- Welcome to the Becker's Healthcare Podcast, made
for the people who power US healthcare.
I'm Molly Gamble, Becker's,
and today I am sitting down with Muk
and Cherry Chief Information Security
and Privacy Officer with University of Illinois Chicago.
Shafai, welcome to the podcast.
Thank you so much for being my guest. How are you today?
And where does the podcast find you?
- Thank you for first of all, having me,
and I'm looking forward to a great conversation.
And right now I am here in the suburbs of Chicago
and with some snow, so, uh,
looking forward to Spring .
- Likewise. Yeah.
For listeners, we're enduring our second winter here in
Chicago after a full spring,
so Sha will hope the next spring sticks.
Um, but for for listeners who want to be more familiar
with University of Illinois, Chicago,
can you share a few key facts about the organization
and then also your role within it
as Chief Information Security
and privacy Officer, just
to help us better acquaint ourselves?
- Oh, absolutely. So, you know, the University of Illinois,
Chicago is part of a larger, uh, system,
higher education system.
So it's the University of Illinois system,
and then there's three campuses.
So I represent the, uh, Chicago campus, uh,
so University of Illinois, Chicago,
and it is located right in the city of Chicago, one
of the largest, uh, universities within the state as well.
And it has about 34,000 students, about 20 plus,
uh, thousand employees.
And, you know, we are made up of 16 colleges where,
you know, we have healthcare components such as the College
of Medicine, college of Dentistry,
and College of Pharmacy as well.
And so we have a mixed bag of, you know, when folks think
of University of Illinois, uh, Chicago, you know, we do,
uh, a lot of research.
We're an R one, um, research entity as well,
which means we do a very high volume
of research about over half a billion dollars
worth of research revenue.
And we do have a hospital UI health, uh,
which is the hospital system
that is here in the Chicago campus.
And so we work very closely, uh, with our partners there.
And, you know, we have about close to, you know,
80 plus bachelor degrees.
We have over a hundred master degrees, over 60, uh, plus
doctoral degrees all through our 16 colleges.
And, you know, we do now also have the John Marshall Law
School, and it's been renamed to, uh, you know,
the UIC law school, uh, and recently.
And so, you know, we honor all sorts of students
and employees and, you know,
we work very hard on our diversity, equity,
and inclusion efforts as well.
So, um, you know, it's a great place to be.
And, and, you know, I welcome any questions.
- Yeah, well, I, that's good
because I have many Ali about your, your role, .
I mean, what an interesting time
to be talking about information security,
especially in the realm of healthcare,
and you're also at the university level.
Um, do you feel as though our social consciousness
or our national attention at a high level 30,000 feet,
do you feel like we are paying attention to
and talking about the right things when it comes
to cybersecurity?
Let me start there.
- Yeah. So I think it just depends on the context
of cybersecurity that folks are paying attention to.
You know, almost every day,
every other hour we hear about some organization
that has been compromised or is reporting a breach, right?
And so it's kind of become part of our day-to-day life.
Um, you know, because we are more technology savvy,
we have a lot of innovation going on, you know,
put artificial intelligence in the middle of all that.
Uh, we have a lot of controversy.
We have, you know, federal regulations that come down, um,
and more so from, uh, the, uh,
federal level than we ever have before.
And that really tells us our cybersecurity landscape is
changing, and it's becoming more of a business focus
for many organizations, uh, more so than
before, I would say,
because it is more about how do we safeguard revenues?
How do we prevent harm?
How do we, you know, prevent, uh, data leakage, uh,
and how do we keep our organizations, you know, continuing
to provide the services that adhere to our mission, right?
And, and doing it without having some type
of cybersecurity attack or, or breach of information.
And it gets harder and harder to do that as much
as we talk about technological advances, uh,
for cybersecurity.
The malicious attackers are probably two steps ahead
of everybody else that's trying to find funding
to really do cybersecurity practice
and put in protocols
to do what's needed for an organization.
Sometimes funding is an issue.
- Mm-Hmm, . Mm-Hmm.
, let me ask you there too.
I mean, when we talk about these malicious attackers,
I remember at, at Becker's, we first reported on,
at at least the first hospital ransomware incident.
I, I was aware of 2016.
It was a really small hospital in rural Kentucky.
And since then, over those past several years,
we've seen the nature of these malicious,
it's the right word for it,
because these attacks, sometimes there's just damage
or inflicted, and it's not even tied to the goal
of obtaining a ransom payment.
It's just seemingly to wreak havoc, um,
in invade patient's privacy, employee's privacy.
What, what have you seen about the nature of some
of these attackers, uh, when these, uh,
attacks were orchestrated in the past near decade?
Any, any thoughts or observations there?
- Yeah, you know, there's, there's a lot there
that's happening lately.
And, you know, some folks may think of it as ransomware,
as a service, right?
Um, you know, there are ethical hackers
and then there are non-ethical hackers,
and that are really in it for a business.
You know, there's a lot of money to be made, uh,
unfortunately from the demise of organizations.
And what is that demise is based on, um, you know, harm
or whether it's based on making money
or if it's to, you know, damage an organization's brand.
Um, there's just a multitude of reasons as to why, you know,
we see ransomware more prevalent than we ever have.
And, you know, every year I look at different sources
and I continue to see from one year to the next
that we continue to say, we'll see more,
we'll see more, we'll see more.
We don't see, oh, we've seen a decrease in, you know,
compromises or cyber attacks or breaches.
We just continue to see it
escalate from one year to the next.
And I think the evolution
that we are seeing here is it's ransomware right now,
but what about it turning into something called
kill ware, right?
Where, um, you know, it's an evolution of hacking where,
you know, there might be competition between hacking groups.
Uh, you know, we know so many ransomware groups
that are out there that want credit.
Some don't take credit,
but there's different purposes as
to why they all do what they do.
So I believe that there is a reason that's critical enough
to warrant it as a business, right?
And, and so now for folks that are not in the business
of ransomware as a service, um, majority of us
that are looking to protect our environments
and our organizations is that, you know, we try
to get better educated on these ransomware groups,
but at the same time, I think, you know, we're just
as vulnerable to understand why they're doing it.
And, you know, trying to put in security measures,
security controls, policies, practices, uh, you name it, uh,
trying to make sure that, you know,
we don't all fall victim, right?
- Mm-Hmm, . Mm-Hmm,
and sha that, that ransomware as a service, you know, it's,
I, I've seen that term
and I, I guess I haven't been as curious about that,
but that is, is that a, basically a, a ransomware vendor
where if you were interested in carrying on an attack,
you would hire this group to execute it and,
and perform it for you.
- You know, there's all sorts of models
that could be out there as ransomware as a service.
And I do believe that it just depends on, um, you know,
where you have these ransomware developers that could lease
or sell, uh, some of their ransomware code to other hackers.
Um, you know, there are different types
of ransomware customization tools, um, malicious programs,
um, infrastructure control panels, uh, technical support
and instructions that can I kind of go
with these types of services.
So, you know, when I think of that, I'm thinking, okay,
these developers are creating this code,
and, you know, if they get in, then
what else can they exploit?
Right? Mm-Hmm, what more can I get now that I'm in there?
You know, where am I going to make the biggest bang
to understand how this organization works?
What are its vulnerabilities?
And then what's the impact of what I'm about to do
as a hacker to that organization?
And sometimes, you know, it's, it's a business model, right?
So, um, you know, there are different kits you can buy,
you know, on the dark web
and anywhere else that, you know, if you wanted to look at
how do I, you know, hack into X organization depends on,
you know, what type of kit, ransomware kit you buy
and what it can do for you, and
how much you're willing to pay for it, right?
So it is a business.
- And al, if we can't,
and let's move in closer to your role,
specifically C-I-S-P-O.
I'm curious if there are any common misconceptions you run
into about your role and your work,
and if so, what those are,
and if you can clarify them for us, if you don't mind.
- Absolutely. So when folks think
of a chief information security officer,
or even a Chief privacy officer, uh,
or a combination of a chief information security
and privacy officer, there's different, you know, flavors of
what the roles are these days.
And sometimes there's a blurring line between privacy
and security, uh, roles.
And so, you know, I wear both hats, you know,
and I like to think of the privacy role as to the, you know,
the why of what's happening with that information.
And then security is how I protect that information, right?
And so looking at the why
and the how, then the, the what, when, where, why
that all comes into play, right?
And so in my role, I look at things very differently
because of the university environment.
You know, I have academics with the students,
I have research, and then, you know, looking at the hospital
and the UI health system partnership that we have, uh,
you know, what the impact there is from the university side
to the hospital side,
because we do have within the university, you know,
healthcare covered components that are part of the,
you know, college of Medicine, college of Dentistry,
college of Pharmacy.
So we have medical clinics, dental clinics,
and then the pharmacy.
So, you know, the role that I play is, is a critical role,
but there's an evolution happening about what a CISO is
as a, as an example.
Um, you know, I think the misconception there is
you are solely responsible for security.
As a ciso the concept really is,
and this is what I try to advocate, is I am trying to sell
security to the organization
because it's a concern for everyone,
whether you are an employee
or a business partner, you know, third party, fourth party,
it's everyone's concern
because there's an impact
to everyone if something goes wrong, uh,
or something is leaked out, right?
And so it's not just for me as a employee
of an organization, but if I'm also a user of
that organization's data
or resources, then, you know, as a user, it's important also
that I understand, you know, what the role of a CISO is.
Uh, a lot of times CISOs get kind
of pigeonholed into it's your issue, you handle it,
you know, you're the person that's responsible.
But I do feel
that I can only be responsible if I've been given the proper
tools and the funding to support what I need
to do to get the job done.
Now, you know, along with that comes support from leadership
and the board sometimes, depending on
how an organization is, is structured from the top down.
Um, some CISOs will report to a board, some CISOs will not.
It just depends. Um, and,
and when you say a ciso, you know, we all come
with varied background in experience, skillset,
certifications, and our own personal abilities.
I think that is a key there.
And so, um, you know, I do see a lot
of CISO positions open right now,
and I think that, um, there is a really big focus nationally
and internationally to be frank, of the attention
that cybersecurity is getting now,
because people do recognize there's a lot of money to lose
and a lot of money to be made,
and a lot of money to be safeguarded. Mm-Hmm.
- , I think
that's such an important distinction.
Like you said, not it, it's not a matter
of being solely responsible for security at the organization
and risk mitigation,
but being a, a cultural leader in many ways,
and a, a, a real champion of security being baked into
and factored into decisions made at a very high level,
the board and executive team level.
And, you know, Shefa, I'd be curious too.
You know, the other thing I was gonna ask you about
is the CSO role.
I feel like so often those efforts can go under sung,
and it's not until something goes wrong or breach occurs
or some sort of cyber attack,
and then ultimately the CISO is held up
to greater visibility at times or held accountable.
Um, I'm curious if you felt that way as though from day
to day, if things are going well, security is intact,
privacy is being honored, um, this is a role that if
careful can diminished.
- Yeah, you know, it, it is an interesting perspective of
what a CISO is and what they're responsible for.
And I think everyone, you know,
they're in a CISO position is, you know, dependent on
what the expectations of that organization are of them.
Uh, and so, you know, for myself personally speaking,
you know, I've been in CSO roles where, you know,
I've taken them only based on a question I will ask
leadership saying, you know, will you be there
to support me when any decisions need to be made?
And if there's some hard decisions, you know,
that we both would need to be in sync.
Um, and so if I have the support of my leadership, um, then,
you know, those are the positions that I have taken.
Um, and likewise, you know, if you're a CISO
that's in a position where you're not really getting
any support from your leadership, then you know,
there's different tactics to take to report out on metrics,
to think through, you know, an innovative way to explain,
uh, how you might be able to get more funding or,
or, uh, understand what kind of resources you need to get
to a better maturity for cybersecurity.
I think the, the other misconception for CISOs is that, um,
you know, some CISOs feel like they're alone.
They're the only technical person that, you know,
everybody relies on.
And I think the key here is, you know, being an advocate
for security and getting out there within the organization
and making relationships with folks, um, building
that relationship and trust is very important
to being successful as a ciso.
I think the other piece here is,
besides gaining trust, is really reaching out to
the leadership and the unofficial leaders.
I can't tell you how many people I have met
that I have run a policy across, just
'cause I know that they will have influence over an, uh,
you know, an official leader, uh, per se.
Um, but I think this is the nuance of the job, right?
That we are held responsible for many things
that could be out of our own control.
And so when I think of what type of control do I need, well,
it starts with the leadership from the top down, right?
Because all the technical tools are in place.
I've got, you know, people in place to do the things.
But you know, if we do know, uh, various things are at risk,
then my risk-based approach with evidence is an approach
that I'll, I would wanna take
and make sure that, you know, I
provide a general update at the highest level,
but then if I need to get technical enough
that I can provide that documentation at
the technical levels, right?
So you, as a ciso, you have to be flexible in order
to understand that gauge where, you know, you have
to be high level and where you have to be, you know,
deep down into the, the weeds.
- Well, Chappelle, this has been such a
interesting and dynamic conversation.
I've learned a lot from you in our time together today.
Is there anything I wasn't able to ask you
or that you wanna make sure our listeners hear
from you as we wind down?
- Yeah, I think the thing that we all know as CISOs is that,
you know, security is everyone's concerned,
but I would just say that, you know, you have to lead
with your head, your heart, and your hands.
And you know, the way it works is, you know, leading
with your head is, you know, we all all come with knowledge.
And in order to be able to share that knowledge, you know,
look at your heart and say, okay, who do I need to get
to know to make my job easier?
And to make sure that the organization is securely,
you know, safeguarded.
And then with the hands is where, you know,
you start working through your
policies, building relationships.
And so look at your head, your heart, and your hands
and see what you can do.
Anything is possible.
- Paul Muhar, chief Information Security
and Privacy Officer with University of Illinois, Chicago,
thank you so much for being my guest today.
I hope we can catch up with you again soon.
- Thank you.