Latest / Identity at the Center / #366 - The Digital Transformation of Healthcare IAM with Shawna Hofer

Transcript

#366 - The Digital Transformation of Healthcare IAM with Shawna Hofer · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. You're great.
0:17
Hey, did you know that we are at the official podcast of ID Pro?
0:22
Yeah, I did know that that was news we made back in WOW May,
0:26
which feels like 7 years ago. But yes, very cool.
0:29
ID pro.org, you know, you and I have been fans of the
0:32
organization, members of the organization for several years.
0:34
And yeah, could be happier about that.
0:36
Yeah, two things I wanted to point out.
0:38
One is for, I'm sure we have a lot of listeners who are new to
0:43
the identity space, maybe not ID Pro members yet.
0:47
I'm not here to like push membership or anything, But one
0:51
thing that they have out there for free for the entire world to
0:54
enjoy is the body of knowledge. I think the easiest way to get
0:58
there is just go to Google, type in ID Pro one word and be OK for
1:03
body of knowledge. It'll be the first thing that
1:06
gets linked out to you. Click on that and my goodness,
1:10
it's just a a bunch of educational material that you
1:14
can kind of dive into for absolutely free now if you are a
1:18
member. The second thing that I wanted
1:20
to talk about is the Slack channel, right?
1:23
I mean, we, we talk about the Slack channel all the time, but
1:26
it's just such a great resource where you can just go out there
1:30
and there's a gig section so you can put in if you have a job and
1:34
you're looking for somebody and you want some help kind of
1:37
recruiting people or vice versa if you're looking for a job,
1:41
kind of putting the putting that out there on the Slack channel.
1:44
But there's all kinds of obviously identity content as
1:48
well where you can post questions or just be a lurker
1:52
and read what's being written about topic, what kind of issues
1:56
people are running into, and you know, the people are happy to
2:00
give on the ID Pro Slack channel.
2:04
So I agree with almost everything you just said.
2:06
The only thing I'll disagree with is heck yeah, we want
2:08
people to go over there and register and become members.
2:10
So yes, please, you know, consider it.
2:13
I think it's a relative bargain. I think it's like 150 bucks a
2:16
year for like an individual membership and the Slack channel
2:19
1 is worth it. You can ask any question you
2:21
want. There's tons of really smart,
2:23
helpful people and people really to help.
2:25
So everything you said, absolutely true.
2:27
ID pro.org, you know, there's links on our homepage.
2:29
I think I even set up like a little fly out banner that says,
2:32
you know, official spot, official podcast for them.
2:34
But yeah, super cool. We've done we've done some, some
2:36
episodes with folks we had like Joni on recently and we we try
2:39
to do like a quarterly update as well.
2:41
Kind of what's going on with ID Pro at large.
2:44
Yeah, there's always a lot going on.
2:46
And you know, in addition, the additional benefit of having
2:50
people on from IT Pro to give the update is they're great
2:53
guests overall. So there are people who are deep
2:56
in the identity space, usually with a lot of experience, and
3:00
they make great guests for the podcast.
3:03
Yeah, they're actually real people doing real IM things, not
3:06
just like, you know. A podcast?
3:08
Yeah. Exactly.
3:10
So it's you know, you know, like Heather is like, you know, the
3:13
is the director of it. And so she's doing identity
3:15
stuff and she's doing a whole bunch of writing and she's got
3:17
her own podcast saying, which is very cool.
3:19
You should go check out as well. But it's actually like real
3:21
world identity people. It's not just like vendors
3:24
pushing product, which I don't think there's actually any of
3:26
that that I've ever seen. I think it's probably kind of a
3:28
hard and fast rule is like, don't promote product just into
3:31
the heart of matters. Kind of like this podcast,
3:33
actually. It's just kind of cool.
3:35
So, yeah, I mean, we see almost all the ID Pro leadership, all
3:40
the conferences and we're doing a bunch of conferences.
3:43
Yeah, been a busy boy. I thought it was going to be
3:46
over when I got back from Vegas after I'd done a verse.
3:49
But I've been doing some more Cyber Risk Alliance events.
3:53
I was in Raleigh a few weeks ago, did a cyber security summit
3:57
there, moderating a panel on incident response.
4:00
I'm going to be doing the same panel moderation in Chicago and
4:03
in Philadelphia in September. So I've got free tickets for
4:05
that if people are interested in coming out and seeing me.
4:07
Hopefully I'll be able to get a good crew from Chicago, which is
4:10
where I'm front to kind of come out and support.
4:11
But they'll be on our our website, idcpodcast.com.
4:14
Just Scroll down a little bit. All of our discount codes are
4:16
there, so that's cool. The relationship with Cyber Risk
4:20
Alliance continues into Ideniverse in DC in November, so
4:25
that'll be fun as well. So, you know, shout out to
4:27
Shirley who's helping make all that possible.
4:29
And then I think maybe we'll be done at the end of the year with
4:33
Gartner in Grapevine, TX in December.
4:36
So we'll have a new identity game show that we'll be, you
4:39
know, debuting later this year, you know, probably as part of
4:42
that. So looking forward to figuring
4:44
out the, the details of how we want to run that.
4:46
So if you're familiar with that, Dennis Globble and the stuff
4:48
that we did with, you know, the authenticate conference few
4:52
years back on identify feud, stuff like that.
4:55
That's, that's the kind of stuff that, you know, we're looking to
4:58
bring a conference, have a little more fun, you know, and,
5:00
and we'll be a little more entertaining.
5:01
Not that knowledge isn't good, but look, we like to have fun
5:05
and we think this is an interesting way to approach it
5:06
too. Yeah, Both CRA and Gartner being
5:10
great partners for us, they've graciously involved us in their
5:14
conferences. Obviously, what you said about
5:17
CRA gives us more opportunity to get out to these regional
5:21
events. I'm not going to be able to make
5:23
all of them. It's just been a challenging
5:25
year in terms of travel, but I'll be kind of more back in the
5:28
game towards the end of the year.
5:31
But it's just in great partnership, great opportunity
5:34
to get out there and meet people.
5:36
I think we're always, you know, people spot us at any of these
5:39
conferences, just come up, shake our hands, do a fist bump,
5:43
whatever you're comfortable with.
5:45
And we'd love to get to meet you and, and just have a
5:48
conversation. Yeah.
5:50
I mean, that's that's it. We put on our golden podcast
5:53
pants just like every other person, you know, So that's how
5:56
we. Roll one leg at a time.
5:58
Exactly. But then we make podcasts.
6:00
That's. Right, we make hit podcasts,
6:02
global podcasts. All right, let's let's pivot
6:05
here to our main star, our main attraction.
6:09
Speaking of real people doing real identity and real security
6:13
things in the real world, I want to welcome to the show Shawna
6:15
Hofer. She's the chief information
6:17
security officer at Saint Luke's Health System in Idaho.
6:21
Welcome, Shawna. Thank you.
6:24
Thank you, Jim and Jeff. Appreciate you inviting me to be
6:28
here with you today. Well, this is a conversation.
6:30
It's been a long time coming. We first met up, I think I feel
6:32
like it was probably a couple months ago and we was like, all
6:34
right, let's get this on the books and we can get things
6:35
going. So I want to give a shout out to
6:37
Matt Franco, who is the person who made the introduction, you
6:39
know, one of my Co workers here at RSM, but definitely,
6:43
definitely want to get in this conversation because I don't
6:46
think Healthcare is a topic that we've really kind of hit too
6:50
hard in our 360 plus episodes that we've done so far.
6:54
We've had a couple conversations in there, but this is an
6:56
opportunity for us to have, you know, real conversation with
6:59
you. Before we get into that though,
7:01
I kind of want to understand your journey, right?
7:03
What's your origin story? How did you, you know, get where
7:07
you are today as a healthcare see?
7:08
So kind of take us through your steps to get there because I
7:10
think a lot of people see, so see, see so as a destination of
7:15
where they would like to take their information security
7:17
career and maybe there's some advice that you can can share
7:19
with that. Sure.
7:21
Yeah, I, I think like many Cesars today, most of us say we
7:26
have a unique journey and becoming Cesar.
7:28
So I would say I'm probably one of those as well.
7:33
I, my undergraduate degree is in accounting.
7:37
I had no idea I would end up in cybersecurity after my
7:42
undergrad. I I got an accounting
7:46
information systems focus for my masters and that is where I
7:51
started to pull in more of the IT space.
7:55
I started my career at Deloitte as a enterprise risk consultant
8:01
at the time really nice name for basically being an IT auditor.
8:07
While I was doing that work for them St.
8:11
Lukes with one of my clients and I got a call from my clients
8:17
here at Saint Luke's asking me to apply for the Identity and
8:21
Access Management Manager role and I kindly said no thank you
8:27
and I my husband pushed me to interview anyway.
8:32
I did. I fell in love with the company.
8:34
My boss is also very persuasive, who is still my boss all these
8:38
years later. So I came in to Saint Luke's
8:41
leading that. I didn't access management team.
8:43
I would say at the time, it was probably more really an access
8:47
management team if you think about kind of how we think about
8:50
identity and access Management Today.
8:52
And I'm kind of more broadly scoped focus.
8:56
I did that for a couple of years and then I ended up taking on
9:00
all of cybersecurity a couple of years later.
9:03
So I've been leading cybersecurity at Saint Luke's
9:06
for about 9 years now. That is such a cool story.
9:11
So I think a lot of people in this space kind of look at like,
9:14
all right, I'm in IM, how do I bridge that gap and go from like
9:17
an IM manager? I was an IM manager as well,
9:19
sort of, you know, working for companies and stuff like that
9:21
before I got into consulting. But I, I, I think this is a
9:26
turning point maybe for the IM industry, is it used to be that
9:30
Seeso's were like firewall and network security type people,
9:35
right? And I am was kind of just kind
9:37
of an afterthought. But I'm kind of hoping and
9:39
maybe, and hopefully you'll agree is like I am can also lead
9:42
to a seeso type role within an organization.
9:44
Obviously, case in point, have you noticed any difference when
9:48
it comes to like people with identity backgrounds and kind of
9:51
their aspirations that maybe you know have a have a broader
9:54
cybersecurity impact maybe as a seeso or other parts of of a
9:57
cybersecurity organization? Yeah, I think, I think people,
10:00
but even just the industry in general, I think the perception
10:06
around identity and access management and I know for me,
10:10
but I think for others too, it's very different than what it used
10:14
to be. You know, and when I think about
10:18
the role that I led and I and I referenced it being very much an
10:21
access management focus, that's just not the only focus for
10:28
identity anymore. And it's, and, and while yes, it
10:32
was still a concept within cybersecurity, the risk
10:37
associated with it is so much higher now.
10:40
So I think when you, when you think about a cybersecurity
10:43
program and how to lead that, you can't do it today without
10:46
having a strong knowledge and understanding of identity and
10:50
access management as a whole. So yeah, I think it, I think
10:53
it's changing significantly. So now that you're the CSO here
10:57
at Saint Luke's, tell me about where you see identity security
11:01
and why is it so important for healthcare?
11:04
And maybe you can give me something that's kind of like
11:06
beyond the obvious, right, Of course, patient data, health
11:09
data, stuff like that. But maybe you can talk to me
11:11
about the conversations that have evolved over time, you
11:14
know, as, as you've had this role and where did identity
11:17
start and where does it one of the conversations you're now
11:19
having with your your your peers and counterparts there?
11:23
Yeah, I think, you know, part of that and and and maybe it is
11:28
part of the obvious, but we're highlighting in my opinion is
11:33
the why. The why is different now.
11:36
The why used to be very much patient data cost of a data
11:42
breach, cost of, you know, medical records example, you
11:48
know, we used to we used to provide education to individuals
11:51
around hey, we really need you to be careful of that phishing
11:54
e-mail because you know, we can get fined by HIPAA if we had a
11:58
breach or what have you. And the conversation today is
12:05
patient lives are at stake and any one of us could, could have
12:12
an impact on our ability to provide safe, efficient and
12:17
effective care to the people in our communities, by the way,
12:19
which is us and our families and, and the people who live
12:22
here. And so it's so much more
12:25
meaningful to people today when you're having a conversation
12:28
around the role that they play and helping keep a health system
12:34
safe. And really what you'll hear
12:35
people say is cyber safety is patient safety.
12:38
Now you're hearing that in the healthcare industry more and
12:41
more. And when you help them
12:44
understand that from an identity perspective, it's that them as
12:49
individuals and the things that they do day in and day out
12:53
certainly have a role to play in that shared responsibility.
13:00
So the conversation's different. It's, it's, it's far more
13:03
interesting. They're more engaged, they feel
13:06
responsible and it makes that conversation and doing the right
13:11
things or making the decisions about risk balance truly a a
13:16
more balanced conversation rather than, you know, security
13:20
trying to push security for security purposes.
13:25
Yeah, Sean, I think that that whole point of view really puts
13:31
a finer point on the importance of what you do.
13:34
And what I thought was really cool about that was, you know,
13:39
it really puts the context around how how impactful it is
13:46
when you make security decisions.
13:49
So it kind of the, the direction I was thinking of asking this
13:54
question was around, you know, traditional.
13:56
I think regardless of the industry, it's the kind of the
14:00
balance has always been user experience versus security.
14:05
There's a trade off, right? You give up 1 to get the other.
14:08
And I think across the board, people are, you know, tired,
14:14
sick and tired of that trade off.
14:16
But there is some truth to it still.
14:19
I think the user experience in healthcare might have a lot to
14:22
do around speed, the speed of transactions.
14:26
So thinking of the the patient room and the ability to go in
14:32
and use computing resources and not be slowed down by security.
14:38
At the same time, you have the bouncing factor of that if
14:40
things aren't secure, problems can happen.
14:43
So you have this balance, but the patient's life is, is at
14:49
stake. So how does that impact what you
14:52
guys do significantly? It's constantly a conversation.
14:57
I'm trying to balance experience and risk.
15:02
But the balance I would say over time has also shifted.
15:05
I recall when we started conversations many years ago
15:09
around, hey, we need to implement multi factor
15:12
authentication. And at the time the, the message
15:15
you would hear from the physicians, regardless of
15:18
whether it was cyber or IT, right?
15:21
You know, around then was the time that we were implementing
15:23
electronic health records and many of them were having to move
15:27
to a more electronic workflow. And so the message that you
15:31
always heard from them were the number of clicks they had in
15:33
their day, right? But the number of clicks was a
15:36
was a measure for them. And so it was a mindset of we
15:41
can't just add clicks. And that that tone and that
15:46
concern has changed to the point now where I think I almost have
15:51
an ingrained assumption that we can't add clicks.
15:54
And yet I have physician leaders who will say to me, we don't
15:58
care. Like if it's more secure, we're
16:00
going to do that, right? And so it's really helped have
16:04
those champions to say the risk tolerance of a few extra clicks
16:09
or one extra click or a few extra seconds is worth it for us
16:13
and, and the rest will follow. And that's, that's really been
16:17
part of it. And I've found I have in my
16:20
identity and access management team just ingrained in them and,
16:25
and I didn't need to do it. They already had it there that
16:28
customer service centric design, right?
16:32
And so they're already very concerned about delivering that
16:37
to the point where sometimes I think we're more risk averse
16:42
from a, from a security perspective even than our
16:44
physician leaders would be. So for us, it's, I think having
16:49
the right leadership, non cybersecurity leadership, our
16:53
physician representatives, our nursing representatives at the
16:56
table to help us lean into that kind of risk tolerance and, and
17:00
risk decision decision making to make sure we're, we're making
17:05
the right call overall. No, and I'm glad you used the
17:07
term risk averse because that was the term I was going to use.
17:12
But I guess traditionally I've been wired to think more
17:16
security equals more risk aversion or vice versa.
17:20
However you want to look at it, they're equal sides of the
17:23
equation. You know, if I make you login
17:27
choice or I make you reset your password every 30 days, that is
17:32
more risk averse. But could you imagine a scenario
17:35
where you're providing patient care and you're in a critical
17:39
situation? You need to see what medications
17:42
this person's on and they're saying your password is expired.
17:46
You've got to go through a password reset.
17:49
And it kind of seems like a ridiculous example, but I've got
17:53
to imagine that like if you're in a change of setting that is
17:57
going to potentially make that impact, you really have to do it
18:01
consciously. You can't just say, all right,
18:03
well, we're just going to push out updates every 14 days and
18:07
not care like what the impact is going to be to our care
18:13
providers. Absolutely.
18:16
And we have to ingrain that and every decision that we make from
18:22
a patching timing to responding to a cybersecurity incident and
18:28
we have this computer, we think it needs to be quarantined right
18:31
away. Pause.
18:32
Let's make sure that that computer isn't tied to someone
18:35
having surgery right now and before we make those kinds of
18:40
decisions. So we have to embed that
18:42
everywhere. And what's really the trade off
18:48
in that is there's risk to both sides.
18:50
As you're, as you pointed out, Jim, there are cyber, there are
18:53
patient safety risks on the other side potentially of the
18:57
cyber risk decisions. And so it it really truly has to
19:00
be an intentional balance. And that's not something that
19:04
just the cyber team alone can make those decisions in a
19:07
vacuum. You know, one thing topic that's
19:11
real hot in identity today is this non human identity machine
19:16
identity concept. And it's really a lot of it ties
19:20
back to the identity of things. It seems like things are
19:25
becoming more connected all the time.
19:27
I know in your space things are ever presently becoming more and
19:32
more connected, which The Avengers are obvious, but the
19:39
security challenges are now multiplied, right?
19:43
Because now you have attackers have more ways to attack those
19:48
systems. And I mean, I'd like to hear
19:51
your input on that. But I, I would think a lot of
19:54
those attacks are based on identity or and credentials
19:59
getting stolen. And that's something that
20:02
constantly you're thinking about.
20:05
Absolutely. The the Internet of Things topic
20:10
is a significant challenge for all of us.
20:13
But in healthcare in particular, we have a lot of legacy
20:19
technical debt and that includes a lot of those IoT devices.
20:24
We have things connected today that already blown my mind.
20:28
I can't imagine the things that are going to be connected five
20:31
years from now. Like we joke about like pretty
20:34
soon we'll have band aids that are connected to the Internet,
20:37
right? Today it's things like
20:39
treadmills and it's, you know, refrigerators that manage the
20:43
temperature. It's camera.
20:45
I mean, all the things already that you can imagine weren't
20:50
necessarily built with security in mind, right?
20:53
These are things that at the time we bought them, they came
20:57
with a default password and a user manual that lives on the
21:01
Internet somewhere and wasn't top of mind to whoever brought
21:06
it in to think about changing that password.
21:08
And so those are things that security teams across the
21:12
healthcare industry are having to grapple with now.
21:16
And not to mention some of the medical devices that we bring
21:20
in, these are $1,000,000 devices and they were built years ago,
21:26
again, not with security in mind.
21:29
And the manufacturers aren't really quick to get them up to
21:33
date because the FDA process takes so long.
21:36
And so we, we can't just replace them.
21:41
So a lot of times you're not dealing with the opportunity to
21:45
secure the device you have. It's how do you mitigate the
21:47
risk associated with that device because you're keeping it for
21:50
the next 10 years, right? So figure out a different way to
21:54
come around those identity challenges because this is just
21:57
the reality that you're going to have to live with.
22:01
So let me bring up a question here as a customer of those
22:05
types of solutions, what kind of, I guess, rigor or imposition
22:11
or request can you make to your vendors to say, look, this just
22:16
isn't secure enough, You know, have something that's stronger
22:20
than a four digit password on your thing, right?
22:23
Like what are some of the things that you can do as a SISO,
22:26
right? And this is made for other
22:26
people listening as well out there is what kind of request
22:30
can you make to your vendors and how do you help them understand?
22:33
Like look, this is a great tool, but it doesn't meet our security
22:35
requirements. Yeah, I think that healthcare
22:38
industry has really rallied to come around that so that each
22:43
seaso isn't having to do it though they do as well.
22:45
So, right, just like every any other industry, we've got our
22:49
our third party intake where we're asking questions, setting
22:53
expectations on design elements that are a lot better now than
22:56
they used to be, right. So there's kind of a, A at least
23:00
plug the whole concept here. But what's great about the
23:04
healthcare industry, we, we have created a collaboration group
23:11
called the Healthcare Sector Coordinating Council.
23:13
It is a, it is a group made-up of both public private industry
23:18
volunteers, which includes health systems like myself,
23:23
pharmaceutical companies, medical device manufacturers and
23:28
and representatives from the government to collaborate on how
23:32
do we collectively raise the bar for healthcare cybersecurity.
23:37
And it's through those relationships and that dialogue
23:40
where medical device manufacturers and C so's are
23:43
having conversations about what are some other reasonable kind
23:47
of guidelines that we're expecting in the design
23:50
contractual requirements that we can collectively hold each other
23:53
to. I mean, these are conversations
23:55
that as an industry we're having.
23:58
And I think the more people who lean into the healthcare sector
24:02
coordinating council will help continue to raise the bar,
24:06
continue to push on maybe even some federal requirements that
24:10
that fall across all of those. And it has to be, I think in my
24:15
mind at a level like that rather than 1222C.
24:18
So is trying to move the needle. We need to do it together.
24:23
I usually have like a coalition of of folks to try and move
24:26
things forward. I want to talk a little bit
24:29
about AI because I don't think we can escape any conversation
24:32
about security at this point or even an episode of this podcast
24:34
without getting into AI at some point here.
24:37
So let's get there. I guess with all of the AI
24:40
things that have already arrived, what is the single
24:44
biggest concern with how you can see that being exploited in in a
24:49
healthcare type of environment? And you know, please don't scare
24:52
me too much 'cause I am, I am frail and feeble and prone to,
24:56
you know, frightened easily. But like one of the things that
24:59
you're already thinking about is like, Oh my gosh, we got to get
25:01
ahead of that. Or conversely, it's like, Oh my
25:04
gosh, that's going to help us out quite a bit 'cause there's
25:06
also a positive side of this as well, too, right?
25:08
There's so much positive opportunity in healthcare.
25:12
I mean, the healthcare industry, we are significantly challenged
25:17
with having the, the right amount of caregivers for our
25:24
communities. There's not enough capacity to
25:27
meet the needs. And so when you think about that
25:30
funnel of caregivers is not also increasing to meet the need.
25:35
The idea of AI is really exciting.
25:38
And our, our health system along with most health systems is, is
25:42
they're ready to rock, right? They're like, hey, AI is going
25:45
to solve our, our availability, our access problems.
25:48
We need to lean into that. And I think when I turn that
25:53
around and ask, OK, knowing that we need to help them meet that
25:58
challenge. We need to enable the growth
26:01
because it's the right thing for the organization and it's the
26:04
right thing for our communities and the people who need access
26:06
to care. It's my concern is, are we
26:10
moving so fast that we don't know the risk that we're
26:13
bringing in? Is my cyber team kind of
26:17
upskilled to the level that they're asking the right
26:19
questions? And then of course, right, like
26:22
that's just the enablement side of AI.
26:25
How are we also still preparing ourselves to combat the threats
26:30
of AI and not to mention all of that in the healthcare industry,
26:35
one with very small margins, which means not significantly
26:39
increasing budget on the cyber side to meet the needs for all
26:44
of those, but having to figure out how to come around that.
26:47
Anyway, I'll give you some examples.
26:49
So Saint Luke's is we, we have built an emerging tech lab here
26:54
at Saint Luke's with a, a partnership with CDW.
26:57
And so we're bringing in kind of what is the art of the possible
27:00
when it comes to future technologies.
27:03
And some of the examples that we have, you know, and, and the way
27:08
that people can think about that is, you know, how can we remove
27:14
having a computer in the patient clinic room?
27:18
Like let's just take it out because it gives space, it
27:21
allows for a better dialogue. There's not a computer in
27:26
between the provider and their patient, which means you need to
27:30
have more listening devices. We call them ambient listening
27:35
devices. And or we looked at things like
27:40
a digital whiteboard, for example.
27:43
Well, bringing identity into that, how do you authenticate
27:47
those devices with the person in the room or the person
27:53
interacting with the whiteboard? Because I can't imagine them
27:57
like typing a username and password.
28:00
They need to be able to authenticate some other way.
28:03
So trying to to imagine how do we enable AI and also imagine
28:12
how we change the way that we've done some traditional
28:15
authentication pieces to be able to, to meet really bad
28:20
experience that we're trying to deliver in the future.
28:23
And this could probably give rise to new form factors for
28:26
identity. You talked there about like the,
28:28
the the whiteboard, right? And I was like, well, how the
28:31
heck do I know who's writing on the whiteboard?
28:33
And I was like, well, what if every doctor or nurse had their
28:36
own pen that was assigned to them?
28:38
And it's tracking what pen wrote on what device, right?
28:42
Or whatever it may be. I don't know if such a thing
28:44
exists, but neither did tablets. Star Trek willed that into
28:47
existence. Yeah.
28:50
But in healthcare, here's here's one of the challenges we also
28:53
face from an identity perspective and that it used to
28:57
be things like we would deal with doctors giving away their
29:03
username and password to their nurses so that they can put in
29:06
their orders for them. Today, we use things like
29:10
badges, right where in the morning you type in your
29:13
username and password and then you can use your badge
29:17
throughout the rest of the day. And now then we're dealing with
29:19
badges floating. And Jeff, I love the idea of a
29:22
pen. I can only imagine where those
29:24
pens. And so, I mean, you're right, we
29:28
do have to imagine differently and also recognize the
29:32
complexities of the environment in which they're in that are
29:35
going to make some of that imagining a little bit
29:38
challenging. Shawna, I'm trying, I'm trying
29:41
to make it better. But.
29:42
Like, these are the conversations like we have to
29:44
have, like, all right, well, yeah, of course it's gonna be
29:45
bad sharing. I mean, I used to work in the
29:47
logistics part of IEM, shipping out those stupid RSA tokens, and
29:50
that was a real nightmare. So, you know, anything where a
29:53
person has to have possession of something involves logistics.
29:56
And that is just a real operational headache if you're
30:00
not prepared for it. I want to go back to something
30:02
you said earlier, and this was about upskilling around AI.
30:07
And I think this is a question that I would like to get in more
30:10
with you here is, look, everyone's talked about AI and I
30:14
think there's a, a genuine concern of AI is going to take
30:17
people's jobs. How do people, especially in the
30:21
security space, identity space that we're talking to here,
30:24
right? How?
30:25
What are the types of skills that they should be learning to
30:28
try and stay ahead of that? I think and in my opinion, you
30:33
know, I, I hope what people can take away from that concern of
30:40
I'm going to lose my job is I'm not going to lose having a job.
30:47
I might lose what I do today, right?
30:49
Like, maybe I don't do those manual monotonous tasks that
30:54
I've been doing day-to-day. Maybe I get to offload that and
30:59
I really can do higher level work that I didn't ever have
31:04
time to get to before. And I think if people can
31:08
embrace that change, which can be very challenging, but if they
31:16
can, I think the opportunity is there for people to grow in ways
31:20
they probably couldn't imagine before.
31:23
You know, I think in the identity space, there's so much
31:27
opportunity to dig into risky behaviors and things that are
31:32
happening in the organization and people asking questions and
31:36
doing things about that. But maybe that wasn't their role
31:38
before. But if they had the capacity to
31:40
do it and maybe the interest, I think there, there could be a
31:46
lot more that we can accomplish if people will take that on.
31:51
I don't see it as any different as other kind of shifting
31:53
technologies, right? The Internet, you know, everyone
31:56
carrying a phone now has like all the information in the
31:58
world. I mean, heck, YouTube has all
32:00
the instruction manuals you could ever possibly want for
32:02
anything and more being built all the time.
32:05
The the idea of there will I I certainly think that there will
32:09
be some disposition of kind of work.
32:12
But when I've gone through this process, IGA, identity,
32:15
governors, administration, I remember deploying that, you
32:18
know, several years ago, decades ago now, I guess at this point,
32:21
and there was a real fear, oh, that's going to take my job,
32:23
right? Because I'm used to creating
32:25
Lotus Notes IDs and RACF accounts and Active Directory,
32:28
right? And all this other stuff.
32:29
But that's not what actually happened.
32:31
What happened was exactly what you just said.
32:34
My team went from being administrators to being
32:38
analysts. And it was a different mindset,
32:41
a different shift in how we approach the job.
32:43
You know, the people who were more interested in just kind of
32:45
stamping up the next widget, you know, definitely struggle with
32:48
it more. But the people who are actually
32:49
interested in learning more about security and the things
32:52
that we're doing that I am actually now had time instead of
32:55
having to create the 80th Florida's notes account that
32:57
they had to do that day or ticket that came in.
33:00
So I definitely agree with that sentiment of like, OK, stay on
33:03
top of it and just think about how much more efficient all of
33:05
us are with even just the basic tools that are out now.
33:07
And this is the worst it will ever be.
33:09
It is continually getting better, scarily good.
33:12
Almost every day there's some, you know, some sort of
33:15
improvement. It's like, Oh my gosh, OK, now I
33:17
can do that. OK, let's figure it out.
33:21
That's right. And but I think it really is a
33:22
mindset, right It, I think there are plenty of people today who
33:28
have and are embracing that mindset.
33:30
And then I think there's an A subset who have to, who have to
33:34
and will turn that corner. And then there might be some
33:38
people who don't. And you know, of course, that's,
33:40
that's the group that I worry about the most.
33:42
But the reality is, if you can, you can embrace it.
33:47
And I think really it's better for you as well as the
33:51
organization and really kind of all of us at a whole.
33:56
I do think there's some caveats to that, though.
33:58
I think that, you know, we, one of my concerns from a sea soap
34:03
perspective is, you know, we have to continue to be resilient
34:08
and then healthcare that that means we always assume as we're
34:12
bringing in new technology and even just within our own
34:15
network, we have to assume the worst will happen and we need to
34:19
be prepared for when that happens.
34:24
And so we spend a lot of time talking about resiliency and
34:27
investing in things like, well, what happens if we do have a
34:30
major cyber attack and what's our downtime for that?
34:34
And I want people to think about AI with the same resiliency
34:38
mindset of how do we operate when it's not there, right?
34:43
Making sure that people are maintaining that level of
34:47
understanding and cognitive thinking capabilities so that in
34:51
the event it isn't there for them at the moment, they need
34:54
it. Like we can still get through
34:56
the things that we need to do, albeit differently, slower, you
35:01
name it. But the skills to to do that are
35:05
still important. OK, so I don't want to be the
35:09
rain on the parade guy, but I think the positive message to
35:14
people ought to be, well, you're right, AI could take your job.
35:19
You better learn AI because there's some people who are
35:23
going to still be needed. Here's the reality.
35:26
It's like, Jeff, I know you are one of the biggest AI bulls.
35:30
I know you just compared AI to IGA.
35:35
When we get to super intelligent AII mean it's all bets are off.
35:41
I mean, it's going to be able to do things that we can't even
35:44
comprehend right now. So 5-10 years down the road,
35:47
like you better really adopt AI and know how to get the job done
35:53
with AI as it is today and keep up with it.
35:56
We're, we're entering a new phase of this kind of work that
36:00
we do. People are still going to be
36:02
required for some time to come. But I think like any kind of
36:07
manual tasks or implementing software, writing software, I
36:13
don't think that that's going to be a job 510 years from now.
36:17
I think it's going to implement itself.
36:20
There's lots of jobs that'll change, right?
36:21
I think we see like, you know, development.
36:23
We've been teaching and telling people for the last decade, hey,
36:26
go to school and learn to code and you'll always have a job.
36:28
Well, guess what? Now code is developing stuff.
36:31
And I'm building Python apps in my spare time on the weekends
36:33
just to try out AII don't know the first thing about Python,
36:36
but I've got functioning applications.
36:38
So, you know, there's, there's that there's, there's just so
36:42
when I talked about the IGA shift, I just thought of it as
36:45
that same mindset of, OK, it's automation AI the other day is a
36:49
lot of it is automation. It's a repetitive task.
36:51
It's searching the Internet, it's surfacing information, all
36:54
stuff that a human can do. And I think Shawn out to your
36:57
point, what we can't have happen, and this is kind of over
36:59
the Idiocracy moment, it's like, well, it has ultra lights.
37:01
It's OK. Well, you know, we still have to
37:03
know our content. We have to know our subjects.
37:06
We have to be able to still operate in the absence of AI
37:08
because I can't imagine an acceptable answer would be, hey,
37:12
I'm here in the, you know, the emergency room and well, we were
37:16
going to operate and save your life, but we can't because the
37:18
computer's down, you know, or the A is isn't working.
37:21
Like that's not going to be acceptable.
37:22
So translate that to any number of, you know, business
37:25
applications, even just outside of healthcare, and there is
37:28
still, you know, room for humans to be part of this.
37:31
But I think it does challenge us to stay on top of it because you
37:35
always need to Fact Check it and, and things like that.
37:37
I think that leads me to my, my hopefully.
37:40
I think my final question for now on AI for you, Shawna, is at
37:45
what point do you as a CSO trust AI to make decisions about your
37:52
security infrastructure? Because I think this is an area
37:55
that a lot of security vendors are going is they're saying,
37:57
hey, guess what? Our, our firewall, our access
38:00
management platform is now 100%, you know, more AI and it's zero
38:04
trust and blah, blah, blah, right, all the buzz terms.
38:06
But one of the things we're trying to do is really set it up
38:09
in a way where the AI is making the decisions on the
38:12
configurations of your security tools.
38:14
So I'm going to ask you as a Siso, when do you start to
38:20
accept that that is a reality and establish that trust that
38:24
you are OK with that kind of thing?
38:27
Well, we don't trust our technology today and we don't
38:33
even trust today. We have incredible partners and
38:40
we're very limited in what we'll let them do, mostly because we
38:46
are in healthcare and lives are tied to those decisions.
38:49
And so I think for us to get there, we would first of all
38:54
have to have incredible data, Like the data needs to be spot
38:58
on that would tell the AI agent whatever is making decisions,
39:08
the risk associated with those decisions.
39:11
I don't think that I know for a fact we don't have that data
39:16
readily available today. It takes a human going and doing
39:19
that digging in order for us to get there.
39:21
So the when answer is, I can't give you a timeline, but I can
39:26
tell you that I would have to put significant effort and
39:30
investment into making sure that the data quality was good enough
39:36
to even start the dialogue. So that that for us would be a,
39:40
a big part of that. And not to mention, you know, I,
39:43
I, I talk about the data, but it's, it's the, the people.
39:49
I mean, we, we are people who everyone who works in
39:53
healthcare, at least here at Saint Luke's, we care, we care
39:57
about the mission, we care about the people, which sometimes
40:01
translates to, yeah, we don't trust you and we don't trust you
40:05
because, you know, that's, that's our lives on the line.
40:10
And so I think there's a mindset shit too that would need to
40:14
happen also with time gaining trust.
40:17
And just using AI, right, even before we allow it to make
40:21
decisions. But hopefully, you know, there's
40:23
some progression to that. And are there some lower risk
40:25
things we can start practicing with, start really kind of
40:30
understanding where, where can we start piloting it, accepting
40:35
the outcomes, right? Where can we get to a point
40:38
where humans maybe aren't always in the loop?
40:41
Not on the healthcare side, of course, but really more on the
40:45
cybersecurity side. I have to to work on what those
40:49
use cases might be. But in terms of those bigger
40:53
decisions, the data just isn't there yet.
40:57
So Shawna, one of the things that Jeff kicked off the whole
41:01
conversation with was you starting out or you being a
41:06
manager of budget and access management.
41:08
Now you're the CSO. One thing that I can tell in
41:12
this dialogue that we've had over the past half hour was you,
41:17
like other Citos, talk about risk.
41:19
You learn the language of risk, which I think translates what
41:23
you do into business speak that the senior people understand,
41:28
like here's the risk, cybersecurity risk and how it
41:32
affects the organization. It's gonna be a tough question.
41:36
How did you learn that? What is your recommendation for,
41:40
you know, upwardly mobile people in the identity access
41:44
management arena to learn to speak the language of risk?
41:48
I learned the language of risk and accounting.
41:51
You know, I think when I joined the cybersecurity team and
41:56
certainly when I started leading the cybersecurity team, I looked
41:59
at my background, my lack of technical background to be
42:04
specific, as a complete downside to what I had to offer.
42:09
And it took me years to realize it was actually my strength.
42:13
It took me a long time to realize that that ability I had
42:17
to speak the business language was exactly what I needed to
42:22
lead this team. And for those who don't have the
42:26
opportunity right to, to start an accounting, because most
42:29
today, they start right in cyber, right?
42:31
That's, I think the difference in what we see in Cisos today
42:34
versus maybe what we'll see in Cisos in the future is that many
42:38
of them will start their careers in cyber.
42:41
They knew it's where they wanted to be.
42:42
It's where they'll grow up. I think there's so much benefit
42:45
not always having a career in cyber.
42:48
I think having experience in other places in the organization
42:52
and the other industries is significantly helpful to be able
42:57
to speak business, like not only living in cyber, living outside
43:01
of cyber #1 like advice of learning to speak business.
43:06
But then beyond that, I think it has to be really an intentional
43:09
effort. And for us and healthcare, it's,
43:13
it's going and experiencing what our caregivers are experiencing,
43:20
right? It's putting ourselves in those
43:21
shoes to make sure that you understand the challenges that
43:26
they face, the decision that we potentially are making that
43:30
impact their workflows. You can't do that without being
43:33
in their shoes. And it means going and being
43:35
physically present with them to get that.
43:38
So those would be some of the recommendations I would make,
43:42
but they they have to be intentional.
43:44
So I want to take that and kind of turn it into making the
43:49
business case for identity. So a lot of folks who are
43:53
listening, identity practitioners are needing to
43:56
make the business case. I always learned there are three
43:58
ways to speak the language of business making a business case.
44:02
It was increased revenues, reduced cost or managed or
44:07
reduced risk. Usually cybersecurity leaves you
44:11
only with that third option. Is that, does that ring true to
44:14
you or or how what are the major factors when you're making a
44:18
business case? I think it depends on the
44:22
industry. Like here in here in healthcare,
44:26
the language that we speak in terms of risk often like our
44:30
number one always is patient safety, right?
44:34
So to have a conversation and to speak business in a way that
44:39
physicians, nurses understand, it's you need to communicate in
44:45
the way in which matters to them.
44:47
And for them it's patient safety.
44:49
If I'm talking to the CFO, certainly the CFO will talk in
44:52
terms of revenue and cost. But at that CFO has the same
44:56
language mindset I do. But at the end of the day, we're
44:59
a health system and we're here to keep people safe and keep
45:02
them healthy. So it's it's that that is a
45:04
universal language to us. It's not just dollars, it's it's
45:08
what matters to our core mission, which is taking care of
45:12
people. So I think you have to
45:13
understand that, right? You have to understand what is
45:15
your industry, what matters. Dollars are universal across all
45:19
of them and certainly is helpful.
45:21
I don't know that risk is, I'll be honest with you, I think that
45:24
there's a level of maturity that organizations have to have to be
45:28
able to have conversations about risk and what that means in an
45:32
enterprise level. You can try, but it doesn't
45:36
always resonate. And so I think part of that is
45:40
just having that understanding of your organization and the
45:44
industry that you're in in order to be able to facilitate those
45:49
conversations. So you're probably prioritizing
45:52
different budgets and asks, right, for different security
45:56
paraphernalia, we'll call it. Take me to the mind of your sort
46:00
of internal throughout process because everyone's fighting for
46:02
money. And so how do you say, OK, well,
46:05
here's the projects we're going to fund this year based on this
46:07
budget we're expected to have. And of course, as soon as you
46:10
put it down, right, things will change in the real world and you
46:11
have to adjust. But that initial thought process
46:13
of, OK, is this the year of MFA? We're going to get it done.
46:17
Is this the year of Pam? Is this the year of Nope, We've
46:19
got to shift some identity spends for projects to some
46:23
other part of security. Talk to you about how you go
46:26
through that sort of that that mental gymnastic routine to try
46:28
and juggle all that. Yeah.
46:31
I, I, I think for us, certainly we would, we would take into
46:36
account everything that we're aware of.
46:40
To your point, Jack, in this moment in time, knowing that
46:43
will change, right. What are the, what are the
46:45
findings we have, What are the threats that we're facing?
46:50
And then really compare that with what's the value of the
46:56
investment. I think is is really important
46:59
because we can go buy a bunch of tools or one, do I have the
47:04
staff to fully implement and take advantage of that
47:07
technology? And two, is it even going to
47:11
move the needle as much as some of the work that might not
47:16
require investment in new technology, but really just
47:19
clean up of existing technology, really like the non sexy work,
47:23
but maybe that moves the needle further.
47:24
And in order to do that assessment, I think a big part
47:27
of that is what are the risks that we're facing?
47:30
What are the attack vectors that we're seeing?
47:33
And then what's our what's our vulnerability to those within
47:37
Saint Luke's? And as you guys know, like
47:40
social engineering is one of the biggest threats overall.
47:44
You know, you that is not Healthcare is certainly
47:48
certainly a big, a big part of that.
47:50
And so it's asking ourselves the question if, if one of the
47:52
things we're going to continue to focus on is social
47:55
engineering is the biggest bang for our buck.
47:58
Bringing in, I mean, MFA is already there.
48:01
It's, it's a non negotiable, you know, but bringing in better
48:05
identity verification technology or can we do better identity
48:10
verification processes, right for lower dollars or can we rely
48:16
on education and awareness? So it's, it's really being
48:20
intentional about bringing the risk to an acceptable level for
48:25
the investment and knowing that that decision might be good
48:32
enough for now and maybe you revisit in another quarter
48:35
because the threat vector has changed or maybe you need to
48:38
make another decision around that.
48:39
But for us, we have to we have to balance all of those things.
48:45
And here in healthcare, one of our strengths is that we have
48:51
really caring people who, who find their way into the
48:54
healthcare industry, which also means they're very vulnerable to
48:58
things like, hey, can you help me?
49:00
I'm a student and I would really love you to look at my resume.
49:04
Or hey, like those typical fishing type of things that just
49:08
like tug on people's heartstrings.
49:10
Like healthcare people really, you know, wanna help and are,
49:16
are hugely vulnerable. And so understanding what is the
49:23
best way to combat that and taking a taking a look at it's a
49:28
technology, is it process or is it really just training the
49:33
people, for example? I love that answer and I I
49:37
really like that you talked about non-technical things too,
49:39
because you got things like, you know, hygiene is what I'll call
49:42
it, cleaning up your Active Directory, cleaning up things
49:44
like that. And I'll disagree.
49:46
I think anything to do with I am a sexy, maybe not sexier than
49:50
other things, but still sexy. Keeping a nice tight, tidy
49:55
Active Directory or you know, universal directory, or you
49:59
know, name your product, right? Whatever it is.
50:01
That is all stuff that pays you, pays you back over time because
50:05
it reduces license counts, it reduces risk for accounts right?
50:08
Being compromised if you ever decide to shift to some other
50:12
product now you've actually got a clean environment or cleaner
50:15
environment than if you hadn't done that clean up.
50:17
So I think that is an often overlooked part of running an
50:20
IAM program is hygiene. And so I I'm really happy that
50:24
you mentioned that. So kudos.
50:26
Yeah, but but Jeff, keeping out of a tight act of character is
50:30
not sexy. I'm sorry.
50:33
We just. Disagree.
50:34
Disagreement is great, but what we found we, we brought in one
50:40
of our interns recently to help us with some of this Active
50:43
Directory hygiene, Jeff, that you would enjoy.
50:47
But what we found, we assumed right.
50:50
Oh, this is just really like not fun work.
50:54
He's out there trying to find owners for groups and whatever
50:57
he came in with the lens of this is like investigation work and
51:00
this is really cool. Like he's having a great time
51:02
with it. So you're right.
51:04
I think it, it can be really interesting and really cool.
51:10
At the end of the day, it it moves the needle a ton right in,
51:14
in that, that, that clean hygiene.
51:17
It's a lot of work. But for us, it's been a really
51:20
good source of investment of time and resources because we're
51:25
not having to necessarily buy new technology and yet we are
51:29
significantly reducing risk. Hey, what better way to meet the
51:33
business and form relationships than try to find out?
51:37
Hey, Jim, do you know who this account belongs to?
51:38
Is this yours right now? You're out there, you're meeting
51:41
people and you know you're you're the face of I am who
51:44
knows you become the mayor of I am town, whatever that looks
51:46
like for your organization. I want to ask you one final
51:49
question here and this is kind of to close things out is let's
51:52
put on our prognosticator hat and say, OK, so what's coming up
51:56
in the next three to five years? Is there an emergency emerging
51:59
challenge on some sort of technology or some sort of, you
52:03
know, business reality especially and want to hear
52:06
about the healthcare side, is that you think is going to be
52:08
very impactful? Is it AI or is it something else
52:11
or is it a combination of things that that you're kind of
52:13
thinking about? Oh, we got to.
52:15
We got to prepare for that. Yeah, I think AI will be a big
52:19
part of whatever that looks like.
52:21
I think for us it's a combination of how do you
52:26
imagine delivering healthcare in ways we didn't before?
52:30
For example, you know, one of the things that we're looking at
52:33
today is how do you deliver an inpatient or hospital like level
52:40
of care in somebody's home, right?
52:42
And, and that helps us reduce the number of people in beds in
52:48
our hospital. It helps reduce the cost of
52:50
care. And ultimately there's better
52:52
outcomes for patients in the data if they're at home rather
52:56
than if they're in the hospital. And so, but today that's still
53:00
pretty resource intensive and nurses or MAS or others having
53:07
to go to the patient's home. So imagine kind of really the
53:11
future of that if you can in bed the right type of technology
53:15
into the patient's home and have kind of the virtual care options
53:21
monitoring that patient more closely or or really helping
53:24
kind of deliver that care. I think our ability to expand
53:29
the capacity of care really is going to completely be limited
53:35
on what we can imagine from a technology augmentation
53:38
standpoint. AI will be a huge part of that.
53:41
The, the devices of course will be a huge part of that.
53:44
And then as we mentioned earlier, the identity components
53:48
and being able to enable that in a secure way of course is going
53:51
to be huge as well. So for us, it's, it'll always
53:55
come back to how do we expand safely our capacity for care and
54:03
provide a better physician experience, nurse experience and
54:09
and ultimately patient experience.
54:11
I think all of that is, is to come.
54:15
I think it's really exciting to imagine and I just want to make
54:19
sure from a security perspective, we're there to
54:21
enable it. That sounds like a whole lot of
54:24
identity management coming down with devices in the field and
54:28
you know, non human identities, machine identities, whatever you
54:30
want to call those, plus the actual people part of it.
54:33
I really appreciate appreciate you taking the time with us
54:35
here. I do want to ask you one final
54:38
super relevant question as we end here on a lighter note.
54:41
If you are a potato, how would you be prepared?
54:44
I love this question and you, you mentioned Jeff in your
54:48
intro. I'm in Idaho, right?
54:50
I and everyone knows Idaho is known for Idaho potatoes.
54:54
So I think this is a particularly relevant question
54:56
for me. What I didn't share in my
54:59
background is that I grew up my my grandparents have owned a
55:06
family traditional diner for 50 years now.
55:12
I grew up working in a diner and the the things that I think
55:18
about in working there and craving the food from there are
55:22
homemade French fries. My like fresh homemade with fry
55:27
sauce. I don't know if you guys do fry
55:29
sauce, but fry sauce is a big thing here.
55:32
So if I were a potato and I would want to be prepared in the
55:37
form of homemade French fries because I think about the
55:40
feeling I have in wanting, you know, just good, like soul food
55:46
or food that makes me feel connected with people and
55:51
memories is homemade French fries.
55:53
See now, Shawna, I knew I liked you.
55:55
I knew we had a connection here because you mentioned, you know,
55:58
the food service background. I spent 10 years in food
56:01
service. So everything's listening to
56:03
serving, bartending, managing even before actually a little
56:06
bit parallel before I moved into IT.
56:07
But so I knew and I think everybody should have to be a
56:11
server at some point and and and learn, you know, how to interact
56:16
with people. But that is such an interesting
56:18
answer. So describe to me the home
56:20
French fry. Is it a thick cut?
56:22
Are we talking like tater tots? Like help me understand here.
56:26
You know, the French fry experience that you're
56:28
describing. Yeah, I think it's, it's not so
56:32
thick that it's considered a steak fry, but it's not your
56:36
like really thin fast food French fries.
56:41
It's greasy, right. Like they're literally they're
56:45
they're chopping them. They store them in buckets all
56:48
day in water so that when you grab them, you drop them in the
56:51
fryer. They come out like just covered
56:53
in grease and so. What's a health food?
56:58
It's so healthy, which is why it tastes so good and can't have it
57:03
all the time. But but it it, it's just, it's
57:07
what the food I think brings back in terms of how it makes
57:12
you feel in the memories for me is that's where I would where
57:16
I'd land. So I've, we've asked this
57:19
question a few different times and my answer in the past has
57:22
been potatoes au gratin. And I tip.
57:24
I'll stay with that. Look, I, I don't discriminate.
57:25
I'll eat pretty much any potato as long as there's no sour cream
57:28
on it. That's not my jam.
57:29
But potatoes at large are good. Jim, how would you like to be
57:34
prepared as a potato? OK, let me first start by saying
57:38
I love mashed potatoes. I love baked potatoes.
57:41
I love twice baked potatoes. I love fries.
57:46
I would not want to be have my skin peeled off and thrown in
57:50
boiling water. I would not want to be shoved in
57:53
an oven for an hour, and I would not want to be thrown in boiling
57:57
grease. So I wouldn't like to be
57:59
prepared in any of those ways. But I'd like to be as forgotten
58:03
about in a dark closet. And I like to have those little
58:06
green things growing out of me. And someone would look at me
58:09
like, oh, that's gross. I throw me in the compost pile
58:12
and let me just sprout other potatoes.
58:17
Can I ask you a question, Jen? Yes.
58:21
I have a theory. When you were growing up.
58:25
So, Jeff, you already confessed you were you you served in
58:28
restaurants. You've already answered my
58:30
question. Jeff, when you were growing up
58:32
or Jen, when you were growing up, did you work in restaurants,
58:36
customer service, or did you mow lawns?
58:40
No. I worked at a my first job was
58:42
at a gas station, gas station. So customer service facing
58:46
that's all right. Maybe you've had enough of that
58:48
customer service. I had this theory than IT.
58:52
Most of us either worked in the customer service industry and
58:56
those tend to be our more external or outgoing kind of
59:01
folks. And all of the introverts did
59:03
something like mowing lawns and that it's how you tell the
59:07
difference. What did you do as a kid growing
59:09
up at what was the job? I think we might have to add
59:12
that question into our repertoire.
59:14
We always start all of our episodes with our first time
59:16
guests as like, how did you get into the space?
59:18
And time to time we'll ask the potato question.
59:20
So the potato question is interesting to me and I and I
59:22
promised you I would share this when I, when I asked it, we're
59:24
kind of prepping and I didn't give you a whole lot of preface
59:26
other than here's what I'm going to ask you.
59:28
Just, you know, be prepared. I've seen a bunch of different
59:32
answers around this. The most common answer is the
59:35
how I would like to be prepared is what I enjoy the most from a
59:40
a deliciousness standpoint, right?
59:41
It's it's the story behind it is what I think tastes good.
59:44
Or, you know, the memories that you've got right you that you
59:46
kind of shared. The other part of that is the
59:50
people who think of the pain associated with how that
59:55
prepare, you know, for preparation is done.
59:56
So Jim talked about, yeah, like, you know, doesn't want to be cut
59:59
up, doesn't want to go into an oven, right, dropped into a deep
1:00:02
fryer. And so he's not even thinking
1:00:04
about the positive aspects or the joy that he could bring to
1:00:07
somebody as a well prepared potato.
1:00:09
He's thinking about it. And he's not the only one,
1:00:11
right? And that's, I've asked this
1:00:13
question so many times. We actually, this came up at
1:00:16
Gartner last year as part of one of our sessions.
1:00:18
You know, Rebecca asked us that question.
1:00:20
I was like, this is a question we asked and so kind of caught.
1:00:23
Thinking what I've heard also is a little bit of a spin on Jim's
1:00:27
answer, which he added the sprouting thing and throwing it
1:00:31
into like a compost pile and making other potatoes.
1:00:33
I asked my wife this and she came up with a well, I'd want to
1:00:36
be planted so I could be more potatoes.
1:00:39
And so now there's like a third thing like, OK, well, I look
1:00:42
like an idiot. Like, of course, you know, you
1:00:43
want to like be helpful for other people.
1:00:45
But so there was the, yeah, the answer of what do you like the
1:00:50
answer of, well, I don't want to be, you know, killed essentially
1:00:54
in this brutal fashion. And then a third answer, which
1:00:56
is the I'll call the nurturing, life giving life, you know,
1:01:00
caregiving type of answer where it's like, OK, yes, plant me and
1:01:04
make me more potatoes. And I noticed Jim snuck that
1:01:06
last part in there that was not there originally.
1:01:08
Jim, when you, when I first asked you this like maybe I
1:01:10
don't know, a year and a half or two years or however long it was
1:01:12
three years ago? Yeah, I didn't realize I was on
1:01:15
the psychology chair. I just Yeah, you're right.
1:01:19
My, my, my main goal is not to be thrown in boiling oil or in a
1:01:25
500° oven. You're right.
1:01:28
That is my main goal. And.
1:01:31
And people feel so good, right? Like there's just not my role on
1:01:35
the show, Sean. My, my role on the show is to
1:01:39
bring a dose of reality. At least that's what I see
1:01:42
today. All right, well.
1:01:45
Shawna, I hope to meet up in person at some point.
1:01:48
And you know, we can. I, I, we didn't even get to the
1:01:51
fry sauce. The only fry sauce that I'm
1:01:52
aware of would be like ketchup. And you know, Mayo is big in
1:01:56
Europe. I definitely don't subscribe to
1:01:57
that idea, but I would like to understand more about the whole
1:02:01
fry sauce fry sauce concept. At some point those things
1:02:03
brought together fry sauce and mayonnaise mixed together mixed
1:02:07
fry sauce. I'll try anything once.
1:02:10
That's about as far as I'll. Go ahead.
1:02:11
I want to hear. I want to hear what you think.
1:02:14
All right, we'll go ahead and wrap it up this week for
1:02:16
everyone here. I'll have a link to your
1:02:18
LinkedIn profile in our show notes.
1:02:19
So if people have, you know, questions about healthcare, I am
1:02:22
security fry. Soft suggestions.
1:02:25
I would say please don't send her resumes to review because
1:02:27
she probably won't click on that link, which as she shouldn't,
1:02:31
but I'll have that in our show notes.
1:02:32
And then yeah, so with for us, you know, make sure that's you,
1:02:36
you like subscribe, we're on the web, IDC, podcast.com.
1:02:38
Don't forget all of our discount codes are on that home page.
1:02:41
There won't make it real easy for people.
1:02:43
And appreciate everyone watching and or listening.
1:02:46
And we'll talk with you all in the next one.
1:02:50
You've been listening to Identity at the Center.
1:02:54
We hope you've enjoyed the show. Make sure to like, rate and
1:02:58
review, and we'll be back soon. But in the meantime, hit the
1:03:02
website at identity@thecenter.com.
1:03:06
See you next time on Identity at the Center.