Latest / Becker’s Healthcare - Clinical Leadership Podcast / Manan Kakkar, Executive Director of IS Business Management at Providence

Transcript

Manan Kakkar, Executive Director of IS Business Management at Providence · Becker’s Healthcare - Clinical Leadership Podcast

• 0:04
  This is the Becker's Healthcare Podcast,
• 0:06
  created by the team of Becker's Healthcare,
• 0:08
  a multimedia company devoted to the people who power us healthcare.
• 0:11
  Four new 15 minute episodes are released daily containing industry news analysis
• 0:15
  and thought leadership.
• 0:16
  From powerful healthcare decision makers Support our show by leaving it a five
• 0:20
  star rating and review on Apple Podcast or other platforms you use.
• 0:23
  It's a chance to tell us what you like about the show and act on your feedback.
• 0:26
  Thanks for listening. Now here's the episode.
• 0:32
  This is Laura Dedo with the Becker's Healthcare Podcast.
• 0:35
  I'm thrilled today to be joined by Menin Kakar,
• 0:37
  who's cybersecurity executive director at Providence. Man,
• 0:40
  it's a pleasure to have you on the podcast today.
• 0:43
  Thank you so much for having me. Looking forward to the discussion.
• 0:47
  Absolutely.
• 0:48
  And I know this is gonna be a great one because there's so much happening in the
• 0:51
  cybersecurity space, especially with healthcare providers, hospitals,
• 0:55
  and health systems, you know, across the board.
• 0:57
  Certainly this is something that's top of mind for executives and executive
• 1:01
  teams. And so I'm looking forward to hearing more about what you're doing at
• 1:04
  Providence. But before we dive into that discussion,
• 1:06
  can you tell us a little bit more about yourself and your background?
• 1:10
  Yeah, absolutely. Um, Monan Cooker, I, I'm at Providence.
• 1:14
  I've been with Providence for about three years now. Before that, I was, uh,
• 1:18
  I spent a long time in cybersecurity and IT consulting with
• 1:23
  EY and Deloitte. And yes, I'm a technology enthusiast.
• 1:27
  I've spent a lot of time just thinking with various technologies, um,
• 1:31
  at work and outside of work.
• 1:34
  So technology is pretty fascinating. And just being in cybersecurity,
• 1:38
  the intersection of the various technologies and risks and business challenges,
• 1:43
  it's a fascinating space to, to be in.
• 1:47
  Absolutely. And you know, from your perspective,
• 1:49
  what got you interested in healthcare?
• 1:51
  Obviously cybersecurity is needed across so many different in industries,
• 1:55
  so why choose healthcare?
• 1:59
  I think being in consulting, I worked across, uh,
• 2:03
  a large variety of industries and finance.
• 2:07
  Finance sector is obviously one of the leading invest areas that has a
• 2:12
  lot of investment in cybersecurity and healthcare by nature
• 2:17
  of the risks it possesses, uh,
• 2:20
  in terms of patient data,
• 2:22
  in terms of making sure critical services are available, um,
• 2:27
  and it technology quickly becoming,
• 2:30
  and digital transformations quickly becoming a key component of how healthcare
• 2:35
  cyber, how, how healthcare is delivered.
• 2:38
  It was an interesting space where new things were being developed,
• 2:41
  new challenges were being thought about and how we are going to think about
• 2:46
  solving these challenges.
• 2:48
  So it was more of it being new in terms of
• 2:53
  a new thought process for,
• 2:54
  for similar challenges that finance the financial industry have been solving for
• 2:59
  a long time, or the defense sector was solving for the long, for,
• 3:02
  for a very long time. But in healthcare,
• 3:04
  we have to reimagine all these things because there was a direct component of
• 3:08
  patient safety interacting with patients,
• 3:12
  interacting with clinicians and physicians that we should,
• 3:16
  we shouldn't think of them as technology experts.
• 3:18
  Some of them are great technologists, uh, but,
• 3:21
  but the large landscape within healthcare is, is not about technologists.
• 3:26
  And bringing that perspective and bridging that gap is, uh,
• 3:30
  was an exciting challenge to me.
• 3:33
  Absolutely. Well, that's fantastic and certainly, you know, uh, like you said,
• 3:36
  an important and emerging field within the technology space as well as then
• 3:40
  needing a lot more from the cybersecurity perspective.
• 3:43
  Could you tell me about your cybersecurity program and team at Providence?
• 3:47
  How did you design the program and what really, you know,
• 3:50
  is unique about what you're doing? I.
• 3:53
  Think this is a,
• 3:54
  a very interesting question because when we thought about when,
• 3:59
  when our CSO Adams was talking about how he wants to build the cybersecurity
• 4:03
  program, we went back and forth on, you know,
• 4:05
  how are we going to reimagine things?
• 4:07
  How are we going to bring cybersecurity to a health system that
• 4:12
  has been around for, for so long?
• 4:15
  And is is in this intersection of rolling out so many new digital technologies,
• 4:20
  how we deliver patient care is being rethought and technology is being a big
• 4:24
  component as part of it, and therefore cyber risks, uh,
• 4:29
  become more prevalent. We started thinking about, you know,
• 4:33
  we should think about cybersecurity as a consistent,
• 4:36
  the approach needs to be consistent.
• 4:38
  So we picked the NIST cybersecurity framework as the,
• 4:43
  the core component around which we built our program.
• 4:46
  So as we started designing it,
• 4:48
  we spent a lot of time thinking about what problems was the cybersecurity
• 4:53
  framework trying to address. Like it really bridges technical controls in a,
• 4:57
  in a language that is not as technical with identify, protect, detect,
• 5:02
  response and recover. Like we can talk about those things with, uh,
• 5:06
  with enough examples from real world that have nothing to do with technology.
• 5:10
  So we picked the NIST cybersecurity framework as the core component around which
• 5:14
  we developed the, the framework developed our program.
• 5:18
  And as we started doing that, we identified key pillars that are well,
• 5:23
  identity and access management is a key component. How do we bring,
• 5:26
  bring on physicians?
• 5:27
  How do we manage their lifecycle of being able to go from one system to the
• 5:32
  other in a seamless way to deliver patient care without a lot
• 5:37
  of technology interruptions? And then how do we,
• 5:40
  from a security operations perspective, are always 24, uh,
• 5:44
  by seven eyes on glass.
• 5:45
  We are monitoring for new stress and how do we respond and recover?
• 5:50
  So we picked the new cybersecurity framework,
• 5:52
  we picked a few key functions that we wanted to, to build.
• 5:55
  And then another component was building the function out, uh, in,
• 6:00
  in our offshore capacity over in India so that we have security
• 6:04
  operations in the US that are monitoring and are able to quickly respond to
• 6:09
  incidents that are happening within the US time zone. But at the same time,
• 6:12
  we have a team out in India that is also providing the same level of visibility,
• 6:18
  same amount of eyes on glass vigilance to the threats,
• 6:21
  and they can work with our S teams if they see something.
• 6:25
  So making sure we are, we have a consistent framework,
• 6:30
  we build the capabilities on the pillars and functions around those, uh,
• 6:34
  components of the framework. And then having 24 by seven availability,
• 6:38
  that was a key component in,
• 6:40
  in how we designed overall our cybersecurity program.
• 6:44
  And then there are a lot of components of maturity in itself.
• 6:47
  Like at the core of it, cybersecurity, uh, is,
• 6:51
  is a service provider to our technology teams, to our,
• 6:56
  to our physicians and clinicians. So from a cybersecurity pillar itself,
• 7:00
  we have to rethink about how we deliver our services to our customers.
• 7:05
  And towards that,
• 7:06
  we spend a lot of time building a program management mentality
• 7:11
  where we have, we have the right engineers,
• 7:13
  we have the engineers working with the program managers,
• 7:16
  so we built a lot of people processing technologies around how we deliver these
• 7:21
  services. It is one thing to build a capability, uh,
• 7:24
  but delivering consistently and in a manner that the
• 7:29
  service can be consumed by the customers. That's a whole different challenge.
• 7:33
  So we spend a lot of time figuring out how we are going to deliver our cyber
• 7:37
  services, and we've been, it, it's a learning process. It's,
• 7:40
  we try a few things, some things work, some things don't.
• 7:42
  We spend a lot of time just kind of reevaluating, uh, what we've already built.
• 7:47
  So that's kind of how we continue to build and evolve our cybersecurity
• 7:50
  capability.
• 7:52
  That's fascinating to hear,
• 7:54
  and I really appreciate you talking through that because I know a lot of
• 7:57
  organizations are sitting in a similar place as, as you and,
• 8:00
  and where when you first joined Providence and trying to think through,
• 8:04
  you know, how do we, um,
• 8:06
  really transform and update and innovate within our cybersecurity space?
• 8:10
  What do we really need as healthcare becomes more, uh,
• 8:13
  integrated with technology and whether it's the healthcare delivery side or, um,
• 8:18
  you know,
• 8:19
  integrating technology into the operational aspects of the health system,
• 8:22
  it seems like there's just a lot of opportunities, um,
• 8:26
  and a lot of potential vulnerabilities. And so I can imagine that, you know,
• 8:29
  certainly we'll keep some folks up at night, but at the same time, you know,
• 8:33
  if you, um, have the right approach,
• 8:35
  it seems like you'd be able to at the very least, mitigate some of that risk.
• 8:41
  Yeah, and, and I think that's, that's the key to the approach, right? In,
• 8:45
  in the cybersecurity space, we often talk about, well,
• 8:48
  do the CISOs ever sleep at night? How do people sleep at night? And,
• 8:53
  and I think our philosophy is that if,
• 8:55
  if you are prepared or if you've gone above and beyond in making sure that you
• 9:00
  have the right controls, you have the right people in place, you,
• 9:03
  you enable them with technologies that allow them to,
• 9:06
  to provide services and do their jobs effectively and efficiently.
• 9:09
  And if we are prepared, we will be able to,
• 9:14
  to deal with certain challenges and issues. The, the fact of the matter is,
• 9:18
  the reality is every organization is susceptible to cybersecurity, uh, attacks.
• 9:23
  There is a,
• 9:24
  there is an industry understanding within cybersecurity that it's not a matter
• 9:28
  of, uh, if, but it's a matter of when.
• 9:31
  So if it is a matter of when Sotheby's going to be, uh,
• 9:35
  facing or dealing with cybersecurity attacks,
• 9:37
  then the conversation needs to be how are we going to,
• 9:40
  to respond and recover from those? Or how do we protect ourselves from,
• 9:44
  from those or mitigate as much as possible?
• 9:47
  So we spend a lot of time in making sure that we have the right controls,
• 9:51
  we test and validate the controls and make sure that, uh,
• 9:54
  if there is a challenge, uh, the team will rise up to it. And, you know,
• 9:58
  at Providence, we work very closely with our technology teams.
• 10:03
  A big component of cybersecurity is within,
• 10:05
  within the wider technology teams and within the business teams that interact
• 10:09
  with the systems. So we spend a lot of time with the,
• 10:12
  with the different leaders on their teams. We have a few groups where we,
• 10:18
  we talk about some of these things like data protection and third party risk
• 10:22
  management, biomedical security. It's not a,
• 10:27
  these are not problems that cybersecurity can just solve within cybersecurity.
• 10:31
  These are things that we can only solve if we partner well and we partner
• 10:36
  effectively with the rest of the organization. Um,
• 10:39
  and that is a key component of how we place the function. Uh,
• 10:43
  our program managers or engineers,
• 10:45
  they spend a lot of time talking to the different teams that interact with
• 10:49
  technology to understand how they use the systems,
• 10:52
  and then we bring in the risk perspective of how can somebody try and, uh,
• 10:57
  adversely impact problems from a cybersecurity perspective and what do we need?
• 11:01
  So we spend a lot of time really interacting with, with the different teams.
• 11:05
  And I think that is,
• 11:06
  having been in consulting and having seen so many industries, so many programs,
• 11:10
  uh, being built,
• 11:12
  I think the ones that succeed are the ones that really come together and
• 11:16
  collectively solve problems rather than say, Hey, we are cybersecurity.
• 11:19
  We wrote a policy, and if you don't follow it, well that's too bad.
• 11:23
  That's your mistake.
• 11:24
  That's not necessarily how you build an effective organization. And,
• 11:29
  and in order to kind of really address risks,
• 11:32
  you have to meet the customers where they are, understand their challenges,
• 11:36
  how do they interact with technologies,
• 11:37
  and then write the policies based on that, and then have the controls put in.
• 11:42
  That's kind of what, uh, the Providence Cybersecurity spends a lot of, uh,
• 11:46
  conscious time and effort around.
• 11:50
  That's so interesting to hear. And you know, I,
• 11:52
  I really appreciate that perspective because I can imagine, you know,
• 11:55
  certainly in a traditional sense,
• 11:57
  a lot of the ways that the technology department or division and teams are
• 12:02
  assembled are exactly as you mentioned, you know,
• 12:04
  building something and saying here, you know, make it work, . Um,
• 12:08
  and so especially with on the cybersecurity end, you know, when you, uh,
• 12:12
  bring on folks, um, to your team and, and,
• 12:16
  and have this set up to where you're co building or co-creating what's gonna be
• 12:20
  needed in the policies, are there any other, uh, I guess skills or, or,
• 12:25
  or something you look for in the people that you're bringing on the team to make
• 12:29
  sure that, you know, you're able to execute on this, um,
• 12:34
  very kind of collaborative and unique method of,
• 12:36
  of making sure that your policies and procedures are up to, up to snuff,
• 12:40
  I guess, in, in doing what they need to be doing?
• 12:43
  Yeah, absolutely. I think as we've been, uh, over the last, uh,
• 12:47
  three years when we started building the team and hiring, hiring folks,
• 12:52
  there was a lot of time spent into what it is that we are looking for in
• 12:57
  people who joined Providence, right? Providence as, as an organization is,
• 13:03
  is very close to its mission. Um,
• 13:05
  and that was something that we were, uh, that is stable stakes.
• 13:10
  Like anybody who comes in has to understand that Providence is a mission-driven
• 13:14
  organization at the core of it,
• 13:16
  like if we keep everything apart, at the core of it,
• 13:21
  Providence is trying to provide patient care to the communities in need.
• 13:27
  And that's, that's what we are here to do. And the only way, and this is again,
• 13:31
  this is my personal perspective, but the way we provide that is through empathy.
• 13:36
  We have to empathize with the people that we are serving.
• 13:39
  We have to understand and appreciate their challenges and then provide what we
• 13:43
  can to make their lives a little better. So I think from that perspective,
• 13:47
  when it comes to building the cybersecurity team,
• 13:50
  we are really focused on bringing in people who understand that culture of
• 13:53
  empathy. We, we spend a lot of time thinking about like,
• 13:58
  oh, you know,
• 13:58
  there are rock stars and there are heroes and there are individual contributors
• 14:02
  who are like, you know, I, I know this problem and I will solve this problem.
• 14:05
  Like that I mentality doesn't necessarily work in, in,
• 14:10
  in what we are building and what we've seen really work. So culture is,
• 14:15
  is really important in terms of who we bring on,
• 14:18
  what is their mindset to solving problems.
• 14:20
  It cannot be like I have the solution. It has to be,
• 14:23
  we will work together to figure out what the right solution is,
• 14:26
  and I bring in enough technical expertise or experience or real world
• 14:31
  experience where we can form the conversation in the right way,
• 14:35
  where we can help prioritize the different challenges that are being laid out
• 14:39
  or, or how do we engage people like that is a key component.
• 14:43
  So whether it is bringing on an identity and access management engineer,
• 14:48
  or it is a security operations person or a program manager, we,
• 14:52
  we are very mindful of figuring out what is the key requirement,
• 14:55
  the technical requirement of that particular role that should definitely be met.
• 15:00
  But at the same time, a huge component is, is this person,
• 15:04
  somebody who can collaborate,
• 15:05
  is this person who brings in the same mission values that Providence has of
• 15:10
  empathy, of understanding, of collaborating, um,
• 15:14
  and does this person have the, have the personality of, yep,
• 15:18
  this is a problem we need to solve. Let's roll up our sleeves,
• 15:20
  let's figure out how we are going to solve it. Um,
• 15:23
  and that's kinda what we've built the team around. And you know, there,
• 15:27
  there's a Steve Jobs quote that says that, you know,
• 15:29
  hire the right people and let them tell you what to do. Uh,
• 15:34
  that's kind of how we, we built the teams,
• 15:36
  like what tools and technology should we bring from cybersecurity perspective?
• 15:40
  Everybody in cybersecurity has a perspective on some of these things,
• 15:43
  has an opinion, knows what's happening out there,
• 15:46
  but when the team comes together and says that, hey, this tool is,
• 15:50
  is much better in terms of the challenges that we are actually seeing on the
• 15:55
  ground, that's a conversation that everybody can rally around instead of,
• 15:59
  you know, unilateral decisions being made by certain people, uh,
• 16:02
  which I've seen through my career in different organizations happen.
• 16:06
  So we are very mindful about,
• 16:09
  about that aspect of hiring and bringing in the right talent, uh,
• 16:12
  because once we bring in the people and kind of just let them do what, uh,
• 16:16
  what they're, what they're supposed to,
• 16:18
  and we encourage and they enable them to do that,
• 16:20
  things really start moving quickly.
• 16:25
  That's great to hear and certainly very inspiring in terms of, you know,
• 16:28
  how working together as a team really makes a difference. Now,
• 16:32
  before we wrap up our conversation, I wanted to ask really quick about,
• 16:36
  you know,
• 16:36
  cybersecurity as a part of the overall broader health system executive strategy.
• 16:42
  I know cybersecurity is a huge risk for hospitals and health systems across the
• 16:46
  board.
• 16:46
  So what is crucial when communicating this risk and need for resources to the
• 16:51
  board and senior leadership? I can imagine, and it's clear providence,
• 16:54
  they really understand why this is a priority.
• 16:57
  But for some organizations that are dealing with so much, uh,
• 17:00
  challenges right now financially and in so many competing interests,
• 17:04
  why does cybersecurity and how, you know,
• 17:06
  really need the resources and how do you impart that, um, to, to, um,
• 17:10
  executive leaders?
• 17:12
  Yeah, absolutely. I think, um, I think again on, on this one, I kind of, uh,
• 17:18
  I kind of piggyback on some of the experiences that I've had. Uh,
• 17:23
  you know, kind of just working with a lot of executives and boards, uh,
• 17:26
  in my consulting days. And context setting to me is,
• 17:31
  is a key component of it. Um,
• 17:34
  and what I mean by that is when we talk about cybersecurity,
• 17:37
  cybersecurity is a complex technology, uh, problem. It's a technical concept,
• 17:42
  but we don't necessarily have to talk about cybersecurity in those technical
• 17:47
  terms with everybody we talk to.
• 17:50
  And context setting of why should somebody care about what we are talking about
• 17:54
  from a cybersecurity perspective is critical, uh, towards that. As an example,
• 17:59
  when we talk to executive and boards, we are very,
• 18:03
  very mindful of not saying, um,
• 18:07
  broad statements like, you know,
• 18:08
  we have x million of vulnerabilities in our environment.
• 18:11
  We need the dollar to to resolve that. Sounds,
• 18:16
  sounds like a huge large scale,
• 18:18
  big magnitude problem when we throw out numbers like that.
• 18:21
  But even as somebody who's in cybersecurity who's been around for 10 years,
• 18:25
  I wouldn't know what to do with that information.
• 18:28
  So we try not to make broad statements or,
• 18:32
  or statements that are just like extremely technical and use words like, oh,
• 18:35
  we have c we have vulnerabilities, and all those kind of things.
• 18:39
  We really like to set the context based on the audience. So in terms of, uh,
• 18:44
  in terms of our conversations with executives, we,
• 18:46
  we really put in a lot of effort in trying on, uh,
• 18:50
  how we present the challenges.
• 18:52
  So we talk about it in terms of we have biomedical devices, uh,
• 18:56
  that have cybersecurity risks because they do not have the latest software.
• 19:02
  Okay, how do we bring them the latest software? Well, here are,
• 19:06
  here are some options. We can work with vendors. Well, what do,
• 19:09
  what happens if we don't do that? Um, here are some of the,
• 19:12
  the challenges that we are seeing in the industry. The F b I, the,
• 19:17
  the federal government are coming out with guidelines.
• 19:20
  There are brands and their attacks that are happening in edges and industries
• 19:24
  that have really impacted their systems and their operations.
• 19:28
  So we try to have a conversation with the audience based on the right context.
• 19:33
  It's not about the vulnerability that is about the risk and impact to the
• 19:37
  organization that that vulnerability brings.
• 19:40
  So we really spend a lot of time within our organization trying to understand
• 19:45
  what the risk and the impact is and how do we communicate it to the executives
• 19:49
  in LA in a non-technical, but a real world.
• 19:53
  How does it impact the business? How does it impact providence kind of way. So,
• 19:58
  and I think that context setting does go a a long way because
• 20:02
  executives are like, okay, now I understand. Okay,
• 20:04
  this is why we need to figure out how to upgrade our networks or biomedical
• 20:09
  devices or our core infrastructure or our data centers,
• 20:13
  or why do we need to move to the cloud?
• 20:15
  So then it really furthers the dialogue in terms of here's what we
• 20:20
  need to do and here's what it would cost.
• 20:22
  Now let's have that conversation as to what are the priorities revenue.
• 20:26
  So it really is about, uh, in my perspective, context setting,
• 20:31
  um, in terms of risk and impact and what would the investments get.
• 20:36
  And if we have that conversation in a consistent, consistent manner, uh,
• 20:41
  it does bring about a lot of positive change.
• 20:45
  That's great advice and great to hear. Minan,
• 20:48
  thank you so much for joining us on the podcast today.
• 20:50
  This has been such a great conversation.
• 20:52
  I always appreciate hearing from Providence executives and leaders just because,
• 20:56
  you know, you have so much going on within the health system, um, and, and,
• 21:00
  and so I've really enjoyed this conversation.
• 21:02
  I look forward to connecting with you again soon.
• 21:05
  Absolutely. Thank you again for holding me. This was, uh,
• 21:08
  this was a good conversation.
• 21:13
  It's so important for leaders at the top of organizations to keep learning,
• 21:17
  stay sharp, grow their networks,
• 21:19
  help our audience better do this in a more simplified, personalized,
• 21:22
  and meaningful way. Becker's Healthcare has launched my B h c,
• 21:27
  it's your trusted Becker's healthcare experience and more with content,
• 21:30
  connections, events and learning opportunities.
• 21:33
  Join the community free of charge@www.my dot becker's hospital
• 21:37
  review.com and we'll see you there.