- This is Laura Dearer with the Becker's Healthcare Podcast.
I'm thrilled today to be joined by Steven Ramirez,
chief Information Security
and Technology Officer for renowned health.
Steven, it's a pleasure to have you on the podcast today.
- Thanks for having me.
- Now I'm, look, I'm looking forward
to diving into this conversation
because there's so much happening in the cybersecurity
space, and I'm particularly in healthcare this year has been
already a, a lot of action
and movement, so I'm looking forward to your perspective.
But before we dive in,
I was wondering if you could tell us a little bit more
about yourself and your background.
- Yeah, definitely. So Steven Ramirez,
I'm the Chief Information Security
and Technology Officer for Renowned health.
Um, I was originally hired as the CIO, um,
but have been serving in the dual cs o
and chief technology role for almost a year now.
Um, so really excited on, you know, how that enables,
you know, the ability to, um, influence security, um,
you know, on, on both sides of the house
to get a lot more things done.
Um, so Renowned health is Reno, Nevada based, um,
four hospital system, the area trauma center.
Um, and we've just got a lot
of exciting things going on out there, um, as part
of our strategic initiatives.
So I know technology and cybersecurity are on the forefront.
So that's, that's really something that our executive team
and end users take seriously.
So
- That's great to hear.
And, you know, considering, um,
your different responsibilities, what are some
of the biggest issues that you're
following in healthcare right now?
- Well, obviously third party risk has been huge.
I know everyone saw that with change Healthcare.
Um, I think that really shows the importance
of having a diverse background of vendor partners, that
that really shows, um, you know, if you have a single point
of failure vendor on how disruptive that can be
to your organization, but also just how you
holistically look at third party risk as an enterprise.
So just, you know, going through
and just the typical security assessments and,
and looking at everything like that, it's,
it's really important to also bake
that into your overall enterprise risk management program
and business continuity, disaster recovery.
We saw how important that the BC side,
so the business continuity side was
during change healthcare, um,
and there's been a lot more zero days.
Um, we've seen as of late, we know
that Palo Alto was the most recent one.
So that took, um, you know, all industry,
but especially within healthcare clients that had
that technology to, you know, rush in
and make sure that we're doing various patching to that.
Um, 'cause you can be doing all things right
and then it can be, you know, a third party and
or a vulnerability.
So it's really, again, important to get into the,
the fundamentals, um, as we're looking into 2024.
So especially as we're, you know,
a lot more organizations are moving into the cloud, um,
you know, I'm definitely interested to see how things like
that, um, might have some additional emerging risk.
- That definitely makes a lot of sense.
And you know, it is so interesting to think about how
that cybersecurity landscape has evolved
and in particular, as you mentioned, the third party risk.
And you know, from your perspective,
what has been really important when you're thinking about
third party partnerships, I know, you know, there,
there's a rude mentor, um, just trying to kind of make sure
that those partners are responsible
and going to be responsible with, um,
any information provided.
But, um, and, and, and then too their their own operations.
But since especially, um, change healthcare, what are some
of the things that you're are planning
to do differently potentially
as you're approaching third party
relationships in the future?
- We're really looking at how your organization uses
that partner and service.
Um, and that gets more into, you know, data you're sending,
you know, is there other ways we can
look at how we send data?
Can we send reports? Can we send more de-identified data?
Do they need, you know, everything as they did before.
Um, you know, the change healthcare instance that, you know,
definitely was an anomaly on the amount of data
and just kind of the, you know, magnitude of that event.
But really just looking, you know, holistically overall at
how you partner with that vendor, how they connect
to your systems, again, how you send them data,
as I had said to that.
So really understand that if there was an interruption, how
that impacts your business and is there a plan B?
So when we're looking at plan B, is there, um, components
that can be done as a workaround?
You know, is this something we can do on paper?
Um, do you need to have a, you know,
separate vendor like an Equifax, you know, for example
that if something like were like that were to go down
or even have a plan C.
Um, so that's really where we're looking at it just based on
interruption that I think that's really changed the approach
of how a lot of people look at business impact assessments.
You know, we would look at various applications
and then we look at important vendors,
but I don't think that we really took
that deep dive into looking at the overall magnitude
of an impact to the organization.
Um, but of course on the front end, you know, making sure
that we are, um, being very diligent on, you know,
the security posture of these organizations potentially
collecting more information.
I know that, you know, meeting with some other CISO
colleagues, it's, you know, is it time
that we start collecting types of security controls
that some of these partners have?
You know, we'll, we'll go through very high level on
security posture, but if there's a zero day, you know,
a partner has like Palo or there was the MoveIt breach
and stuff like that, you have a little bit
of this inte intelligence upfront.
So I think that the third party vetting process is just now
becoming, you know, starting to evolve, um, just from these,
you know, big, um, high profile events that we've seen.
So it's gonna be something that we'll continue
to have to keep a pulse on.
And I think that can be also something that I'm hoping
that the, the feds start to crack down on, um, a lot.
We know there's that new SEC rule of course, that, you know,
from a reporting mandate standpoint,
but just that's gonna be one of the ways too, to hold some
of these, these vendors accountable.
- That makes a lot of sense.
You know, it's really helpful to kind
of get a peek into those conversations and discussions
and where things are headed now.
When you look ahead, what are you most excited
about and what makes you nervous?
- Well, I'm, I'm really exci in healthcare.
I think we do a very good job of information sharing.
Um, I think that the new performance goals that came out,
um, really helped boil the ocean down from, you know,
like a lot of organizations use NCSF
and other, um, frameworks that,
that really helps make things more palatable
and easy to understand for some of your non-technical
and security partners internally.
So I think that I'm excited about, you know,
just the emphasis that, you know, the healthcare
IT security industries putting on this for, you know,
how we can better collaborate,
how we can better partner together to information share.
That was a great thing that came outta change healthcare
that, you know, really the CIO community coming together to,
you know, see how we can information share, et cetera.
So I'm really excited about
where we have come and where we're going.
But still what makes me nervous is just, you know,
the sophistication of attacks
and then just the sheer number that seemed to be popping up.
So it's like emerging risk still.
That's really what keep me up at night, you know,
'cause again, we can be doing everything correctly.
You know, we've been making an emphasis on a lot
of security hygiene that we should be doing from the
security controls processes, access management.
And then that can all crumble at the wayside just by,
you know, either a vendor
or just social engineering, social engineering's getting,
you know, even more sophisticated.
We're seeing, you know, extremely sophisticated attacks.
We're seeing, you know, the service desk start to be,
you know, more of a target to go
after that varied type of access.
So, you know, a lot of the emphasis
that we had originally put on just access management
continues to expand
and become more, you know, Swiss cheese on, you know,
additional holes on ways guys can get in.
So I think that's something that we need to continue
to get creative and training and awareness
and yeah, just makes me nervous that once we start
to utilize AI into this,
'cause right now, you know, threat actors are doing the bare
minimum basics, getting in through, you know, MFA
or zero days,
but you know, it's, people start
to button down the hatches on that.
We're gonna start to see them leverage,
you know, components of that.
It's gonna make it really hard for some
of our security tools to, you know, tell the difference
between, you know, what's a phishing email, what isn't maybe
what is, is what is
and isn't malicious activity in your system.
So that's where, you know, we're gonna have to also evolve
to how we can have AI on the good side to start
to combat components of that moving forward.
- That makes a lot of sense.
You know, and is really fascinating to think about
how cybersecurity
and some of those different attacks are coming through.
And like you mentioned, um, being able to connect
with the other CISOs and the, um, out there and,
and share information is
so important when you have conversations with them
and really, um, get an understanding of how, um,
different leaders are thinking about things,
you know, working on things.
What are some of the big target areas that you're still, um,
trying to solve for?
- Well, just looking at tools, processes and procedures.
So it's like we have, there's a few group chats that we,
we have together and we'll, you know,
ask about different services, different tools
because again, as you know,
we've talked about stuff like social engineering that,
you know, my organization had to pivot phishing tools just
because we saw the tool we had wasn't working.
So this is where you have a, a platform to ask what other,
you know, CISOs and the industry are doing,
um, and vice versa.
That's , we're looking at this technology
or what do you guys use for um, SSO?
Or what would you use as a SIM?
Or what do you use as a third party risk?
So it's just, you know, a way to bounce something off, um,
a peer, um, and you know,
just really share various information on if
they're experiencing an event.
Um, and you know, having that many eyes
and ears out there too, if something does go bad.
I think that group chat was
where I found out about change healthcare
before, you know, it was broken, the papers.
So, you know, again, having those kind of relationships
and people that are out there living
and breathing with these various vendors will help get you
some of that real time threat
intelligence, you know, upfront.
So, um, makes, that, makes
that collaboration really impactful.
And 4 0 5 DH isac, um, you name it, there's a lot
of various organizations out there that really help, um,
you know, healthcare come together,
information share, um, in it.
And I think that's really helping us move the needle, um,
to where we need to go.
Um, still a lot of work a lot of us need to do.
'cause again, you know, healthcare is
so dynamic in our overall ecosystem, but,
- Got it.
You know, that, that's really helpful and,
and great to hear you have that as a resource.
Now, uh, before we wrap up here, I'm wondering
what will most effective healthcare leaders need in order
to be successful over the next two to three years?
Especially given how sophisticated, as you mentioned some
of these cyber attacks are,
and, um, then to looking at how AI
and other technologies can make a difference.
- Definitely knowing what's going on in the
environment, super critical.
What are today's risk
and how can those morph into, you know, emerging risks?
Um, being nimble, you know, it's, I have three year plans,
five year plans, all of that.
What we put together today might change tomorrow.
So being able to, you know, make sure that you're keeping
that pulse on what's going on,
what's changing within your organization, um,
so you can be adaptive in how you approach security.
Um, because again, what you do today
will likely change tomorrow.
Just some these various sophistications or,
or attacks that we're seeing.
Um, but also being able to, you know, stretch,
stretch a dollar and be, you know, fiscally sound
because, you know, throwing money at an issue
isn't always gonna fix it.
As you can see, again, that a lot
of organizations could be doing the right thing.
And then it's pivoting to the importance
of business continuity, you know, with
what we saw with change healthcare.
So again, it's all three of those kind of interconnect on
that, that it's, you know, you need to just be smart
and tactical with how we're looking at things.
And really, I've always made a a focus on, you know,
sticking to the fundamentals
and doing the fundamentals very well, that if you do MFA,
you know, you start to get an enhanced privilege access,
you know, you do phishing training
and awareness, you know, have some technologies behind that
and, you know, go through a lot of
what we see in the performance goals.
Um, patching vulnerability management, you know, the,
the importance of that stuff will really make sure that,
you know, we are successful doing that very well will,
you know, make you at the top, you know, one to 5% on that.
Because again, threat actors want that easy, you know,
lucrative target, um, that they don't want to have
to put a lot of work into getting into your organization.
So the more hurdles that are there,
they'll hopefully just move on.
So having that mindset I think will really take
organizations, you know, be successful,
but also understanding technology.
There's so much new tech, um, coming in
that's super exciting, but also scary, especially with ai.
So making sure that, you know, again,
that we're doing our due diligence on
how our organization strategically wants
to use these technologies so that we can come up
with a defensive strategy on
how we're gonna protect the organization
and our patient's data as well
as our operational continuity.
- Steven, thank you so much
for joining us on the podcast today.
This has been a fantastic conversation, very informative,
and I look forward to connecting with you again soon.
- Appreciate it. Thanks for having me.