Third-Party Risk Management in Healthcare

Thanks for tuning back in to Simplifying Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're pleased to be here with Kelly White. And I've known Kelly since my days at a large pharmaceutical company. I think we met at the Healthcare ISAC and had great conversations and just have kept having them over the years and regularly now. Happy to, Kelly, finally have you on the show. I can't believe that we've waited this long to do it, but thanks for, thanks for Yeah, it's a pleasure as always to be talking with you.

Thanks for the invite.

Awesome. So today, and I know you've focused a lot of your career, we'll let you kind of tell a little bit of your brief story, but you've had time in financial services on the corporate side and time in consulting to start your career. And then obviously we met as you were supporting with RiskRecon, uh, the pharmaceutical industry, but give us a little bit of your background, how you found your way into cyber and, uh, what you want the listeners to know about you.

Yeah. Um, uh, my, my story in cyber is pretty long. Started building, soldering Timex Sinclair computer together back in the late '70s. Wrote, had to write our own software for video games. I mean, copy instructions, not, not invent our own. Uh, so that got me into programming and took that through high school. Was actually an accounting student, an accounting major in college, but I did, I did a research paper on cybersecurity. Well, not called cybersecurity at the time, but in the mid-'90s and pivoted over towards what was information systems at the time then, and was fascinated with it enough in the mid-'90s that I decided to make a career out of it and had the good fortune of joining up with a great group in Silicon Valley with Ernst Young where they they were standing up a security assessment or what was called at the time ATT&CK and penetration testing services. And yeah, that got me going into 8 years of consulting and then 10 years at a financial institution.

And I guess I knew you when you already had founded RiskRecon and were kind of expanding your marketplace. What prompted you to make the entrepreneurial leap?

Yeah, I think practitioners have the best view of the problem. I mean, that's an obvious statement. You know, as you're in the trenches solving problems, one of those that was pressing on us at the time, and it really started in like 2009, I think, for the bank I was at, the bank brought on Salesforce and that opened the floodgates for like, hey, we're going to—

Yeah.

Outsource systems and services as a strategy, because this is so much more efficient and faster than build and operate internally. And so we were dealing with a flood of requests for assessing vendors, and all these vendors wanted the bank's sensitive data and customers. And so you're kind of looking at the questionnaires going like, is this really true? Like, everybody's passing these questionnaires. I mean, I don't even pass my own questionnaire like this. And so I was just looking for more data to substantiate what vendors were claiming about their programs, about where there's even basic questions like, where do you host your systems? Oh yeah, it's all in, in the internal data center. It's all in this one hosting provider. I'm like, is that true? And so I started digging into open source places on the internet to find answers, my own objective answers to substantiate what vendors were saying in questionnaires and found a treasure trove of information where I, you know, I developed this kind of saying that, you know, you can't do anything on the internet without revealing at least in some part the quality of your cybersecurity program. And with that, thesis, I started writing code to systemically identify the systems companies operate on the internet and, you know, mine information out of those to get indicators of what their cyber health was. And that was really for 4, 4 and a half years. That was just a side project, nights and weekends. But it turned into 30,000 lines of code that actually worked. Yeah. And that became RiskRecon.

Well, it's been great. I mean, I think it's got loads and loads of data. I know the software personally, but you had a cool white paper that I think we looked at recently that was on healthcare cyber incident correlation in US health sectors over the past decade and data from RiskRecon. So to our listeners, if you have not checked it out, it's a phenomenal white paper. It's on riskrecon.com. But I want to hit a few things that I saw in there that were pretty interesting. I think one was like over the past decade, healthcare has consistently led breach volume, but what do you think makes this sector so uniquely vulnerable compared to others like finance or education?

Yeah, yeah. So what our data shows, again, all sourced from RiskRecon, and we have a team that really does quite a good job of cataloging every publicly reported cybersecurity breach event. And as we take that data, we correlate it out to like, well, what industries, what's the size of the company, What's the geography? What's their cybersecurity hygiene at the time of the breach event? So it makes for really fascinating objective insight into breach events and kind of who's getting breached and, and, you know, what are their conditions and so on. And as it turns out, as you say, uh, you know, healthcare and the white paper you're referring to is specifically a study of about 15,000 healthcare organizations in the US. And what's the breach events over the last 10 years for them. Zooming out, 37% of healthcare organization— sorry, when you look at all the breach events that have happened in the last 10 years, 37% of those have been of healthcare organizations.

Wow.

And so, why is that such a big target? Why healthcare? You know, I think there's a few factors that that contribute to that. One is I think that threat pressure pivoted over to healthcare later than it did the financial sector.

Yeah.

So, if you actually looked at breach events pre-2015, like before this 10-year study, but if you look back starting in 2000 through 2010, those were really more financial-focused.

Yeah.

There was a pivot towards healthcare I think part of that was that the threat pressure was on financial institutions. So healthcare wasn't under the, you know, the threat scope so much. Regulations were focused on the financial sector. You got the threat pressure, you got the regulations, you've got budget, and you've got, they're really working on it. Healthcare really operated without that, those motivators, I think.

Yeah.

For quite a period of time, but it came on fast. And when it comes on fast, that creates its own challenges. The other thing is that I think that as complex as the financial services is from a technology and infrastructure perspective, healthcare is an order of magnitude more complex.

Yeah.

As I understand it, you know, manufacturers of medical devices that have embedded software can't even update those without getting certain approvals. So, it's just a very different dynamic in healthcare, very different attack surface, very challenging. But at the same time, when you look at it now, you know, who needs to be operational 24/7, 365? If you had to pick one, it would be healthcare. So, they have high operational requirements. And they have what I think is the most sensitive. If somebody got my financial information, okay, I can recover from that. But if somebody gets my healthcare information, for certain people, you know, that can be really devastating.

Or shuts down a medical device. I mean, I know we've had several confirmed patient deaths in hospitals with ransomware. I think that pressure alone, once that tipping point had been covered or toppled, there was a flood of, in my belief, threat actors that like they knew that, that they were going to pay. And that's really what it's all about. Like even with like ransomware insurance, it with insurance isn't going to help you through the operational gaps that have been caused.

Yeah.

The report mentioned something about, well, an obvious thing that a lot of healthcare companies have dramatically improved their cybersecurity hygiene after the breach. And this happens everywhere. But if, you know, if you were to coach a hospital CEO, what are some of the things that you've seen based upon the data that they should be proactively doing before the breach, even if they've not had their turn yet?

Yeah, I mean, the data consistently shows that good cybersecurity hygiene matters. And if you're an organization that's demonstrating good cybersecurity hygiene, just based on these 22,000 breach of— if you look at the 22,000 breach events in our study, and companies with good organizations with good hygiene have, depending on what industry sector you're in, between 4 and 6 times lower rate of breach events than those with poor hygiene. So, good hygiene, 4 to 6 times lower frequency of breach events. And this is, you know, across the total study. Looking at around 200,000 companies, 20,000 breach events, who's getting breached? Those with poor hygiene. Those with poor hygiene, 4 to 6 times higher than those with good. And so what's behind that? Like you're looking at things like remote access, you know, secure remote access. What's the quality of the remote access? The presence of unsafe network services. Like, do you have Telnet or database listeners out on the internet that are easy attack vectors? Software patching. And then the one we can't measure so well from RiskRecon's perspective, but of course it comes down to people. So many of these attacks start with phishing. But companies with good hygiene, you know, you're taking care of the basics. And again, if you look at ransomware attacks, just trace it back. There's enough incident reports out there that you can say it's phishing, it's vulnerable software, it's unsafe network services, it's unsafe remote access. Take care of those things. Those are hygiene things. And that's not trivial to do in a large organization. You gotta really have— and you have a front row seat to this in your consulting practices— to say, "Hey, you know, do a good job of managing software vulnerabilities," or, really keep unsafe network services from being exposed from the internet. That sounds like that's a, those are very short statements, but having your IT in your organization operating in a way that consistently does that, that's not trivial. So it takes organizational discipline. There's a lot behind it.

And it's the not, it's not the sexy work either. Cause sometimes it's, it's fundamentally, you know, a, a, a real, a real, you know, drudge to get through. But I guess if you were back, So if you went back to a CISO role in healthcare today and you had a limited budget, which most healthcare organizations don't have a blank check, and even if they have all the money they need, the change, the cost of change and people, organizational change management is probably the biggest hurdle that we see. But where, where are you spending your money and your time in the first 30, 60, 90 days?

I'd say secure remote access and identity and access management. I might be wrong, but you can't be wrong by starting there. There might be some other equal opportunities. But, you know, a lot of breach events are not, they're not zero days. They're really kind of a failure in identity management or an insecure remote access type of scenario that's really going to come and get you. If you don't have those foundations in place, you don't have much to build on.

Yep. Yeah. And sometimes you see companies wanting to rush for the sexy project, you know, a great threat intelligence tool or, you know, an XMDR capability that will tell you the alerts, but It's almost like if you don't have the foundation poured and stabilized and you're putting the third floor watchtower on, it's really tough to really— you're going to be in a defensive reactive posture regardless.

Yeah. One thing I think about too, you know, about like hygiene and like third-party risk, obviously that's a big part of RiskRecon, but we get a question, I get this question probably once, twice, you know, a week is integrating AI into specifically third-party. And so as someone who's built a successful company and sold it within third-party risk risk and everything. What are your thoughts where I think, hey, if I'm looking to make a few bets on AI within my third-party risk program, where are you saying go big and where are you saying to practice a little prudence and see kind of how things fall out first?

Yeah. You know, I think the application of AI, and maybe this is applicable more broadly, is as you look at automating processes that are very routine and really don't require the work of a professional but are time-consuming. And so, questionnaires or straight off the top AIs. There's a number of solutions out there. RiskRecon has one, but you can take a questionnaire of your, whatever one you're using, and you can take a body of documents from your suppliers. And rather than asking them to answer questionnaires, you just say, hey, give me, give me the docs you have about your program. The AI can read it, answer the questions, tie it together, present it to you in a way that says, hey, with this degree of confidence, they have this in their program, these things in their program. Hey, here's some areas where we just can't get it out of the docs or our AI just doesn't get us to a confidence level. So you could whittle down that questionnaire process from, you know, weeks to hours, for example.

Yeah.

So that, that's good efficiency. And what you're really doing there is you're looking for opportunities for your professionals to spend time on higher value problems. And that's really what I think we need in third-party risk management because the supply chains are so complex and they're embedded with so much risk. Still to— still today are not treating it as they could.

Yeah.

Just because of budget limitations and realities. But if you can free up those, if you can pinpoint, start pinpointing better where risk exists, automatically. And you know, that's what RiskRecon does, right? RiskRecon's, it's not questionnaire-centric, but you know, we're surfacing direct evidence about the quality of their software patching and network filtering and malware and, you know, all these different things. But what all of these things are doing is, and AI included, is pinpointing where risk exists, where there's evidence anyway, higher probability of risk existing, and then your professionals have the time with that increased automation, with AI, with RiskRecon, to spend time with those suppliers and internally having the conversations with the business owners. Should we transfer risk? Should we work with them on remediating it? And so on, treating the risk. And so that's where I think the opportunity lies today. And I think that that's where, you know, as I look on the horizon, it's getting better at you know, packaging, collecting all of this data and structuring it in a way to enable risk professionals to understand and act quickly.

Yep. I think with so many vendors and so many potential rabbit holes that you can go down, that focus element is so critical.

Yep.

You know, because even with companies that have hundreds or thousands of vendors, like, Man, if you could take the top 10 and go really deep on those and then still have coverage on the others, but go deep in specific areas with the limited practitioners that you have allocated, you can actually reduce more risk. And I want to pick on or amplify one thing that you mentioned on risk treatment, because we still see today a lot of third-party risk programs that have all the tools and have lots of things in place, but they don't actively have a risk treatment. Program or approach. They're not tracking findings, they're not holding vendors accountable. So it literally turns into a paper dragon exercise. And with AI coming into it, we're now seeing AIs talking to AIs and fabricating results on both sides. So I think really, if we're going to improve in this place, spot on with your advice, we've got to focus on helping— having AI narrow our focus, have the smart practitioners go deeper in limited areas. And then really get findings management right because you can't reduce risk if you don't treat risk.

Yeah.

Yeah.

One thing I think about too, so obviously a lot of great stuff, Kelly, you've got a long career of just success and some great things. You get a phone call that you get to make to Kelly White 20, 25 years ago.

Yeah.

You know, 2-minute phone call with like 3 bullet point tips. What are you saying?

The first thing I'm going to say is just give. I think the best things in your career are going to come. Number one, you're going to do really good work in your assignments for your employer. Be a really good employee and really lean into it. The things that you give outside of those work hours, though, are going to be where you really were really things take off and take off in ways that you just can't expect. Whether that's additional learning and study, developing your own research, publishing papers, it could be working with working groups, you know, volunteering, doing volunteer work with nonprofits who need help with cybersecurity, working with a conference, whatever. What you give outside will return to you greater than what you gave. And I'd say that's where, that's the first thing I would say. It's a bit of an act of faith. And if you're, you know, you got to do it authentically, not looking, doing it with the intent of getting something out of it. That's not the way to do this. It's really a genuine thing you're giving with the right motives. That's the first thing. The second thing I'd say, and probably the last, is like, hey, this, this is going to be a grand adventure and it's going to take you places you'd never expect. So don't, don't try to script it so tightly that you're not open to the opportunities that are going to come your way. And when those, when those opportunities do come your way, err on the side of taking a risk yourself.

Getting out of your comfort zone. What do you always repeat?

Growth begins where comfort ends.

I like that. So there, there's 3. That I really believe in.

Yeah, that's excellent. That's excellent. And I say, you know, beyond the third-party risk and the software, and I had a pleasure meeting you and reading your white paper, what's— give our listeners a little bit— what's either a fun hobby, Kelly White outside of cybersecurity? So musician, play an instrument, while X-game athlete behind the scenes, getting warmer.

I do a lot of dirt biking in the mountains and the deserts of Utah. I'm blessed to live in a state where it's like 90— I don't know, 70% of the land is public land. And so you could really venture out for thousands of miles, but I've got a group of friends. The group varies from 4 to a dozen depending on what we're doing, but every week Thursday, late afternoon into the evening, we're out in the mountains on our dirt bikes.

Oh man, that's awesome. You got the whole garb with the helmet, the pads and everything, man. Got the cool boots.

Neck brace. I guess you call the sport hard enduro and it's a hoot. And then in the winter, it's all about skiing, which Aaron knows all about.

And I frequent Utah. It's a good, easy location to fly in direct from Indy. Be out to the slopes in 30 minutes. You can ski that first day, lose 3 hours or gain 3 hours coming over. It's great.

One last thing I'll say, what's, what's your third-party risk process when you bring on some new gear? I mean, how deep are you going? Are you doing just the scan of the website? Are you looking at customer reviews? Or give us your third-party risk process.

Well, you know, I pay attention. So there's a person named Graham Jarvis who's the king of hard enduro, and he's semi-retired now. I mean, he's In his mid-40s, but I pay attention to people like that. I watch their videos, study them. I've met up with them. So, I definitely want endorsements.

That's excellent. That's excellent.

Cool. Well, Kelly, thanks for coming on the show today. We really enjoyed this conversation and always good to talk with you. Thanks again.

Yeah. Thank you.

Thanks, Kelly.