Latest / Becker’s Healthcare Digital Health + Health IT / Aaron Weismann, Chief Information Security Officer at Main Line Health

Transcript

Aaron Weismann, Chief Information Security Officer at Main Line Health · Becker’s Healthcare Digital Health + Health IT

• 0:00
  - Welcome to Becker Healthcare Podcast, made
• 0:01
  for the people who power US healthcare.
• 0:03
  I am Molly Gamble at Becker's.
• 0:05
  Today I'm delighted to spend time with Erin Wiseman,
• 0:07
  chief Information Security Officer with Mainline Health.
• 0:11
  Erin, welcome back to the podcast.
• 0:13
  Thank you for being our guest. Again, h how are you today?
• 0:16
  And where does the podcast find you?
• 0:19
  - Yeah, thank you for having me. I'm doing fantastic today.
• 0:22
  Thank you for asking. And I am in sunny Philadelphia.
• 0:27
  - Terrific. And Mainline has a presence there.
• 0:29
  For listeners, Erin, who could use a refresher again on
• 0:33
  Mainline Health, can you share a bit about the system just
• 0:36
  for the listeners who would like
• 0:37
  to get reacquainted with it?
• 0:40
  - Yeah. We're a community health system in the
• 0:43
  Philadelphia suburbs.
• 0:44
  We serve the Tri-state area.
• 0:47
  We're about five hospitals, a number
• 0:49
  of different ambulatory sites,
• 0:50
  clinical practices, et cetera.
• 0:52
  - Okay, great. Um,
• 0:54
  and Aaron, just guess up to speed on the year
• 0:56
  so far from you, where are you investing the bulk
• 0:59
  of your time and energy as of late in your work?
• 1:04
  - Yeah, so in information security, a lot
• 1:06
  of my time investment is in mitigating ransomware
• 1:10
  and the impact of the ransomware attacks, right?
• 1:13
  So all of the downstream cascading effects that we see
• 1:17
  as a result of ransomware.
• 1:19
  You know, being able to prepare for downtime, thinking about
• 1:22
  how we're handling third parties, what we're going to do
• 1:25
  for system availability, et cetera.
• 1:27
  Uh, really top of mind for me.
• 1:31
  - Uh, it's so far this year, I mean,
• 1:33
  we have really seen information security.
• 1:35
  It has just been escalating to the top
• 1:37
  of the fold in the national conversation
• 1:40
  and also especially in healthcare, uh, for the leaders
• 1:44
  who have been and remain really close to this work.
• 1:48
  What, what skill sets
• 1:49
  or traits are you seeing as having renewed value right now
• 1:53
  for, for the CISO role?
• 1:55
  I
• 1:57
  - Think there are a few.
• 1:58
  One is definitely strategic planning
• 2:00
  and, you know, being able
• 2:01
  to drive a successful security vision, we're not really able
• 2:06
  to actively mitigate threats so much as react
• 2:08
  to them very, very quickly.
• 2:09
  And I think some of the more successful CISOs are able to do
• 2:13
  that at scale, continually
• 2:15
  and keep their organization safe as long as they can.
• 2:18
  There's also this element to being able to plan for
• 2:20
  that downtime and figuring out, okay,
• 2:22
  once our organization's hit with ransomware,
• 2:25
  how do I make sure I promote my confidence, you know,
• 2:28
  in my ability to respond to
• 2:30
  that throughout the organization.
• 2:32
  And I think a lot of that's being driven by, uh,
• 2:34
  another competency, which is being able
• 2:36
  to drive collaboration across the organization
• 2:39
  and really being able to explain security concepts to
• 2:44
  relative lay people when it comes to technology,
• 2:46
  and really be able to convince people, okay,
• 2:48
  this is a patient safety and a patient dignity issue.
• 2:50
  It's not just a technology issue. Mm-Hmm,
• 2:53
  - .
• 2:54
  Mm-Hmm. . I mean, it's,
• 2:56
  I that makes a lot of sense.
• 2:57
  It's not the ability to only prevent you,
• 3:00
  you mentioned mitigation, but also reaction
• 3:03
  and reacting quickly and reporting on these attacks.
• 3:06
  It's, you know, it's interesting
• 3:07
  because understandably information can be slow
• 3:10
  to be released and for a good reason.
• 3:12
  But do you feel Aaron, like you have a good community
• 3:15
  and there's good guidance out there about if a ransomware
• 3:19
  were attack were to occur, how, how best to respond?
• 3:22
  Is there more community there among the health system
• 3:26
  players than there was maybe five years ago when this type
• 3:29
  of attack was still, you know, relatively novel?
• 3:33
  - Yeah, I think there's a lot more, what I
• 3:38
  consider shared therapy sessions around it, you know,
• 3:40
  where folks come together
• 3:42
  and talk about this horrible shared plight, right?
• 3:45
  You know, the, the threat of ransomware attack
• 3:48
  and how health systems are organizing around that.
• 3:51
  And then healthcare fortunately, has had through hipaa, uh,
• 3:55
  this longstanding obligation to report healthcare breaches,
• 3:59
  et cetera, uh, breaches of protected health information.
• 4:02
  Some health systems now have the added, uh, difficulty
• 4:07
  of responding to SEC regulations, right?
• 4:10
  And, and having to report under much
• 4:12
  tighter timelines for that.
• 4:14
  So I think it's becoming a lot more complex,
• 4:16
  but it's also driving a lot more collaboration within the
• 4:19
  healthcare industry and trying to figure out what other
• 4:23
  industry players are doing in order to keep abreast
• 4:26
  of those new regulations and new obligations. Mm-Hmm.
• 4:29
  - , that's the answer I was hoping for.
• 4:32
  You know, I understand competitive natures,
• 4:34
  but also if something like this occurs,
• 4:36
  I was hoping there would be some community
• 4:37
  and consensus around it
• 4:39
  and trying to, like, even if it's like you said in the form
• 4:41
  of therapy sessions, but, um,
• 4:43
  we've seen these ransomware attacks grow
• 4:45
  to affect larger institutions
• 4:47
  and even become more cruel, I would say, in nature with,
• 4:51
  you know, release of patient photos,
• 4:53
  children's hospital safety nets, demanding large sums
• 4:55
  of money in 48 hours from safety net hospitals.
• 4:58
  Uh, I'm just curious if you have any other thoughts to add,
• 5:01
  Aaron, about the, the nature of these
• 5:02
  and the characterization of these attacks,
• 5:04
  if there's anything that stood out to you.
• 5:08
  - Yeah, I I think they're incredibly profitable
• 5:11
  because of that brutalism.
• 5:12
  So health threat actors are out there, you know,
• 5:17
  attacking health systems
• 5:18
  because they wanna make money not
• 5:20
  necessarily for any other reason.
• 5:22
  And the way they maximize those payouts are by, you know,
• 5:26
  sort of the heinousness of what they're doing
• 5:28
  by locking down children's hospitals, by releasing photos
• 5:31
  of cancer patients.
• 5:32
  Those are some notable examples over the past few months.
• 5:35
  Um, you know, where, where really patient safety
• 5:38
  and patient dignity have been pretty critically impacted.
• 5:42
  I, I find your commentary about, uh, competition.
• 5:44
  Interesting. A lot of the conversations I've had
• 5:46
  with my peers have been,
• 5:47
  we don't compete on information security.
• 5:50
  There's a lot that of other stuff that we compete on.
• 5:53
  Information security supports that,
• 5:55
  but it's not a competitive
• 5:57
  distinction between health systems.
• 5:59
  So why would we treat it like that?
• 6:01
  I, I, I think that makes it information security a lot more
• 6:04
  collaborative than maybe other areas of hospital practice.
• 6:08
  Um, although I haven't really seen any of the, you know,
• 6:10
  sort of cut throat competition
• 6:11
  that you might associate with other industries.
• 6:14
  - Mm-Hmm. , - Well, a, as more
• 6:17
  and more information continues
• 6:18
  to come at us about information security
• 6:20
  and threats related to it, Aaron,
• 6:23
  can you pinpoint one lesson or,
• 6:24
  or one bigger takeaway we should take from 2020 four's
• 6:29
  events so far related to information security in healthcare?
• 6:32
  Can you kind of boil the ocean for us?
• 6:34
  What's one big lesson we should keep in mind here?
• 6:39
  - Diversify monolithic vendors,
• 6:42
  and I think we keep seeing that lesson repeated over
• 6:45
  and over again, 20 22, 20 23, 20 24,
• 6:48
  where these large service providers that handle, uh,
• 6:53
  you know, either visibility or, uh, office and email
• 6:57
  or even claims processing for a large number of systems
• 7:01
  when they're impacted very negatively,
• 7:04
  that has cascading downstream impacts
• 7:07
  that are very significant.
• 7:08
  And if you put all your eggs in one basket
• 7:10
  and you're relying on one service provider to
• 7:15
  effectively manage all that downstream work, that
• 7:18
  that is going to lead to problems.
• 7:20
  So, you know, I think there's a lot of inefficiency
• 7:23
  that's introduced by trying to diversify in specific areas.
• 7:26
  And, you know, certainly it takes a lot more work to manage,
• 7:29
  but at the same time, you know, even this year,
• 7:31
  as we're seeing in the claims processing space, um, very,
• 7:35
  very difficult to continue operations
• 7:37
  and continue to be profitable as an organization if,
• 7:40
  you know, all your eggs are in one basket
• 7:42
  and that basket's destroyed, right?
• 7:44
  - Mm-Hmm. . Mm-Hmm. ,
• 7:47
  - I mean, the way you said that,
• 7:48
  diversify monolithic vendors, it sounds like
• 7:50
  that's been something top of mind for you.
• 7:53
  Uh, I, I'm curious
• 7:55
  because there's, seems like
• 7:56
  there's two sides of the coin there.
• 7:57
  You, you hear from some in the data
• 8:00
  and IT world, they'll talk about moving to one platform
• 8:04
  or one system and avoiding fragmentation as if it's a,
• 8:08
  a the only good thing.
• 8:10
  But I think as you just pointed out, Erin, there are a lot
• 8:12
  of risks with that too, right?
• 8:13
  Um, so I think sometimes the way it's discussed, it's like
• 8:16
  that seamlessness is upheld as the universal good,
• 8:19
  but as you just helped us remember
• 8:21
  and understand that there's a lot of risks that can come
• 8:23
  with that if there's frailties with, with that one system
• 8:26
  or that one basket.
• 8:29
  - Well, and it's ultimately a risk management activity
• 8:32
  and how much risk the organization wants to undertake.
• 8:35
  Um, I, I think there are a lot
• 8:37
  of benefits in minimizing the number of vendors you have.
• 8:41
  But you know, then again, the, the risk that any one
• 8:44
  of those vendors poses
• 8:45
  to your organization becomes much more significant.
• 8:49
  And, you know, I mean, even tech giants like Microsoft
• 8:52
  and Google and SolarWinds, for example, you know,
• 8:56
  can be impacted and have been impacted by cyber attacks.
• 8:59
  And it's, it's really difficult to sort of say, okay,
• 9:02
  you know, we as an organization are gonna be able
• 9:04
  to continue our operations when these large monolithic
• 9:09
  organizations that spend, um, in, in incredible amounts
• 9:13
  of money on cybersecurity are also impacted.
• 9:15
  So it, it, it, it's definitely something to think about
• 9:18
  and I think organizations need to take
• 9:20
  that into account when they think about their
• 9:22
  downstream third party risk.
• 9:24
  - Right. Right. Well, Aaron Weissman,
• 9:26
  chief Information Security Officer
• 9:28
  with Mainline Health, I wanna thank you again.
• 9:29
  This has been a, a really dynamic conversation.
• 9:32
  I appreciate your thoughts
• 9:33
  and expertise on this topic today.
• 9:36
  Any final thoughts or closing thoughts you
• 9:38
  wanna leave our listeners with?
• 9:41
  - I think my final thought would be, you know,
• 9:43
  cybersecurity is a collaborative effort, both within
• 9:46
  and without, you know, cyber threat.
• 9:48
  Actors are working with each other to figure out how
• 9:52
  to maximize the impact of their cyber crimes.
• 9:55
  We as security practitioners need to be thinking
• 9:57
  how we can work within our organizations
• 9:59
  to develop cybersecurity strategy
• 10:02
  and also across industries to figure out
• 10:03
  how we can collectively defend against these attacks.
• 10:07
  - Mm-Hmm. , Aaron,
• 10:09
  I wanna wish you continued success and luck in your work.
• 10:11
  I think you hit so many great points,
• 10:13
  and I'm gonna keep in mind the things you said about the
• 10:15
  CISO role, just so much emphasis on strategic planning, how
• 10:19
  one and one's team reacts,
• 10:21
  and then keeping that collaboration alive and well.
• 10:24
  Um, so Aaron Weissman, chiefs information Security officer
• 10:27
  with Mainline Health, thank you for returning
• 10:29
  to the podcast, Aaron, and hope we can
• 10:31
  catch up again with you soon.
• 10:33
  - Likewise. And thank you so much for having me.