EP49 Lifesaving Tradeoffs: CISO Considerations in moving Healthcare to Cloud

Security.

Hi there, welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Tim Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed, tamed, and altogether really nice guy nowadays, former analyst and member of the cloud security team here at Google. You can find and subscribe to this podcast wherever podcasts are available, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered to you piping hot every Monday afternoon, please do hit that subscribe button. You can subscribe to the show's Twitter account as well, twitter.com/cloudsecpodcast. Anton, we've got a fun episode today. We are talking about healthcare and the cloud and security. and healthcare and the cloud. And it's quite an interesting set of content, I think.

Indeed. And you guys are making fun of me, I guess in a few minutes the audience would listen to it, for saying fun about challenges like ransomware in a hospital. Okay, that's not fun. Fine. Maybe I wouldn't draw the line. But the point is that we are talking about a pretty fascinating convergence of circumstances. We have environments with a fair bit of legacy IT, somewhat budget constrained, with interesting priorities. pressured by the pandemic and by the threats. So to me, I don't envy our guest in his previous role when he was a healthcare CISO, and I don't envy all other current healthcare CISOs because the challenges are quite dramatic, especially given the current, well, healthcare pandemic, not only ransomware pandemic, as IT people or security people like to say.

I thought one of the really interesting things about this was we're always arguing about budget, but in this case, he's literally arguing about budget for systems versus budget for patient care. It's a very difficult set of trade-offs these people have to navigate. I hadn't thought about how stark that is in that context before. True.

And this one comes to me as well from my Gartner days when I've seen this, and you'd assume that it's the same for every industry. If I'm making shovels, I have a choice of investing into more shovel making or IT, but it's just not the same with any other business because you literally know that the $100 you would not spend on some IT security control may save a person.

That's right.

From, well, dying. So to me, I can see why it's a different story. Okay, I'll be very tame and very mild.

With that, let's welcome today's guest.

And today we have Taylor Liman, Director at the Office of the CISO at Google Cloud. Hey Taylor, how are you?

I'm doing great, thanks. How are you folks?

Thanks for joining us today.

Indeed, indeed. And we'll talk about a very fun area, namely, Security, cloud security, and healthcare. Now that sounds scary to some people, especially in the—

Is that a fun area?

Okay, well, I call every area a fun area. Sorry, I'm just that type of person.

I was gonna say.

Anton's also never seen an ugly baby, folks.

There is that, yes.

Or been to like an amusement park, because those are like always fun, I feel like.

Life is an amusement park when you're Anton. It's wonderful.

There you go.

Okay, so what's top of mind for healthcare organization CISOs now that we are almost 2 years in the pandemic?

The pandemic's put a lot of stress on the healthcare system. Unfortunately, many of the things that were putting stress on the healthcare system are the same things, just sort of more of them. They're arguably having an increased amount of effectiveness. But to just get into the details, obviously ransomware sort of continues to plague the industry. Health systems across the spectrum, it's not just hospitals, it's the payers, it's the HCLS organizations, it's the life sciences, pharma folks. All really still relying on legacy technologies to run the great majority of their operations, especially now given many of these organizations under massive financial constraints coming out of the pandemic, or still dealing with the pandemic, dealing with a variety of other things that they need to focus on to deliver patient care that are demanding that investment. Not having the ability to get off legacy technology creates this— I wouldn't say it's an opportunity, but the susceptibility of the industry hasn't been addressed. Necessarily to the extent it needs to, to help these organizations get through the next couple years safely and securely, given the tech they're on. We're seeing a lot of organizations solve this or try to solve this by adopting new tech, which with it carries a variety of other potential risks they need to manage around their supply chain. But it still unfortunately doesn't provide an avenue to getting completely off this stuff. So getting off legacy technology onto supported technology is still a challenge for these organizations. And ransomware and specifically how it works and spreads. When you've got organizations that are using legacy technology across all their facilities and across most of their most critical business processes, and you know, in a hospital setting, you're seeing much of the medical equipment they're using to even treat patients is relying on legacy technology to deliver treatment and to deliver therapy. You're seeing not only the ransomware risk present itself as one of disruption, of the hospital itself, but also in some cases, getting close to threatening quality at the point of care. That's the big one. Ransomware continues. The one perspective that's unique about healthcare that's not always easy to put together is, you know, when you think of what's at risk, and this is how ransomware operators think, you look at a hospital and shutting down a hospital versus, say, shutting down a bank or shutting down a retail store. You know, the consequences of shutting down a retail store are very different than the consequences of shutting down a hospital. Shutting down a hospital or affecting a hospital's ability to deliver care puts people at risk, whereas shutting down A retail organization might put your Gatorade at risk, put your bag of chips at risk, but it doesn't carry the same consequences. And so threat actors know that, and they use that to increase the amount that they're able to extort out of these organizations and use it as a lever to get them to pay or do whatever, right? So ransomware will continue to be an issue, both because of the legacy issue as well as the incentives for the attackers to go after it. I mentioned supply chains. The pandemic forced many, many organizations to work from home. and work remotely. This led to a huge adoption of SaaS, as well as other sort of vendor-controlled, managed, supported software. And so, while there was a big hurry to get off of legacy platforms, to the extent they could, and get onto new modern platforms, the proper governance and oversight and risk management and shifting all of your security resources or some of your security resources to begin to focus on those risks didn't come at the same time. There's such a push to get onto new tech. And so, making sure that organizations now have proper insight into where they're getting their technology from, how it's being developed, how it's being released, What vulnerabilities are in it, how it's being managed. Like, those are really important things that organizations need doing if they're not. And you're seeing, you know, in many cases, these under-resourced, financially strapped organizations, again, not being able to put the resources to managing these risks. Supply chain, definitely on the list. And there's a variety of other things around medical devices that sort of touch that legacy IT world, but also this like, hey, medical devices are this special blend of tech. It's closed systems, don't really know what our vendors are doing necessarily. So touching on that supply chain risk as well. But what medical devices often represent is that sort of critical care or safety aspect you don't read about in your security journals growing up and being taught about. Safety is a really critical outcome for security, especially within health organizations and medical IoT and medical technology. It's like technical security becomes safety for the patient and the patient's care. Unfortunately, due to the lack of visibility into some of that tech and the lack of regulation that's been there for years, you're starting to see major concerns crop up. You're starting to see these devices get compromised, and you're starting to see it become a major area of focus for caregivers.

That's really interesting. So you touched on this a little bit, but to draw it out explicitly, what's changed during the pandemic? Because surely, you know, people are still going into medical offices and you can't deliver all of your care remotely.

I think the pressure on organizations to upgrade their systems has gone up dramatically. to deal with these risks. I'd say for all of the reasons I mentioned— security, safety, resiliency— IT teams simply not being on site, you know, of course, being able to make sure that we can keep the tech running and keep the people on site that need to be there on a minimum basis to make sure systems operate. But I'd say the biggest thing that changed, like the tech didn't change so much as the urgency in which to transform your technical footprint did change. To be responding to this increased focus by threat actors on these systems, plus the need to adopt new technology to facilitate new working patterns. Not everything before healthcare went into pandemic mode was able to be— like healthcare itself wasn't able to really be delivered remotely ever. In fact, insurance organizations weren't paying at the same rates they were paying if you showed up to the doctor. They pay more for that as opposed to paying more for treatment remotely. That's all changed now. So being able to now deliver care remotely is also something that has changed because it's imperative to the business of healthcare. If you can't deliver care remotely and you do it safely, you're missing a major opportunity. So that's also changed too. I think it's the pressure that organizations were under to respond to the threats and risks that emerged during the pandemic. And then it's more of the shift to delivering care remotely. And all of that entails relying on your vendors, making sure the tech is up to date and working correctly. Making sure users are trained to do the right thing, making sure the systems itself that capture diagnostic information are reliable, and make sure that they can be maintained and secured. They're all top of mind.

So it sounds like when people talk about how COVID pandemic accelerated digital transformation for a lot of companies, this has happened even more dramatically in healthcare, and that opened up all sorts of interesting security paths. Whether they're opportunities or challenges, separate story, but it sounds like that Rapid digital transformation have caused problems?

There's like 2 camps on this from my tech. There's the health systems that were ready for it, were already in the cloud doing interesting things. And then there was the ones that were hanging on to legacy tech that weren't in a position to take advantage of digital transformation. And you'll see the ones who weren't ready for it are still struggling to adopt cloud services, are still struggling to adopt some of these futuristic ways of delivering and monitoring care. The organizations who were ready who are already in the cloud, who are already leveraging SaaS, and who are already leveraging services like Google Cloud, were ready to take these changes in stride because they effectively had gotten used to operating in the cloud. But I do think there are many, many health systems in the US and worldwide who just simply were doing their best to stay in business, to treat patients, because that's what they're in the business for. They aren't technology companies.

Mm-hmm.

They're there to process claims, they're there to treat patients. And that was their business. Their business never previously was, let's be the latest and greatest on the bleeding edge of tech, so that we can adopt rapid market changes, and, you know, keep our business going in times of strife like now. But they're learning that lesson. And they are positioning themselves, or at least the forward-thinking insurance companies and health payers are positioning themselves to take advantage of the opportunities that they have now to do this.

That makes sense. So to summarize a little bit, if people were already leaning forward, it's a lot easier for them to have gotten going during the pandemic and get ahead of this stuff. And there are a significant group in your mind of like, laggards who are still a little flat-footed here.

Absolutely.

I want to make sure that we give advice to the people that are lagging. How do we really help them stop lagging other than, you know, get good?

I mean, it's a complicated problem. There's no silver bullet.

That counts as a hard question.

It's okay. It's a good question. I think that you have to sort of frame the problem correctly in order to answer it. So number one, what you're asking is how do organizations to shift their resources more effectively to take advantage of what digital transformation offers? How do organizations shift resources to address their security vulnerabilities? You know, how do organizations change the resources to pursue more revenue opportunities to then reinvest in the company? All of those questions end with, how do I take money away from treating patients and customers and give it to dealing with legacy debt or technology adoption issues that are oftentimes a result of just failure to execute or failure to see the future. It's a hard question to ask when you're going to the CEO of a company and say, hey, I want to spend $1 million to transform our technology footprint to be one of more resilient and safe. You're almost always arguing, well, what could that $100 be used to treat more patients? Could that be used to treat people more healthy? And so I come back to you like security leaders really need to understand, it's not necessarily how to win an argument, but you need to understand how to articulate The value and benefits of going to the cloud in terms of the things that your business is in business to do. If you're going to argue to set up a modernization project on your data center, you need to be able to clarify and explain how that will benefit the ultimate mission of the organization. In this case, it's helping people, how many more, how safely, et cetera. So you obviously need to understand the impact of those proposals on your business to then successfully argue, because I'll be honest, arguing against spending money on patients is a really hard thing that healthcare CISOs need to do.

Yeah.

And it's unique, right? It's banks, it's different. We're going to— how do I prevent fraud? How do I prevent loss events? How do I prevent a variety of negative outcomes for consumers? Well, you're not usually making a decision to prevent someone from getting care versus not getting care, which is often the case that gets brought up.

That came up quite a few times in my Gartner experience is that that decision between money spent on security, money spent on care, it's very real. I mean, obviously, Taylor knows it better than I did. But it's interesting how that theme was always brought up by the healthcare clients, by the healthcare orgs I encountered. It's kind of like, yeah, if we do this, we'll be more secure, but that means we won't treat one more patient kind of thing, right?

I'll throw a few things out there. One, the technology opportunity we have today is huge. Number one, the ability to predict care when it's needed and intervene based on historical medical data of a given individual that can now be studied and those predictions can be made. Almost all of those predictions are based on having an analytics platform and data to do it that are often only operating and only capabilities on cloud. Now, the reason it's important to get to cloud is we build in security to our platform. So when you do take advantage of those capabilities in cloud, the security burden is shifted to your cloud service provider to take care of a lot. So out of the gate, by even taking on a project or using the case to say, hey, we can get more predictive, which means we can control costs better, which means we have better clinical outcomes long-term, that's great for our patients. By taking advantage of tech that allows you to do that, which is typically in cloud, you get the benefits of cloud by going in that direction. And that's not the only reason, getting to cloud isn't the only outcome, but finding ways to get predictive, finding ways to use data to make more data-driven decisions across all fronts, whether it be operational or clinical, are huge opportunities to shift the conversation away from let's spend less money on customers and more on tech. Let's focus on things that actually matter to my business. So Case management, operational improvements, finding opportunities to take cost out of situations by studying data of a given business process. I know it's standard stuff, but there's a lot of money that gets spent on healthcare and there's a lot of waste. Finding ways to remove waste provides opportunities to pivot a conversation around how do we modernize, how do we get to new technologies that help us secure ourselves more favorably. I've never been a fan of leading with scare tactics. I don't think anybody should either, and especially in healthcare.

Mm-hmm.

The consequences are great.

To shift gears a little bit, and of course, when we talk about healthcare, there's always somebody who brings up HIPAA and other regulations. And last time I checked my calendar, it was 2022. And of course, HIPAA is from 1996, which is like decades old. So how do healthcare security leaders live in the world where regulations are from the '90s, but technology is kind of from the 2020s? Maybe that's a cynical way to ask it, but like, What regulations are shaping the healthcare industry, how it approaches security, and how does this whole 1990s regs, 2020s tech is working together?

Specifically, the HIPAA Security Rule, which was a component of HIPAA and which was a part of the Administrative Simplification Act, which was the underlying, overlying, however you want to describe it, law that put it all into action back in the '90s. It's been amended a number of times. It's been amended to keep up with changes in how to report data breaches, how to manage service providers. Additional publications have been put out on how to clarify and comply with the requirements. The Office of Civil Rights has begun enforcing the HIPAA Security Rule on those who don't demonstrate compliance. And through those engagements, the rules have sort of been updated similar to like establishing case law as one would in terms of guiding what an organization should do to be compliant. So all of those things are happening, and it's been a mechanism to keep HIPAA up to date. But it is the fundamental At least here in the US, it's the fundamental law that shapes how organizations need to secure medical information or health information.

So Taylor, I want to switch gears a little bit and ask you to speculate, which is always fun. Could you share why you think we're not seeing more cloud ransomware? Medical sector gets hit with ransomware all the time. Why aren't we seeing more cloud ransomware?

Well, I think if you look at the successful campaigns, the threat actor groups, the tools, techniques, procedures they follow. Most of those attacks are designed to take advantage of weaknesses in on-prem, like known systemic vulnerabilities that effectively everyone on-prem has.

Mm-hmm.

If you look at the typical kill chain or whatever the new hot term is for understanding how the attack has occurred, you'll typically see the same things: email with attachments that have bad things in them that get detonated on an endpoint that bring more bad things. That then result in threat actors gaining footholds, moving around environments, and doing all sorts of actions to facilitate a ransomware attack. The assumptions those threat actors make are true when you imagine systems in an on-prem fashion. Poorly patched, low to no segmentation of a network, and a variety of other issues create the perfect environment for ransomware to be successful in. The reason I don't see as much of this in cloud, although there are ransom events and types of ransoms and extortion that occurs with respect to cloud resources, you don't see the traditional ransomware attacks we're reading about Because number one, most malware is designed to propagate on an on-premise network, not jump an on-premise network to a cloud, right?

Yep.

It's not smart enough. I'm not saying it can't be, but currently isn't smart enough at scale to jump into a cloud environment, understand the cloud environment's particulars, and move laterally. Second, cloud is, you know, done well, you know, cloud is secure by design. So when you deploy a new workload, if you do it right, you're deploying workloads into an isolated environment that's separate from other things that you care about and wish to keep. And so if in the event something does hop the wire and gets into a cloud environment, your blast radius is typically small, and that's by default because you've set it up correctly. So you can get ransomed, but the chances of you getting ransomed and having that have a big impact versus a small impact are lower, given some of the sort of primitives of how cloud works.

Hmm.

There's a variety of other factors, but I'd say specifically, if you get into specific details on specific threat actors and specific campaigns, But I'd say primarily it's due to the fact that most ransomware gangs and ransomware operators and the tools they use are designed for highly vulnerable, highly susceptible on-premise infrastructure.

That makes a ton of sense. And I think that's a really interesting answer, looking at both the way the ransomware ecosystem works, as we've discussed previously on the show, with actors using tools from other actors and the tooling not being there yet, as well as kind of the nature of cloud that you touched on. I think that's a really interesting answer.

Thanks. I think we'll see evolution here, but I think over time, hopefully we all get better at this and we see ransomware reduce and go away and let us go back to focusing on treating patients.

Yeah, indeed. And I think that we definitely expect more research to kind of explore the ransom events and type of ransom activities that may be in the cloud, even though they may not involve malware, as we discussed in the past. So Taylor, sometimes healthcare orgs are seen as IT laggards, but we do know they adopt the cloud Today they adopt software as a service. So what are some of the key cloud security migration lessons that you've seen from healthcare that can be useful to others?

I think the first thing that comes to mind is taking advantage of the built-in security properties of the cloud. What that means is security teams can— not to say that they can eliminate focus, they can't— but they can reduce the amount of things they need to know to secure the workload effectively. They don't need to know 100 things. Like they might need to know on-prem from, you know, the silicon up to the app. They can instead focus on a smaller subset of the infrastructure that they themselves are accountable for managing. This gets back to the shared responsibility, shared fate model.

Yes.

But I think the migration guidance number one would be fully understand the model and understand what you're accountable for, and then build strength and depth in those areas. You'll find that's a much smaller volume of information you need to be good at. They're easy to understand and then demonstrate technical capability to be good at. The opportunity to be more focused and build stronger security in because you're more focused on a couple security opportunities versus, you know, trying to manage the entire stack end to end is huge and it shouldn't be overlooked. The second is, this is more of a warning, not necessarily like a best practice, but teams who try to repeat what they're doing on-prem in the cloud do not miss the opportunity. Trying to manage a server in the cloud using native cloud services, offer it, tremendous opportunity to reduce toil within your IT teams that they're experiencing trying to maintain that same infrastructure on-prem. The tools are different. The tools built for cloud are meant to provide, in some cases, continuous services to secure the workload, continuous and autonomous mechanisms to make sure workloads stay up to date, say, ensure workloads are reporting into centralized logging and monitoring servers.

Mm-hmm.

And deploying things with code offers you an opportunity to completely rebuild your infrastructure from a known state of good anytime you want, ensure that the security parameters and policies you want to apply are the ones that actually apply, and your ability to secure the workload goes away from necessarily having to watch every bell and whistle to understanding when those configs change and when you see anomalous activity, which again, if done well, you're reducing the scope that that security professional has to manage to a few things versus a whole host of things. So trying to manage security on-prem, that's very different than trying to manage security in the cloud. And it requires a different approach because the tech is different and the opportunity to build on cloud means you get to take advantage of a lot of security that's already there. And you use code to define and deploy your architecture. You get what you ask for. So those are 2 things that pop right out to the top. I think the other beautiful thing is actually talking about this to someone earlier today, it's like there's this whole concept of bolt-on security. which is a concept that exists in certainly those who are adopting cloud early and trying to figure out where security fit in the process of building and deploying tech. But bolt-on security refers to security controls we apply right before we deploy it into production. In many cases, the same way we deploy tech on-prem is, let's figure out how it all works, let's deploy the architecture, and then let's call the security folks 2 weeks before we go live to make sure it's safe. Done well, We can move all of that compliance, security, testing, all of that activity to occur much, much earlier in the deployment process. And it occurs in many cases at the same time other validations occur. So, when testing is done, it means all testing, including security testing, is done. When code is ready to be deployed, it means all specific sets of requirements have been addressed, not just functional or non-functional requirements. When code is running, you know, we can tell anomalous behavior and activity from all angles— user activity, infrastructure activity. We can build and engineer these controls into the deployment process. So in fact, they're seamless and invisible in some cases, but it gets us out of having to react late in the process to try to strap on whatever security controls we can at the very end. Going on cloud and specifically being able to deploy infrastructure as code and applications as code, in some cases now security as code, Being able to define that as code side by side with potentially other code you're writing that support the app is a huge, huge opportunity. Can't be overlooked. So if you're just using services to deploy a server in Google Cloud, great. You can do that as code as well, but you're missing the point. Being able to define an entire workload end-to-end with code that includes security code is a huge opportunity and one not to be missed. It's a game changer.

Perfect. Thank you very much for this. And let me ask you a very brief final question. Our traditional final question. Any one action item the audience, presumably in healthcare, can use to improve security? So any one tip, any one hopefully quick thing to make things better?

I'd say that the most important thing that's made a huge difference to me, that's not technical related. If you are at your desk, maybe this is not the best advice to give during COVID but I'd still encourage folks to think about it this way. You will never see the impact your security program has Until you throw scrubs on and go follow physicians and clinicians around your facility or sit with claims processors and watch them work or sit at a customer service support desk and listen to support calls coming in, you will never see, truly see, the impact your security program has on how well you enable your business until you get out there and watch it happen. The book is The Phoenix Project. The example is standing on top of facility sort of scaffolding to watch how facility, you know, goods get moved around. Same concepts as exist in healthcare. You need to get out, you need to follow, you need to listen to doctors, you need to talk to them, you need to understand how they work, you need to understand how security enables them or disables them from getting their job. But most importantly, you need to talk to them, building relationships, understanding where they're coming from, developing that deep, deep empathy, and then taking that back and framing how you're going to solve for security is critical to be successful in this job.

That actually does make sense. I'm not surprised at all that your tip isn't about, oh, adopt this tech and you're good. It's the process. It's the quintessential 1990s advice that's still as valid in 2020s as it ever was. See how the business actually does, well, the business, right?

Yep.

You're not going to know everything, so you need to do it often and regularly.

Perfect. With this, thank you very much, Taylor. Appreciate you spending time with us and looking forward to future episodes.

Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter at twitter.com/cloudsecpodcast. And of course, your hosts are also on Twitter. @Anton_Chuvaikin and _TeamPeacock. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. Of course, now you know that we have restarted our weekly cadence for 2022, so we will be with you hopefully every Monday. See you on the next Cloud Security Podcast episode.