lisa Bisterfeldt

Lisa Bisterfeldt manages the Cyber Resilience program for the St. Luke’s Health System in Boise, Idaho. St. Luke’s is a non-profit health system comprised of 9 hospitals and 200+ clinics providing care to communities across southwest Idaho. The Cyber Resiliency program includes components of incident response, business continuity, and disaster recovery. Prior to transitioning into the Cyber Security arena, Lisa spent eight years working in emergency management in the healthcare and government sectors.  

Lisa has a Bachelor of Health Science Studies from Boise State University, a Master of Public Health from Idaho State University, and a Certified Cyber Resiliency Professional (CCRP). In her free time, she enjoys spending time hiking through any of Idaho’s beautiful trails with her husband and Brittany Spaniel. 

Stacie Brough

DEBRA BRUEMMER

Debra Bruemmer is a Senior Director of Clinical Security at MedSec where she will partner with small to mid-size hospitals and help them institute security basics within their medical device fleet before investing in expensive tools. Prior to joining MedSec, she had a 24-year career at Mayo Clinic which included 10 years as a senior leader within the Office of Information Security focused on reducing cybersecurity risk to protect clinical workflows and support patient safety.

She has experience developing a medical device security program, addressing cyber securityesilience in all network connected  rassets, maintaining secure identity and access management practices, and upholding security principles in network segmentation. Debra received her Bachelor of Science in Finance from Winona State University, a Masters in Business Administration from Cardinal Stritch University, and is CISSP certified.

David Brumley is the CEO of ForAllSecure and a full professor at Carnegie Mellon University. His research focuses on novel program analysis and verification techniques that prove the presence of bugs and vulnerabilities.  He has published numerous academic papers, won several test-of-time and achievement awards, competed and won the DARPA Cyber Grand Challenge, and holds a black badge. ForAllSecure created Mayhem to bring the same technology used by the world’s best hackers into commercial software development pipelines.

gerome burrell

On behalf of HHS, CDR Christl is promoting resilience of the nation’s health infrastructure by leading a dynamic public-private partnership, drawing from all aspects of the Sector, to prepare for future threats, manage risks, and coordinate effective response. As the Director of CIP, CDR Christl leads the SRMA activities and serves as the permanent Co-Chair of the HPH Sector’s Government Coordinating Council.

Prior to joining CIP in 2019, CDR Christl spent 16 years with the Food and Drug Administration as a project manager, emergency coordinator, and most recently the Director of the Office of Drug Security, Integrity and Response where he oversaw strategic and operational activities supporting global pharmaceutical supply chain
integrity including imports, exports, recalls and the detection and prevention of and response to counterfeit or otherwise illegitimate drugs in the U.S. pharmaceutical supply chain.

In his capacity within the Commissioned Corps of the US Public Health Service, CDR Christl had deployed to public health disaster responses on numerous occasions including COVID-19, Hurricanes Irma and Maria, and to the Monrovia Medical Unit Ebola Treatment Unit outside of Monrovia, Liberia. CDR Christl earned Bachelors in Science in Biology and Marine Science from the University of Miami, his M.S. in Biomedical Sciences from the Medical University of South Carolina and his M.S. in Organizational Leadership at Johns Hopkins University.

Dr. Allan Friedman

Dr. Allan Friedman is “the SBOM guy.” He is Senior Advisor and Strategist at the Cybersecurity and Infrastructure Security Agency. He coordinates the global cross-sector community efforts around software bill of materials (SBOM) and related vulnerability and supply chain initiatives, and works to advance their adoption inside the US government and around the world. He was previously the Director of Cybersecurity Initiatives at NTIA, leading pioneering work on vulnerability disclosure, SBOM, and other security topics. Prior to joining the Federal government, Friedman spent over a decade as a noted information security and technology policy scholar at Harvard’s Computer Science department, the Brookings Institution, and George Washington University’s Engineering School.

He is the co-author of the popular text “Cybersecurity and Cyberwar: What Everyone Needs to Know,” has a degree in computer science from Swarthmore College and a PhD in public policy from Harvard University.  He is quite friendly for a failed-professor-turned-technocrat.

Dr. Kevin Fu

Kevin Fu is credited for establishing the field of medical device security beginning with the 2008 IEEE paper on defibrillator security.

Kevin is a former MIT Technology Review TR35 Innovator of the Year and Fellow of the AAAS, ACM, and IEEE. He has testified in the House and Senate on matters of information and medical device security and has written commissioned work on trustworthy medical device software for the Institute of Medicine of the National Academies. He was a member of NIST Information Security and Privacy Advisory Board, the CRA Computing Community Consortium Council, and the ACM Committee on Computers and Public Policy. He received the Dr. Dwight E. Harken Memorial Lecturer Award from the Association for the Advancement of Medical Instrumentation (AAMI) for his leadership on medical device security standardization.

Jack Kufahl is the Chief Information Security Officer for Michigan Medicine at the University of Michigan, one of the nation’s top academic medical centers that brings together world-class experts from research, patient care, and education to make groundbreaking discoveries that create life-changing medicine. 

He has over 20 years of experience in information technology, primarily in leadership roles. He is one of the incorporating officers of the Michigan Healthcare Cybersecurity Council and is a current board member. The MiHCC is a public-private partnership in the State of Michigan and the healthcare industry supporting the citizens, patients, workforce , and students of Michigan. MiHCC seeks to protect the critical healthcare infrastructure and institutions of Michigan by providing relevant knowledge, meaningful relationships, and information security services to the partnering individuals, agencies, organizations , and vendors. Jack is also a graduate of the esteemed FBI CISO Academy and has completed the Masters of Legal Studies program with a concentration in compliance law at Washington University in St Louis. 

As the Chief Information Security Officer, he is currently responsible for planning, developing, implementing, and maintaining the Michigan Medicine information assurance program. He directs all information assurance activities across the academic medical center to ensure the confidentiality, integrity, and availability of electronic information resources critical to the tripartite mission of patient care, research, and education at Michigan Medicine.  

Dan Lyon

Jeremy Milburn

David Nathans currently serves as a Product Security Manager for Siemens Healthcare, where he specializes in building cybersecurity programs and security operation centers. Having previously held prominent positions in the defense, retail, managed security and healthcare industries, Nathans has a wealth of cybersecurity knowledge which he shares to help protect companies from this growing threat.

His experiences and lessons learned also stem from his time building security programs at one of the largest breached retail companies in history as well as working all over the world as a Cyber-Operations Officer for the US Air Force.

Policy Analyst (Cybersecurity)
Center for Devices and Radiological Health (CDRH)
U.S. Food and Drug Administration (FDA)
Office of Product Evaluation and Quality (OPEQ)
Immediate Office (IO) – Digital Health

Justin Post is currently a Policy Analyst (Cybersecurity) in the Immediate Office – Digital Health within CDRH’s OPEQ. The Immediate Office – Digital Health contributes to FDA’s digital health policy and to digital health related programs and activities. It also provides leadership and support to OPEQ staff with premarket and postmarket reviews in alignment with FDA guidance documents with digital health content. As part of the Immediate Office – Digital Health, Justin is focused on premarket and postmarket cybersecurity policy development and implementation across OPEQ’s Office of Health Technology (OHT) 1 through 8.

 Prior to this role, Justin was a lead reviewer in OPEQ’s OHT7 (Office of In Vitro Diagnostics) supporting pre-market and post-market review activities. He was also OHT7’s lead representative supporting FDA’s Digital Health Center of Excellence where he was a contributing author to FDA guidance documents with digital health content and an active participant in digital health related programs and activities.

Prior to the FDA, Justin spent 12 years at a global IVD manufacturer holding positions in R&D, Regulatory Affairs and Quality Assurance where he supported the commercialization and maintenance of regulated IVD products in US and ex-US markets.

chris reed

Chris Reed leads the corporate Product Security Office at Medtronic providing governance, centralized product security services and coordination of systemic security risk management across Medtronic’s product portfolio. He reports to Medtronic’s Chief Quality Officer and is a member of the Medtronic Quality Leadership Team.

Chris spent 2 years prior as Medtronic’s Director of Regulatory Policy for Product Security and Digital Health working on key regulatory legislation and initiatives such as the PATCH act. He also advised Medtronic businesses through various cybersecurity related product issues both with submissions and with deployed products.

Chris spent over 21 years with Eli Lilly and Company including building Lilly’s product security program supporting Digital Health including connected diabetes management products.

He is actively engaged as a leader in many medical device security and digital health
industry initiatives such as the MDIC Cybersecurity Working Group, Health-ISAC Medical Device Security Information Sharing and Coordination’s Advisory Committee and as co-lead for the Healthcare Sector Coordinating Council’s MedTech Cybersecurity Task Group.

Bill is a member of Google Cloud’s Office of the Chief Information Security Officer (CISO), where he advises Health and Life Sciences customers on ways to achieve their business goals while adopting a high security bar.  

Prior to Google, he was VP and Chief Security Officer for National Resilience, a bio-manufacturing company, where he established and ran the Security and Privacy organization, including physical, IT, and OT/ICS systems.  Before Resilience, Bill was the CISO for Amazon Care, a telemedicine and in person care service.  Also at AWS, Bill led the AWS Security Solution Architecture team.  Earlier, Bill held CISO roles at healthcare technology and medical device companies, and was Director of Product Management for Microsoft’s Health Solutions Group and member of their Trustworthy Computing initiative.

Bill began his career in healthcare administration for Group Health Cooperative (now Kaiser).  He has a Masters from Tufts University and Bachelors from the University of Pennsylvania. 

hector Rodriguez

Principal Industry Specialist & Executive Security Advisor
AWS World-Wide Public Sector Security Team

ADAM SHOSTACK

Skip Sorrels is a distinguished cybersecurity professional, widely recognized for his leadership
in developing robust cybersecurity programs. Armed with a Master of Science in Cybersecurity
and Information Assurance, he possesses a unique blend of technical expertise and a solid
foundation in healthcare cybersecurity. 

Skip has come full circle in his career, starting in the nursing profession in Texas. He worked
across intensive care and trauma units, as well as with transplant teams. Despite his roots in
healthcare, computers and technology always intrigued him, eventually leading him to Dell. At
Dell, he contributed to the architecture and solutioning work for Department of Defense
contracts, different branches of the military and civilian divisions of the government. 

Currently, he serves as one of the Directors of Cybersecurity overseeing various cybersecurity
needs for Ascension Healthcare, one of the country’s largest non-profit healthcare providers.
His front-and-center experience as both a former nursing practitioner and a security executive
uniquely positions him to contribute to the betterment of healthcare cybersecurity. 

Skip currently plays a pivotal role in establishing a medical device cybersecurity program. His
success in this initiative over the past six years has propelled him into broader responsibilities,
including the development of cybersecurity programs for Operational Technologies (OT) and
venturing into the realm of eXtended Internet of Things (XIoT). 

Beyond his responsibilities at Ascension, Skip is a devoted advocate for knowledge sharing. He
actively contributes to the cybersecurity community through engaging in webinars, podcasts,
and crafting insightful blog posts. His commitment to sharing experience and knowledge
exemplifies his dedication to advancing the field and nurturing the next generation of
cybersecurity professionals.

Dr. Hans-Martin von Stockhausen holds a position as Principal Key Expert for Cybersecurity at Siemens Healthineers. In this position he leads the company in developing security requirements for all products gathered from international regulations and customers around the globe with a focus on supporting the operational risk management on the operator’s side. Inside the Siemens security community, he leads a team that that works on improving and maintaining the security posture of products and security related customer communication. He has extensive domain knowledge from 20+ years of work experience in the medical device industry holding various positions throughout the product lifecycle from SW developer to SW platform architect to product manager.

For 10+ years, his focus has been on cyber security while holding a position as product security officer for medical IT systems and image acquisition devices. Hans-Martin participates in expert workshops and talks at conferences held by European and internationally recognized organizations. Furthermore, he is a member of the board of directors of Health-ISAC.

nastassia Tamari

Nastassia Tamari is the Division Director for Medical Device Cybersecurity within the Division of Medical Device Cybersecurity (DMDC), housed within the Office of Readiness and Response (ORR) in the Office of Strategic Partnerships and Technology Innovation (OST) in FDA CDRH. The Division of Medical Device Cybersecurity provides leadership and strategic direction for medical device cybersecurity policy.​ As part of DMDC, she leads a team which develops policy related to medical device cybersecurity to advance national preparedness and responds to cybersecurity incidents involving medical devices.

She spent more than a decade at a private medical device manufacture focusing on cybersecurity, security operations and strategic regulatory alignment. She earned a B.A. in Communication from San Diego State University and completed graduate work at Boston University earning an M.S. in Journalism.

Mike Nelson is the Global VP of Digital Trust at DigiCert. In this role, he oversees strategic market development and champions digital trust across organizations to protect servers, users, devices, documents, software and more. 

Mike frequently consults with organizations, contributes to media reports, and speaks at industry conferences about the risks of connected technology, and what can be done to improve the security of these systems.  

Before DigiCert, Mike spent his career in healthcare IT including time at the US Department of Health and Human Services, GE Healthcare and Leavitt Partners. Mike’s passion for the industry stems from his personal experience as a type 1 diabetic and his use of connected technology in his treatment.