think it's the combination of trust, continuity and real world impact where we're collaborating together on reports or other real time threats. That's why I consider it the gold standard.
00;07;47;17 - 00;08;12;02
John Riggi
Thank you, Gretchen. And to your point, we look not only to just meet and exchange information, but we've developed these ongoing projects. What will we do? What will we produce? And we will measure our impact on helping defend the health care sector. So again, thank you and your team so much for that. Now we have a great relationship at the national level which benefits the entire field.
00;08;12;04 - 00;08;21;29
John Riggi
But there's over 5,000 plus hospitals out there. How can hospitals on a local and regional level establish productive relationships with the FBI?
00;08;22;01 - 00;08;41;00
Gretchen Burrier
Sure. Look, hospitals can establish a relationship with the FBI by reaching out to their local FBI field office and asking for the private sector coordinator. And, of course, John, you're a great resource as well from your time in the Bureau. And I know that if any hospital reached out to you, I know you would assist them with an introduction as well.
00;08;41;03 - 00;08;50;04
Gretchen Burrier
And of course, at the end of the day, the Office of Private Sector, we also will get everyone connected with who they need to be connected with for whatever reason.
00;08;50;06 - 00;09;18;06
John Riggi
And again, we can't emphasize that enough. The FBI is always predisposed to help. And, one thing I do want to point out by contacting the FBI does not somehow place you at risk of regulatory exposure. The FBI is not a regulatory agency. Their job is to help you all recover from the attacks, to try to discover attribution, and really to provide you assistance during an attack.
00;09;18;08 - 00;09;33;01
John Riggi
Brett and Gretchen, what do you think the best way for the field, the hospital field, health care field is to contact the FBI in a true cyber emergency, like a ransomware attack, which is causing ambulance diversions.
00;09;33;03 - 00;09;50;26
Brett Leatherman
I know Gretchen mentioned, reach out to your local field office, and that is the best way to reach out. Now, we prefer to talk to you before a crisis happens. So I encourage everybody to reach out and get to know your private sector coordinator like Gretchen mentioned, as well as your cyber supervisor in your local field office.
00;09;50;28 - 00;10;17;23
Brett Leatherman
We take a victim-centric approach in everything we do. Our job in FBI Cyber Division is to impose cost on state and criminal adversaries. But an equal mission is to provide significant support and assistance to victims of cybercrime. And we can do that best when we have an established relationship with you. And that is through the private sector coordinator and your local cyber squad in your local field office.
00;10;17;23 - 00;10;42;08
Brett Leatherman
So, I would reach out in advance to have those conversations. But even if you don't have that relationship and you do suffer a cyber incident, reach out, have that conversation. There is value in bringing the FBI in. We protect information when it comes in. It's protected under law enforcement investigations. We don't share information that we get pursuant to those investigations with regulators.
00;10;42;08 - 00;11;06;29
Brett Leatherman
We don't make that information available publicly. We are bound by the Victims Rights Act, and we treat victims like victims. That is always been a part of our DNA and will always be a part of our DNA. The other thing that that does, though, is it allows an organization to reach out, say, this is what we're seeing. We have we have this particular ransomware attack in our environment.
00;11;07;01 - 00;11;34;01
Brett Leatherman
These are the IOCs, the indicators of compromise we see. And in the FBI, we can run that through our law enforcement holdings. We can check with our intelligence community partners. We have 22 cyber assistant legal attachés globally who sit with foreign partners. We can run those things through foreign partner visibility, and we can come back and we can provide additional information that helps with threat hunt containment and eradication activity.
00;11;34;01 - 00;12;00;25
Brett Leatherman
So as much as we want to pivot upstream against the actors, we also want to help organizations in containing the threat and getting back on their feet to help patients, which is the core mission of the hospitals. So, really, that is part of the value that we bring to reaching out. Every one of our 56 field offices have a cyber task force that is comprised of federal, state and local law enforcement partners, and they're there to help.
00;12;00;28 - 00;12;31;15
John Riggi
Such key points, Brett. And again, I think one of the key points that you made was the fact that by contacting your local FBI office doesn't mean that you'll just get the resources of that local office, perhaps in a remote area. It unlocks the resources of the entire US federal government and allied partners. All the agencies, all the intelligence communities will be notified of the attack, and then their resources and information will be brought to bear to assist your hospital.
00;12;31;15 - 00;12;50;13
John Riggi
Whether you're a multi state, multi-billion dollar system covering millions or lives, or you're a ten-bed critical access in a very remote area where the next nearest available hospital is 100 miles away. Gretchen, anything else to add on how our hospitals should contact the FBI during a cyber emergency?
00;12;50;15 - 00;13;11;03
Gretchen Burrier
You know, I think Brett said it perfectly. I would just again encourage you to reach out if you don't have that relationship and start building it today, because if a cyber incident hasn't happened, it probably will, unfortunately. And this way you've got a contact and hopefully that individual's contact information is in your cell phone. You can call them immediately
00;13;11;03 - 00;13;15;27
Gretchen Burrier
so no time is lost, because time is critical in an incident.
00;13;15;29 - 00;13;34;26
Brett Leatherman
Yeah. John, I would just add to what Gretchen was saying there that, it starts with the conversation and think about it that way. Because the FBI teams at the private sector coordinator level, the cyber level, even the special agents in charge and the assistant special agents in charge were happy to have a conversation. And there's no commitment beyond that.
00;13;34;26 - 00;14;02;10
Brett Leatherman
You don't have to feel like you're now committed to providing very sensitive information to the FBI. We're never going to ask for patient information or sensitive information. What we ask for is fully aligned with threat pursuit and victim response, and that is, you know, anonymized indicators of compromise, not PHI or anything like that. And so I would encourage folks, if you have questions, reach out, have that conversation to start with.
00;14;02;10 - 00;14;04;08
Brett Leatherman
And it's as easy as that.
00;14;04;11 - 00;14;30;24
John Riggi
Totally agree, Brett. And during that conversations folks will come to see the FBI are human. They're good folks. They want to help, such as yourselves. And it'll help allay some of those fears. Perhaps the legal folks might need to be involved to just assure them that you don't collect PHI. You don't need that. You don't need access to the service, and you would never tell a hospital not to restore because it's pending your criminal investigation.
00;14;30;26 - 00;14;39;17
John Riggi
So in a sense, the rules of engagement can kind of be worked out ahead of time. You don't want to have those questions during an emergency.
00;14;39;23 - 00;15;04;00
Brett Leatherman
To your point, like you brought up legal counsel. That is incredibly important in today's environment. It is often outside counsel in coordination with inside counsel, who kind of control the flow of data and information. And so the earlier you as a chief information security officer or network defender can have those conversations with your counsel and encourage them to engage the FBI in advance,
00;15;04;02 - 00;15;20;06
Brett Leatherman
the more ready you will be to share and receive intelligence on day one should there be a breach. And so incredibly important point is that counsel plays an a very important role in the bilateral sharing of information. And so bring them into those conversations early.
00;15;20;08 - 00;15;47;03
John Riggi
Absolutely agreed. And again, sensitizing them and helping them become comfortable to the relationship to the information sharing can certainly expedite recovery, quite frankly, with the assistance of the FBI and the federal government, Brett and Gretchen, want to thank you again for being here today, sharing your very important and salient points with us today for the benefit of the entire field, our patients and the nation.
00;15;47;03 - 00;16;07;27
John Riggi
And thank you both for what you do, and all the men and women in the FBI, every day to protect the nation and to our health care providers. Thank you for what you do every day to defend networks and care for patients and serve our communities. This has been John Riggi, your national advisor for Cybersecurity and Risk at the American Hospital Association.
00;16;07;29 - 00;16;10;12
John Riggi
Stay safe everyone.
00;16;10;15 - 00;16;18;24
Tom Haederle
Thanks for listening to Advancing Health. Please subscribe and rate us five stars on Apple Podcasts, Spotify, or wherever you get your podcasts.



