This is the Becker's Healthcare Podcast,
created by the team of Becker's Healthcare,
a multimedia company devoted to the people who power us healthcare.
Four new 15 minute episodes are released daily containing industry news analysis
and thought leadership.
From powerful healthcare decision makers Support our show by leaving it a five
star rating and review on Apple Podcast or other platforms you use.
It's a chance to tell us what you like about the show and act on your feedback.
Thanks for listening. Now here's the episode.
This is Laura Dedo with the Becker's Healthcare Podcast.
I'm thrilled today to be joined by Menin Kakar,
who's cybersecurity executive director at Providence. Man,
it's a pleasure to have you on the podcast today.
Thank you so much for having me. Looking forward to the discussion.
Absolutely.
And I know this is gonna be a great one because there's so much happening in the
cybersecurity space, especially with healthcare providers, hospitals,
and health systems, you know, across the board.
Certainly this is something that's top of mind for executives and executive
teams. And so I'm looking forward to hearing more about what you're doing at
Providence. But before we dive into that discussion,
can you tell us a little bit more about yourself and your background?
Yeah, absolutely. Um, Monan Cooker, I, I'm at Providence.
I've been with Providence for about three years now. Before that, I was, uh,
I spent a long time in cybersecurity and IT consulting with
EY and Deloitte. And yes, I'm a technology enthusiast.
I've spent a lot of time just thinking with various technologies, um,
at work and outside of work.
So technology is pretty fascinating. And just being in cybersecurity,
the intersection of the various technologies and risks and business challenges,
it's a fascinating space to, to be in.
Absolutely. And you know, from your perspective,
what got you interested in healthcare?
Obviously cybersecurity is needed across so many different in industries,
so why choose healthcare?
I think being in consulting, I worked across, uh,
a large variety of industries and finance.
Finance sector is obviously one of the leading invest areas that has a
lot of investment in cybersecurity and healthcare by nature
of the risks it possesses, uh,
in terms of patient data,
in terms of making sure critical services are available, um,
and it technology quickly becoming,
and digital transformations quickly becoming a key component of how healthcare
cyber, how, how healthcare is delivered.
It was an interesting space where new things were being developed,
new challenges were being thought about and how we are going to think about
solving these challenges.
So it was more of it being new in terms of
a new thought process for,
for similar challenges that finance the financial industry have been solving for
a long time, or the defense sector was solving for the long, for,
for a very long time. But in healthcare,
we have to reimagine all these things because there was a direct component of
patient safety interacting with patients,
interacting with clinicians and physicians that we should,
we shouldn't think of them as technology experts.
Some of them are great technologists, uh, but,
but the large landscape within healthcare is, is not about technologists.
And bringing that perspective and bridging that gap is, uh,
was an exciting challenge to me.
Absolutely. Well, that's fantastic and certainly, you know, uh, like you said,
an important and emerging field within the technology space as well as then
needing a lot more from the cybersecurity perspective.
Could you tell me about your cybersecurity program and team at Providence?
How did you design the program and what really, you know,
is unique about what you're doing? I.
Think this is a,
a very interesting question because when we thought about when,
when our CSO Adams was talking about how he wants to build the cybersecurity
program, we went back and forth on, you know,
how are we going to reimagine things?
How are we going to bring cybersecurity to a health system that
has been around for, for so long?
And is is in this intersection of rolling out so many new digital technologies,
how we deliver patient care is being rethought and technology is being a big
component as part of it, and therefore cyber risks, uh,
become more prevalent. We started thinking about, you know,
we should think about cybersecurity as a consistent,
the approach needs to be consistent.
So we picked the NIST cybersecurity framework as the,
the core component around which we built our program.
So as we started designing it,
we spent a lot of time thinking about what problems was the cybersecurity
framework trying to address. Like it really bridges technical controls in a,
in a language that is not as technical with identify, protect, detect,
response and recover. Like we can talk about those things with, uh,
with enough examples from real world that have nothing to do with technology.
So we picked the NIST cybersecurity framework as the core component around which
we developed the, the framework developed our program.
And as we started doing that, we identified key pillars that are well,
identity and access management is a key component. How do we bring,
bring on physicians?
How do we manage their lifecycle of being able to go from one system to the
other in a seamless way to deliver patient care without a lot
of technology interruptions? And then how do we,
from a security operations perspective, are always 24, uh,
by seven eyes on glass.
We are monitoring for new stress and how do we respond and recover?
So we picked the new cybersecurity framework,
we picked a few key functions that we wanted to, to build.
And then another component was building the function out, uh, in,
in our offshore capacity over in India so that we have security
operations in the US that are monitoring and are able to quickly respond to
incidents that are happening within the US time zone. But at the same time,
we have a team out in India that is also providing the same level of visibility,
same amount of eyes on glass vigilance to the threats,
and they can work with our S teams if they see something.
So making sure we are, we have a consistent framework,
we build the capabilities on the pillars and functions around those, uh,
components of the framework. And then having 24 by seven availability,
that was a key component in,
in how we designed overall our cybersecurity program.
And then there are a lot of components of maturity in itself.
Like at the core of it, cybersecurity, uh, is,
is a service provider to our technology teams, to our,
to our physicians and clinicians. So from a cybersecurity pillar itself,
we have to rethink about how we deliver our services to our customers.
And towards that,
we spend a lot of time building a program management mentality
where we have, we have the right engineers,
we have the engineers working with the program managers,
so we built a lot of people processing technologies around how we deliver these
services. It is one thing to build a capability, uh,
but delivering consistently and in a manner that the
service can be consumed by the customers. That's a whole different challenge.
So we spend a lot of time figuring out how we are going to deliver our cyber
services, and we've been, it, it's a learning process. It's,
we try a few things, some things work, some things don't.
We spend a lot of time just kind of reevaluating, uh, what we've already built.
So that's kind of how we continue to build and evolve our cybersecurity
capability.
That's fascinating to hear,
and I really appreciate you talking through that because I know a lot of
organizations are sitting in a similar place as, as you and,
and where when you first joined Providence and trying to think through,
you know, how do we, um,
really transform and update and innovate within our cybersecurity space?
What do we really need as healthcare becomes more, uh,
integrated with technology and whether it's the healthcare delivery side or, um,
you know,
integrating technology into the operational aspects of the health system,
it seems like there's just a lot of opportunities, um,
and a lot of potential vulnerabilities. And so I can imagine that, you know,
certainly we'll keep some folks up at night, but at the same time, you know,
if you, um, have the right approach,
it seems like you'd be able to at the very least, mitigate some of that risk.
Yeah, and, and I think that's, that's the key to the approach, right? In,
in the cybersecurity space, we often talk about, well,
do the CISOs ever sleep at night? How do people sleep at night? And,
and I think our philosophy is that if,
if you are prepared or if you've gone above and beyond in making sure that you
have the right controls, you have the right people in place, you,
you enable them with technologies that allow them to,
to provide services and do their jobs effectively and efficiently.
And if we are prepared, we will be able to,
to deal with certain challenges and issues. The, the fact of the matter is,
the reality is every organization is susceptible to cybersecurity, uh, attacks.
There is a,
there is an industry understanding within cybersecurity that it's not a matter
of, uh, if, but it's a matter of when.
So if it is a matter of when Sotheby's going to be, uh,
facing or dealing with cybersecurity attacks,
then the conversation needs to be how are we going to,
to respond and recover from those? Or how do we protect ourselves from,
from those or mitigate as much as possible?
So we spend a lot of time in making sure that we have the right controls,
we test and validate the controls and make sure that, uh,
if there is a challenge, uh, the team will rise up to it. And, you know,
at Providence, we work very closely with our technology teams.
A big component of cybersecurity is within,
within the wider technology teams and within the business teams that interact
with the systems. So we spend a lot of time with the,
with the different leaders on their teams. We have a few groups where we,
we talk about some of these things like data protection and third party risk
management, biomedical security. It's not a,
these are not problems that cybersecurity can just solve within cybersecurity.
These are things that we can only solve if we partner well and we partner
effectively with the rest of the organization. Um,
and that is a key component of how we place the function. Uh,
our program managers or engineers,
they spend a lot of time talking to the different teams that interact with
technology to understand how they use the systems,
and then we bring in the risk perspective of how can somebody try and, uh,
adversely impact problems from a cybersecurity perspective and what do we need?
So we spend a lot of time really interacting with, with the different teams.
And I think that is,
having been in consulting and having seen so many industries, so many programs,
uh, being built,
I think the ones that succeed are the ones that really come together and
collectively solve problems rather than say, Hey, we are cybersecurity.
We wrote a policy, and if you don't follow it, well that's too bad.
That's your mistake.
That's not necessarily how you build an effective organization. And,
and in order to kind of really address risks,
you have to meet the customers where they are, understand their challenges,
how do they interact with technologies,
and then write the policies based on that, and then have the controls put in.
That's kind of what, uh, the Providence Cybersecurity spends a lot of, uh,
conscious time and effort around.
That's so interesting to hear. And you know, I,
I really appreciate that perspective because I can imagine, you know,
certainly in a traditional sense,
a lot of the ways that the technology department or division and teams are
assembled are exactly as you mentioned, you know,
building something and saying here, you know, make it work, . Um,
and so especially with on the cybersecurity end, you know, when you, uh,
bring on folks, um, to your team and, and,
and have this set up to where you're co building or co-creating what's gonna be
needed in the policies, are there any other, uh, I guess skills or, or,
or something you look for in the people that you're bringing on the team to make
sure that, you know, you're able to execute on this, um,
very kind of collaborative and unique method of,
of making sure that your policies and procedures are up to, up to snuff,
I guess, in, in doing what they need to be doing?
Yeah, absolutely. I think as we've been, uh, over the last, uh,
three years when we started building the team and hiring, hiring folks,
there was a lot of time spent into what it is that we are looking for in
people who joined Providence, right? Providence as, as an organization is,
is very close to its mission. Um,
and that was something that we were, uh, that is stable stakes.
Like anybody who comes in has to understand that Providence is a mission-driven
organization at the core of it,
like if we keep everything apart, at the core of it,
Providence is trying to provide patient care to the communities in need.
And that's, that's what we are here to do. And the only way, and this is again,
this is my personal perspective, but the way we provide that is through empathy.
We have to empathize with the people that we are serving.
We have to understand and appreciate their challenges and then provide what we
can to make their lives a little better. So I think from that perspective,
when it comes to building the cybersecurity team,
we are really focused on bringing in people who understand that culture of
empathy. We, we spend a lot of time thinking about like,
oh, you know,
there are rock stars and there are heroes and there are individual contributors
who are like, you know, I, I know this problem and I will solve this problem.
Like that I mentality doesn't necessarily work in, in,
in what we are building and what we've seen really work. So culture is,
is really important in terms of who we bring on,
what is their mindset to solving problems.
It cannot be like I have the solution. It has to be,
we will work together to figure out what the right solution is,
and I bring in enough technical expertise or experience or real world
experience where we can form the conversation in the right way,
where we can help prioritize the different challenges that are being laid out
or, or how do we engage people like that is a key component.
So whether it is bringing on an identity and access management engineer,
or it is a security operations person or a program manager, we,
we are very mindful of figuring out what is the key requirement,
the technical requirement of that particular role that should definitely be met.
But at the same time, a huge component is, is this person,
somebody who can collaborate,
is this person who brings in the same mission values that Providence has of
empathy, of understanding, of collaborating, um,
and does this person have the, have the personality of, yep,
this is a problem we need to solve. Let's roll up our sleeves,
let's figure out how we are going to solve it. Um,
and that's kinda what we've built the team around. And you know, there,
there's a Steve Jobs quote that says that, you know,
hire the right people and let them tell you what to do. Uh,
that's kind of how we, we built the teams,
like what tools and technology should we bring from cybersecurity perspective?
Everybody in cybersecurity has a perspective on some of these things,
has an opinion, knows what's happening out there,
but when the team comes together and says that, hey, this tool is,
is much better in terms of the challenges that we are actually seeing on the
ground, that's a conversation that everybody can rally around instead of,
you know, unilateral decisions being made by certain people, uh,
which I've seen through my career in different organizations happen.
So we are very mindful about,
about that aspect of hiring and bringing in the right talent, uh,
because once we bring in the people and kind of just let them do what, uh,
what they're, what they're supposed to,
and we encourage and they enable them to do that,
things really start moving quickly.
That's great to hear and certainly very inspiring in terms of, you know,
how working together as a team really makes a difference. Now,
before we wrap up our conversation, I wanted to ask really quick about,
you know,
cybersecurity as a part of the overall broader health system executive strategy.
I know cybersecurity is a huge risk for hospitals and health systems across the
board.
So what is crucial when communicating this risk and need for resources to the
board and senior leadership? I can imagine, and it's clear providence,
they really understand why this is a priority.
But for some organizations that are dealing with so much, uh,
challenges right now financially and in so many competing interests,
why does cybersecurity and how, you know,
really need the resources and how do you impart that, um, to, to, um,
executive leaders?
Yeah, absolutely. I think, um, I think again on, on this one, I kind of, uh,
I kind of piggyback on some of the experiences that I've had. Uh,
you know, kind of just working with a lot of executives and boards, uh,
in my consulting days. And context setting to me is,
is a key component of it. Um,
and what I mean by that is when we talk about cybersecurity,
cybersecurity is a complex technology, uh, problem. It's a technical concept,
but we don't necessarily have to talk about cybersecurity in those technical
terms with everybody we talk to.
And context setting of why should somebody care about what we are talking about
from a cybersecurity perspective is critical, uh, towards that. As an example,
when we talk to executive and boards, we are very,
very mindful of not saying, um,
broad statements like, you know,
we have x million of vulnerabilities in our environment.
We need the dollar to to resolve that. Sounds,
sounds like a huge large scale,
big magnitude problem when we throw out numbers like that.
But even as somebody who's in cybersecurity who's been around for 10 years,
I wouldn't know what to do with that information.
So we try not to make broad statements or,
or statements that are just like extremely technical and use words like, oh,
we have c we have vulnerabilities, and all those kind of things.
We really like to set the context based on the audience. So in terms of, uh,
in terms of our conversations with executives, we,
we really put in a lot of effort in trying on, uh,
how we present the challenges.
So we talk about it in terms of we have biomedical devices, uh,
that have cybersecurity risks because they do not have the latest software.
Okay, how do we bring them the latest software? Well, here are,
here are some options. We can work with vendors. Well, what do,
what happens if we don't do that? Um, here are some of the,
the challenges that we are seeing in the industry. The F b I, the,
the federal government are coming out with guidelines.
There are brands and their attacks that are happening in edges and industries
that have really impacted their systems and their operations.
So we try to have a conversation with the audience based on the right context.
It's not about the vulnerability that is about the risk and impact to the
organization that that vulnerability brings.
So we really spend a lot of time within our organization trying to understand
what the risk and the impact is and how do we communicate it to the executives
in LA in a non-technical, but a real world.
How does it impact the business? How does it impact providence kind of way. So,
and I think that context setting does go a a long way because
executives are like, okay, now I understand. Okay,
this is why we need to figure out how to upgrade our networks or biomedical
devices or our core infrastructure or our data centers,
or why do we need to move to the cloud?
So then it really furthers the dialogue in terms of here's what we
need to do and here's what it would cost.
Now let's have that conversation as to what are the priorities revenue.
So it really is about, uh, in my perspective, context setting,
um, in terms of risk and impact and what would the investments get.
And if we have that conversation in a consistent, consistent manner, uh,
it does bring about a lot of positive change.
That's great advice and great to hear. Minan,
thank you so much for joining us on the podcast today.
This has been such a great conversation.
I always appreciate hearing from Providence executives and leaders just because,
you know, you have so much going on within the health system, um, and, and,
and so I've really enjoyed this conversation.
I look forward to connecting with you again soon.
Absolutely. Thank you again for holding me. This was, uh,
this was a good conversation.
It's so important for leaders at the top of organizations to keep learning,
stay sharp, grow their networks,
help our audience better do this in a more simplified, personalized,
and meaningful way. Becker's Healthcare has launched my B h c,
it's your trusted Becker's healthcare experience and more with content,
connections, events and learning opportunities.
Join the community free of charge@www.my dot becker's hospital
review.com and we'll see you there.