Latest / Becker’s Healthcare Podcast / Greg Sieg on Building a Resilient Cybersecurity Program Across a Growing Health System

Transcript

Greg Sieg on Building a Resilient Cybersecurity Program Across a Growing Health System · Becker’s Healthcare Podcast

• 0:00
  This is Laura Dierda with the Becker's Healthcare
• 0:02
  Podcast. I'm thrilled today to be joined by
• 0:04
  Greg Sieg, chief information security officer at University
• 0:07
  of Michigan Health Regional Network. Greg, it's a
• 0:09
  pleasure to have you on the podcast today.
• 0:11
  Thank you, Laura. It's a pleasure to be
• 0:12
  here with you.
• 0:14
  Absolutely. Now I'm excited for our conversation because
• 0:16
  I know, cybersecurity is such an important topic
• 0:18
  in health care right now and certainly,
• 0:21
  will continue to be as things change and
• 0:23
  and we have more in technology and AI
• 0:25
  than ever before. But before we dive into
• 0:27
  the broader discussion, can you tell me a
• 0:28
  little bit more about yourself, your background, and
• 0:31
  the organization?
• 0:32
  Yeah.
• 0:33
  Been with, with the University of Michigan Health
• 0:36
  Center for,
• 0:38
  about three and a half years now. I
• 0:40
  have a background in, in IT and and
• 0:43
  networking security. Kinda worked my way up through
• 0:45
  the through the rankings,
• 0:48
  starting in health care at help desk and
• 0:50
  then moving into,
• 0:51
  different support roles and and into leadership and
• 0:55
  spent quite a bit of time at a
• 0:57
  rural health facility,
• 0:59
  where, you know, we wear we wear quite
• 1:01
  a few hats, not just not just one,
• 1:04
  before I moved over to to the university
• 1:06
  here. And
• 1:08
  where now I get to, you know, focus
• 1:10
  on security and,
• 1:12
  you know, really kinda, you know, dig into
• 1:13
  it.
• 1:15
  That's great to hear. And, you know, when
• 1:17
  you think about the last year in particular,
• 1:19
  were there any great initiatives that you led?
• 1:21
  What did you do, and what were the
• 1:22
  results?
• 1:23
  Yeah.
• 1:24
  We've, last year, we've been working on,
• 1:27
  an acquisition that, we've purchased about two years
• 1:29
  ago. That's what, I've been supporting
• 1:32
  as well as another affiliate,
• 1:34
  that that we acquired as well
• 1:36
  and working on bringing them together.
• 1:38
  So there's been a lot of different pieces
• 1:41
  to that, to that work in the last
• 1:43
  year. So I I wouldn't really pinpoint,
• 1:45
  you know, say one thing,
• 1:47
  from from that standpoint. But,
• 1:50
  I would say that, as we've been bringing
• 1:52
  them over, we've been trying to align to
• 1:55
  a cybersecurity framework that
• 1:57
  will work across the organizations regardless
• 2:00
  of size and be more of a standard.
• 2:03
  That work has helped us lay the groundwork,
• 2:07
  if you will,
• 2:09
  for moving tooling,
• 2:10
  you know, our our people, all the work
• 2:12
  all the work that we've kind of been,
• 2:14
  bringing together.
• 2:16
  The the the work's been you know, the
• 2:18
  results have been good, but it it's it's
• 2:21
  a lot of work there. It's not just
• 2:23
  about tools. It's about people and and, you
• 2:26
  know, communication with the different departments,
• 2:29
  and and building up, you know, a culture,
• 2:32
  if you will. So it's been,
• 2:34
  satisfying,
• 2:36
  to see
• 2:37
  the where we've come in the last year
• 2:39
  and and the work that we've done,
• 2:41
  as we've moved through it.
• 2:43
  Absolutely. I I think, you know, you have
• 2:45
  the two things that you talked through right
• 2:47
  there and just looking at the cybersecurity, the
• 2:49
  technology side of it, and then the the
• 2:51
  people side too, which I know is no
• 2:54
  easy task to make sure everybody is practicing
• 2:57
  the proper
• 2:58
  cyber hygiene and being a good spot of
• 3:00
  communication and culture as you put it. So,
• 3:03
  you know, when you think through,
• 3:06
  what you've been able to accomplish over the
• 3:07
  last year and then look ahead, what are
• 3:09
  you kind of focused on? What are some
• 3:10
  of the priorities and headwinds that are,
• 3:13
  top of mind for you in 2026?
• 3:16
  Yeah. The the the fun thing with
• 3:19
  with SauerScure is it's it's ever changing. You
• 3:22
  know? The last few years, we were hyper
• 3:25
  focused on AI,
• 3:26
  in in the industry with the changes that
• 3:29
  came out of that and and the speed
• 3:30
  that it that it goes at. But,
• 3:33
  I would say right now, our focus,
• 3:36
  from an overall is really looking at our
• 3:38
  identity. So whether that is,
• 3:41
  a person, whether, a machine identity,
• 3:44
  really kind of across the gamut, looking and
• 3:46
  making vendors
• 3:47
  and so on, making sure that we've got
• 3:50
  the the correct structure around, the correct governance
• 3:52
  around it. We're doing the correct auditing with
• 3:54
  it. You know? And,
• 3:56
  we're we're keeping track of of those identities
• 3:59
  as they as they come through the system.
• 4:00
  So,
• 4:01
  working with,
• 4:03
  multiple systems, multiple HR systems that they come
• 4:06
  through,
• 4:07
  and making sure that we're deduping
• 4:09
  those identities
• 4:10
  and that, you know, again, we get a
• 4:12
  nice clean clean look at them. So
• 4:14
  there's,
• 4:15
  there's a lot of work that goes in
• 4:17
  Dendy, and there's,
• 4:19
  it hits pretty pretty much every facet of
• 4:21
  cybersecurity.
• 4:23
  So it's one of those areas that,
• 4:25
  if you don't have your Dendy right, a
• 4:27
  lot of your tools are you know, it's
• 4:28
  hard just to say that they're working right.
• 4:30
  You know, the
• 4:33
  a bad actor
• 4:34
  that gets a a good identity. It's very
• 4:36
  hard to track,
• 4:37
  that town and, you know, determine that you
• 4:39
  have something in your system. So,
• 4:42
  having a good secure program around that is
• 4:44
  is really our focus right now.
• 4:47
  It makes a lot of sense. And, you
• 4:48
  know, I I think it's especially critical to
• 4:51
  have that type of governance in place,
• 4:54
  in something a lot of health systems are
• 4:56
  focused on right now and continuing to evolve.
• 4:58
  And so, you know, I'm curious if you
• 5:00
  could dig a little bit deeper and share
• 5:02
  a little bit more about how you're structuring
• 5:04
  the governance process at,
• 5:06
  University of Michigan. That would be helpful to
• 5:08
  understand. I think, you know, anything that you
• 5:10
  might do differently or uniquely because of the
• 5:12
  last year,
• 5:13
  of how, you know, things that are evolving
• 5:16
  at such a rapid pace.
• 5:18
  Yeah.
• 5:19
  So one of the things that, I would
• 5:21
  say we're focused on right now is,
• 5:24
  trying to align
• 5:25
  the entities.
• 5:27
  So
• 5:27
  working through through m and a, you typically
• 5:30
  are working through multiple tools in in in
• 5:32
  different environments.
• 5:34
  So
• 5:35
  we're working on doing alignment and,
• 5:38
  visibility across those organizations.
• 5:40
  Right now, we have it in in tool
• 5:42
  sets, but we're looking to get it into
• 5:43
  a single pane of glass
• 5:45
  and make it a little bit, easier for
• 5:47
  us to to view those.
• 5:49
  And then,
• 5:50
  as I mentioned,
• 5:51
  the machine identity, that's something that I I'm,
• 5:54
  you know, very, you know, intrigued with, you
• 5:57
  know, getting into more,
• 5:59
  as we go through through items,
• 6:01
  because a lot of times your machine identities
• 6:04
  are
• 6:05
  items that,
• 6:07
  they're they're created for a server,
• 6:09
  an application, a device.
• 6:11
  And, you know, those those have a life
• 6:13
  cycle that,
• 6:15
  is a little different than than, say, a
• 6:17
  human account.
• 6:18
  You know, typically, you know, not having the
• 6:20
  same,
• 6:21
  password reset functions on them and and items.
• 6:24
  So there's things you can do with with
• 6:26
  certificates and and different work to better secure
• 6:30
  those accounts and
• 6:31
  and also, you know, allow us to change
• 6:33
  those passwords on the fly with automation.
• 6:36
  And those are some things that we're we're
• 6:37
  keenly looking at to,
• 6:39
  try to be better along those lines.
• 6:43
  That's helpful to know. Thank you for digging
• 6:44
  a little bit deeper there. Now looking into
• 6:47
  the next year as well, what do you
• 6:48
  think the hardest thing you'll have to do
• 6:49
  will be?
• 6:51
  So as we talk to your you know,
• 6:53
  cybersecurity
• 6:53
  is not just about
• 6:55
  deploying a tool,
• 6:57
  you know, to secure yourselves.
• 6:58
  There is a very large,
• 7:01
  you know, people process technology
• 7:03
  piece to it, you know, working together. You
• 7:06
  know? And and the people side is very
• 7:08
  subjective.
• 7:09
  You know, that's where,
• 7:11
  coming in, you know, we still see a
• 7:13
  lot of social engineering, a lot of fishing.
• 7:15
  You know? It's not something that, like I
• 7:17
  said, that you can just put a tool
• 7:19
  in place and and be fixed.
• 7:22
  So when you look at that and then
• 7:24
  you look at health care, which is an
• 7:26
  an area that, you know, we're also having
• 7:28
  to balance with, you know, patient safety and
• 7:30
  regulatory requirements,
• 7:32
  it it gives us, you know, a lot
• 7:34
  of work to do, I guess, is the
• 7:35
  best way to say it.
• 7:37
  So, you know, the next year,
• 7:40
  as I mentioned, we're gonna continue to work
• 7:41
  with with identity,
• 7:43
  but also looking at ways that, we can
• 7:46
  make sure that we're doing a good balance
• 7:49
  of of our, communications
• 7:51
  out to,
• 7:52
  staff and and and
• 7:54
  even our patients on, you know, how to
• 7:56
  keep themselves secure and how to keep our
• 7:58
  environment secure,
• 7:59
  while they're there,
• 8:01
  as well as continuing to look at our
• 8:03
  technologies and our processes,
• 8:05
  to make sure that,
• 8:07
  that they're going in the right direction.
• 8:09
  Cyber is really a very continuous,
• 8:12
  life cycle at the end of the day.
• 8:15
  It's we don't get to go and put
• 8:17
  a tool in and then walk away and
• 8:18
  say, okay. The job's done. Let's move on
• 8:20
  to the next.
• 8:22
  So, the moment that tool goes in and
• 8:24
  gets configured,
• 8:25
  we're going right back and tweaking and adjusting,
• 8:29
  you know, as we learn new things.
• 8:31
  And, you know, a lot of that comes
• 8:33
  through,
• 8:34
  what we call cyber threat intelligence,
• 8:37
  working on that to,
• 8:39
  try to make sure that, the the tools
• 8:42
  and the processes that we have in place
• 8:43
  and the education that we're doing with the
• 8:45
  with our employees
• 8:46
  is the right stuff for our environment,
• 8:49
  and that we're, you know, protecting the right
• 8:52
  way. So we utilize a lot of that
• 8:53
  intelligence information to help us make those decisions
• 8:57
  and, to, you know, move forward in the
• 8:59
  right way.
• 9:01
  That makes a lot of sense. And, you
• 9:02
  know, I appreciate you talking through everything that
• 9:04
  goes into, the process, not only technology, but
• 9:08
  how you wanna make sure that the processes
• 9:10
  are there and everyone understands
• 9:12
  the importance of following them because it it
• 9:14
  just makes such a big difference. And the
• 9:16
  the data you have too, I can imagine,
• 9:18
  you know, really helps you,
• 9:21
  keep track of all of these things in
• 9:22
  a way that you weren't able to in
• 9:24
  the past.
• 9:25
  Absolutely.
• 9:26
  Now, before we wrap up here, I wanna
• 9:28
  talk about growth too. Where do you see
• 9:30
  some of the best opportunities for organizational growth
• 9:32
  in the future?
• 9:34
  Yeah. So this one,
• 9:35
  you know, health care is expanding, you know,
• 9:38
  pretty rapidly right now, but it's it's expanding
• 9:41
  outside of the hospital walls.
• 9:43
  You know,
• 9:45
  yes, we're seeing we're seeing expansion hospitals too,
• 9:46
  but a lot of it is we're seeing
• 9:49
  new ambulatory clinics, we're seeing a lot of
• 9:51
  virtual health,
• 9:52
  we're seeing
• 9:54
  AI playing a role in in this as
• 9:56
  well,
• 9:57
  you know, bringing a lot more care direct
• 9:59
  to the patient even even in their home.
• 10:02
  And,
• 10:03
  that makes it, you know, it we don't
• 10:06
  have that footprint of, you know, within the
• 10:08
  hospital walls like we once did. And for
• 10:10
  cybersecurity, that makes it, a little bit harder
• 10:13
  because, you know, you don't have a
• 10:15
  set line, you know, that that you're looking
• 10:17
  at. So as we go through and and
• 10:20
  we look at that,
• 10:21
  we we have to grow and and and
• 10:23
  adjust with them. And,
• 10:25
  in cybersecurity, we've gotta be able to be
• 10:28
  flexible to allow the the facility to grow
• 10:30
  as well. The other point that didn't point
• 10:32
  out there is, as I mentioned earlier, we're
• 10:34
  we're doing mergers and acquisitions.
• 10:36
  That helps accelerate this. You know, we're still
• 10:39
  seeing that fairly heavy in the health care
• 10:41
  industry right now. But,
• 10:44
  from the cyber side, I look at our
• 10:46
  job as as making sure that as we
• 10:48
  do these, we're we're doing the right pieces
• 10:50
  to keep us secure,
• 10:51
  to allow the business to to do that
• 10:53
  organizational growth,
• 10:55
  and feel, you know, confident that we're that
• 10:57
  we're putting the right steps in place as
• 10:59
  we do those. We're doing the risk assessments
• 11:01
  on the sites and and bring everything up.
• 11:04
  That makes a lot of sense. And, you
• 11:06
  know, it it's cool to hear, especially the
• 11:08
  way that you can integrate into that whole
• 11:10
  growth process. And when you are bringing on
• 11:12
  new sites to new facilities,
• 11:14
  amidst some of the the larger m and
• 11:16
  a and the integration of those kind of
• 11:17
  things, What are some of the the challenges
• 11:20
  that arise or the things that you have
• 11:21
  to troubleshoot as you're trying to, you know,
• 11:24
  get everything up to speed so you're bringing,
• 11:27
  you know, the new facilities or organizations into
• 11:29
  the fold?
• 11:30
  Yeah. I would say,
• 11:32
  you know, health care is very, very keen
• 11:35
  on on people and relationships.
• 11:37
  And,
• 11:38
  I think that's one of the biggest things
• 11:40
  that you that you have to focus on,
• 11:42
  when you go when you go into these
• 11:44
  events.
• 11:45
  You have organizations that, you know, may have
• 11:48
  may have been there for
• 11:50
  for fifty years, you know, or or or
• 11:52
  more and you've got people that
• 11:54
  might have spent their careers there that they
• 11:57
  know their way of doing things and they
• 11:59
  might have ways of doing things better. You
• 12:02
  know, they might have ways of doing things
• 12:03
  that are different. And it's
• 12:05
  looking at those, validating those and reviewing the
• 12:08
  risk
• 12:09
  and determining, you know, what the next step
• 12:11
  is.
• 12:12
  But, you know, at the end of the
• 12:14
  day,
• 12:15
  you know, there's a it's it's all people
• 12:17
  centric, you know, when you get into that.
• 12:19
  So, you know, like I said, it's very
• 12:21
  easy to to think, oh, I'll just go
• 12:22
  deploy a tool and and and get a
• 12:24
  score,
• 12:25
  but,
• 12:26
  that doesn't tell the whole story. So
• 12:29
  working,
• 12:30
  with with staff, working with, the the departments,
• 12:33
  it's not just I'm not just working with,
• 12:36
  with a IT department or or or security
• 12:40
  department.
• 12:40
  I'm working with with, you know, clinical departments,
• 12:43
  with financial departments,
• 12:45
  to
• 12:46
  make sure that we're
• 12:48
  there
• 12:49
  assisting them getting the right steps that they
• 12:51
  need,
• 12:52
  to
• 12:53
  really to get the next process going,
• 12:55
  you know, and make sure that they're doing
• 12:57
  it, you know, in in a right and
• 12:58
  secure way and that they understand what we're
• 13:01
  there for. The, you know, the last thing
• 13:03
  I want is,
• 13:05
  to be looked at as as a barrier,
• 13:07
  you know, to what the business is trying
• 13:09
  to do. I want to be looked as
• 13:11
  a partner that,
• 13:13
  can come in and help,
• 13:14
  because when you're a barrier, people look to
• 13:16
  go around you,
• 13:17
  versus,
• 13:18
  when you're a partner, people will come to
• 13:20
  you and ask you how they can proceed
• 13:22
  to the next step and get and get
• 13:23
  around a barrier that's in front of them.
• 13:26
  I love that analogy. Greg, thank you so
• 13:28
  much for joining us on the podcast today.
• 13:29
  This has been such a a fun and
• 13:31
  informative conversation.
• 13:32
  I really appreciate your time, and I'm excited
• 13:34
  to see you as well at our annual
• 13:36
  meeting coming up in April. I know you'll
• 13:37
  be speaking on a panel and and definitely
• 13:39
  digging deeper into some of the things we
• 13:40
  talked about today, and so it'll be great
• 13:42
  to get your expertise and to see you
• 13:44
  in person.
• 13:46
  I'm I'm absolutely looking forward to it. Thank
• 13:48
  you for your time again today as well,
• 13:49
  and we appreciate this.