Hello everyone. I am Ryan Mohammed with Becker's Hospital Review.
Thank you so much for tuning into the Becker's Healthcare podcast series.
In today's conversation, we are joined by Gary Soloman,
c e o of Black Talent Security. And Gary, how are you?
Thank you so much for coming on here.
Thank you so much. Great to be here. Yeah, of.
Course. Yes. Um,
so glad to talk with you today and we can jump right into our conversation,
um, as the expert on security,
the first question that I wanted to ask you is,
what value can be realized from having an independent cybersecurity company
assess a D SS O risk?
Yeah, so I think one of the biggest challenges we see in the D S O space is
DSOs believe that their cybersecurity posture is strong.
And often what I see happen is when you start digging into the security
in these environments,
you quickly unravel quite a few problems.
It usually starts at the executive level,
where when you ask the executives, Hey, you know, Mrs. C e o,
what are you doing for cybersecurity? She's like, you know, I think, uh,
I think we have that covered. And then I'll say, well,
what does that actually mean? You have a covered, well,
I have an IT manager and they do cybersecurity, and we have a couple folks,
you know, that handle cyber. And then I'll often say, well, you know,
one of the most important things to, to realize is that in the end,
if things go sideways, you have a cyber event, a ransomware attack,
an email intrusion, a theft of patient data,
ultimately you're gonna be responsible and you're gonna need to have all the
correct answers for a state attorney general,
for the officer for civil rights. And you really need to have a,
a clear understanding of what it means to have proper
SI cybersecurity measures in place. So typically what we find is,
you know, really regardless of the size of the dso,
so I'm talking like small to medium, you know,
DSOs with say 10 locations up to a couple hundred,
they often just have very basic security in place.
They have firewalls and they have antivirus software,
and they have some backups,
but they're missing a lot of the core elements of a true cybersecurity
solution. And as we know in many organizations,
as the information is passed up the chain,
it is kind of changed, right? Because you don't want your bosses to know, Hey,
maybe we're not doing a good job from a cybersecurity perspective.
So to answer your question, you know,
what cybersecurity companies like ours can do is we can come in and do a true
third party evaluation.
We can help everyone that touches compliance and
and security to have a clear understanding of how well they're
actually doing from a security perspective. And that's done in two ways. One,
actual tests, right?
We can conduct very sophisticated tests against all the computers,
like the workstations, the servers, the laptops, the firewalls,
and give the business a really good understanding of how secure they actually
are. Um,
we can also evaluate the DSOs policies and procedures,
right? The, a lot of times what we see,
'cause we do a lot of incident response cases.
We've done quite a few ransomware attacks in, in the, uh, dental space and,
and D S O space.
And what we often see is the executives believe they have all these protocols
and policies and procedures in place,
and backups and protections against these types of events.
And then all of a sudden they turn around and a ransomware attack hits,
and everyone kind of has the deer in the headlight syndrome and the finger
pointing starts, and the, I thought you were doing this,
and I thought we had this, and how did this happen?
I thought we had these discussions start occurring. So, you know,
cyber company can come in and really do a deep
evaluation of how well, you know,
the D S O is doing from a preventative perspective, you know,
preventing a ransomware attack or theft of patient data,
and then help them implement strong solutions to actually, uh,
further harden their, their cybersecurity posture, uh,
verse what we typically see in most organizations, which is, you know,
I think we're fine. And, and unfortunately that's all too common.
Yeah, definitely. You made some excellent points in there, um, especially about,
you know, the finger pointing and, you know, I thought you were doing that,
that I feel like that often happens a lot. Um,
can to go more into detail on why is so crucial for D s O leaders to
understand why cyber threats are a major concern for the overall health of the
business.
Sure. Look, I think, I think it can be broken down into a couple buckets.
One is the legal issue.
What we're starting to see now is when ransomware attacks hit DSOs,
almost all DSOs are suffering from the data theft.
So most of these hacking groups not only hit the D S O with ransomware,
which basically locks up all of the computers and servers for a two week period,
but most ransomware groups are stealing as much or all of the patient
data,
which puts the D S O in a very precarious situation from a compliance and legal
perspective. And now what we're seeing is, and it's public information,
there are now multiple DSOs that are not only under investigation by
state attorney generals, um, by the federal government,
the officer of Civil rights, but now the victims, right? The patients,
unfortunately, in these types of attacks, there are multiple victims.
There's the D S O themself that's a victim.
Then you have the patients that are victims. The patient victims, um,
through class action lawsuits are actually, uh,
winning claims against the DSOs because the attorneys are claiming that the s o
did not have adequate cyber protections in place to protect these patients.
This is relatively new, you know, within the last 12 ish months or so,
and we're starting to see more and more of these class action, uh,
suits against the DSOs because the attorneys have figured out how to get it
through the court systems. Previously,
a lot of the judges were throwing these lawsuits out because the patients
couldn't prove harm. Right? Now, some of the judges are saying, well,
we know what happens when patient data gets stolen and I,
and how it relates to identity theft, et cetera.
So we're gonna allow the court systems to hear the cases. So that's one issue.
Then you have the compliance component of it. Um,
so what happens typically is the state and federal government will
investigate a ransomware attack, you know, an intrusion into an email system,
et cetera, and they're gonna dig really, really deep into that organization.
They're not gonna just say, well, okay,
this just impacted one or two of your locations,
or maybe it did impact all of your locations,
but they're gonna want the D S O to be able to answer some really difficult
questions on how they are implementing cybersecurity solutions to
prevent these intrusions.
And the investigator or investigators from officer of Civil
Rights may deem, well,
you had nothing in place and you weren't doing what's considered best practices
from a security perspective, um,
and potentially levy fines or require the D S O to start implementing
much more stringent security solutions.
Probably things that they should have had in place to, uh, begin with.
So you have, you know, to deal with that. I will tell you,
many of these federal investigations can take 12 plus months,
and they will request a tremendous amount of documentation and proof
from the DSOs. So they kind of turn them upside down and inside out.
Then really the last part of, uh,
the investigation really revolves around, um,
what the, uh,
D S O is going to feel from a pain perspective related to the
financial impact.
So what most DSOs don't realize is when you get hit with ransomware,
if it's systemic throughout your environment,
like we've seen recently with some of the larger DSOs where, you know,
almost every location gets hit, you're gonna be down for two to four weeks.
And I believe seeing it firsthand,
many of these DSOs don't really realize the potential impact from a financial
perspective. Could you imagine A D S O with, you know,
50 to a hundred locations or more, or even one with 10? It,
it's all proportional, right? Literally having to close their doors for,
for two plus weeks. And typically, Mariah,
what what we hear executives say is, well, I've,
I've been told that we have backups and, you know, we're in the cloud,
so you know, we, we can't be impacted by a ransomware event.
And then when you realize how damaging and destructive these ransomware
events are, you then realize and actually see some of these news broadcasts,
right? Well, you know, X Y Z D S O, you know,
has all of their facilities closed and you know,
ha have been closed for two weeks. You quickly realize, wow, that's,
that's devastating for the organization from a financial perspective.
So what I tell every board that I talk to, or C-suite, I say,
I want you to play this out in your head. Do back of the napkin math.
How much do you generate every day right now, multiply that by 10,
and that's gonna be your minimum loss.
That's just strictly production from treating patients gone. Now,
think about the impact over the next three to eight weeks
as these systems slowly come back online,
because even with really good incident response,
companies that help recover from the ransomware attack and good IT resources,
I rarely see, uh,
dental practices and DSOs come back online in less than two weeks. And,
and they, they suffer kind of the pain and anguish for weeks after,
because you forget how many interconnected systems you have.
You not only have, um, uh, scheduling and billing,
you have two dimensional x-rays, you have three dimensional x-rays,
you have text messaging, you have, uh,
connectors that gather all of this data and mine the data and,
and generate forecasts,
and you have payroll and phone systems and appointment reminders. So yeah,
look, it's,
it's often way bigger than what people perceive.
And until an executive has actually gone through
a ransomware event firsthand,
it's often very difficult to communicate that to them because they just don't
understand the, the gravity of these types of situations. And then obviously,
like we just described, the long-term consequences and impact,
and then you have to think about maybe you're getting ready to sell your D S O
now with all the class action lawsuits occurring,
is another D S O gonna wanna buy you with the potential of dealing with millions
of dollars of class action lawsuit payouts in the future? Like, it, it's,
it's a big question on a lot of people's radar right now.
Why would you take that risk? You know, your,
your investment in that organization could be, you know,
diminished dramatically if in a year from now you get hit with multiple class
action lawsuits. So I think, I think we really need to, uh,
address all of these concerns holistically and, and,
and look into solutions to try and prevent these types of intrusions.
Yeah, absolutely. Thank you so much for giving us that rundown. Um,
I certainly do not know all of that about what happens.
So thank you for sharing. Um, and I know at Becker's we report,
we have been reporting on these cyber attacks very frequently. Um,
why are healthcare organizations including those in dentals,
seeing such a rise in cyber attacks in these, you know, recent months?
Yeah, it's, it's been dramatic. Um,
I would say if you go back to the beginning of the war with Russia and Ukraine,
the cyber attacks kind of dropped off, literally, like fell off a ledge.
And ransomware, uh, for lack of a better word, almost died for, for months. Um,
and then earlier this year, they, you know,
became systemic, right? We were seeing them hit, uh,
we were seeing the threat actors hit all different sized dental groups with,
with ransomware, literally like someone turned the switch on again and boom,
they started. So that the question really is why. So I think there's,
there's a, there's a couple reasons here that we see, right?
We deal with ransomware attacks firsthand, not, you know,
second secondhand or third hand by, by reading articles.
We actually deal with these DSOs that get hit.
And I think there are a couple reasons. First,
the hackers know where the money is, right? And,
and if you are a hacker and you know that
DSOs and medical groups have a ton of patient records in their system,
they also have a clear understanding of our HIPAA laws.
And believe it or not, hackers have, you know,
sent communications to me saying, we know the HIPAA laws you have to pay,
you'll face, you know, serious fines from your government.
They understand that most healthcare entities do in fact pay the ransom demand
because when the hackers steal this data,
if the victim like a D S O doesn't pay,
the hackers will publish and sell all of those patient records on the dark web.
And you can imagine, once again,
the legal and compliance issues related to that. So kind of follow the money.
Um,
they also know that most DSOs have pretty substantial insurance policies related
to paying out on cyber events. You know,
many DSOs have multimillion dollar policies, um, and,
you know,
the insurance carriers do in fact pay because that's what they're insuring,
right? They're, they're trying to, you know,
provide insurance to these DSOs and help them recover from these types of events
so that that hacking community understands that concept as well. In fact,
one of the methodologies that hackers use is they will actively search
the network,
the server workstation storage devices for copies of the
DSOs insurance policy, and they'll say, oh,
you're claiming you can only pay us half a million.
We found your insurance policy and you have $3 million in coverage,
pay us $3 million. You know, so it's crazy to even think that,
but those are some of the, the tactics that they're using. Um, the attack,
the attack surface is another big issue for DSOs.
We see so many DSOs with, um,
a lack of standardization in their technology, right?
They'll have five to 10 different brands of firewalls, you know,
10 different flavors of antivirus and intrusion detection software.
Um, lots of different practice management systems, both cloud-based, um,
and on-premise based,
and they have no real visibility into their attack
surface. And what an attack surface is, is basically every,
uh, component of your network that presents cyber risk.
So examples of attack surface are your firewalls. Um,
so a lot of DSOs have work from home employees.
They have third parties who remote into their systems.
They have firewalls that actually have vulnerabilities,
which can be caused by a piece of software on the firewall,
uh, that has in fact some type of, um,
problem with it, right?
Some type of defect within the software that the hackers can scan and find,
and then they exploit that firewall and they get into the practice or into the,
you know, central, uh, management console of, of A D S O and,
and then potentially gain access to all of the locations. Um, so you have that,
you have vulnerabilities on computers that hackers can exploit vulnerabilities
in pieces of software vulnerabilities in pieces of hardware,
and the hackers will basically build hacking toolkits to exploit these
vulnerabilities. So this is also part of your attack surface.
And what we find for most DSOs is they
don't have any tools that identify this
attack surface issue, right? They're focusing on what I like to call defense,
which basically means, hey, if someone gets into our environment,
we're going to hope that some piece of software we have on our network
is going to alert us, and then someone can potentially take action.
But what I say to everyone is, once that tool's going off and alerting,
if it actually does,
'cause nothing's a hundred percent someone's already in your network, right?
Or malicious code is already in your network. Now,
you're just hoping that this tool is gonna stop it.
What I find is through attack surface management,
by analyzing your firewalls daily, by scanning your computers daily,
by running penetration tests through ethical hackers,
you get a clear picture of your attack surface and you can
now play offense. So offense basically says, Hey,
how do we harden our computers?
How do we harden our firewalls and all this other technology?
So when hackers scan them,
they actually don't see any vulnerabilities that they can exploit.
So offenses very important. Um, that's done with these,
these daily scans of the firewalls and computers and pen testing. Um,
and that's kind of your outer defense, right? If we,
if we don't give the, uh, threat actors,
these hackers an opportunity to break in,
then the chance of them breaking in is lower, right?
The other part of an attack surface is your people. Now,
federal law says you have to train every single person in A D S O, uh,
on cyber threats.
So how to detect phishing and spear phishing and other forms of social
engineering.
And what we find is a lot of DSOs don't have a thorough,
uh, cybersecurity awareness training program. Some will be like, oh, well,
we just send out reminders to our doctors and staff and tell 'em not to click on
things. And then I'll ask, Hey,
do you actually test them by sending out simulated phishing or spear phishing
emails? Like, nah, you know, we've talked about that. We don't really do it.
Like that's a huge problem. You know, the human element of cyber is,
is an issue. You know, depending on what study you look at,
somewhere between 60 and 90% of all cyber events are the result of a
human making a mistake, right? Clicking on a link, opening an attachment,
giving up usernames and passwords and, and things like that,
causing the downloading of malicious code into the system like
ransomware. So if you can take a look at your entire attack surface,
both from a technical perspective as well as a human perspective,
you're going to set yourself up for success. And this is one of the things that,
you know, O C R Officer of Civil Rights is looking for. You know,
did you as A D S O do what was necessary to try and prevent this event?
And if you did, okay, we understand nothing's a hundred percent,
but if you can't start providing concrete, uh,
data showing how you're managing risk by addressing vulnerabilities and training
your people and using more advanced, um,
AI based antivirus software and, and good firewalls,
you know, these DSOs are gonna have a big problem. And,
and that's what we're seeing here. Um,
so the technology exists to be able to really help minimize the chances of an
intrusion, but what we're finding is many DSOs in fact aren't, you know,
leveraging them or they're leveraging the wrong partner, you know,
that doesn't truly understand the threat matrix.
Got it. Thank you so much for all of that insight.
And if you could make something clear, should it resources,
whether internal or external be providing some type of protection.
So yes, um, they should, but I, I,
the challenge that I see is most IT
departments in DSOs, and this is regardless of size, we have,
we have clients that have 10 locations and clients that have hundreds,
most of the time the IT resources are focusing on what I like
to call firefighting, right? Practice, you know,
a has a problem with their server and they can't take X-rays, right?
And they're on the phone with the it's tech support department,
and they're trying to get that practice up online.
And because of resources and often the lack of, um,
certified individuals, uh, in security,
those organizations are mostly doing IT work, right?
Which is keeping those practices up and running, you know, diagnosing problems,
answering questions, things like that.
And often they don't have the correct tool set or, uh, the correct, uh,
training in order to really leverage, you know,
some of these higher end security tools, security applications. Um,
and then frankly,
you really need individuals that truly understand cybersecurity
and the cyber threat landscape. Um, because if you don't,
and you, and you don't understand how hackers are breaking in,
it becomes very difficult to defend against it.
And what I typically see is the IT resources
believe they know how hackers break in and are trying to defend against it,
and they're putting their resources, you know,
for argument's sake on the left side of the building, right?
And the hackers are like, oh,
look there exposure on the right side of the building, and they walk right in.
Um, so having kind of a third party company that comes in and,
and can help identify where the cyber risk exists and helping implement
security tools along with human intellect, i i, is really where the, um,
the cyber world is at right now.
Got it. Thank you so much for all of that information. Um,
if we could get some solutions, the next question I wanted to ask you is,
what should the private equity firms and fast-growing D s O groups do to protect
themselves when acquiring emerging locations?
Right?
So one of the challenges that exists right now is are you gonna buy a
breach, right? So you're, you're, you're about to,
you issue a letter of intent an l o i for a practice,
and maybe that practice had a cyber event that they weren't aware of.
Or what I hear a lot of time, uh, being said to me is, oh, well, you know,
we had this thing like two years ago, you know,
our IT resources called it a crypto virus. I'm like, well,
what's a crypto virus? Right? That's, that's a, uh,
that's a phrase that often IT people use, uh,
instead of ransomware, right? Because it's not as
horrible sounding. Um, and the IT resource would be like, oh, no, well, we just,
we got rid of that crypto virus. And then I'll say, well,
did the hackers steal your patient data? And they're like, well, I've,
I have no idea. My IT company said they took care of it.
So what now happens is a private equity company,
larger D S O goes to acquire that practice.
Maybe they had a cyber event in the past and
three months after they close on the deal,
there's a disclosure maybe through a government agency that finds the data, Hey,
uh, you have 10,000 patient records being sold on the dark web. You know,
are you aware of this? And, you know,
typically when the government finds it,
it's not very much longer thereafter that private entities,
researchers start finding that data. Law firms start finding that data.
And that's kind of the escalation to these class action lawsuits or
attorney general, right? Of the state or states or O C R.
So what PE companies and other DSOs
can do is they can conduct cyber due diligence.
So typically cyber companies that specialize in this,
this is one of the things we do. We will conduct a, um,
comprehensive assessment against the practice or D S O that's going to
be acquired. Uh, we'll deploy some very sophisticated tools, um,
both artificial intelligence based as well as some tools that look for
potential entry points into the environment.
We'll ask the practice and the IT company a whole bunch of questions, uh,
related to how they do things. And then we go back to the D S O and say, Hey,
here are the things that we've identified as high risk.
Here are some of the things that we've identified as moderate,
and here's a list of kind of low risk things that you probably don't need to be
concerned about. Um, we can also provide information on the technology,
whether or not it's kind of outta date and antiquated,
and they're gonna need to make some big financial investments.
But most importantly, we come back with a risk score. You know,
we'll tell the D s O, Hey, on this scale,
this acquisition is low, medium, or high risk.
And then the d s O gets to make some decisions what they wanna do.
They may walk away, they're like, wow,
they had a ransomware attack that they didn't disclose.
You guys found the code and the executables, that's not good, right?
What else didn't they disclose? Um,
or it's something they can go back and say to the, you know, the seller, Hey,
are you, are you aware you had this event? And see what they say.
So cyber due diligence has been very popular in other sectors. Um,
but it's starting to become more and more popular in,
in the healthcare sector now. 'cause like I said at the beginning,
no one wants to buy a breach.
Yeah, yeah.
Thank you for giving us all of that information that's very important to right
now. Specifically, um, Gary, before I let you go,
the last thing I wanted to ask you is,
what are the key things these DSOs need to assess within their attack surface
as they grow?
Right. So I think, I think attack surface management is critical. Um,
you need to understand where you're vulnerable and vulnerabilities
are broken down kind of into those two buckets that I described before,
the human vulnerability and then the technical vulnerability. So DSOs,
you know,
need to be leveraging cyber companies to look at the technical vulnerabilities
through vulnerability scanning and penetration testing and security risk
assessments. And really, you know,
kind of like virtual chief information security officer roles, you know,
engaging with folks that are credentialed in the cyber world,
like a CI S S P, or H C I S P P.
These are individuals that have legitimate cyber certifications. Um,
so they need to be looking at that. And most importantly, Mariah's,
they have to be doing this ongoing, right?
Having an assessment done today and not doing it again for a quarter or half a
year,
or even worse a year is almost useless because the cyber world is moving so
quickly. These te these types of tests, like I just described,
really need to be done almost on a daily basis now.
So they need to look at that. Um,
they need to look at their policies and procedures.
Do they have a disaster plan? Do they have an incident response plan, right?
So do they have a plan for a ransomware attack, a fire, a theft,
a natural disaster, and how do they address it? But more importantly,
have actually tested the plan. That's another big issue that we see.
Backup solutions,
a lot of DSOs do not have a formalized backup solution. Um,
or they have some type of solution, they've never once again tested it.
So I think that's, that's really important.
But for the executives that are probably listening to this,
the most important message that I can get out to you is you have to do the trust
but verify, right? You have to leverage third parties to come in,
analyze your environment, see what your people are doing,
and then present that data back to you so you can make educated decisions.
You know, I I, I've been around for a long time in this IT and cyber world,
and often what I hear, you know,
folks who are in decision making roles is, well,
if I had known that we had all this risk, I would've done something differently.
But instead, people, you know, at a level, a level lower or two levels lower,
say, oh, you know what? Our executives are never gonna pay for this technology,
so I'm not even gonna bother and ask them,
or I'm not even gonna warn 'em that we have risk because they're,
they're against, you know, investing in new, uh,
technology or security features. So, in the end,
when these things go sideways and a ransomware or, you know, intrusion occurs,
the ones that are gonna be held responsible are the executives in the board.
And my suggestion to everyone is you need clear
visibility, right? You're, you're gonna be responsible.
And without visibility into where your security risk is, you can't address it,
right? You may say, okay, you know what? I'm gonna accept that risk.
I'm okay with this risk. Or you may say, as an executive, I'm not, okay,
what do we need to do, you know, to lock down our environment, uh,
more so we're not at risk for some type of cyber event. The last thing,
there's some really amazing artificial intelligence technology out there.
It's known as X D R, extended detection response. Um,
this is a technology typically, you know, cyber companies are gonna deploy and,
and monitor. It is a defensive mechanism,
so it's triggering when something is happening in your environment. Um,
but it is, it is powerful. It is nowhere near a hundred percent.
So everyone knows, right? There is no technology that stops all cyber events,
but it is a good tool that you need to evaluate and have in your
environment, right?
A lot of DSOs are still running kind of antiquated antivirus software.
This X D R, um, software is, is a platform you need to be investing in.
Wow. Thank you Gary,
so much for your time and thought provoking responses today. Uh,
we really do appreciate c appreciate you coming on the podcast.
And we also wanna thank our podcast sponsor Black Talent Security.
You can tune into more podcasts from Becker's Healthcare by visiting our podcast
page at becker's podcast.com. Thank you again, Gary.
You're very welcome. It's my pleasure.