Sign Mississippi Banking Medical History Secure

Industry sign banking mississippi medical history secure

[Music] welcome back to another change healthcare security podcast i'm john zuziak change healthcare consulting practice director for it risk management today we'll be speaking with phil alexander the chief information security officer for north mississippi health services about security awareness programs phil thank you so much for joining us today if you don't mind can you go ahead and give us a quick intro about yourself sure john thanks for having me i am the chief information security officer here at north mississippi health services been at this role for three years now i've been in health care for about eight years total and prior to that i was in uh cyber security and federal cyber security for over 20 years both in dod and nsa and other places dod contracts and that sort of thing so a lot of experience in in uh cyber security just all over around the world i won't go through the litany of places but just all over the world just to start off i think the one thing that we you know we're constantly hearing is how important information security awareness programs are to the the overall security uh posture of a company and on top of that you also seem to have a very deep passion for information security awareness and building can you go ahead and give a a little bit more you know information on that and about your passion and where that came from yeah and to me it's the the saying that you people hear all the time it's not business it's or it's not personal it's business i flip that around and i say it's not business it's personal and i think a lot of times people you know since we're five years old most people um ask the question why it's not about what we're going to do and how we're going to do it but really why and so i think that's where we've missed in cyber security awareness uh for many many years is our people don't know why we should even have or why why should they even pay attention to cyber security and so the why is why my passion is i'm very passionate about teaching people why not just business about personal and so i teach a lot of people a lot of our staff uh why they should care about cyber security and their personal life their their smartphone their kids on the internet uh you know i'm selling a computer in the yard sale what do i need to do to make sure my my data is really removed all of those kind of things so it's that personal level and that's what i'm passionate about is getting people to learn cyber security personally not just in business because i believe that if we teach them good cyber health uh you know hygiene they translate that bring that to work and do you think that plays any different across industry you know having that passion and focusing more on the personal aspect of it versus the business side is that is that something that would translate from you know the healthcare to manufacturing other industries i do i think that that's when i say you know a lot of industries whether you're in the government we used to think we were special you know the enemies after us you know we're special then i get to healthcare and i hear that everywhere i go people say well healthcare is different we're different everybody likes to think they're different right banking thinks they're different everybody thinks they're unique um and i i think we're not i think at the end of the day um you know quote a movie it's about people and we got to know people and uh it's not about dollars and cents it's not about your product it's not about what you do it's really why you do it and in healthcare we like to talk about while we're in healthcare from a clinical standpoint we always talk about the patient experience or patient care banking is no different oil and gas everybody has their why what they're doing i think cyber security if everybody understood the why of why they're doing cyber security awareness and again making it personal all of those people it's about them it's about your employees uh focus and so giving a quick example there it takes about five to six hundred mana hours to clean up identity theft so whenever i have executives ask me why are you spending so much time uh with jugglers and clowns and weird stuff and aliens and all this other weird stuff uh in our organization don't you have better things to do i say no because if that individual has their identity stolen and they're out of work because they're having to clean up their own personal identity that staff member is now that's a problem for our organization so it's a twofold thing but it doesn't really matter if you're in banking healthcare dod it's all the same it's just about people yeah that's a great point i think you see that often that it's your point it's the person and once you can kind of help make that change it applies everywhere at that point right um kind of another i guess sort of of spin on that you know when you look at the different the roles of either industry organization or person in the business unit i mean especially in healthcare i think you know we're not unique by any means but there are just different nuances among different departments and roles that we play within a healthcare organization do you when you start to build your program or kind of have those the the awareness presentations and classes that you're going through do you build anything different from the clinicians versus administrative or more back office functions we do so um we have our general new employee orientation kind of you know uh discussions where we talk the why hackers get into healthcare while we're number one uh in in nation state uh you know attacks and that sort of thing we have that in a general sense uh for all employees but then then we then we dive in and carve out say for instance i.t very specific uh skill sets very specific attack attack targets uh nit you're you're very attacked persons uh not just an i.t but then moving over to our executives i teach them totally different than i would say someone in housekeeping because they're very attacked their names are on the website right uh their titles and maybe even their email addresses and so they're very attacked persons uh unlike somebody who's in in laundry uh and so yeah we we tater tailor it to that but that doesn't mean that those individuals aren't just as important somebody in in uh in the cafeteria for instance they're taking plastic right to to swipe that that transaction so pci data all of those kind of things we talk about again on a personal level but they translate it over so yeah we do target each and every department a little differently uh and go after that besides just a general education and along those lines about you know some of those topics and how you look at risk versus compliance or something along those lines come the behaviors that you want to change how do you develop your own topics what drives the conversations that you're having with uh you know the employees of the organization right great question so i let that come for the employees so we have a website on our website it's public facing website and all of the tools and tips and everything that's on that website uh are for our employees at home it's not for here it's for there it doesn't say hipaa anywhere on our cyber security website it's all about how do i sell my computer in a yard sale right uh you know and so and safely make sure no data's there how do i secure my cell phone how do i make sure my child is surfing safe um et cetera et cetera tax time how do i make sure my w-2 is secure all of those things are personal driven stuff but i'll give you an example of how that translates over we did this whole lunch and learn on encryption encrypting your personal information your hard drive backing your stuff up kind of bcdr at the same you know personal level but also encryption and about three months later i had a nurse done in radiology called me and she said um hey phil said listen this is so and so down here in radiology um i attended your lunch and learn on encryption it was wonderful went home that night my husband and i downloaded your free encryption tool on your website encrypted our thumb drive we were very happy with it we're feeling more secure appreciate that but what i've got a question for you today is we've got this old access database on a computer down here in radiology got a ton of patient records on it shouldn't that be encrypted so she translated that from a personal we didn't talk about that at all in the lunch and learn about what what that means at work we just talked about her personal financial information at home and how she should protect it she understood the value then and so now she's at work and she sees something that needs to be protected and go shouldn't this be under the same level of protection and so i to me that's the kind of stuff that we can get our employees passionate about security at home because let's face it they love their work and they love what they do but they're never going to be as passionate as they are about their family about their children their grandchildren and so if we can teach them those habits there they will translate and i got a thousand of those stories uh of them translating that over into business it's actually funny you mentioned that because that's probably one of those items that you never would have found on any form of audit um and i know a lot of times when i was with the hospital we would be doing you know assessments and finding things and everything's pretty buttoned up you know there wasn't a lot of changes there but you're right when somebody comes to you with hey we've got this server underneath our desk that's been there for years you know what should we do with it never would have come up in conversation that you know so you're right once people are kind of you know tuned in to know what they're looking for it's amazing what they can find and how they'll help the program and i would say the other thing too is part of the program we do is we uh you've got to make it fun right so make it exciting kind of gamification so one of one of the things we do is we have this uh award we call men in black award everybody knows men in black most people love that movie and so what we have is every friday my team wears all black at least pre-coveted we would come to work in fr on friday all black and we'd have black sunglasses and at least uh two or three people in the organization would get an mrb award and i had marketing make up these little three by five glossy cards and like a certificate said congratulations you caught an alien uh and we had these little green aliens that i purchased on amazon little bendable plastic aliens and what we would do is when these employees would report to us these vulnerabilities or these risks in our environment and they would let us know rather than come him with a stick or beat them over the head because they did something wrong or they allowed this to happen we actually rewarded them we gave them an award and now it's a little cheesy award but i can tell you right now that you would think they're winning an academy award because when we would walk down the hall three of us walked down with all black sunglasses and they go oh my god m.i.b you know the nurses are screaming you think you know they won something uh and you're giving them this little card with a little alien and a pair of sunglasses um it was exciting to them as a very inexpensive uh way to reward folks for reporting those uh those risks to you and so you've got to find ways to make it fun make it exciting and and and gamified i always tell my staff we have to educate our employees and they not them know they're being educated i want auditors come in and say so how is your education program and they go we're going to ask your staff and i've had them do that before go around and say how's the security education and the staff goes i don't know what you're talking about we don't really have anything like that and then i say really what about mlb oh yeah let me show you my mib oh let me show you this what about the cyber security fair oh that was awesome this is what i did and they start they didn't even know that they're being educated and so that's the key is to educate with them not even knowing because it's so fun it's something they enjoy doing yeah that's that's a great i know what we've seen in the past with different organizations you know when when we're going through the annual you know compliance training and nothing against it it's a good program it's something you have to have is kind of that baseline but everyone is is so almost resistant to going through it and and they just sort of tune it out and there's no value at that point so i love the fact that you mentioned the gamification and how do you just make it fun and light it doesn't have to be this painful education that we go through it can be fun it can be you know valuable in just the sense that it's it's learning right i mean you don't have to make it complex absolutely i was telling somebody uh cso a new cso a few years ago i said the myth there's a myth that people hate training and they hate security training that's a myth what they hate is they hate bad security training and we got plenty of that because we're trying to target it just like you said john we're trying to target it to compliance which we know compliance doesn't equal security and so we we should get away from bad training uh if you have fun training everybody loves fun training they may not admit it at first until it's over and then they go that was so much fun people hate bad training and so we do the same thing we still have the annual you know compliance regulatory thing that you got to answer little questions i don't even mess with that i only try to make that fun i just let that go that's going to happen and then everything else i do my cyber security fair in october my fishing tournaments i have in the summer all of the arrests of stuff is the fun fluffy stuff that everybody remembers you mentioned budget or you know of the the cost of a program doesn't have to be expensive what i mean we know the cost of security is increasing every day funding i would love to say is is always being increased but i guess the needs of funding has increased all the time how do you balance you know this this program and the time that you're putting into it again you know making sure your tools are effective and efficient is there like a massive equation that you have to find that balance or is it you know you're just kind of going through and doing the best you can well yeah not really a math or a numbers thing i'll just say that my cyber security awareness training program is one of the most robust things that we do here and it's the cheapest thing we do we spend less on that than anything else and it's on the most effective and uh and the most robust thing we do uh and how we do that is uh and and i and when i was at university medical center in lubbock texas we had 108 counties around us and all of those counties were very rural when i say rural health care in west texas i'm talking about a hospital may have had eight or ten beds little bitty places out there and they look to me uh to help them you know develop programs and i'd speak at their conferences and that sort of thing for the really small rural health systems and i used to tell them all the time to start an education program didn't cost you hardly anything cost you a lunch like there's nerds and geeks in every single town out there they're in the basements of every town they go to your church and a lot of those nerds and geeks will never get to speak at black hat or def con but you pay give them a lunch and ask them come speak on fishing pick you know pick a topic let them come do a 30 minute lunch and learn in your dining room give them free lunch you know why they'll do it it's a bullet point for their resume it's something for their linkedin um and yet you get boom you've had an education already you've started it you don't have to do a lot another thing we do is involve our employees and this can be any size organization you don't have to have a big organization with a big i.t security budget we have what's called the jedi council again part of this gamification havi g fun the joint employee defense and intelligence council well how you like that uh the government you know acronyms but we have a jedi council and the jedi council is we picked out tried to find all the nerds in the organization we have a pharmacist who has a certified ethical hacker certification so we went around trying to find all of these nerds in our organization and and we were surprised at how many of these security people people who were security minded that we could find and we put them on a council and we meet once a month now we're doing it virtually but we were meeting once a month physically and they give us feedback from all the radiology pharmacy cardiology they're giving us feedback and they're helping us develop develop our program and then they take education back to their their departments and so you don't have to have your own staff you can reach out and use them and they're loving it they love being called jedi in fact now we have people uh applying to be a jedi i want to be a jedi you know and uh the jedi council is like well no we've only got so many slots and now we can be picky but it's an exciting thing that they they get to do they get to be a part of the program they get to have input and then take that back to their department that's it almost ends up being kind of a train the trainer as well right they're feeding into your security program but then when they go back to the department they can educate you know locally and really where the action happens kind of boots on the ground type of training at that point correct that's right boots on the ground yeah all right so with that you know one thing i always find interesting because what we've always tried to try to do with our programs is what we have to communicate up how effective the program is right you have to have some type of way to measure you know we've done x amount of trainings and it's driven this type of result do you do you gotta go through that probably with the jedi council of of taking that information or actually how do you build that information and then take it to others to show how successful your program is within the company that's the hard part is that the measurement because first you've got to have a baseline right and so um part and going back to the budget so we'll tie these two together in from an executive level how do you get budget for some things obviously is measuring and managing it right so you show those measurements of what you need so what we do is we educate the why going back to the why whenever i educate our senior leaders and i talk about why a security and i have these uh examples real world examples of china getting in our network we have you know uh why would uh south korea uh china you know all of these different nation states target health care uh and then we talk about anonymous and the the attacks from anonymous and other hacktivist groups we talk about just regular hackers we talk about insider threat and and that sort of thing when i explain all of the things about why they want in healthcare then i don't have to talk about what i want to do or how i'm going to do it they go excuse me but what are we going to do about this or how are you going to fix this and then i say well this is what we're going to need to do that and they start ponying up the money so that's part of your budget discussion is first you got to tell them why not what you're going to do and how you're going to do it that's a lot of cso's problems is they immediately try to go tell you know that the board this is what i need i need this i need that i need this nope i also try to pull the reins back i don't try to come in with the whole plan and say here's all the things i'm going to need here's all the staff going to need i don't do that the first year i do nothing but what you're talking about with metrics i run fishing campaign silent fishing campaign every month i run a phishing campaign on my staff every month for a whole year i don't try to educate i don't try to do anything just boom boom boom boom boom the first year really is you getting to learn the organization anyways start getting your stuff put together and all that stuff so the first year should just be running metrics pull your metrics you know vulnerability analysis risk all of these different things pull your metrics once you get the metrics then you can say this is what i've seen over time because one month doesn't tell a story two months that doesn't tell a story really a quarter doesn't always tell the story so pulling those metrics for a year it's hard because you're waiting uh a year also once your cio or cfo starts seeing this they're going when are you going to do something and it feeds their appetite too they're wanting you to do something not yet hold on hold on wait for it wait for it wait for it right and then you produce the numbers and they start ponying up the money uh and and then not only is it the money but also you can then when you start implementing your security training program or your tools your dop or ips or whatever they you know fund for you you can then hopefully see a downward trend in the numbers um but you can't really tell if you don't have a baseline so you really need to spend about a year getting that baseline and it's difficult but i promise you you have a get out of jail free card your first year at any organization so take that time to build your baseline and then that way you can show a decrease in your in your numbers yeah that's a great point i think you know i've always thought that the best way to i guess the best goal of a security program is we're here to change the culture right they're the truth awareness program here to change culture changing behavior and you you can't change behavior unless you know what behaviors need to be changed so you're right taking that time that grace period that you have to to really understand the culture of the organization um and and what you know the behaviors that are that need to be focused on i think that makes for a great uh safe time for the program where to target your your audience because you may have a group of folks maybe h.i.m or whatever who's who's not as good as this other there may be a group of people that are doing a really really good and they're not having a problem what i have found in some organizations i've worked in um is that the i.t department was the worst right so you don't know don't assume that the executives they're they're good to go because they're really smart they wouldn't fall for this stuff or don't assume it's smart they know what they're doing you can't do that because uh you know i learned that i worked at nsa for a long time and everybody thinks ooh nsa bunch of cyber nerds or spies or whatever no we had housekeepers we had movers we had you know cable pullers we had secretaries i mean you you have the gamut of folks that working in another organization so you can't assume that all it people know what they're doing in security you need to figure out what that looks like when it comes to health care i've i've seen it and it's it's amazing to me that really everybody's sort of goal or culture and you have your pockets there's exceptions to the rule of course but everyone wants that they want to do the right thing they're you know they're there for the patient they're there for the organization um and so i think you're right once you can to help change that behavior get everyone sort of focused on the right item from a security perspective right we're not the the most important we fight to think so we're the most important department of the company but um once you get that everyone on that same page and focus and you know we're really driving things forward you know you have the great people behind kind of that army to drive it forward at that point because they want to help they want to do the right thing they do um do you think that helps healthcare stand out different from other other industries that we really have a group of people that are just they're they're there to help it's really a very compassionate empathetic group of people you know does that help with this degree program you know if and i i'll be completely transparent here you know working in the government we didn't see ourselves as servants or you know customer focused kind of people right um but and in healthcare it's completely opposite right it's i got into this as a nurse or as a radiologist for people uh even though we say it's not about the money but we got into it to help people that's really what we're doing i don't know i couldn't answer to say are we any different say than the banking or oil and gas whatever but i think we will be i do i think that most people that i've met in healthcare in my eight years in healthcare so far uh are very very passionate about the people that they serve um we are very i mean every meeting we talk about is about how will this impact the patient care right and so i do believe that uh and i know for for me it's changed how i do cyber security because i really think about that patient and that i was talking to a group of folks this morning doing a class and i told them i said you know we do an incredible job of healing a person we heal that patient we send them on their way and they're very thankful for the care they received and the healing they received at our organization only to find out three weeks later that we did not take care of their data their information and it was breached because of our lack of care and concern or understanding and now they have an identity problem and so they come back to our organization complaining and they are emotionally and and financially distraught so that term that we use in health care called do no harm uh extends to cyber security and that's what i was explaining to this group of nurses this morning is that you can't just leave your computer up you can't you know open you can't just leave stuff laying around it extends to that information it's not just information it is that patient so we may heal them physically but then we cause them harm emotionally uh psychologically and maybe even financially kind of changing a little bit you know for for those that are just starting off with our security program whether it's a new cso or really just a new security program within within an organization uh where do you think we know that you know the best place to start is building that baseline getting those metrics that information pulled together but what once you have that where's the next best place to start how do what's that first block um to really start to build a security awareness program to me uh the two that go hand in hand is another module and i know this isn't the topic for today which is around risk management because once you get them to understand the why of security uh then you start bringing in and start showing them some of the risks that are that are there right start talking about risk anybody it doesn't have to be the executive councils or or that sort of thing it can be a normal person can understand risk you start talking risk mitigation because once they understand if you do a really good job getting all your metrics uh that first year then you can start talking about what you're going to do and how you're going to do it or start talking about what you want to do and how you're going to do it and a lot of that is around risk because you can say oh yeah hackers want to get into health care we know that nation states want to breach health care we know that phil's talked about that for the past year he's got his examples of other hospitals that's been that way but we're different right so again it goes back to that different until they can see that you've got oh target had this problem look we have the same vulnerability oh you know dch hospital in alabama have this issue oh look we have the same thing compare yourselves to those things are out there and show them that same thing then they start going whoa hold on the cost they paid for that breach could be us and we have the exact same scenario so then you start showing them scenarios and you start building that way and you mentioned with the awareness program right you want to make it personal um the same thing i think is is critical when it comes to risk management and how you communicate you know the impacts you want to make that personal you never really want to go with general terms or right this is extremely high or really bad so we need to do something now if you're going to the the chief financial officer you should be talking in numbers right if you're going to the chief nursing officer or medical officer you want to be talking in terms of patient safety patient impact um so yeah i think absolutely it's all about that communication and making it personal yeah and knowing that audience like you saying knowing your audience of who you're talking to using examples that they will understand so if you're talking to a group of cardiologists and you're using a breach example you need to know how it affected the cardiologist at that organization that was breached how's that affect them what can they what's going to affect me what can i not do in my job if this happens you know and they'll understand that exactly well phil thank you so much for taking the time to chat with us today about the information security awareness programs that you've built and how you run in your shop today uh for our listeners and don't forget to check our show notes for any links to resources and contact information regarding the show and always stay tuned to the change healthcare consulting security podcast for more shows covering the information security and risk management topics that you find important you know if you're looking for any more information regarding information security awareness programs security assessments the virtual chief information security offering or other services from change healthcare please check out our website at changehealthcare.com and once again my name is john zuziak and i hope you've enjoyed this program and have a great rest of your day you've been listening to the change healthcare podcast for more information on this and other health care it topics please visit changehealthcare.com don't forget to check the show notes for useful links to related resources and our contact information thanks for listening and have a great day you