Cybersecurity as a Strategic Differentiator (ft. Vugar Zeynalov)

Thanks for tuning to Digital Voices Podcast, where we chat digital transformation challenges and opportunities across healthcare and life sciences. And now, your host, Ed Marx.

Hey everyone, this is the first time on Digital Voices Podcast that we'll be talking cybersecurity. There's many, many other better venues for discussions about cybersecurity, but our take on it is from a digital officer point of view. So there's no one better that I know to speak about that than a longtime friend and colleague. And right before we get to him, DJ Sidney, you know, cybersecurity all over the news, certainly healthcare, but, you know, in life in general, how has it impacted you and your generation?

I can't say I personally have been impacted by it, but I am really grateful to be in a job position where I'm learning more about it every day.

I bet you're pretty careful about how much information you share online and all that kind of stuff.

Yes, yeah, definitely. I think it depends who you ask in my generation because I think it can go both ways. But me personally, yeah.

All right, awesome. So my friend Vugar, let me introduce him at a really high level, and then I'll let him— you know, we'll ask a couple standard questions, as all my audience knows, and then we'll have him sort of add additional color to that. But Vugar and I go back to our time at the Cleveland Clinic together. That's when we first had the opportunity to meet, and, you know, we just sort of hit it off right from the beginning, maybe because we're both from foreign countries, I'm not sure, or married to amazing wives, a lot of different commonalities, but, but we really hit it off. And not only did we work really hard on creating an amazing cybersecurity situation, or he and his team did specifically, but we also developed this really good— and just part of overall great leadership team that we had. So thrilled to have Vugar as a guest on the show. And Vugar, One thing we always ask our guests right up front is favorite music. So what kind of music, like when you're chilling, you know, what kind of music do you like to listen to?

First of all, Ed, it's great to see you and thank you for the invite. As you know, I come— I was raised, born and raised in a country called Azerbaijan. And a few of you might have heard about the country, but it's basically halfway around the globe. And my favorite music is our national music, our classical national music I love. And from the Western music, I listen to the Queen. And that's, that's the music I grew up with.

All right.

No, awesome. And yeah, I know we've got to hang around music venues a lot with our wives and enjoy a lot of multicultural activities. And yeah, it's just awesome. So tell us about your passion in life or message or mantra. You know, what keeps you kind of going and motivated?

You know, I traveled the world, came across the seas, lived in different continents and countries, and what drove me all these years is personal growth, but moreover is creating platforms for other people to thrive. I look back 20, 30 years and frankly, I don't remember exactly what I was doing. I remember it was super important, but I don't remember exactly what I was doing. What I do remember though is the relationships I forged, friendships I created, and then legacy you leave. So the biggest mantra, if I can say so, looking back in so many years is seeing people around me achieve their best potential, being able to give the gift of time. You can give many gifts, but the gift of time, I think, is the one— to me, it's the most important one because time is the commodity you'll never get back. So helping others in coaching and mentoring and seeing them achieve what their best potential— I think that's what gets me going.

Yeah, that's awesome. And I can give testimony to all that you just said, Vugar, because I know the time that you spent. You started with 3, 4 people and grew this amazing department, and you grew the leadership. And I know just recently one of the people that you mentored and raised up, and you worked with him in previous industry, you know, went off and became a CISO himself. And that's a great testimony to the leadership and, you know, leaving a legacy like you were describing. So you have— oh, so before we jump right in, because I'm so anxious to ask you some of these questions though, give us a little bit of background. Yeah, so you, you already mentioned where you're from originally, but you have served in multiple countries and in multiple industries. So yeah, tell us about that background and evolution.

Well, I started my career in cybersecurity about 30 years ago, probably this— as far as the industry goes. I worked with the U.S. government and NATO in Europe and then moved to Canada and helped financial institutions in Canada and the U.S. establish their cyber programs from ground up. On the last 15 years, I have focused on healthcare, holding leadership positions in medical device manufacturing, pharmaceuticals, health insurance and provider networks. And all these aspects of care converge here at Cleveland Clinic. I'm Cleveland Clinic's— I serve as Cleveland Clinic's first CISO. And I have to tell you, Ed, that nothing in my mind, nothing has prepared me 5 years ago to step in the role I stepped in. And it's not because healthcare was behind, and it was, that was expected. What I, what I saw is, and what I, what I experienced is something that I would say very different from what, from what I expected when I stepped into this role. I lived in the world of bits and bytes all my life, and I never thought that I have to make life-saving decisions. They're very First week I stepped into this role, we had a cyber incident in one of our newly acquired facilities. And I remember being on the call 3:00 a.m. in the morning with 50 people. They haven't slept for 40 hours trying to clean it up. And the decision they wanted me to make is to connect this infected facility back to the mothership with the risk of infecting the entire health system, or there were 8 surgeries in the morning and the brain lab was down. That was a changing moment for me because I realized that all these great industries I had a privilege to serve, they had all the important things in the world. They had their brand reputation, financials, data, and so do we. But on top of that, we have patient safety with tens of thousands of medical devices connected to live humans. And then patient privacy. It's really hard to go back to a cancer patient or family of the deceased and tell them on top of everything else that they have to go through, we also— their data was impacted. And then something like a virus outbreak or ransomware for all the other industries mean they can't process claims, they can't process transactions, which is really, really bad. But for us, for us, it means babies in NICUs. People in coma and loved ones storming the hospital trying to find out what's going on because the phone systems are down.

Yeah, yeah, that's powerful and a unique perspective. Thanks for sharing that. So what are a couple best practices, let's just say, Gugar, that there's a new CISO out there or it's a Chief Digital Officer and they're trying to figure out, you know, the cyber thing. what they need to be concerned about. And, you know, we often look to other industries who maybe are a little bit more advanced. Certainly they don't have the perspective that you just shared, but they might have back to the more technical perspective. What are 2 to 3— and the best practice may not be technical— what are 2 or 3 things that maybe that you learned from some of these other industries that you did bring over to healthcare and just would be like pointers for someone who's just starting to think about?

You know, healthcare, when it comes to cybersecurity as an industry, it's the industry which is undergoing transformation and also is the industry under attack. And by many accounts, healthcare in general is behind when it comes to cyber. So when I stepped here, stepping in here, I realized that if I do everything I did in the previous places in financials and in payers and such, here in healthcare, we will never catch up by definition. So we had to figure out how do we leapfrog. The one good thing about being behind is that you can learn from successes and missteps of others. So there were a couple of things we did which I would say we did differently. First, we focused on pushing most of our solutions in the cloud. Basically, and building customized solutions or hiring people to manage and maintain it, a lot of our platforms were delivered right in the cloud. That significantly accelerated our path. So my number one message to anyone who starts in this area, that focus on anything the industry could offer that is mature enough And that's something we can embrace. And then putting— we're one of the first cyber teams that moved fully in agile, meaning we treated cybersecurity capabilities as products. We put the product teams together where we have mission-driven teams, let's say a team that protects the devices, a team that protects the network, and we gave them everything they needed— tools, budget, people and stepped out of their way. Amazing things happened. Amazing things happened. They were able to roll out in 3 months in the organization that has more than 120,000 devices. They were able to roll out great products at the maximum velocity.

Yeah, no, those are great. And I really do want to get to the strategic, but it's so interesting because what you've alluded to a couple of times and it's not often talked about, So again, you know, this isn't meant to be a cybersecurity, you know, technique podcast for sure, 'cause like I said, there's better forums out there. But, you know, something that I just wanna call out is culture. And that was something that you were always very attentive to. And I can hear it as you speak. Can you maybe opine a little bit on that? Because, you know, it's about the pace of change too. And I know that you were very intentional on the pace. You really understood culture. So what should someone really think about when it comes to culture and cyber and those sort of things?

You know, quite often cyber leaders, they would like to have a seat at the table, but the value of that seat is obviously going to be diminished if we are a hindrance to the ability of our organizations to execute, especially in healthcare. In healthcare, it's impossible to say no. Even if you can have a life-saving device, it might be hideously insecure, but you have to enable it. So velocity of execution and the throughput of your organization and your ability to change under everlasting change conditions, I think it's an important consideration for the team. So the way I explain it to my team, I'm like, It's almost like working in the emergency department. You never know what's going to come through the door, but your level of preparedness, your level of agility, your ability to change under stressful conditions, your resilience, and that's the key word, is going to make all the difference in the world. So the way we define and construct the teams, we construct, as I said, the mission-driven teams and we enable Build those teams by looking at 5 components. First, making sure that— and that's the foundation of any team, I believe— there is a personal and professional trust. That's the starting point. And you've done great with our team building that trust in our leadership team. But we try to take those lessons to every team we have. But then you don't need trust when everything is hunky-dory. You actually need trust to be able to have tough conversations. You need trust to be able to have diversity of thoughts and make sure everybody gets a voice. And once everybody's voice is heard, as a leader, you have to make a decision. But the team, hopefully, they will commit and execute. There's no looking back. Everybody's behind you. And through that you can drive accountability and results.

That's great stuff. We could go on on this whole topic, but some really important things, because like I said, Gubarn, you know this, is many people just jump right into all the sort of the tools and they're all about the tools and they lose focus of some of these other things like culture and the leadership and the team building. And so no matter what great tool you have, it's gonna fall short if you don't have those other things as a foundation. So let's shift gears now. I wanna talk strategic and really think about board-level communication. So how does this— how do you approach the board when it comes to all things cybersecurity, digital transformation, you know, and giving the big picture without getting into too much detail that might go beyond a board and getting the attention that you still need?

So the way I construct my board messages, I start with describing cybersecurity landscape. What are the threats we're facing as an organization, our industry is facing, and the world is facing in general. And based on those threats, we talked about what are the risks, specifically risks that the organization is facing, what we've done about them since our last conversation, and what are we planning to do about them going forward. Now the key messages I think every leader and executive need to understand about cyber is that Cybersecurity is not a condition that is managed. It's not a condition that is treated. It's a condition that is managed. As such, cybersecurity is a continuous effort. The second message is that probably apart from a natural disaster of epic proportion, cybersecurity is the biggest threat your organization may face. And any organization can have a security incident, but how you respond to it at every level makes all the difference in the world. So the skills around crisis management and incident readiness at every level of the organization are essential skills. And finally, done right, cyber actually— since we're talking about digital transformation— can unlock the value of digital transformation. Because if it's like to drive faster, you need bigger brakes. So it can enable making it safe to explore digital innovations that are too risky for your competitors, or opening the new modalities for the business, like this massive shift to remote work that we've been experiencing during pandemic. So cyber can be a market differentiator for your organization, especially as you're moving into this digital era.

Yeah, I love it. Cyber as a strategic differentiator. You don't hear that very often. I agree, it unlocks the value of digital transformation. You're absolutely right. Dang, Vugar, I miss working with you. This is making me long for the days that we had the opportunity to serve together. I really appreciate your wisdom and your approach to all things cyber, and you're just a generally good which is what the basic requirement is anyways in any sort of leadership role, but you're a very strong leader. We could just talk about leadership if we wanted to as well. How about advice for someone first time presenting to a board? So it doesn't have to be cyber-specific, but you know, you went through that process. And so, you know, maybe what's one thing that you would offer as advice? So, you know, a lot of our audience are chief digital officers or people who aspire to be such. And so at some point they are or will be bored and they're probably scared to death and wondering what to do. So what would be one piece of advice based on your experience?

I think if— there are many, many aspects to it, but if I have to think about one, that is having a very strong support network. Having those meetings before meetings. Having these key allies within the organization that have done it before. They understand. The sentiments of the board members. And you can have a series of meetings with those key individuals beforehand and let them pressure test your message. Let them help you with paranoia questions and being prepared for them. Let them help you with the dry running, that whole presentation, because you have to be crisp, short, And allow some time for dialogue. The best message to the board actually happens once you finish. The best conversation happens once you finish your presentation. So if indeed they are interested in what you have to say, if indeed they're interested in what you have to bring to the table, then the engaging conversation starts. And they ask some awesome questions. Being ready to answer those questions and in crisp fashion. comes through that preparation.

Yeah, I know my team here at Checkmender Health and Life Sciences, like when we present, get ready to present to the board, you know, we have 3 to 5 rehearsals ahead of time. And, you know, it's that same level of discipline. And then like you pick out, I always like to pick out the board members who might be the most resistant to the message and having those meetings ahead of time like you were talking about, And just figuring out, you know, adjusting your, your message based on some of those interactions and getting some of the, some of the big questions out of the way up front. And, and it's just a good learning and it makes for a great, uh, board, uh, presentation. Hey, just curious, in, in any of your, uh, last few presentations that you've done to C-suite or C-suite peers or To the board, how many slides did you use? This is like off-the-cuff question here.

Typically I use no more than 5 slides. I try to stay under 10 minutes. If I can make it crisper, even better. And on each slide, I don't use more than 5 bullets, the headline style. Everything is high level, deliver crisp, messages and see their level— gauge the level of interest and let them ask questions. Yeah.

Yeah, I sort of knew the answer obviously and I was just bringing that up because, you know, a lot of times we feel like we just need to— especially on a complex topic like cybersecurity, we feel like we need to wow with a lot of slides and then no matter how many slides, they're very confusing. But you had a good Art of, of keeping the slides to a minimum, and then like you said, just being really clear and crisp in that messaging. And it was more about the dialogue, like you said. Hey, let's— I want to go actually turn back in now a little bit to, to this concept and technique that I know that you employ, because I think it's good not just for cybersecurity but anything at this— Level of organization. So can you tell me a little bit about war games, both operationally, you know, red versus blue type thing, and then with the C-suite level and, you know, the modeling and stuff?

Well, as I said, any organization can have a cyber incident. It's how you respond to it makes all the difference in the world. And crisis management and incident readiness. It starts well before the incident itself, if you will. So there are a number of things we do within cyber teams, and that is what you call it, what we call a fusion center. It's where we have defenders and then we have— that's what we call blue team— and we have some of our offensive capabilities. like our ethical hackers work together on pressure testing our defenses and then improving our prevention and detection capabilities. But then if you think of that time, like if, if you're hacked, what do you do from that moment on? What actions you take, what decisions you make, it's all going to have long-lasting implications. And some of these decisions are made at the executive level by the executive team. So being able to prep upfront under stressful conditions. So the exercises we run, like recently we had a cyber range where you have several scenarios and a lot of them real-world scenarios that we put in front of the executive team and test our planning and test our response capabilities. Some of them can be as difficult as if you're ransomed and you can't recover your data, when is it appropriate to pay? What do you do if the attackers are on the Department of Treasury's sanction list and there are significant penalties for paying ransom? How do you move into the downtime procedures? How your organization is capable of operating in the absence of technology? technology. A lot of our workforce right now never used paper, especially in the clinical setting. How do you train your organization to be able to continue delivering, continue care delivery at the time of the incident? Because a lot of the incidents nowadays, they're no longer just about like stealing records and passwords. It's impacting directly our care delivery. So being able to conduct these exercises Being able to learn from them and improve the overall resilience and preparedness of the team, I think, is paramount.

I just think what you do is brilliant because that's the next level that many organizations are not there yet. And it's very similar, right, what we did in the military when I was a combat engineer officer and we would, you know, learn all our training theoretically and we'd do desktop exercises and we do all sorts of military training. But then, once a year, we got shipped out to a base in Cali, in this case happened to be California, and we would literally fight an opposing army. Obviously, it was with lasers and things like that, but it was like this real world because otherwise it's scary and you don't know how you react to your— in the game. And yeah, so what you do is brilliant. It's really taken it to the next level. So a lot of organizations Yeah, they'll do like, they'll sit around a conference table and maybe do something very light. But what you're talking about, when you talk about these cyber ranges and things, you're talking about a big time and resource and capabilities, you know, the digital capabilities of these cyber ranges. You can watch your stock drop, right? You can watch your brand drop. You can see the impact, you know, and it just brings this new level of awareness to the organizations. So you're to be applauded for that because not that many take it to that level and, you know, that's probably something that we should get to in all of our organizations given what's going on. So let's talk a little bit— here's a sort of a controversial topic, it just depends who you are. But the CISO has grown more in importance in the last few years than ever before, obviously, and appropriately.

Absolutely.

And where should the CISO ultimately report to? Where is the best place in an organization if you had the ability to make those sort of decisions?

I think it depends highly on 2 factors. One is how the organization embraces technology, and the second is the maturity of the cyber program itself. So in the organizations where technology is the back office function, And typically cyber is fairly mature due to some years of investment. Typically what I observed is cyber reports to IT organizations. And that makes sense because you're— at that point you're building some foundational capabilities. So being a member of the IT leadership team, being able to tap into the vast IT resources and influence IT decisions makes sense. That— like you can build those capabilities with velocity. Technology capabilities. Now as the cyber program evolves, so is organizations' adoption of technologies. When the technology becomes an integral part of your business and foundational capabilities are in place, typically cyber evolves further into the organization that needs to have direct access or to get a voice in the CEO meetings and the board meetings. At that point, I see cyber evolving and reporting outside of ITD, sometimes to the legal office, sometimes to the compliance office, but it allows us to have more influence and more authority, if you will. But then the third evolution that you see in the organizations that truly embracing digital transformation, truly driving their value through digital channels, that's where I see CISOs are reporting to the CEOs directly. And the reason for that is, as we mentioned earlier, at that point cyber becomes your market differentiator. People will not embrace your products if they're unsafe or cannot be trusted, or they feel like their data, their lives, or their future will be at risk. Yeah.

Great answer. And you know, you're blessed to be in a great organization, and you know, you're all doing wonderful things in saving people's lives around the world, and cyber is a key part of that. So that's, that's really cool. Look, what, what piece of advice would you have, Vugar, to Chief Digital Officers? So Chief Digital Officers are sort of an emerging role, as you know, maybe at this point 15, 20% of healthcare systems have one in place. It'll grow a little bit more. I don't know what the endgame is, but how would you counsel a new CDO coming in? So this is a CDO, right? They don't have cybersecurity responsibilities, but yet they're responsible for digital transformation. And maybe it's the Chief Transformation Officer, which we're seeing the emergence of as well. Which you also, which you do have at the Cleveland Clinic. So what sort of advice should a CISO be giving someone who's responsible for this digital transformation?

I think many, when they think of cybersecurity, they think of keeping bad guys out. But I think that's the big part. But what it also includes, it includes making sure that our clinicians, our employees, they can get what they need when they need it. So cyber is not only about protection. It's also about protecting our patients and businesses from cyber threats in a seamless and frictionless manner. So being able to work hand in hand, having CISO as your partner, where, as I said, if you're building a fast car, you need to have bigger brakes, pretty bigger brakes. So making cybersecurity as an integral part of your digital platform, making sure that your digital platform is not only innovative but also trusted and resilient, and making it as easy as possible for clinicians, for our patients, to be able to leverage the transformational capabilities of digital means that they can spend more time— our clinicians can spend more time with their patients, and our patients can spend more time with their families and less time worrying about things like passwords and ransomware and other things.

Yeah, no, that's sage, sage advice. Look, Lugar, we— I wish we had more time, and I can't wait to reconnect with you up in Cleveland again. What, what is something you might want to talk about in closing that maybe I didn't ask, or something we did talk about but just kind of reinforce. So I give you the last 60 seconds.

Well, there are, what, over 2,500 hospitals in the US that has less than 100 beds, and they have the exact same concerns as we have at the Cleveland Clinic but may not have similar resources and capabilities. So I think it's time, just like the bad guys, they collaborate. They work with each other. They learn from each other. I think it's time for us to come together as an industry and learn from our successes, learn from our missteps, and together build those digital platforms that are trusted, that are resilient, and help patients to embrace the new era of healthcare and digital healthcare in a safe manner.

Yeah, wow. Yeah, I agree, powerful, excellent idea. Vugar, thank you so much. We, we covered a lot, as I mentioned, and kind of dipped into a little bit tactical a couple times, but it's super, super interesting. And just hearing sort of a strategic viewpoint of cybersecurity, really informative. Thank you for being our guest.

Thank you very much for inviting me. It's great to see you.

Hey, that wraps up another Drop for Digital Voices. Talk to you next week.

Hi, this is John Lynn from the Healthcare IT Today podcast. If you like the latest rumors, insights, and happenings in healthcare IT, you'll enjoy hearing my colleague Colin Hung and myself debate and share the latest happenings from the world of healthcare IT. Find the latest episodes or dig into our archive at healthcareittoday.com or Or search for Healthcare IT Today on your favorite podcast application or YouTube. When it comes to healthcare technology, we love this stuff, and we can't wait to have you join in on the discussion of everything health IT.

Thank you for listening to Digital Voices Podcast with Ed Marx. If you enjoyed this episode, subscribe on your preferred streaming service and leave a rating and review. And most importantly, thanks again for listening.