Cybersecurity as Patient Care with Nick Sturgeon

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with Nick Sturgeon, who's the Chief Information Security Officer of the Community Health Network based in Indianapolis, but covering a lot of Indiana. Nick, welcome to the show. Nice to talk to you.

Yeah, thanks for having me. I'm excited to be here.

Awesome. And noting that you are, you are hailing from a podcast studio of your own. I think you are a prior or current podcaster yourself. Is that correct?

Yeah. The, the podcast I have is on hiatus while I'm finishing up my PhD. So not a lot of time. And as you guys know, there's a lot of time and effort that goes into doing a podcast. It isn't just doing this. It's the pre-game stuff. It's the post editing and all of that stuff takes time and being a host of one and all that stuff falls on me. And so. Don't have the times.

PhD, fairly new CISO role, and then also town councilman. So maybe let's use that as the segue to get right into the who is Nick Sturgeon conversation. Give us a little bit of your story, maybe starting kind of how did you come up in cyber, and then obviously some of the things that you're into now.

Yeah, so I've always been in technology. I had my Bachelor of Science in MIS from Indiana State back in '03. Got into actually law enforcement early on, moved out west to Las Vegas for about a year, came back, some personal reasons for having that move back. In 2006, got into law enforcement and was part of the 67th Recruit Academy for the Indiana State Police. Actually, it was my IT and tech background that really helped, you know, kind of separate me out from the other 6,000+ people that applied for the 150 spots.

So, it's unbadged server credentials that was the topper there?

Yeah, I really do think it was the IT piece that pushed me over and kind of had that differentiation between all the other folks that were criminal justice majors. So yeah, got in the academy in '07, early '07, January 26th to be exact. I'll never forget that day. Um, and the 6 months, um, of, of the academy, which were fun, but I always knew I wanted to be in, in— of course, now cybersecurity wasn't really a thing back when I was in, um, undergrad. It was, you know, you know, cybercrime was a thing, information security, but I always knew I wanted to blend law enforcement and my IT background and was able to, to get in and do that early on in my career. I got promoted to sergeant in our IT section. So really got to immerse myself in both the IT side, supporting an enterprise network of applications and got into actually supporting the ISP Cyber Crimes Unit, being their tech support, but also getting digital forensics, cyber forensics training. And that led me to Purdue to get my master's in cyber forensics. And then, you know, from there, the, you know, the opportunities with my career in the private sector opened up and actually did a little stint at the Indiana Office of Technology running two statewide cyber programs for a couple of years and then on into the private sector after that. And then, you know, I was at EY for a little bit, got the consulting piece. I was at Ponderance. I managed their security operations center for a little bit. And then, you know, prior to here, how I got into healthcare was worked for IU Health for about a little over 4 and a half years. And then the opportunity at Community opened up and it's not often here in central Indiana, a CISO role in healthcare opens up. So, it's one of those things, it's like, if I don't do it now, who knows when it's going to happen again. Obviously got the job and been at Community for just over 2 years now.

Love it. So being in healthcare for a while and obviously navigating through Change Health, which I think opened the eyes further of a lot of health plans and healthcare organizations on the importance of business continuity and downtime procedures, but kind of what's been your eye-opening—

Yeah, that happened basically 2 months into me as a new CISO. So imagine coming in as a brand new CISO and here's Change Healthcare. Wow. Boom. Cross.

Welcome to the team.

Yeah. Here you go. Nothing like, you know, trial by fire, right?

It's like, don't you miss that Nigerian prince from like 15 years ago? They're just trying to get his wealth out of the country and he's evolved.

Yeah. Or going way back, the Mariah Lovebug, you know, since it is, you know, day before You know, Valentine's Day. There you go. Yeah, those, that's old school.

You better knock on some wood. AI just heard you and they're going to spin up the Lovebug 2026. You don't want that. Knock on some wood there, buddy.

Nick's ready, man. Nick's ready.

Yeah. Awesome.

Well, I think give us a little bit more insights on being part of healthcare, human health, maybe what's different from some of your peers and kind of the focus maybe that are in other industries, manufacturing. What is it about human health that's kept you there for, you know, 6+ years? And then maybe what's different based upon the focus or the tactics that you're using versus other industries?

Yeah, great question. You know, as I mentioned, I bounced a little bit after leaving law enforcement, that public service side of me that, you know, we call it you get the bug or, you know, it's in your blood to go into public service. And really healthcare is, probably the closest to that mission of law enforcement, of service and protection. You know, really, the way that I look at it, and I've looked at it since I first got into healthcare, is if we don't do our jobs and our systems are not secure, lives are at stake. And that's really what drives me and my mission and that purpose of what I do. And I, you know, to my teams, it's like, you know, if we fail, people could get hurt.

Makes sense.

Well, and I kind of want to talk about this identity crisis of modern security. I know you had the same thought too, but you often mention that the perimeter is no longer just the hospital walls and it's kind of wherever the patient or the employee is. And we've mentioned before how OCM, organizational change management, is that bridge that helps people accept this new, more intrusive reality. When we, you know, how do you use OCN to change the narrative, you know, from like IT is watching me to we are guarding this mission together?

Yeah, you know, COVID really just exploded the perimeter of not just healthcare but all enterprise systems. It isn't just the four walls of the building anymore. It is, you know, you've got your device and everybody's got, or most everybody has their email, corporate email hooked up to their personal devices. You're at home working off personal devices. You got patients that are coming in and out of networks. And especially with, I think the challenging part with healthcare is we've got medical devices in patients' homes now. Home health has been a huge thing. It's exploded since COVID because of COVID And so now, there is really no true perimeter. It is really expanded to every patient's home, every employee's home. And so that makes it challenging to defend the concept of, "Well, I only have to worry about these four walls," is no longer. And now as CISO and security teams, you've got to think about how do we defend against this and which the tools and the technologies change to be able to do that. Security, by the way that we do, we're a friction point for for business, it makes things harder.

Yeah.

Passwords, multifactor authentication, all these other things interrupt those business flows that typically, I'm just going to get it done. And nope, I got to log in and I've got to type a password in or hit a hardware token or whatever the case be. That takes time. And in healthcare, kid you not, and I've said this in open forums before, is nurses especially will count. Well, if I have to enter 2 more keys on a, you know, go from 8 to 10 or 10 to 15, that is going to be 5 seconds of additional time. And if I've got to enter in my password every 30 minutes, every hour, they will calculate the time over a week, over a month, and a year of how disruptive those changes are to patient care. And so if you're in manufacturing or if you're in just a normal business, you know, okay, so what? But when it's actually, you know, if there's an emergency, somebody comes in the ED or somebody's in ICU and they, that impacts patient care. So when we talk about OCM, it's like we've got to think about how is this going to really impact patients and the delivery of healthcare in either the ambulatory or acute settings.

Yeah, well, and I think too, kind of like, you know, you mentioned earlier in your famous, you know, ISP or police background, you had a badge and a uniform to kind of signal authority. You know, I think now as a CISO, you don't. So it's how do you exert that influence and drive change across an organization where you can't just give a citation for bad cyber hygiene?

Yeah. And I think that's even in leadership too. You know, when I was a sergeant and I had people, you know, chain of command, I'm your boss, you're going to follow my orders. And, you know, in the civilian sector, you don't have the same, yeah, I may be your boss. I could write you up, but now I got to get HR involved and get all these. So that, that how you lead is different. How you influence people is different, definitely different. And I think where I have found that has been successful is connecting to patient care. It's like, and say, we're, we're in the same thing. We want to make sure you're able to provide that patient care safely. And it's no different than, you know, every year we've got to do all the infectious disease, you know, trainings and all that. It's no different there. You know, it's just digital versus physical. And so, having that conversation and relating what we're trying to do to what matters to our, what we call caregivers or employees, that helps. Now, you know, it's, 80/20 rule kind of generally, you know, most people get it and then you're just going to have that certain population that doesn't want to do it. But okay, we can work through that. But I think really trying to relate what we're doing to the mission of, you know, our health system, I think is kind of how that first step of getting folks to get on board and adopt these, you know, whatever new security rule or change or policy that we try to implement.

No, that's great. Yeah. And Nick, for similar reasons, Reveal Risk, you know, I spent a lot of my career in pharma, but we've heavily aligned to human health, whether that be pharma, life sciences, biopharma, healthcare, and then also, you know, payer insurance, which has many challenges, not only from a cyber standpoint, but just kind of the, you know, how, how patient care is being funded and all of that. So we've been thankful and excited, motivated by having a huge part of our practice be focused on that. I want to go back to a comment on perimeter and you were talking about remote work and COVID and obviously we've all adjusted from that, but it's still, still adjusting. I would say there's never done because that perimeter is always changing. Maybe broadening the question a little bit, because we've, I've seen kind of the new perimeter shift again with AI. And I'm curious your thoughts, especially within healthcare, as you think about e-health prescribing and telehealth. Deepfake, like two questions. One, what are your biggest risk concerns with AI? And then what are you most excited about within AI and healthcare?

Yeah, I mean, there's so much, and I think we're not even at the tip of the iceberg with the risk of AI healthcare or in the industry in general or in life in general. But really it's, okay, for AI to work, it needs access to the data. Given that HIPAA and even other state privacy laws are around the data, the breach of the data, it's okay, how do we put controls and limit and have good governance on the vast amounts of data? And it's stored in a number of different locations, but how do we effectively apply those controls and permissions and labels and just, So that way that whatever model it may be, that if it doesn't meet these certain policy criteria or, you know, conditions, then it doesn't get access to the data. You know, when we were first talking about turning on Copilot and again, CommunityHealth as a network, we've been pretty headfirst into AI and not shy about using it, but you've got to do it cautiously. And it's like, okay, we've got to get data governance down because, you you know, Copilot, it's got access to Teams and SharePoint, email box and all of that. Like if permissions aren't set correctly and, you know, somebody has set something that's got PHI or PII or financial information to anybody in the network to see, then even if it is a, you know, just it's doing what it's doing, it's a tool and that could potentially cause a breach because somebody, you know, the tool has got access and the data has been exposed to, one or more individual that shouldn't have been exposed to that PHI, and we've got a data breach on our hands.

Yeah. Nick, have you seen a resurgence of decades-old topic of info class, data classification? You mentioned data governance.

Yeah.

I mean, we are working—

Microsoft proclaimed that, hey, for your Purview instance, you're going to need data classification to be able to tell us what you want in or out of Copilot.

Yeah, in utilizing Purview as well as Varonis to help with that classification. I mean, it's a machine. I mean, yeah, it's a much smarter tool than maybe what we're used to, but if the metadata says this is PII or PHI and we've got those rules that say you cannot be accessed under, except under these conditions, da da da, if it's just open, it's not going to know. It's going to say, oh, okay, I'm going to try to do what I need to do. Here, you know, whatever key terms in the prompt, you know, are, you know, the user's asking for, I'm gonna go out and do it. So while it's intelligent, it's still a tool and it isn't, you know, it's just gonna go do what it, it's been asked to do. And, you know, it, it's could, to me, that's been my biggest worry, that overexposure of data on steroids.

Before we move on, Nick, what's the thing you're most excited about just to counter the, the concerns and the threats?

So, you know, just the, it's not just the admin day-to-day stuff, efficiencies that you can get with AI. It's, you know, just the opportunity in the healthcare sector with some moderation and human intervention of just diseases and cancers, potentially finding cures for those things that because of just limitations in prior technologies that we may now have the ability to get cures or provide different healthcare outcomes because of all of the data coming together and finding those correlations or connections that because of datasets being disparate, now AI can help bridge those gaps and find some and just help treatments, you know, and better treatments than maybe we've been able to get before AI was being used.

I want to chat a few things too about like, you know, back to OCM and kind of process type things. But, you know, I know some CISOs will see like process and OCM as a phase 2 activity or something to do after tech is deployed. I think you're a little more innovative in like, do you believe that it should be the first step in design of a security program, or where do you see Process and OCM fitting in in that kind of phase of rolling out a tool?

Yeah, and we were talking about this off camera, so to speak, beforehand is, as my previous role is like, okay, here's the project, implement the technology, get it done. Really, and no fault to anybody, you know, I come into CISO and get my first big project of security implementation, you know, new tool that we're putting out there. And the tech part was the easy side of things. It was, oh, how are we communicating this? You know, how get the adoption? Because we really were forcing adoption of this particular technology. And the friction point throughout was the OCM is, you know, folks thought we were being intrusive or people didn't want to, you know, give up the information or, you know, didn't want to download the app on their phone or, you know, whatever reason that they came up with. And again, just from lack of experience, I should have put more focus on the change management and the adoption at the beginning. Of the process, how the effective communication and the why, and, you know, really, you know, even getting out to, you know, the workforce earlier to say, okay, this is, you know, how would this affect your job and disrupt those processes? Again, it's knowing the business, it's understanding that, again, nurses and physicians, other providers, they just want to be able to, to get to the patient and have that conversation and, and get the treatment plans and all that stuff as effectively, efficiently as possible. But those— these security tools, again, like I mentioned earlier, are disruptive to that, even if it's just a second. And so I think it, you know, to really answer your question, needs to be a part of the beginning stages of, um, every project. I think, and that's one thing I think community does very well. Um, and again, part of me coming into, um, the organization new to understand that and learn that. And I would, and I feel that again, as the role of CISO has changed from being highly technical to really being more of that understanding and of the business, still you got to understand the tech. That, that'll never change. But the shift of tech to business acumen is definitely a higher percentage of the business acumen.

Yeah. Well, I, I always think if you had to choose, question, you could choose between a $1 million Gartner Magic Quadrant top right tool with a 0% OCM budget or a $100K tool, a give you a challenger up and coming with 100% org buy-in. Which one keeps you sleeping better at night and why?

I would say the latter because one of the— and actually had this conversation recently here in the last couple days— is people will find ways around the security controls and tools. And I've said this for years. I want people to go through the security tools and controls that we have set up because I can monitor for it. I can alert on it. Understand it. So even though I've got my own feelings about Gartner, but I would rather something that's going to get 100% adoption by the organization, even if it may not be the most tested or the most brand-recognized tool. We can make the technology work, get it to work along the way, but at least we are getting the adoption of our workforce.

Having some FOMO. You got a great question game going on, so we're going to keep them coming out rapid fire for Nick. You mentioned business knowledge and understanding the organization, and I know you've had some experience with both sides of this, so I bet you have a good opinion or answer. You have a choice between filling a role, let's say it's a GRC leader role or something kind of in the medium tech requirements bucket. Do you hire a practitioner? A business person within the organization that has a high motivational fit and desire to learn cyber? Or do you hire the stereotypical infrastructure guy that knows the nuanced depth and you know they're going to be rock solid from a tech standpoint and teach them to learn the business of healthcare?

Yeah, I think it depends on the specific role. And I've actually had to make this decision in previous roles. Is what do I want? The, again, if it's from an offensive security perspective, I need a senior pentester. I want the high-end technical person for that type of role. If it's a GRC or maybe it's kind of mid-level, I may choose the person that's got the fire and wants to learn. And my feeling has always been I can teach people technology. But there's those soft skills and certain things that people either have or don't. And if I need that, I guess if it really came down to it, give me a person who's highly motivated with zero skills. I can mold that person into what I want them to be, and I can teach them the technology. But it's, it's really hard to— somebody may be highly technical, but if they're not motivated to learn and get after it, They're not. I would much rather the former.

Yeah, no. And you failed just to ask me for a C, all of the above answer. In the reality, real world, all of the above is often not available. That's what we call a unicorn. So I, from my corporate experience as well, I, as well as have had success on Motivational Fit winning and some really good hires from the business side that actually went on to, we've had one of them on our podcast, Chris Farr, that went on to build a career out of cyber after coming out of, you know, finance and Six Sigma. So yeah, it does depend, but totally agree with you, like motivational fit and desire usually trumps all.

Yeah, and it's, you know, it, it, I do the, the political answer of it depends, but I, one of the things, and I kind of get off on a, a little side tangent here is, you know, the, and I've experienced this as well, coming up in a non-traditional cyber background is, well, you don't have this certain pedigree. And it's like, I, I, you wonder why we're in such a, a position of a number, a large number of jobs not being open when certain folks, not everybody, but certain, well, you've got to have this pedigree. Well, we need new blood. It's going to take folks from different areas. To come in and be able to— that don't do the CS or the highly technical degrees and da, da, da, da, da. We need folks that come in from different areas and begin, as I said, the job, some of the roles are changing, especially with GRC or kind of these IT audit type of roles where we need folks that understand, like technology, know how it, incorporates into the business, but they don't have to be highly technical. They didn't, at least starting out, but if, again, if they're motivated and they want to learn Python or SQL, some of the, you know, whatever, give them the opportunity to upskill.

All right, man, I'm going to bring it home with some kind of fun questions now. You know, I want to kick off with one that's a new one. So even Aaron doesn't know this question, but what is one cybersecurity word you wish you could ban from the boardroom to make change management easier.

That's a heater, Cody.

I know, man.

I'm coming in hot. That's actually not so much a word, but maybe just a phrase.

Or a phrase.

A CSI effect, you know, that, you know, cyber happens like that. Some of these things just don't. It takes time. And I've seen that in juries and other aspects where they watch a TV show and be like, oh man, you can hack a cell phone in 2 seconds. No, you can't. Not really. Or you can, you pull this data in this record, you know, speed. And it's like, nah, that's not really how it works in the real world.

Mine, Cody, you didn't ask me, but I'm going to offer is eyes on glass. And that's probably more of the cyber leader saying that versus the business. But, you know, at this day and age, like, when are we not eyes on glass? And it's kind of a catch-all for like, we're going to do it all. It's going to be fine. Like we get people people with eyes on glass.

Also, is it glass anymore? Are people still rocking CRTs or like the CRT monitors? Is it all like eyes on OLED?

Actually invalid. So I'm gonna, I'm gonna call the next person out that says eyes on glass.

Man, well, cool. Well, Nick, also I'd like to ask, like, you know, obviously you're a seasoned leader in the area, you know, respected by a lot of people and doing a great job out here in the community and in the CCISO community. But you get, you get to get a phone call. You give— pick up the cell phone, you get the call, the Nick of 20 years ago and give him a couple sentences or a couple, you know, blurbs of advice. What are you calling yourself and telling yourself 20 years ago with some advice?

Yeah, be patient. You know, things happen when they will, when the time's right. You know, there's things, even career and trying to make that move, you know, you want the right fit. You don't just want to rush at the first opportunity. So be patient. You know, I think that I struggle with that all the time, but to go back and say things will work out the way that's supposed supposed to. There's lessons to be learned, um, you know, in the situations that you're in, and, and just absorb everything.

Awesome. Nick, I mentioned at the beginning as we were talking about, well, my reflection of how do you get it all done with, uh, councilman, PhD, CISO, and probably kids and all your other hobbies that you probably have. But what have you learned, without getting into politics and all that, like, what have you learned by being in politics and, you know, being a councilman within your township and how that translates to politics that are in the workplace or specific departments and so on and so forth.

Aaron Pritzker: Yeah. Well, we'll stay away from the big P politics and all that stuff, but really it's about dealing with people, understanding people's motivations. Again, how do we get people to do things that we want to do without that threat of authority, you know, that, you know, the badge and the gun, if you will. Cody, you brought up earlier, but it's interacting with people, really paying attention to understanding their motivations, their wants, what drives them to do things and really utilize that, you know, on the council side and the big P politics to bring it in. And same thing. So just, it's politics of different flavors. And, and, you know, so it's just, it's, so there is some crossover there. So understanding and, you know, having to deal with getting yelled at as a council person because folks don't feel like you did something right, you know, as a policy decision, or you come in on the CISO side, well, why did you change this, you know, security policy, and getting yelled at there. So it's just a little bit of similarities, but it's all—

I can imagine you were mentioning with the, the weather being -10 and water mains breaking and like across the state and you got to deal with complaints, probably same thing. Like, are you blocking Cloud Copilot with full open access to everything on your PC and the network? Probably some similar conversations to say like, hey, here, we're trying to help. Here's what's reasonable.

Yeah, very much so. There are a lot of similarities there. Oh, you know, this security upgrade broke this and, you know, the business is screaming or how dare you. How dare you do this?

I did, I did one tour on my, uh, 1,000 Change the World and joined my HOA for a brief 2 seasons and realized that it's not how you change the world. So I resigned immediately. Anyway, well, Nick, thank you again for the time today. We really appreciate it. It's been great hearing from you. Um, I'm sure listeners will enjoy it as well too, but Aaron, I'll let you wrap us up.

No, no, I think you already have, Cody. Nick, really appreciate talking to you. As always, thanks for all your passion on human health. Healthcare, general public service as always, and keep fighting the good fight. And, uh, and, uh, we'll all win and save the world one, one person at a time together.

Awesome. Thanks for having me on, guys.

Awesome. Thanks everyone.