Latest / Becker’s Healthcare - Clinical Leadership Podcast / Shefali Mookencherry, Chief Information Security Officer at the University of Illinois at Chicago

Transcript

Shefali Mookencherry, Chief Information Security Officer at the University of Illinois at Chicago · Becker’s Healthcare - Clinical Leadership Podcast

• 0:00
  - Welcome to the Becker's Healthcare Podcast, made
• 0:02
  for the people who power US healthcare.
• 0:04
  I'm Molly Gamble, Becker's,
• 0:05
  and today I am sitting down with Muk
• 0:07
  and Cherry Chief Information Security
• 0:09
  and Privacy Officer with University of Illinois Chicago.
• 0:13
  Shafai, welcome to the podcast.
• 0:15
  Thank you so much for being my guest. How are you today?
• 0:18
  And where does the podcast find you?
• 0:21
  - Thank you for first of all, having me,
• 0:23
  and I'm looking forward to a great conversation.
• 0:26
  And right now I am here in the suburbs of Chicago
• 0:31
  and with some snow, so, uh,
• 0:33
  looking forward to Spring .
• 0:35
  - Likewise. Yeah.
• 0:36
  For listeners, we're enduring our second winter here in
• 0:39
  Chicago after a full spring,
• 0:41
  so Sha will hope the next spring sticks.
• 0:43
  Um, but for for listeners who want to be more familiar
• 0:46
  with University of Illinois, Chicago,
• 0:48
  can you share a few key facts about the organization
• 0:51
  and then also your role within it
• 0:53
  as Chief Information Security
• 0:55
  and privacy Officer, just
• 0:57
  to help us better acquaint ourselves?
• 1:00
  - Oh, absolutely. So, you know, the University of Illinois,
• 1:03
  Chicago is part of a larger, uh, system,
• 1:07
  higher education system.
• 1:08
  So it's the University of Illinois system,
• 1:10
  and then there's three campuses.
• 1:13
  So I represent the, uh, Chicago campus, uh,
• 1:17
  so University of Illinois, Chicago,
• 1:19
  and it is located right in the city of Chicago, one
• 1:23
  of the largest, uh, universities within the state as well.
• 1:28
  And it has about 34,000 students, about 20 plus,
• 1:33
  uh, thousand employees.
• 1:35
  And, you know, we are made up of 16 colleges where,
• 1:40
  you know, we have healthcare components such as the College
• 1:44
  of Medicine, college of Dentistry,
• 1:46
  and College of Pharmacy as well.
• 1:48
  And so we have a mixed bag of, you know, when folks think
• 1:52
  of University of Illinois, uh, Chicago, you know, we do,
• 1:56
  uh, a lot of research.
• 1:57
  We're an R one, um, research entity as well,
• 2:01
  which means we do a very high volume
• 2:04
  of research about over half a billion dollars
• 2:07
  worth of research revenue.
• 2:09
  And we do have a hospital UI health, uh,
• 2:13
  which is the hospital system
• 2:14
  that is here in the Chicago campus.
• 2:17
  And so we work very closely, uh, with our partners there.
• 2:20
  And, you know, we have about close to, you know,
• 2:23
  80 plus bachelor degrees.
• 2:25
  We have over a hundred master degrees, over 60, uh, plus
• 2:31
  doctoral degrees all through our 16 colleges.
• 2:34
  And, you know, we do now also have the John Marshall Law
• 2:38
  School, and it's been renamed to, uh, you know,
• 2:40
  the UIC law school, uh, and recently.
• 2:44
  And so, you know, we honor all sorts of students
• 2:48
  and employees and, you know,
• 2:50
  we work very hard on our diversity, equity,
• 2:54
  and inclusion efforts as well.
• 2:56
  So, um, you know, it's a great place to be.
• 2:58
  And, and, you know, I welcome any questions.
• 3:01
  - Yeah, well, I, that's good
• 3:03
  because I have many Ali about your, your role, .
• 3:06
  I mean, what an interesting time
• 3:08
  to be talking about information security,
• 3:10
  especially in the realm of healthcare,
• 3:13
  and you're also at the university level.
• 3:15
  Um, do you feel as though our social consciousness
• 3:19
  or our national attention at a high level 30,000 feet,
• 3:23
  do you feel like we are paying attention to
• 3:26
  and talking about the right things when it comes
• 3:28
  to cybersecurity?
• 3:29
  Let me start there.
• 3:32
  - Yeah. So I think it just depends on the context
• 3:35
  of cybersecurity that folks are paying attention to.
• 3:38
  You know, almost every day,
• 3:40
  every other hour we hear about some organization
• 3:43
  that has been compromised or is reporting a breach, right?
• 3:47
  And so it's kind of become part of our day-to-day life.
• 3:52
  Um, you know, because we are more technology savvy,
• 3:55
  we have a lot of innovation going on, you know,
• 3:58
  put artificial intelligence in the middle of all that.
• 4:00
  Uh, we have a lot of controversy.
• 4:02
  We have, you know, federal regulations that come down, um,
• 4:07
  and more so from, uh, the, uh,
• 4:10
  federal level than we ever have before.
• 4:12
  And that really tells us our cybersecurity landscape is
• 4:16
  changing, and it's becoming more of a business focus
• 4:21
  for many organizations, uh, more so than
• 4:23
  before, I would say,
• 4:25
  because it is more about how do we safeguard revenues?
• 4:28
  How do we prevent harm?
• 4:30
  How do we, you know, prevent, uh, data leakage, uh,
• 4:34
  and how do we keep our organizations, you know, continuing
• 4:39
  to provide the services that adhere to our mission, right?
• 4:42
  And, and doing it without having some type
• 4:45
  of cybersecurity attack or, or breach of information.
• 4:49
  And it gets harder and harder to do that as much
• 4:51
  as we talk about technological advances, uh,
• 4:54
  for cybersecurity.
• 4:56
  The malicious attackers are probably two steps ahead
• 5:00
  of everybody else that's trying to find funding
• 5:04
  to really do cybersecurity practice
• 5:07
  and put in protocols
• 5:09
  to do what's needed for an organization.
• 5:12
  Sometimes funding is an issue.
• 5:14
  - Mm-Hmm, . Mm-Hmm.
• 5:15
  , let me ask you there too.
• 5:17
  I mean, when we talk about these malicious attackers,
• 5:19
  I remember at, at Becker's, we first reported on,
• 5:23
  at at least the first hospital ransomware incident.
• 5:26
  I, I was aware of 2016.
• 5:28
  It was a really small hospital in rural Kentucky.
• 5:31
  And since then, over those past several years,
• 5:34
  we've seen the nature of these malicious,
• 5:37
  it's the right word for it,
• 5:39
  because these attacks, sometimes there's just damage
• 5:41
  or inflicted, and it's not even tied to the goal
• 5:44
  of obtaining a ransom payment.
• 5:47
  It's just seemingly to wreak havoc, um,
• 5:50
  in invade patient's privacy, employee's privacy.
• 5:54
  What, what have you seen about the nature of some
• 5:57
  of these attackers, uh, when these, uh,
• 6:01
  attacks were orchestrated in the past near decade?
• 6:04
  Any, any thoughts or observations there?
• 6:08
  - Yeah, you know, there's, there's a lot there
• 6:09
  that's happening lately.
• 6:11
  And, you know, some folks may think of it as ransomware,
• 6:15
  as a service, right?
• 6:16
  Um, you know, there are ethical hackers
• 6:18
  and then there are non-ethical hackers,
• 6:20
  and that are really in it for a business.
• 6:23
  You know, there's a lot of money to be made, uh,
• 6:26
  unfortunately from the demise of organizations.
• 6:29
  And what is that demise is based on, um, you know, harm
• 6:35
  or whether it's based on making money
• 6:37
  or if it's to, you know, damage an organization's brand.
• 6:41
  Um, there's just a multitude of reasons as to why, you know,
• 6:45
  we see ransomware more prevalent than we ever have.
• 6:48
  And, you know, every year I look at different sources
• 6:51
  and I continue to see from one year to the next
• 6:53
  that we continue to say, we'll see more,
• 6:56
  we'll see more, we'll see more.
• 6:57
  We don't see, oh, we've seen a decrease in, you know,
• 7:02
  compromises or cyber attacks or breaches.
• 7:04
  We just continue to see it
• 7:06
  escalate from one year to the next.
• 7:07
  And I think the evolution
• 7:08
  that we are seeing here is it's ransomware right now,
• 7:13
  but what about it turning into something called
• 7:16
  kill ware, right?
• 7:17
  Where, um, you know, it's an evolution of hacking where,
• 7:21
  you know, there might be competition between hacking groups.
• 7:24
  Uh, you know, we know so many ransomware groups
• 7:26
  that are out there that want credit.
• 7:28
  Some don't take credit,
• 7:29
  but there's different purposes as
• 7:31
  to why they all do what they do.
• 7:33
  So I believe that there is a reason that's critical enough
• 7:37
  to warrant it as a business, right?
• 7:40
  And, and so now for folks that are not in the business
• 7:44
  of ransomware as a service, um, majority of us
• 7:46
  that are looking to protect our environments
• 7:49
  and our organizations is that, you know, we try
• 7:52
  to get better educated on these ransomware groups,
• 7:54
  but at the same time, I think, you know, we're just
• 7:57
  as vulnerable to understand why they're doing it.
• 8:00
  And, you know, trying to put in security measures,
• 8:03
  security controls, policies, practices, uh, you name it, uh,
• 8:08
  trying to make sure that, you know,
• 8:10
  we don't all fall victim, right?
• 8:13
  - Mm-Hmm, . Mm-Hmm,
• 8:15
  and sha that, that ransomware as a service, you know, it's,
• 8:18
  I, I've seen that term
• 8:19
  and I, I guess I haven't been as curious about that,
• 8:22
  but that is, is that a, basically a, a ransomware vendor
• 8:25
  where if you were interested in carrying on an attack,
• 8:29
  you would hire this group to execute it and,
• 8:31
  and perform it for you.
• 8:35
  - You know, there's all sorts of models
• 8:37
  that could be out there as ransomware as a service.
• 8:41
  And I do believe that it just depends on, um, you know,
• 8:45
  where you have these ransomware developers that could lease
• 8:49
  or sell, uh, some of their ransomware code to other hackers.
• 8:53
  Um, you know, there are different types
• 8:55
  of ransomware customization tools, um, malicious programs,
• 8:59
  um, infrastructure control panels, uh, technical support
• 9:03
  and instructions that can I kind of go
• 9:05
  with these types of services.
• 9:07
  So, you know, when I think of that, I'm thinking, okay,
• 9:10
  these developers are creating this code,
• 9:13
  and, you know, if they get in, then
• 9:15
  what else can they exploit?
• 9:17
  Right? Mm-Hmm, what more can I get now that I'm in there?
• 9:20
  You know, where am I going to make the biggest bang
• 9:23
  to understand how this organization works?
• 9:26
  What are its vulnerabilities?
• 9:27
  And then what's the impact of what I'm about to do
• 9:30
  as a hacker to that organization?
• 9:32
  And sometimes, you know, it's, it's a business model, right?
• 9:36
  So, um, you know, there are different kits you can buy,
• 9:40
  you know, on the dark web
• 9:41
  and anywhere else that, you know, if you wanted to look at
• 9:45
  how do I, you know, hack into X organization depends on,
• 9:49
  you know, what type of kit, ransomware kit you buy
• 9:51
  and what it can do for you, and
• 9:53
  how much you're willing to pay for it, right?
• 9:54
  So it is a business.
• 9:58
  - And al, if we can't,
• 9:59
  and let's move in closer to your role,
• 10:01
  specifically C-I-S-P-O.
• 10:04
  I'm curious if there are any common misconceptions you run
• 10:07
  into about your role and your work,
• 10:09
  and if so, what those are,
• 10:11
  and if you can clarify them for us, if you don't mind.
• 10:16
  - Absolutely. So when folks think
• 10:18
  of a chief information security officer,
• 10:20
  or even a Chief privacy officer, uh,
• 10:23
  or a combination of a chief information security
• 10:25
  and privacy officer, there's different, you know, flavors of
• 10:28
  what the roles are these days.
• 10:30
  And sometimes there's a blurring line between privacy
• 10:33
  and security, uh, roles.
• 10:35
  And so, you know, I wear both hats, you know,
• 10:37
  and I like to think of the privacy role as to the, you know,
• 10:41
  the why of what's happening with that information.
• 10:44
  And then security is how I protect that information, right?
• 10:49
  And so looking at the why
• 10:51
  and the how, then the, the what, when, where, why
• 10:54
  that all comes into play, right?
• 10:57
  And so in my role, I look at things very differently
• 11:01
  because of the university environment.
• 11:03
  You know, I have academics with the students,
• 11:05
  I have research, and then, you know, looking at the hospital
• 11:09
  and the UI health system partnership that we have, uh,
• 11:12
  you know, what the impact there is from the university side
• 11:15
  to the hospital side,
• 11:16
  because we do have within the university, you know,
• 11:19
  healthcare covered components that are part of the,
• 11:23
  you know, college of Medicine, college of Dentistry,
• 11:25
  college of Pharmacy.
• 11:27
  So we have medical clinics, dental clinics,
• 11:29
  and then the pharmacy.
• 11:30
  So, you know, the role that I play is, is a critical role,
• 11:34
  but there's an evolution happening about what a CISO is
• 11:37
  as a, as an example.
• 11:39
  Um, you know, I think the misconception there is
• 11:42
  you are solely responsible for security.
• 11:44
  As a ciso the concept really is,
• 11:48
  and this is what I try to advocate, is I am trying to sell
• 11:54
  security to the organization
• 11:57
  because it's a concern for everyone,
• 12:00
  whether you are an employee
• 12:02
  or a business partner, you know, third party, fourth party,
• 12:06
  it's everyone's concern
• 12:07
  because there's an impact
• 12:08
  to everyone if something goes wrong, uh,
• 12:11
  or something is leaked out, right?
• 12:14
  And so it's not just for me as a employee
• 12:18
  of an organization, but if I'm also a user of
• 12:22
  that organization's data
• 12:24
  or resources, then, you know, as a user, it's important also
• 12:28
  that I understand, you know, what the role of a CISO is.
• 12:32
  Uh, a lot of times CISOs get kind
• 12:34
  of pigeonholed into it's your issue, you handle it,
• 12:37
  you know, you're the person that's responsible.
• 12:39
  But I do feel
• 12:41
  that I can only be responsible if I've been given the proper
• 12:45
  tools and the funding to support what I need
• 12:49
  to do to get the job done.
• 12:51
  Now, you know, along with that comes support from leadership
• 12:54
  and the board sometimes, depending on
• 12:57
  how an organization is, is structured from the top down.
• 13:00
  Um, some CISOs will report to a board, some CISOs will not.
• 13:04
  It just depends. Um, and,
• 13:07
  and when you say a ciso, you know, we all come
• 13:09
  with varied background in experience, skillset,
• 13:13
  certifications, and our own personal abilities.
• 13:17
  I think that is a key there.
• 13:18
  And so, um, you know, I do see a lot
• 13:21
  of CISO positions open right now,
• 13:23
  and I think that, um, there is a really big focus nationally
• 13:27
  and internationally to be frank, of the attention
• 13:31
  that cybersecurity is getting now,
• 13:33
  because people do recognize there's a lot of money to lose
• 13:36
  and a lot of money to be made,
• 13:37
  and a lot of money to be safeguarded. Mm-Hmm.
• 13:40
  - , I think
• 13:41
  that's such an important distinction.
• 13:43
  Like you said, not it, it's not a matter
• 13:46
  of being solely responsible for security at the organization
• 13:49
  and risk mitigation,
• 13:51
  but being a, a cultural leader in many ways,
• 13:54
  and a, a, a real champion of security being baked into
• 13:59
  and factored into decisions made at a very high level,
• 14:02
  the board and executive team level.
• 14:04
  And, you know, Shefa, I'd be curious too.
• 14:06
  You know, the other thing I was gonna ask you about
• 14:08
  is the CSO role.
• 14:09
  I feel like so often those efforts can go under sung,
• 14:12
  and it's not until something goes wrong or breach occurs
• 14:15
  or some sort of cyber attack,
• 14:17
  and then ultimately the CISO is held up
• 14:19
  to greater visibility at times or held accountable.
• 14:23
  Um, I'm curious if you felt that way as though from day
• 14:27
  to day, if things are going well, security is intact,
• 14:30
  privacy is being honored, um, this is a role that if
• 14:35
  careful can diminished.
• 14:39
  - Yeah, you know, it, it is an interesting perspective of
• 14:42
  what a CISO is and what they're responsible for.
• 14:44
  And I think everyone, you know,
• 14:46
  they're in a CISO position is, you know, dependent on
• 14:49
  what the expectations of that organization are of them.
• 14:53
  Uh, and so, you know, for myself personally speaking,
• 14:56
  you know, I've been in CSO roles where, you know,
• 14:59
  I've taken them only based on a question I will ask
• 15:02
  leadership saying, you know, will you be there
• 15:05
  to support me when any decisions need to be made?
• 15:07
  And if there's some hard decisions, you know,
• 15:09
  that we both would need to be in sync.
• 15:12
  Um, and so if I have the support of my leadership, um, then,
• 15:16
  you know, those are the positions that I have taken.
• 15:18
  Um, and likewise, you know, if you're a CISO
• 15:22
  that's in a position where you're not really getting
• 15:24
  any support from your leadership, then you know,
• 15:27
  there's different tactics to take to report out on metrics,
• 15:30
  to think through, you know, an innovative way to explain,
• 15:35
  uh, how you might be able to get more funding or,
• 15:38
  or, uh, understand what kind of resources you need to get
• 15:41
  to a better maturity for cybersecurity.
• 15:44
  I think the, the other misconception for CISOs is that, um,
• 15:49
  you know, some CISOs feel like they're alone.
• 15:51
  They're the only technical person that, you know,
• 15:53
  everybody relies on.
• 15:55
  And I think the key here is, you know, being an advocate
• 15:58
  for security and getting out there within the organization
• 16:02
  and making relationships with folks, um, building
• 16:05
  that relationship and trust is very important
• 16:08
  to being successful as a ciso.
• 16:10
  I think the other piece here is,
• 16:12
  besides gaining trust, is really reaching out to
• 16:17
  the leadership and the unofficial leaders.
• 16:20
  I can't tell you how many people I have met
• 16:21
  that I have run a policy across, just
• 16:25
  'cause I know that they will have influence over an, uh,
• 16:29
  you know, an official leader, uh, per se.
• 16:32
  Um, but I think this is the nuance of the job, right?
• 16:35
  That we are held responsible for many things
• 16:37
  that could be out of our own control.
• 16:40
  And so when I think of what type of control do I need, well,
• 16:44
  it starts with the leadership from the top down, right?
• 16:47
  Because all the technical tools are in place.
• 16:49
  I've got, you know, people in place to do the things.
• 16:52
  But you know, if we do know, uh, various things are at risk,
• 16:57
  then my risk-based approach with evidence is an approach
• 17:01
  that I'll, I would wanna take
• 17:02
  and make sure that, you know, I
• 17:06
  provide a general update at the highest level,
• 17:09
  but then if I need to get technical enough
• 17:12
  that I can provide that documentation at
• 17:14
  the technical levels, right?
• 17:15
  So you, as a ciso, you have to be flexible in order
• 17:18
  to understand that gauge where, you know, you have
• 17:21
  to be high level and where you have to be, you know,
• 17:25
  deep down into the, the weeds.
• 17:28
  - Well, Chappelle, this has been such a
• 17:30
  interesting and dynamic conversation.
• 17:32
  I've learned a lot from you in our time together today.
• 17:34
  Is there anything I wasn't able to ask you
• 17:35
  or that you wanna make sure our listeners hear
• 17:37
  from you as we wind down?
• 17:41
  - Yeah, I think the thing that we all know as CISOs is that,
• 17:44
  you know, security is everyone's concerned,
• 17:46
  but I would just say that, you know, you have to lead
• 17:49
  with your head, your heart, and your hands.
• 17:54
  And you know, the way it works is, you know, leading
• 17:56
  with your head is, you know, we all all come with knowledge.
• 18:00
  And in order to be able to share that knowledge, you know,
• 18:03
  look at your heart and say, okay, who do I need to get
• 18:05
  to know to make my job easier?
• 18:08
  And to make sure that the organization is securely,
• 18:10
  you know, safeguarded.
• 18:11
  And then with the hands is where, you know,
• 18:13
  you start working through your
• 18:15
  policies, building relationships.
• 18:16
  And so look at your head, your heart, and your hands
• 18:18
  and see what you can do.
• 18:20
  Anything is possible.
• 18:23
  - Paul Muhar, chief Information Security
• 18:26
  and Privacy Officer with University of Illinois, Chicago,
• 18:28
  thank you so much for being my guest today.
• 18:31
  I hope we can catch up with you again soon.
• 18:33
  - Thank you.