"Cybersecurity is patient safety and patient safety is cybersecurity," is how Stoddard Manikin, Chief Information Security Officer, Children's Healthcare of Atlanta, described the significance of cybersecurity readiness in the healthcare sector. Speaking with exceptional clarity and eloquence, Stoddard traced the evolution of the cybersecurity threat landscape and governance approaches, before discussing in detail what it takes to succeed as a modern CISO.

Time Stamps

01:35

How would you describe the evolution of the cybersecurity phenomenon and what has stayed with you by way of lessons learned?

05:17

Talking about specialization, getting the right people for the right kinds of roles in cybersecurity is very critical. And there are challenges there. But at the same time, you also need the non-cyber security professionals, the members of the organization to do their part. Don't you agree?

06:55

What are your recommendations when it comes to cybersecurity awareness and training?

10:41

What are some metrics or KPIs that are being tracked or should be tracked?

13:37

What does it take to make a CISO, and when I say CISO, I mean the CISO function as a whole, effective?

17:35

From a practical standpoint, how feasible is it to involve legal or to work with legal closely?

19:59

How and to what extent does your function partner with Legal when formulating and reviewing cybersecurity strategies?

22:25

How do you stay on top of industry regulations and compliance requirements?

24:18

What is the state of cybersecurity readiness in the US healthcare industry?

28:40

Is it common practice to regularly test the disaster recovery capabilities of an organization?

30:46

What are your thoughts on the practicality of conducting real-time security audits?

33:19

According to media reports, many of the breaches that have happened, large breaches, major breaches, the story goes that the organization was made aware, or a particular individual was made aware, who did nothing about it. Based on your experience in the field, how or why does that happen?

36:03

How feasible is it to have structures and mechanisms to ensure joint ownership and accountability both within the organization, as well as when you're partnering up with vendors?

40:23

Any final thoughts for the audience?

Memorable Stoddard Manikin Quotes

"Cybersecurity is everyone's responsibility within an organization. We're past the days where you have a few people in a room providing all the security to the organization, and it's just up to them to take care of it. It's now a central team coordinating cybersecurity for an organization but directing a lot of different players."

"And when it comes down to it, people are the easiest way to breach an organization's security defenses. So it's incumbent on every organization to train all of their users that have access to IT resources, and equip them with the knowledge and awareness they need, so that they can be prepared, should someone target them with some kind of attack or attempted attack."

"I find that providing them specialized training, giving them a forum to ask questions, testing them on it, perhaps even monthly with a simulation exercise is how you get the best behavioral response. The other part of that training is it can't just be one way where you're giving them the info; the next step is to test them on it. And then the step after that is to measure them on it."

"First and foremost, the most fundamental thing you've got to know as the CISO is the business of the organization that you're in. Because if you don't understand how the business operates, what it does, how it earns money, how it spends money, where it really makes its profit that funds other areas that have losses, then it's very hard for you to understand how to prioritize what security controls need to be put in place, and also how restrictive you can be without cutting off the lifeblood of the organization."

"So a patient can recover from a data breach, but they might not be able to fully recover from lack of care. So that's where I really want to emphasize that cybersecurity is patient safety. And we all have to take it seriously, regardless of where we are in that healthcare ecosystem."

Connect with Host Dr. Dave Chatterjee and Subscribe to the Podcast

Please subscribe to the podcast so you don't miss any new episodes! And please leave the show a rating if you like what you hear. New episodes release every two weeks.

Connect with Dr. Chatterjee on these platforms:

LinkedIn: https://www.linkedin.com/in/dchatte/

Website: https://dchatte.com/

Cybersecurity Readiness Book: https://www.amazon.com/Cybersecurity-Readiness-Holistic-High-Performance-Approach/dp/1071837338

Welcome to the Cybersecurity Readiness Podcast

Series with Dr. Dave Chatterjee. Dr. Chatterjee is the author of

A Holistic and High-Performance

Approach by SAGE publishing. He has been studying cybersecurity

for over a decade, authored and edited scholarly papers,

delivered talks, conducted webinars, consulted with

companies, and served on a cybersecurity SWAT team with

Chief Information Security officers. Dr. Chatterjee is an

Associate Professor of Management Information Systems

at the Terry College of Business, the University of

Georgia, and Visiting Professor at Duke University's Pratt

School of Engineering.

Hello, everyone, I'm delighted to

welcome you to another episode of the Cybersecurity Readiness

Podcast Series. Today, our guest is Mr. Stoddard Manikin, Chief

Information Security Officer, Children's Healthcare of

Atlanta, with over 18 years of progressive experience in

information technology, security, and privacy. Stoddard

specializes in advising complex organizations on security

topics, including regulatory compliance, integrating

information security with enterprise risk management, and

identity and access management. So we are truly privileged to

have a subject matter expert with us. Stoddard, welcome!

Thanks for making time for this podcast.

Thank you, Dave. It's great to be here.

So given the amount of time you've spent

as a cybersecurity professional, I'm sure you've seen a lot over

the last 25 years in the cybersecurity space. How would

you capture the evolution of this phenomenon and what has

stayed with you by way of lessons learned?

I think that cybersecurity has evolved

dramatically, since I've been involved in the 1990s. And and

that's true of so many aspects of, you know, modern life. But

in particular, we didn't used to call it cybersecurity, either.

We used to call it you know, information security or even

data security. So, the name itself has changed over time to

reflect what, what the world thinks of it. But I think that,

most importantly, it's, it's captured the imagination, much

more. So it's kind of follow that hype train, if you will,

that popular culture typically does where something is

marginally understood by the masses. And then some tiny

aspect of it is used to appeal to the masses. Like if you look

back many years ago, when they were hacker movies coming out of

Hollywood, and everything was just super oversimplified and

glorified. And it made everybody fear that these hackers were

everywhere. And they could get in and steal all your

information by guessing a couple of passwords, right. So now I

think we've gotten to a point where most people realize

there's not just somebody hiding in a basement somewhere with a

dial up modem cracking into all these different organizations. I

mean, now we're talking about organized crime, state sponsored

actors, you know, script kiddies, renting ransomware as a

service and using it to make money. And it is truly a college

cottage industry, where at this point, a lot of these

ransomware-as-a-service will not only provide the software, but

also they include English speaking help desks to help

their payers figure out how to buy bitcoin and pay the ransom.

So it's a tremendous evolution in terms of the threat

landscape. And it's also remarkable evolution from the

perspective of practitioners like ourselves. So the

specialization is significant. Whereas 20 years ago, you might

have one security person or maybe just a network person who

dabbled in security, and they had to learn how to do it all.

And the expectation for management was that one person

could do it all. And and now you have specialization of positions

in cybersecurity much like you do in the medical field, where

you wouldn't want to hire, say, a surgeon to look at common

colds. Right? What is the point of that? Nor would you want a

general practitioner doing surgery? Well, it's a lot like

that in cybersecurity, there are certain positions where you are

trained to do certain things, and you are not necessarily an

expert to do others. And so that specialization has become very

traumatic in the industry. And unfortunately, we still have a

ways to go in convincing non-practitioners of this

specialization importance because we still see job

postings out there looking for a security professional and

they're expected to do the work of eight different people. So I

think that's that's kind of the next step of the evolution. It's

that recognition of the variety of specializations in

cybersecurity, and that no one person can do them all.

You captured the the landscape very,

very well. I couldn't agree with you more. Talking about

specialization, getting the right people for the right kinds

of roles in cybersecurity is very critical. And there are

challenges there. But, at the same time, you also need the

non-cybersecurity professionals, the members of the organization

to also do their part. Don't you agree?

Absolutely. Cybersecurity is everyone's

responsibility within an organization. It's to the point

where in my opinion, certainly every IT job description, should

have some type of security requirements written into it.

Because I think we're past the days where you have a few people

in a room providing all the security to the organization,

and it's just up to them to take care of it. It's now a central

team coordinating cybersecurity for an organization, but

directing a lot of different players. And when it comes down

to it, people are the easiest way to breach an organization's

security defenses. So it's incumbent on every organization

to train all of their users that have access to IT resources, and

equip them with the knowledge and awareness they need, so that

they can be prepared, should someone target them with some

kind of attack or attempted attack.

Yeah, the human element in cybersecurity

is so significant, I like the way you framed it. I couldn't

emphasize more what you just said, everyone has a role to

play, and they must be trained accordingly. You know, I've been

doing research in this area, I've authored a book I consult

as well. One of the things that I see across the spectrum, is a

varied approach to cybersecurity awareness and training. In some

organizations, it's about checking the box and doing the

required training once or twice in the year. It's kind of broad

based, a hit or miss approach. And then there are other

organizations where they have a more role focused training. In

your experience, what have you seen? Or what are you seeing?

And what are your recommendations when it comes to

cybersecurity awareness and training?

It's a great question, because it's so

relevant. And I think that what you were describing where an

organization might provide, perhaps an onboarding training,

when they first start to say, Hey, don't give your password

anyone and here's how you enroll and password reset and, and

watch out for phishing attempts. That's, like maturity level 1.0

And table stakes. Right? You have to do that on their first

day, of course. But from there, it requires consistent

reinforcement of the topic, and reminders for people because

human beings typically can't retain information forever after

hearing it once. And so what I find to be most effective is to

start off with that kind of onboarding training, that

background stuff, the context. And then what that does is it

plants triggers, so that when the users hear future trainings,

it reminds them Oh, yeah, that is important. And I remember why

and I heard this before somewhere, but I can't quite

make it out. And so over time, you build up that retention and

awareness. And I think that minimum once a year type of

training is what a lot of organizations do. And frankly,

it's it's not enough depending on someone's job function and

responsibility. So may be you do that for the majority of your

workforce that rarely has to worry about security issues. But

if you've got people processing an invoice and payroll, then

they are specifically going to be targeted with business email

compromise attempts constantly. And if you only train them once

a year, you can't expect them to successfully repelled those

tacks that have been honed and improved upon through 1000s of

attempts around the world on a daily basis. So I find that

providing them specialized training, giving them a forum to

ask questions, testing them on it, perhaps even monthly with a

simulation exercise is how you get the best behavioral

response. The other part of that training is it can't just be one

way when you're giving them the info, the next step is to test

them on it. And then the step after that is to measure them on

it. So for example, if you do a quarterly or a monthly phishing

test, capture the results of that test, did people click on

the link or enter their credentials? Did they open the

attachment? Did they do nothing? Did they report the message

proactively, which is the best behavior, and then report on

those percentages by department by division by type of user to

the leadership chain, and the data will help you figure out

where your education is working, and where it needs to be

improved.

Fantastic means being able to measure the

effectiveness of training is so critical. And I don't hear folks

in your position emphasize this enough. In fact, the first time

I'm hearing a CISO so emphatically, specifying the

importance of measurement. Because, there's no point giving

people training, if you're not being able to see the progress,

or if you don't see the progress, what else can be done.

In other words, you know, taking a very substantive approach, as

opposed to check-the-box approach where you really want

to see this, whatever training is being is being given is

having an impact. Talking about measurement Stoddard, if we can

go a little broader, as the CISO of your organization, and you

don't have to be specific to your organization, you can be

very generic. What are some metrics or KPIs that are being

tracked or should be tracked?

This is a very challenging one to answer.

Because the, the audience that you're preparing the metrics

for, has very different levels of understanding of them. So you

know, if you think back to the old days, when you had a, a

CISO, who was more of like a network security person or an IT

security person, they would try out the metrics of, you know,

the number of intrusion attempts and the number of things that

got blocked at the firewall, and all very kind of technical,

objective data that wasn't necessarily meaningful to the

audience. I think there's a place for some of that data, to

remain in your kind of dashboard reporting type of things,

particularly for your executive team and your board. But I think

you've also got to have some other really common sense

measures in there. Things that are more related to the

organization itself. Like, for example, if you have a strategic

goal, to reach a certain level of maturity on a given maturity

framework, then you might want to report on what your most

recent third party assessment gave you as the maturity

ranking. And whether that's up or down, and the areas where you

improve the areas where you're still lagging, and so forth. You

might also want include something along the lines of the

number of IT audit findings that happened from an external audit,

because I think that's important to to watch for trends. And then

you can dive into the details either in the comment section or

in follow up q&a, where you say, here's where the audit findings

are, is it a same place as the last three years? And we're not

fixing it? Or is a brand new place? Or is it a brand new

field, like related to cloud security that's just so new that

you don't have a handle on it yet. And I think that that way,

your metrics can drive the conversation of where you need

to focus and prioritize investment.

Absolutely. In fact, you touched upon three

things about performance measures. First is taking a

holistic approach. In fact, when I look at my research, my book,

I come at it from the standpoint of business value impact

measures, productivity measures, extent of preparedness measures,

audit and compliance measures. And there can be more. The

second, the second thing that you talked about is equally

important, what's the point of measuring, if we are not gonna

review the results and act on them? So what mechanisms are in

place to effectively and promptly review the findings and

take action? And the third is, who is interested in these

measures? And how important are these measures to them, as you

know, in organizations, there can be a multitude of metrics,

and often what gets measured is what is convenient to measure,

not what needs to be measured. And I'm sure cybersecurity is

not an exception to that situation. But, but yeah, the

points are very, very well made. Moving along from the standpoint

of CISO empowerment, essentially, the question is,

what does it take to make a CISO, and when I say CISO, I

mean the CISO function as a whole, effective?

Well, that's an interesting one, too, because

the role has changed over time, including its position in the

organization and the reporting structure. And there is no one

answer to this either. A lot of it depends on the organization

and who's in the roles at that organization. I think that

historically, a lot of CISOs came from, you know, one of two

places, they came either from military and law enforcement, or

they came from a network security type of background. And

both of those types of backgrounds prepare you well.

But unless you're able to expand your your perspective, and

embrace a lot of other areas of the organization, you can't

succeed as a modern CISO. I certainly need the fundamental

technical background, to understand what people are

telling me and what the implications are, I need to

understand how law enforcement works, and when do I engage with

them and how to do so effectively. But I also have to

understand regulatory compliance, I have to understand

audit, I have to understand finance, because when I'm trying

to get a security product in house and implement it, I have

to know how to budget for it, whether it makes more sense for

us to capitalize it or subscribe to it and pay it out of opex, I

have to know whether the training should be included or

not depending on how we want to pay for things, and what the

useful lifespan is going to be. So I've got to understand those

financial implications. I also need to understand insurance,

because cybersecurity insurance is a critical aspect of this.

And then there's other areas as well, that you've got to have a

broad understanding of. But first and foremost, the most

fundamental thing you've got to know as the CISO is the business

of the organization that you're in. Because if you don't

understand how the business operates, what it does, how it

earns money, how it spends money, where it really makes its

profit, that funds other areas that have losses, then it's very

hard for you to understand how to prioritize what security

controls need to be put in place, and and also how

restrictive you can be without cutting off the lifeblood of the

organization.

Security versus convenience, security

versus mission of the organization, you have to find

that balance. Very well said, Very well said. So I'd like to

follow up on a couple of things you mentioned. You talked about

law enforcement and regulatory compliance. And that brings to

mind the role that the legal function plays. And if you think

about it, when organizations are in trouble, many a times that

leads to a lawsuit, they have to defend, you know, all that they

have done to protect the organization, and so on and so

forth. So doesn't it make sense to involve legal every step of

the way? And is that too much to expect? Because when I pose this

question to people in other organizations in your role, I

get very different responses. And sometimes the responses are

not very clear. So I want to know, from a practical

standpoint, how feasible is is it to involve legal or to work

with legal closely.

I think it's not only feasible, but it's a

requirement for survival of a sea. So I've always had

excellent relationships with the legal officers of different

organizations that I've worked with. And I think that it all

comes down to the relationship that cybersecurity has with

legal as far as how straightforward it is to engage.

Now, I would not propose bringing everything to legal

that happens, because so many things that that start out as an

investigation turned into nothing, it turns into sure this

looks really bad. It looks like someone just hacked us from

Puerto Rico. And we don't have any operations there. But then

you dig into the the details and the logs and you find okay, we

actually had someone on vacation and they got a call and they

were asked to login and do this. So you know, why would I alarm

legal about that until I've done some due diligence around it?

bring things to them that are real, or if they're significant

enough that you don't know yet, but they need to be aware and

involved early, then be clear with them that you don't know

yet if this is real or not, but you're engaging them early so

that if it becomes real, they'll have background and context and

they are ramped up already.

Very fair, very reasonable. But but it's

also true that when you're formulating your cybersecurity

strategy or let's say you're doing an annual review, that you

get legal involved to provide y'all with a checklist or a

guideline or the do's and don'ts just to make sure that you're

always staying on the right side of the law. Is that is that a

common practice common procedure? Or do you accomplish

it in some other way?

You know, I think it depends. Because

really, what I'm interpreting, as you say, legal in that

context is it's really about regulatory compliance, or even

contractual obligations, right, because those are two different

things that you have to think about as a CISO. And from a

regulatory compliance perspective, you've got to think

about the international implications, the national here

in the US, we think about state and local, and then beyond the

governmental regulations, if you do business in other countries,

you might have GDPR if you're in Europe, and there's just it

really gets complex quickly. States have individual privacy

laws that you need to be aware of. And that's getting more and

more complex. And then on top of that, you've got commitments to

other partners that you have contracts with in terms of how

quickly you need to notify them if you have some type of breach.

And you even have industry regulations. So for example, in

the credit card industry, there's PCI DSS, the Payment

Card Industry Data Security Standard, that is not a

government regulation, that is essentially a voluntary industry

requirement, that if you want to accept and process credit cards,

you must follow. But it's created by a consortium of

credit card companies. And so that's just kind of another

dimension there. And that's why I say when you say legal, it

sounds to me like it's compliance. And in reality,

that's not all coming from just one department, be it legal or

compliance that's coming from four different departments, it's

going to come from legal and the contracts aspect, and they'll

have to handle typically the the government regulation. In terms

of the industry regulation for PCI, that's going to be the

finance division, it gets very complicated. And that's where I

was saying earlier, it's really important for the CISO to have

broad relationships everywhere. And and even if they come from a

narrow background, to have very broad horizons in their

thinking.

Yep, that is that is very necessery for

the kind of role of a CISO plays, which is highly

interdisciplinary. And you and you talked about different types

of regulatory requirements. Some are requirements. Some are

industry regulations, industry expectations. So how do you stay

on top of all this? Do you have a team that provides that

guidance? Or is one particular person assigned to make sure

that you're on top of all the different expectations from a

compliance and other legal standpoint?

Well, certainly, we're going to focus

on the ones that are most relevant to us, above others.

And for example, that would include the HIPAA security rule

and the HIPAA Privacy Rule, the High Tech Act for health care,

things like that. But But ultimately, what I have found to

be effective is to find a framework, a security framework

that incorporates multiple regulations and requirements, so

that you can focus on meeting the framework design and measure

yourself against that. And by doing so, you're going to cover

the majority of your bases related to regulatory

requirements. So for example, in healthcare, there's the high

trust framework that you could adopt. And and I think a lot of

organizations in the US in particular are using the NIST

CSF the Cybersecurity Framework, these frameworks incorporate

multiple regulatory requirements, some of them go

above and beyond it. So you actually have to kind of be

careful that you don't turn the wrench too tight on your

organization. But it's a matter of picking that framework,

laying it out, mapping what you do to the framework, figure out

where you're doing well, where you need to improve and then

measuring yourself on that.

Okay, okay. Good to know, talking about the

US healthcare industry, or you can, you know, go even further

and talk about the global healthcare industry. There are a

lot of reports out there that talk about how the landscape or

the the areas of vulnerability are expanding because of the use

of IoT devices, because of the complexity of these

organizations. It's very hard to keep track of where the weak

points are. In one particular report, they say there is enough

evidence to suggest that US healthcare organizations lack a

deliberate, organized, and comprehensive cyber resilience

strategy. So with this kind of statements being made, I just

wanted to get your sense of what is the state of cybersecurity

readiness in the US in the US healthcare industry.

So I believe that it's far better than it was

in the past. But there's, of course still room for

improvement. When you talk about healthcare as an industry, it is

a massive ecosystem. There are providers, including large

healthcare systems with multi hospitals and clinics that are

standalone independent hospitals, there are physician

practices, there are medical device manufacturers, there's

even the insurance industry around healthcare. It is

enormous, and it makes up a significant part of the United

States GDP every year. So what we're talking about is just

massive, and such different levels of sophistication. But

when it comes down to it, Dave, cybersecurity is patient safety.

Patient safety is cybersecurity. Now, historically, cybersecurity

in healthcare was all about confidentiality, because you

were concerned about having a breach of patient data,

electronic protected health information, or ePHI, would be a

HIPAA breach. And then, if affected more than 500 records,

then you got on the HHS Wall of Shame website, where it was

publicly known. You know what, it's not only about

confidentiality, and I'm glad that it's not, it's much more

about integrity, and most importantly, availability now,

because now we recognize that, especially with ransomware,

attacks, and similar types of things, systems become

unavailable. And healthcare delivery, meaning providers,

people touching patients, and taking care of them rely on

electronic computer aided workflows. And if the systems

are down, because some patch broke something or there's a

ransomware attack, then you can't easily know a patient's

blood type. You can't look at their medical records to know

what history they have, what allergies they have, you can't

get lab results back to know how to treat a patient. And

sometimes that could result in a life threatening or life

altering delay. So a patient can recover from a data breach, but

they might not be able to fully recover from lack of care. So

that's where I really want to emphasize that cybersecurity is

patient safety. And we all have to take it seriously, regardless

of where we are in that healthcare ecosystem. Now, to be

fair, there is a significant disparity in healthcare systems

based on size and resources and how prepared people are for

cybersecurity impact, right. So those large multi hospital

systems typically have more resources, and ability to deal

with those kinds of things. Smaller community hospitals or

systems might have less resources. Physician practices,

if it's an independent practice, we've seen them close after one

ransomware attack, because the physicians that work there said

it's just not worth trying to recover. Because all our patient

records are in that system, I'm going to retire. So there's

really a significant impact if you're not ready to handle these

kinds of things. And everybody's a little bit different. So I

think one of the things we've got to move towards, and we've

started to do so is to level the playing field in terms of

ability to protect yourself against cybersecurity attacks.

And that's where things like industry consortiums and

government resources, help you do what you need to do, even if

you don't have the same resources as someone who's

bigger.

Okay, that's good to know. And in

terms of, you know, threat analysis, where you're kind of

testing the recovery capability of your organization, how, how

committed is the organization in doing these kinds of disaster

recovery, business continuity planning. If you could, if you

could expand on these approaches, strategies, let's

Yeah, I think that testing your strategies and

say?

procedures is absolutely crucial so that you're ready to execute

on them during an emergency. It's very similar to sports

where if you have a team that just shows up once a week to

play games, they are probably going to really struggle to do

anything intricate on the field. You've got to practice all week

long to get ready for that game. So when it comes to business

continuity, disaster recovery, responding to a phishing attempt

responding to a ransomware attack, any any of those major

types of incidents that you are writing an incident response

plan for, you should be testing that at some frequency. You

could do a tabletop exercise twice a year and bring all the

different people together that would be involved in a

ransomware attack. You can you can do red teaming where you

have offensively minded people on your team, try to break

something or hack into a system, and then tell you what's wrong

and what needs to be fixed. That's actually evolving from

the old Red Team Blue Team, mild Blue team, or the defenders into

a purple teaming approach, where the red team and blue team are

in the same room working together. And the red team will

say, here's how I would attack it, the blue team says here's

how I would defend against it. And then they both go at it

together as a kind of a blended purple team. And that actually

has even better results than the older model. So there's so many

different ways that you should be testing these things. But I

agree with you, it's absolutely essential to do frequent tests

of the most likely and largest impacting types of incidents,

You know, you mentioned about audits. And

that brought back memories; I used to be an auditor in my

first career. We always do audit, it's like after the fact,

and I have been a huge proponent of real-time audit, whether it's

financial, whether it's security, because you want to

know what the vulnerabilities are, what the weaknesses are, so

you get an opportunity to fix it before it's too late. And

there's no point reviewing historical facts, because you

didn't get a chance to fix it. It's past now. What are your

thoughts from the practicality of conducting real-time security

audits?

I think that it's becoming more and more

commonplace. And like you said, it's better to be proactive.

Now, I do think if you've had an incident, you should do a very

thorough review root cause analysis and understand what

happens so that you can make changes and it can't happen

again. And at the same time, I think that there is a concept

that's been around for decades in audit, called continuous

controls monitoring, right? And so when we, as security

professionals put a control in place, you think it's there, you

think it's configured correctly, it's still operating

effectively. But how often are you testing it to make sure and

and so often, you put it in place, and you move on to the

next thing without necessarily having a good operational plan

to monitor it. So what I see becoming much more relevant

lately, is this concept of CCM, the continuous controls

monitoring, where you identify some key controls where if they

were to fail, the impact could be significant, right? So high

risk. And then from there, you figure out how are we going to

monitor this are we going to set up some kind of alert to tell us

if it fails, and it sends us an email? Are we going to

physically test it ourselves every once a week, every day,

every hour, we got to automate that and then only email us if

it fails. That type of approach helps you identify weaknesses

and vulnerabilities before someone else finds them and

exploits them. And that's certainly one of my focus areas,

is to identify what those key controls are, come up with the

monitoring plan based on potential risk. And then make

sure that we're proactively looking at them ourselves,

before someone else finds them.

Couldn't agree with you more, you got to

be proactive. You've got to continuously monitor. You know

Stoddard, as you are aware, based on the media reports, many

of the breaches that have happened, large breaches, major

breaches, the story goes that the organization was made aware,

or a particular individual was made aware, who did nothing

about it. Based on your experience in the field, how or

why does that happen? It's almost borderline negligence.

And that's what the courts have found time and again, in several

cases, they have found organizations to be guilty of

negligence. Can you speak to that?

I sure can. And I also want to be very

cautious because you can't always put yourself in someone

else's shoes, especially after something has happened. Right?

It's very easy to look back and say how did you not see this

going on guys. But I also know that historically, there has

been a certain amount of scapegoating that has occurred

with CISOs, where they were not necessarily given the authority

or the resources to fix problems. They've made

management aware of them and management accepted the risk.

And only when it became a public relations issue that the

organization decide that oh, yeah, what we should have done

something. Right. It's the traffic light mentality. You see

car accidents happening at a corner, but until there's a

really bad one that gets a lot of visibility, they don't pay

the money for a new traffic light because it's incredibly

expensive to put that in there and then maintain it. So you

know, again, I I want to be cautious about that concept of

negligence because it's really easy to throw that word around.

And that's primarily a legal term that results in higher

damages, particularly for publicly traded companies with

shareholder lawsuits. What I can tell you from my experience, is

that the amount and volume of alerts that come from a good

mature security system of anywhere from 25 or more

security tools, is enormous. And no matter how big your team is,

it is a physical impossibility, to look at every one of those

alerts and determine if it's real or not. So yeah, we need

more automation, we need to use more machine learning and AI to

handle that avalanche of data. But the reality is, is you get

so many of these types of warnings, that you've got to use

your judgment, and your artistic skills and your logic to figure

out which ones are the most likely to be going on, and which

ones need to track down in the limited amount of time and

resources you have to deal with it.

You know, that is, you know, very

enlightening to know, it's a hard, hard job, no doubt. You

you touched upon something that brings to mind another topic

that is very close to my heart. And that's the possibility of

joint ownership and accountability. And you just

said that the CISOs, or the security professionals, are made

scapegoats of incidents, they often lose their jobs. But yet

we say cybersecurity is everyone's business, everyone

has a role to play. How feasible is it to have structures and

mechanisms where there is some level of joint ownership and

accountability both within the organization, as well as when

you're partnering up with vendors, where the vendor

organization also has a stake in ensuring your data is secure on

their servers. Your thoughts?

I think that I have been much more successful

at doing that within the organization than I have with

vendor partners. So you know, talk about them distinctly.

Internally, there is some responsibility with the security

executive via the CISO, or anyone else to build that kind

of framework. And by that I mean, if a CISO operates

independently and in the dark, and throws around a lot of

technical terms and doesn't do a good job of explaining why then

they're not going to kind of build that shared accountability

concept with the other key leaders of the organization.

Right? What's very important from my experience is to explain

the why behind things, to do shared decision making about

which areas need prioritization based on risk, which ones you're

going to jointly agree to not do anything about, or maybe do a

slower rollout, for different reasons, be it financial,

operational, and so forth. And even get some guidance from key

board members so that they understand the risks that you're

accepting the risks that you're not willing to accept, and, and

how much to invest. Because there is eventually a declining

ROI on those things, right? You can never eliminate risk unless

you just stopped doing business and turn off all your computers,

that's probably not going to happen for most industries. So

that's where I think that shared accountability it comes from it

comes from shared decision making, shared prioritization,

shared understanding of what we're willing to accept or not,

what threshold of risk can we live with? And what do we want

to remediate otherwise, that's internal. When it comes to your

vendor partner, network, that is way more complicated. Same thing

we talked about earlier, where healthcare has this disparity of

capability and resources. vendor partners have the same thing,

right, you've got the really large ones that are well

resourced, and they'll, they'll hand you their procedure sheet

and their third party audit reports of what they do for

security. Then all the way at the other end of the spectrum,

you've got what I consider to be small business websites that

might run a specialized program for real estate or some other

niche purpose. Where, you know, they say we were in a pen test

once last year. But that's it. And meanwhile, you've got an

area of your organization that's screaming, saying we have to use

this as the only one that'll meet our requirements. And

you're trying to tell them, Okay, but they're going to have

the ability to log into our network. And third party

breaches is one of the most common tactics to break into an

organizatio now. If you look at some high profile breaches,

you'll find that they came in through for example, an air

conditioning contractor who responded to a phishing attempt,

use their credentials to login and then they escalated from

there. Well, I don't really want to bet my organization's

security posture on the security capabilities of a 1000 or more

independent, contracted vendor partners who may or may not have

reasonable security practices. So it's up to me to make sure

I'm working with everybody to get the right controls in place

and give the minimum necessary access to these organizations,

and make sure that people are aware of the risk before they

engage in business with these types of companies.

Fabulous, very, very insightful. Started.

Thank you so much for your time today. Before we conclude any

final thoughts for the audience?

I would say that my journey has been very,

very interesting in the cybersecurity industry, in

particular for healthcare, it is a complex one, but also

rewarding. It's one of those few industries in my opinion, where

you can truly find purpose and meaning in the long hours and

the resistance that you have to push through. And I am very

grateful to be in the position I'm in where I can help protect

patients and enable our caregivers to take care of kids.

Well, thank you again, Stoller, for all that

you do, appreciate your time on the podcast, and hopefully,

we'll talk to you again in the future.

My pleasure, thank you.

A special thanks to Stoddard Manikin for

his time and insights. If you like what you heard, please

leave the podcast a rating and share it with your network. Also

subscribe to the show, so you don't miss any new episodes.

Thank you for listening, and I'll see you in the next

episode.

The information contained in this podcast is for

general guidance only. The discussions assume no

responsibility or liability for any errors or omissions in the

content of this podcast. The information contained in this

podcast is provided on an as is basis with no guarantee of

completeness, accuracy, usefulness, or timeliness. The

opinions and recommendations expressed in this podcast are

those of the discussants and not of any organization.