heartbleed was a really interesting vulnerability it was a very scary vulnerability because the nationally we didn't know how it worked and what it can do it turned out to be more benign they would initially thought but the the main problem was open s.s.l. was used in so many different products and services this vulnerability is potentially devastating. it was complicated to fix normal vulnerabilities you fix by installing a patch this film ability had a three or four step process to regain security you had a patch your systems regenerate keys you had to do multiple things and that made it very dangerous it was an open source piece of software i mean a lot of people believe that open source was magically more secure it turns out that's not true it's software that secure is software that's been analyzed open source software has the potential of being advised by anybody because the source code is available but what happened with open s.s.l. is really a tragedy of the commons everyone thought someone else was reviewing the software so nobody actually bothered. it is very doubtful we have a lo

you know heartbleed was a really interesting vulnerability it was a very scary vulnerability because the nationally we didn't know how it worked and what it can do it turned out to be more benign they would initially thought but the the main problem was open s.s.l. deployed it during the weeks after it was discovered before everyone patched their systems you know i think all intel's ange these do that and you know right now we've recovered security but it really was a wake up call to people who thought that open source meant magically secure it does that we have the potential to make open source more secure but we have to analyze the software and we're trying to do that media the heartbleed vulnerability because the open source community do stablished these projects to review open source software a lot of very big companies are using this they should help with the analysis and they are doing that so hopefully we're going to do better next time but hartley really was an exception it was a big deal you know that a lot of all abilities that happen that aren't as a big deal this one was

i want to emphasized that it is not clear the heartbleed vulnerability is how it was compromised, but it is a subject of speculation at this point. of what i want to do is sort wrap up my prepared remarks by emphasizing again that so much of the threat that we face, private sector, individual, government, comes from these very basic vulnerabilities, ones that can be addressed through basic measures of hygiene. information is out there on those vulnerabilities and on the way to fix them, it is not just incumbent, not just important but critical that network defenders actually take the action to patch the vulnerabilities, address the threat. and i believe the only way that we are going to get there is by increasing the culture, improving the culture of accountability to where, whether you are an individual computer owner or a business or a government employee, that you have a sense of responsibility for actually defending your network against these basic vulnerabilities. again, that's not the end under ory story -- of the st because there are more sophisticated threats that require more

>> guest: well, i think if you look at the news of late, heartbleed bug, the target breach, more ande often these stories are coming up. and i think if you were to ask the average user, ie, right before christmas, you know, christmas time if your debit card or credit card got shut down, would a $300 investment over the course of a year been worth it for your peace of mind, if you will, tie to your bank, tie to anything that that's sensitive and critical to you? i think most people would say yes. i know i would. that's one of the big things. and as time goes on and technology increases, you know, obviously, the price points start to decrease and volume picks up. >> host: who developed this technology? >> guest: we did. self-proprietary to eye item lock. we're headquartered in manhattan. our technology is in new jersey, and we manufacture in the u.s. >> host: michael fiorito of eye item lock, thank you for your time. >> guest: thank you very much. >> host: michael boczek is the founder of descartes biometrics out of seattle, washington. what is descartes biometrics? >> guest: we're a u

chs was hacked by heartbleed which was not made public. broke in and got access to credentials and there's things to do to protect that information. >> how much would it cost to harden up the whole system? >> that is the thing. you can either build security at the very early stages of protecting that information, so putting encryption in ahead of time. we know that wasn't done with healthcare.gov. then you can build it afterwards which is more expensive because you have to recode everything. they have already spent an estimated 400 million to a billion dollars on healthcare.gov. going to take loot to actually recode the applications and fix it. >> to put this in perspective, data breaches in the health care industry, far less prepared for security than other industries, banks, for example. data breaches if doubled in the last year and hackers are salivating that doctors and hospitals are required to use electronic health records. >> if guy to my doctor, part of obamacare, and i say, don't put this information about me into your electronic