Latest / Becker’s Healthcare Digital Health + Health IT / Steven Ramirez, Chief Information Security & Technology Officer at Renown Health

Transcript

Steven Ramirez, Chief Information Security & Technology Officer at Renown Health · Becker’s Healthcare Digital Health + Health IT

• 0:00
  - This is Laura Dearer with the Becker's Healthcare Podcast.
• 0:03
  I'm thrilled today to be joined by Steven Ramirez,
• 0:05
  chief Information Security
• 0:07
  and Technology Officer for renowned health.
• 0:09
  Steven, it's a pleasure to have you on the podcast today.
• 0:12
  - Thanks for having me.
• 0:14
  - Now I'm, look, I'm looking forward
• 0:15
  to diving into this conversation
• 0:16
  because there's so much happening in the cybersecurity
• 0:18
  space, and I'm particularly in healthcare this year has been
• 0:21
  already a, a lot of action
• 0:23
  and movement, so I'm looking forward to your perspective.
• 0:26
  But before we dive in,
• 0:27
  I was wondering if you could tell us a little bit more
• 0:29
  about yourself and your background.
• 0:32
  - Yeah, definitely. So Steven Ramirez,
• 0:34
  I'm the Chief Information Security
• 0:35
  and Technology Officer for Renowned health.
• 0:38
  Um, I was originally hired as the CIO, um,
• 0:42
  but have been serving in the dual cs o
• 0:44
  and chief technology role for almost a year now.
• 0:48
  Um, so really excited on, you know, how that enables,
• 0:51
  you know, the ability to, um, influence security, um,
• 0:56
  you know, on, on both sides of the house
• 0:57
  to get a lot more things done.
• 0:59
  Um, so Renowned health is Reno, Nevada based, um,
• 1:03
  four hospital system, the area trauma center.
• 1:07
  Um, and we've just got a lot
• 1:09
  of exciting things going on out there, um, as part
• 1:11
  of our strategic initiatives.
• 1:13
  So I know technology and cybersecurity are on the forefront.
• 1:17
  So that's, that's really something that our executive team
• 1:20
  and end users take seriously.
• 1:22
  So
• 1:24
  - That's great to hear.
• 1:25
  And, you know, considering, um,
• 1:26
  your different responsibilities, what are some
• 1:28
  of the biggest issues that you're
• 1:30
  following in healthcare right now?
• 1:33
  - Well, obviously third party risk has been huge.
• 1:35
  I know everyone saw that with change Healthcare.
• 1:37
  Um, I think that really shows the importance
• 1:39
  of having a diverse background of vendor partners, that
• 1:43
  that really shows, um, you know, if you have a single point
• 1:47
  of failure vendor on how disruptive that can be
• 1:50
  to your organization, but also just how you
• 1:52
  holistically look at third party risk as an enterprise.
• 1:56
  So just, you know, going through
• 1:57
  and just the typical security assessments and,
• 2:01
  and looking at everything like that, it's,
• 2:02
  it's really important to also bake
• 2:04
  that into your overall enterprise risk management program
• 2:08
  and business continuity, disaster recovery.
• 2:09
  We saw how important that the BC side,
• 2:13
  so the business continuity side was
• 2:14
  during change healthcare, um,
• 2:16
  and there's been a lot more zero days.
• 2:19
  Um, we've seen as of late, we know
• 2:21
  that Palo Alto was the most recent one.
• 2:23
  So that took, um, you know, all industry,
• 2:25
  but especially within healthcare clients that had
• 2:27
  that technology to, you know, rush in
• 2:30
  and make sure that we're doing various patching to that.
• 2:32
  Um, 'cause you can be doing all things right
• 2:35
  and then it can be, you know, a third party and
• 2:37
  or a vulnerability.
• 2:38
  So it's really, again, important to get into the,
• 2:42
  the fundamentals, um, as we're looking into 2024.
• 2:46
  So especially as we're, you know,
• 2:47
  a lot more organizations are moving into the cloud, um,
• 2:50
  you know, I'm definitely interested to see how things like
• 2:53
  that, um, might have some additional emerging risk.
• 2:58
  - That definitely makes a lot of sense.
• 2:59
  And you know, it is so interesting to think about how
• 3:01
  that cybersecurity landscape has evolved
• 3:04
  and in particular, as you mentioned, the third party risk.
• 3:07
  And you know, from your perspective,
• 3:10
  what has been really important when you're thinking about
• 3:12
  third party partnerships, I know, you know, there,
• 3:15
  there's a rude mentor, um, just trying to kind of make sure
• 3:18
  that those partners are responsible
• 3:20
  and going to be responsible with, um,
• 3:22
  any information provided.
• 3:24
  But, um, and, and, and then too their their own operations.
• 3:27
  But since especially, um, change healthcare, what are some
• 3:31
  of the things that you're are planning
• 3:33
  to do differently potentially
• 3:34
  as you're approaching third party
• 3:36
  relationships in the future?
• 3:38
  - We're really looking at how your organization uses
• 3:42
  that partner and service.
• 3:44
  Um, and that gets more into, you know, data you're sending,
• 3:48
  you know, is there other ways we can
• 3:50
  look at how we send data?
• 3:51
  Can we send reports? Can we send more de-identified data?
• 3:54
  Do they need, you know, everything as they did before.
• 3:57
  Um, you know, the change healthcare instance that, you know,
• 4:00
  definitely was an anomaly on the amount of data
• 4:02
  and just kind of the, you know, magnitude of that event.
• 4:06
  But really just looking, you know, holistically overall at
• 4:09
  how you partner with that vendor, how they connect
• 4:12
  to your systems, again, how you send them data,
• 4:15
  as I had said to that.
• 4:16
  So really understand that if there was an interruption, how
• 4:19
  that impacts your business and is there a plan B?
• 4:22
  So when we're looking at plan B, is there, um, components
• 4:26
  that can be done as a workaround?
• 4:27
  You know, is this something we can do on paper?
• 4:29
  Um, do you need to have a, you know,
• 4:31
  separate vendor like an Equifax, you know, for example
• 4:34
  that if something like were like that were to go down
• 4:37
  or even have a plan C.
• 4:39
  Um, so that's really where we're looking at it just based on
• 4:42
  interruption that I think that's really changed the approach
• 4:45
  of how a lot of people look at business impact assessments.
• 4:48
  You know, we would look at various applications
• 4:50
  and then we look at important vendors,
• 4:52
  but I don't think that we really took
• 4:54
  that deep dive into looking at the overall magnitude
• 4:58
  of an impact to the organization.
• 5:00
  Um, but of course on the front end, you know, making sure
• 5:03
  that we are, um, being very diligent on, you know,
• 5:06
  the security posture of these organizations potentially
• 5:10
  collecting more information.
• 5:12
  I know that, you know, meeting with some other CISO
• 5:15
  colleagues, it's, you know, is it time
• 5:17
  that we start collecting types of security controls
• 5:19
  that some of these partners have?
• 5:21
  You know, we'll, we'll go through very high level on
• 5:23
  security posture, but if there's a zero day, you know,
• 5:25
  a partner has like Palo or there was the MoveIt breach
• 5:28
  and stuff like that, you have a little bit
• 5:30
  of this inte intelligence upfront.
• 5:32
  So I think that the third party vetting process is just now
• 5:36
  becoming, you know, starting to evolve, um, just from these,
• 5:40
  you know, big, um, high profile events that we've seen.
• 5:43
  So it's gonna be something that we'll continue
• 5:44
  to have to keep a pulse on.
• 5:45
  And I think that can be also something that I'm hoping
• 5:49
  that the, the feds start to crack down on, um, a lot.
• 5:52
  We know there's that new SEC rule of course, that, you know,
• 5:55
  from a reporting mandate standpoint,
• 5:57
  but just that's gonna be one of the ways too, to hold some
• 6:00
  of these, these vendors accountable.
• 6:04
  - That makes a lot of sense.
• 6:05
  You know, it's really helpful to kind
• 6:06
  of get a peek into those conversations and discussions
• 6:09
  and where things are headed now.
• 6:11
  When you look ahead, what are you most excited
• 6:12
  about and what makes you nervous?
• 6:15
  - Well, I'm, I'm really exci in healthcare.
• 6:18
  I think we do a very good job of information sharing.
• 6:21
  Um, I think that the new performance goals that came out,
• 6:25
  um, really helped boil the ocean down from, you know,
• 6:28
  like a lot of organizations use NCSF
• 6:30
  and other, um, frameworks that,
• 6:32
  that really helps make things more palatable
• 6:35
  and easy to understand for some of your non-technical
• 6:39
  and security partners internally.
• 6:41
  So I think that I'm excited about, you know,
• 6:43
  just the emphasis that, you know, the healthcare
• 6:46
  IT security industries putting on this for, you know,
• 6:49
  how we can better collaborate,
• 6:51
  how we can better partner together to information share.
• 6:53
  That was a great thing that came outta change healthcare
• 6:56
  that, you know, really the CIO community coming together to,
• 6:59
  you know, see how we can information share, et cetera.
• 7:02
  So I'm really excited about
• 7:03
  where we have come and where we're going.
• 7:06
  But still what makes me nervous is just, you know,
• 7:10
  the sophistication of attacks
• 7:14
  and then just the sheer number that seemed to be popping up.
• 7:16
  So it's like emerging risk still.
• 7:20
  That's really what keep me up at night, you know,
• 7:22
  'cause again, we can be doing everything correctly.
• 7:24
  You know, we've been making an emphasis on a lot
• 7:26
  of security hygiene that we should be doing from the
• 7:29
  security controls processes, access management.
• 7:33
  And then that can all crumble at the wayside just by,
• 7:35
  you know, either a vendor
• 7:37
  or just social engineering, social engineering's getting,
• 7:40
  you know, even more sophisticated.
• 7:42
  We're seeing, you know, extremely sophisticated attacks.
• 7:45
  We're seeing, you know, the service desk start to be,
• 7:48
  you know, more of a target to go
• 7:50
  after that varied type of access.
• 7:51
  So, you know, a lot of the emphasis
• 7:54
  that we had originally put on just access management
• 7:57
  continues to expand
• 7:58
  and become more, you know, Swiss cheese on, you know,
• 8:02
  additional holes on ways guys can get in.
• 8:05
  So I think that's something that we need to continue
• 8:07
  to get creative and training and awareness
• 8:10
  and yeah, just makes me nervous that once we start
• 8:14
  to utilize AI into this,
• 8:18
  'cause right now, you know, threat actors are doing the bare
• 8:21
  minimum basics, getting in through, you know, MFA
• 8:23
  or zero days,
• 8:24
  but you know, it's, people start
• 8:25
  to button down the hatches on that.
• 8:27
  We're gonna start to see them leverage,
• 8:29
  you know, components of that.
• 8:30
  It's gonna make it really hard for some
• 8:33
  of our security tools to, you know, tell the difference
• 8:37
  between, you know, what's a phishing email, what isn't maybe
• 8:39
  what is, is what is
• 8:41
  and isn't malicious activity in your system.
• 8:43
  So that's where, you know, we're gonna have to also evolve
• 8:46
  to how we can have AI on the good side to start
• 8:50
  to combat components of that moving forward.
• 8:53
  - That makes a lot of sense.
• 8:54
  You know, and is really fascinating to think about
• 8:57
  how cybersecurity
• 8:58
  and some of those different attacks are coming through.
• 9:01
  And like you mentioned, um, being able to connect
• 9:04
  with the other CISOs and the, um, out there and,
• 9:06
  and share information is
• 9:08
  so important when you have conversations with them
• 9:11
  and really, um, get an understanding of how, um,
• 9:15
  different leaders are thinking about things,
• 9:17
  you know, working on things.
• 9:19
  What are some of the big target areas that you're still, um,
• 9:22
  trying to solve for?
• 9:25
  - Well, just looking at tools, processes and procedures.
• 9:28
  So it's like we have, there's a few group chats that we,
• 9:32
  we have together and we'll, you know,
• 9:34
  ask about different services, different tools
• 9:36
  because again, as you know,
• 9:37
  we've talked about stuff like social engineering that,
• 9:40
  you know, my organization had to pivot phishing tools just
• 9:43
  because we saw the tool we had wasn't working.
• 9:46
  So this is where you have a, a platform to ask what other,
• 9:49
  you know, CISOs and the industry are doing,
• 9:52
  um, and vice versa.
• 9:53
  That's , we're looking at this technology
• 9:55
  or what do you guys use for um, SSO?
• 9:59
  Or what would you use as a SIM?
• 10:00
  Or what do you use as a third party risk?
• 10:02
  So it's just, you know, a way to bounce something off, um,
• 10:05
  a peer, um, and you know,
• 10:07
  just really share various information on if
• 10:09
  they're experiencing an event.
• 10:11
  Um, and you know, having that many eyes
• 10:13
  and ears out there too, if something does go bad.
• 10:15
  I think that group chat was
• 10:16
  where I found out about change healthcare
• 10:19
  before, you know, it was broken, the papers.
• 10:21
  So, you know, again, having those kind of relationships
• 10:24
  and people that are out there living
• 10:25
  and breathing with these various vendors will help get you
• 10:27
  some of that real time threat
• 10:29
  intelligence, you know, upfront.
• 10:30
  So, um, makes, that, makes
• 10:33
  that collaboration really impactful.
• 10:35
  And 4 0 5 DH isac, um, you name it, there's a lot
• 10:40
  of various organizations out there that really help, um,
• 10:42
  you know, healthcare come together,
• 10:44
  information share, um, in it.
• 10:46
  And I think that's really helping us move the needle, um,
• 10:49
  to where we need to go.
• 10:51
  Um, still a lot of work a lot of us need to do.
• 10:54
  'cause again, you know, healthcare is
• 10:55
  so dynamic in our overall ecosystem, but,
• 10:59
  - Got it.
• 11:00
  You know, that, that's really helpful and,
• 11:01
  and great to hear you have that as a resource.
• 11:03
  Now, uh, before we wrap up here, I'm wondering
• 11:06
  what will most effective healthcare leaders need in order
• 11:08
  to be successful over the next two to three years?
• 11:11
  Especially given how sophisticated, as you mentioned some
• 11:14
  of these cyber attacks are,
• 11:15
  and, um, then to looking at how AI
• 11:18
  and other technologies can make a difference.
• 11:21
  - Definitely knowing what's going on in the
• 11:23
  environment, super critical.
• 11:25
  What are today's risk
• 11:27
  and how can those morph into, you know, emerging risks?
• 11:31
  Um, being nimble, you know, it's, I have three year plans,
• 11:36
  five year plans, all of that.
• 11:37
  What we put together today might change tomorrow.
• 11:40
  So being able to, you know, make sure that you're keeping
• 11:43
  that pulse on what's going on,
• 11:45
  what's changing within your organization, um,
• 11:47
  so you can be adaptive in how you approach security.
• 11:51
  Um, because again, what you do today
• 11:54
  will likely change tomorrow.
• 11:55
  Just some these various sophistications or,
• 11:57
  or attacks that we're seeing.
• 11:59
  Um, but also being able to, you know, stretch,
• 12:02
  stretch a dollar and be, you know, fiscally sound
• 12:05
  because, you know, throwing money at an issue
• 12:08
  isn't always gonna fix it.
• 12:09
  As you can see, again, that a lot
• 12:11
  of organizations could be doing the right thing.
• 12:13
  And then it's pivoting to the importance
• 12:15
  of business continuity, you know, with
• 12:16
  what we saw with change healthcare.
• 12:18
  So again, it's all three of those kind of interconnect on
• 12:21
  that, that it's, you know, you need to just be smart
• 12:25
  and tactical with how we're looking at things.
• 12:27
  And really, I've always made a a focus on, you know,
• 12:31
  sticking to the fundamentals
• 12:32
  and doing the fundamentals very well, that if you do MFA,
• 12:35
  you know, you start to get an enhanced privilege access,
• 12:38
  you know, you do phishing training
• 12:40
  and awareness, you know, have some technologies behind that
• 12:43
  and, you know, go through a lot of
• 12:44
  what we see in the performance goals.
• 12:46
  Um, patching vulnerability management, you know, the,
• 12:49
  the importance of that stuff will really make sure that,
• 12:51
  you know, we are successful doing that very well will,
• 12:55
  you know, make you at the top, you know, one to 5% on that.
• 12:59
  Because again, threat actors want that easy, you know,
• 13:02
  lucrative target, um, that they don't want to have
• 13:04
  to put a lot of work into getting into your organization.
• 13:07
  So the more hurdles that are there,
• 13:09
  they'll hopefully just move on.
• 13:11
  So having that mindset I think will really take
• 13:14
  organizations, you know, be successful,
• 13:16
  but also understanding technology.
• 13:18
  There's so much new tech, um, coming in
• 13:21
  that's super exciting, but also scary, especially with ai.
• 13:24
  So making sure that, you know, again,
• 13:26
  that we're doing our due diligence on
• 13:28
  how our organization strategically wants
• 13:30
  to use these technologies so that we can come up
• 13:32
  with a defensive strategy on
• 13:35
  how we're gonna protect the organization
• 13:36
  and our patient's data as well
• 13:39
  as our operational continuity.
• 13:41
  - Steven, thank you so much
• 13:42
  for joining us on the podcast today.
• 13:44
  This has been a fantastic conversation, very informative,
• 13:47
  and I look forward to connecting with you again soon.
• 13:50
  - Appreciate it. Thanks for having me.