Challenges for Healthcare Cybersecurity

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the cybersecurity risks that the healthcare sector faces. And I get the pleasure of talking with Jason Elrod. Jason is the CISO of MultiCare Health Systems, advisor to NightDragon Investments, and founder of Limitless Cyber, where he's also the host of Drink Coffee and Do Cool Stuff podcast. Welcome, Jason. It's good to catch up with you again.

Absolutely. Happy to be here. It's been a hot minute. It has. It has.

So the healthcare industry, right? I mean, it's the critical functions there. Are important to every modern society, right? Which makes it a target for criminals, adversaries, including for adversarial nation states. And we've seen data breaches that expose sensitive patient health information, attacks that undermine health services that are critical to people in urgent need, and cyber risks that manifest pressure on the fragile supply chain infrastructure of healthcare. So, I mean, this affects all of us and it affects the ones we love. So your deep and rich history in the healthcare environment, in protecting organizations, in seeing the risks, where is the healthcare industry currently at from a cybersecurity perspective?

Well, that's like tell people, I don't just work here, I'm also a customer, which means, which means the The work that I do in healthcare, the work that my teams do where they show up every day and just knock it out of the park, it is for not just for the organization, but for themselves, for their family, from their community. It's really a core infrastructure component. So healthcare is critical infrastructure. It really is. And for me, it's really understanding that in healthcare, cyber incidents are not abstract. They're life-impacting. Downtime isn't just an inconvenience, it's a patient safety event.

So we've seen ransomware attacks that have targeted hospitals, emergency rooms, critical clinics, things of that sort. And, you know, we saw in what, United Kingdom, right, where they had their entire health system get impacted to a certain extent and having to push people to other hospitals and all sorts of different things. Is this the primary issue that you see in your industry that resonates with the leadership in healthcare? Or is it still around data breaches, regulatory compliance of HIPAA? We don't want the lawsuits. We don't want to violate regulations. That's where the focus kind of is.

Well, I think it's a little bit of both. Maybe 5, 10 years ago, I would have to explain, hey, what is ransomware? What is phishing? What is a cybersecurity impact in a healthcare environment? And nowadays I don't have to. I mean, everybody is really aware of that. And that's from line staff all the way up to the chairman of the board. So we have a better idea that, that I mentioned before there, cybersecurity events are patient safety events. So there is a good understanding about that. Now, with that said, a lot of the programs are based around compliance. How do we stay compliant with, um, whatever the laws are that we have to be, that we're beholden to, both at a state level and a federal level. So I think it's, it still has some work to go there because the challenge is no longer awareness, it's prioritization. See, everyone knows cybersecurity matters. The question is, who owns the outcome there? And so every dollar we spend in a cybersecurity infrastructure component or a technical infrastructure component is a dollar that, for instance, we don't spend in a pediatric burn unit. So in healthcare, you have to make those trade-offs. So sometimes you're going to say, hey, you know what? We're going to deploy this particular technology because it protects all of those pediatric burn units and all of our patients. But then other times you have to make that determination and say, you know, even though I think this would be a great tool, like we really want to deploy zero trust or microsegmentation, or we— this is really going to move us from a technical risk standpoint into a better position. But you know what? It's more important to open up an urgent care clinic in a healthcare desert because that's the real mission. So attaching the two is really the nuance.

Well, I like where you're going here, right? Because there do— there's never infinite resources. So there have to be prioritizations. There has to be trade-offs. And, you know, we've seen in the industry that in the overall cybersecurity industry that cybersecurity tends to take a backseat to most other priorities unless something bad has happened or something is on fire. So in the healthcare industry, I mean, how difficult is it to be able to have those conversations at the right executive level, right? I mean, I read a stat the other day that a 2024 survey found that 69% of US-based organizations, right, that experienced a cyber incident actually had disruptions to patient care as a direct consequence. That's a huge amount, right? But again, as you put it, there are certain calculus that has to happen. How as a security professional are you communicating to be able to allow management to understand both sides and make that right value-added decision?

So it all comes down to the metrics. And unfortunately in cybersecurity, historically and even today, we live under this invisible success metrics. So when we're successful, everything looks great. You don't see anything. Everything's perfect. You know, when you're successful, it's invisible. And when you're not, it's highly visible because it means like, oh my gosh, how did this happen? What's going on? Why didn't you tell me? Where's it going? There's an instant blame game because none of the success was up in front of people's faces all the time. So you end up with, like I said, this invisible success metric. So the key there is when you're talking to executive leaders, when I'm speaking with the board, when I'm speaking with our executive leadership team, I always want to talk about a different ROI. So sometimes I refer to it as RROI, but recently I'm just going back to ROI again because why not use a reuse a 3-letter acronym. So instead of return on investment, it's risk reduction on investment. Historically, that's how it's an RROI. When I do this, this is going to reduce these risk factors, and here's our chance of happening. And if this happened, this would be the impact. So this is risk avoidance. But recently I switched that up just a little bit back to just ROI on investment, because I think that is the criteria we need to start looking at now. Resilience in healthcare is about the continuity of care, not just the uptime of systems. So by taking it and putting it into that state of, hey, here's how we maintain the resilience in healthcare on the investments we're making here, I have a better audience where it's easier for people to hear that.

Do you run into any challenges? Because again, resilience is a big buzzword in our industry. And resilience is typically your capability of recovering when something bad happens, right? And in fact, it assumes failure. And that's probably the case in our industry. There's always going to be failures. But do you get resistance at all for leading with a metric like that, which is assuming that versus leading with, I mean, still having, right, that ability to recover and restore and respond, but leading with more of a let me predict and prevent because that's where the highest return on investment is, right? If we can avoid something versus having to minimize the impact of when something does happen.

Well, I still lean on that. Resilience is the new ROI. It is. Well, and the reason why I say that is If we're taking the NIST Identify, you know, Protect, Detect, Respond, Recover, the majority of our maturity needs to be in the Detect, Respond, Recover. Identifying what you have and protecting it is table stakes. So any program that is focused purely on identifying your assets and the valuable items in your organization and protecting it, you're just doing table stakes. So you have to have that, but you're never going to be invulnerable. Matter of fact, everybody is vulnerable right now. They just don't know it yet. There's zero days. If I were to say, and so everywhere out there, there in every infrastructure, in every hospital, in every system or solution, managing the vulnerability of it is focusing on the wrong thing. What you have to do is you have to focus on the exploitability of that. Number one, how do I make sure that my threat landscape is as small as possible? How do I react knowing that I'm gonna get compromised? That's that detect, respond, recover. So how do I shorten that time? How do I shorten that window, the MTTRs? And then how do I get into that space? Because especially when we're looking at AI threats. How am I going to respond to that? Those are brand new threats at a brand new speed. So I go back to the— how can I be the most resilient? Foundation, identify and protect. There's your baseline security. But they get really good at detecting, responding, and recovering, because that's going to be the cycle that we're very soon going to be into at an AI pace.

Yeah, so AI is obviously one of the big tools that are coming out. The good guys are using them, right? Organizations are integrating them, but also obviously the bad guys are using them and they always get that first kind of advantage, first mover advantage.

How do you— The bad guys.

Well, you know, they don't have to do QA testing, so they can just run with it.

They don't have to go through a governance committee for that.

No. They don't. They can bypass the whole ethics check. There's many shortcuts they can apply. So, you know, with these disruptive technologies and whether it's AI or distributed computing or quantum or whatnot that comes out, how do you see the attacks changing over time against the healthcare sector?

I like where you're going with that one. So when I talk about AI and security, I usually look at two things. How am I protecting AI? Am I securing AI? And how, um, how am I securing myself from AI? So, so how do I secure my AI? And how do I secure myself from AI? There's a, there's a different attack mode. So there's a couple of points here. What I'm going to say right now, AI is now fully in the clinical workflow. And attackers know it. So I think probably more so here in '26, but AI isn't experimental. It's embedded in diagnostics and imaging and scheduling and triage, rev cycle management. So AI disruption is clinical disruption, and AI outage very soon will be the new EHR downtime. So now AI governance is tilting into patient safety governance, and it's not an IT initiative. So I fully think in '26 and beyond, AI is part of patient care. And if you compromise the AI, you're compromising the care. So it's a complete shift in the model. So it's not just, hey, how does this affect me? The legacy stuff we're doing. But this is a brand new threat model, a brand new threat landscape, and it is quickly being embedded in everything we do for patient care.

Do you think that adoption, right? Because when AI gets integrated and embraced, it's got to connect to all the patient care systems and data systems and scheduling systems and all these other things, right? So the value of AI systems typically is predicated on the amount of access that it has to sensitive systems and data. So as we embrace it more, are you concerned that it will then open up an entire new vector of exposures that bypass your traditional security controls?

Absolutely. Absolutely. Attackers are already probing ML models, APIs, data pipelines, critical weak points. They're looking for errors in MCP, you know, Model Context Protocol, I think, right? MCP. They're already looking at these other weak points that were never there before. But I think it's interesting you mentioned data. So data is the oil of the information age. Well, data is the DNA of the AI age. It's literally created from it. And so that data, in order to have effective AI, you need effective clean data quality. And when you have that larger amount of data quality and that large amount of data availability, and the depth of that data source, that's, you know, ransomware's going to totally shift from just data theft. It's going to shift to care disruption via that mechanism. So we're going to, I think, I honestly think in my latte of evil moments where I'm thinking like a supervillain, you know, I think—

We all have those, by the way. I have a tie custom made for, Evil Matthew, by the way, yes. Yeah, evil Matthew.

So if Evil Jay and Evil Ham are having a conversation, you know, we're going to see a shift from data theft and ransomware to kinetic disruption in healthcare. We're shutting down OR schedules or imaging workflows or medical dispensing systems. So double extortion becomes triple. System disruption, data theft, and AI model corruption. There's already nation-state toolkits where they continue to leak into the criminal systems right now. And we're talking about like the bad guys crowdsource every single day. They are not constrained by their models on how they could operate this. So their ability to be first adopters in increasing sophistication is just crazy fast compared to what we can do inside of enterprise or even legacy healthcare in the enterprise like that. So I think, yeah, man, I'm kind of losing my prediction for '26, right? It isn't about files. It's about whether care can happen at all.

So I want to explore this evil Matthew, evil Jason angle here for a second because— Evil laugh. Have to have the evil laugh, by the way. You know, as cohorts in evil now, and we look towards the healthcare industry, you know, I see two big opportunities for two different primary threat actors, right? You've got the cybercriminals that are looking for extortion, money, whatever, right? And they're going to do that through grabbing data and breaching systems and denial of service, affecting care. Hey, if you don't pay me off, I'm going to shut down this or turn off your whatever.

Okay, great.

I also see nation states using this as a pawn in the foreign policy game, global foreign policies and politics, to undermine adversaries, to impact social stability for countries. And in those types of attacks, it's not about extorting for a few million or billion dollars like, you know, North Korea might. It's more, let's bring down the health system. Let's bring down the confidence of the health system. Let's bring down or undermine the confidence of the government that oversees the protection of the health system. And okay, so those type of attacks, I see where they're going to potentially exploit AI systems that have been integrated by the healthcare and not go in to shut them down, not go in to steal the data or expose data. They're going to go in to tamper with transactions, to modify patient records. Let's change up what people are allergic to. Right. And now, again, you've got, you know, what you started off with. You're talking about a health risk. This is, you know, lives that are in jeopardy. And when the confidence level starts going down and there's no paper records, there's no manila folder like in the old days, oh, this is, you know, Matthew's records, I can just go check this. It's all in the data systems. And if those have been tampered with, that could cause even greater damage at a society level. Mwahahaha. $1 million.

Welcome to my nightmare. Welcome to the machine. So yeah, I put my reductionist model, I put threat actors into 3 categories, cash, cause, or chaos, right? So you have people that want the ransom money, you know, chi-ching, make it happen, make it rain. Cause, hey, hear me roar. But the chaos component, that's the realm of nation states. That's the wrong— that's the lever they're going to be do that. And hospitals, make no mistake, are a microcosm of the national critical infrastructure problem. Complex, interconnected, underfunded, and mission critical.

And very visible and tying to the heartstrings of everyone, rightfully so.

That's right.

You know, uh, if you've got a child that has appendicitis and you can't get in to do surgery, that is life-threatening. Wait, what is that? You know, I I live in a first world country and I can't get an appendicitis taken care of before it bursts, right? I mean, that's, that's, it's crazy.

It's crazy. But you talked about the integrity of it and this, this is where it gets really scary. So somebody can go in there and they don't lock it up. They confuse it up. And so somebody could change labs. Let's just say potassium results.

Blood type. Blood type. Yeah.

Let's say blood type or just potassium. They're going in for your next thing. So the doctor can either prescribe me something that's gonna raise or increase that. Mm-hmm. And guess what? That's now physician-assisted suicide.

Assisted suicide.

Because now they've given something that's going to throw that off, changing one item, one, the integrity of one item in one lab result for a population. And so it does two things. One, it instills fear and uncertainty and doubt into a critical infrastructure piece that we have as a society. How do I go get healed? How do I protect my mom or my family or myself when we're at our weakest? We don't all go to the hospital and go, yeah, let's go to Disneyland. We go to the hospital and let's go check it out.

I'm feeling great today. Let's go get some blood tests.

Yeah, let's go get some blood tests and have some hospital cafeteria food.

That's the best.

But it's that when the confidence in the systems that we're using to deliver care either from a patient standpoint or provider standpoint, a physician coming in, they can't trust that. What does that do? What does that do? So the eroding of the confidence builds in fragility to this portion of critical infrastructure for us. And if our healthcare systems from a confidence level is like you go in and you're just like, roll the dice, that can cause a lot more disruption in society and culture than I think, hey, look, I've got more tanks than you. 70s.

Is it undermining the Hippocratic oath, right? And do no harm. We have to make sure we're doing no harm. And if we don't have cybersecurity, that could be undermining it.

Wow. And you're attaching it both. So it's, I used to make this joke about my little finger people here, right?

So I wasn't going to say anything, but yes.

Yeah. Yeah.

I'm using the fingers. Nobody wants to see the fingers.

Nobody wants to see the thing of the air pistols. But it used to be like, here's business and IT. It used to be like business and IT. There was this conjunction. And then now you really can't do business without IT. You really can't do modern business without it. Then there was business, IT, and security. So there's business and everybody knows you have to have IT for security, but then there's security stuff over here and it's like, okay. And over the years now we're getting to this point where like, oh yeah, you can't do modern business without modern IT, without modern security. And guess what we have now on the scene? AI.

I don't know where you're going with this, but let's keep it clean. Whatever finger things you're going to use.

I'm not talking about what they did. This is, this is not podcast after dark. Healthcare after dark. Unplugged. But the, the point, each one of these areas, but, but very soon you're not gonna be able to do any of this without AI embedded. As a given, as a component on here. And at any one of those points there, it used to be like business, I could keep it separate, IT I could keep it separate. And then if I undermine the confidence in IT, I could still do business. IT just made it better, right? And then I could say, okay, and then if I could undermine the security, confidence in security, well, that's okay, I can still do some kind of things here now. But when we start talking about, okay, if I undermine the confidence of all of those things and the mechanisms through something like AI, which is going to be embedded, we see it everywhere. One of the questions I don't have an answer to that I struggle with is how do we ensure that confidentiality, that security, that privacy is actually maintained? And not just in today's model, but tomorrow's and the next one. Because the evil Jay goes, you know, gosh, I can compromise this at speed now. Or I can, compromise this and just wait until it becomes part of that system and then exploit it well.

So healthcare is also a very regulated field, right? You've got customers, you've got suppliers and vendors and partners, you've got regulators and auditors, you've got your executives and maybe shareholders. You've got a lot of people to answer to, and cybersecurity plays a role in many of those. How do you see the expectations of cybersecurity changing in healthcare?

You forgot lions and tigers and bears. Oh my.

And there are lions and tigers and bears. And how are their expectations changing over the years and where do you see them going?

So, so back to my finger people. I'm not going to show them again. They've had their time on stage. It used to be something separate, right? So you used to, but nowadays you can't do modern healthcare without modern IT. You can't do modern IT without modern security. So it's really collapsing that into it. Like they're not different. Doing modern healthcare means you're doing modern security. And I think that's the cultural shift we're experiencing right now. You have to consider that at all levels, just for the confidentiality and integrity and availability of the healthcare record. So it is not an add or an extra or I should do, it's a must do. And I think shifting culturally in people's head that in order for me to do healthcare today, modern healthcare, I need modern IT, I need modern security. That's it. That becomes the non-negotiable. And getting everybody into that space where it's not just the CISO's job or the security team's job or the network infrastructure person. It's everybody's job because where the rubber hits the road is us, is all the people in the equation. I don't do security just because I love security. I may love security, but I don't do it for that. I do it so we can deliver patient care. That's the only reason why my job exists in healthcare. And you, so understanding that the job is to make sure everybody understands that if they're delivering healthcare in a modern society, you have to be doing security as well. So it's that crowdsourcing internally, it's that ownership model where everybody has a piece to play in it. I think that's a big cultural shift that has to happen, and it is happening right now. It's way better now than it was 10 years ago.

And as that cultural shift, do the, for example, the patients or the doctors or, you know, the CEO of the organization, Do you think their expectations of security, what you're going to deliver or make not happen, do you think that's going up? Or do you think it's kind of leveling off or somewhere in between? Maybe it's going down. Maybe they expect less of cybersecurity. I don't know. What is it in the deeper bowels in dealing with all these lions and tigers and bears?

Oh my. I think the, uh, it's not getting less. I think what's happened is, is we've sort of pulled the curtain back and, um, from a leadership standpoint, they're now looking behind the curtain saying, oh, I didn't know all that stuff was going on. This was, these were the invisible, invisible measures of success that were always occurring and now starting to try to consume the magnitude of what that is. And saying, hey, you know, when you have that rational conversation, it's hard to say it's rational that Matthew is in charge of everything up and down and possible security about everything inside this healthcare organization. You lose that thing of like, well, you're doing your security thing. How come you didn't do your security thing right? When you pull it back and you say the security thing's everything and everybody. So guess what? It can't all reside in one individual because one individual can't do it. They can't do it. And we're not resourced to the point where I could do it 100%. And you know what? We shouldn't be because I'm not a security organization. I'm a healthcare organization. So there's going to be a point where the maturity of the security program and the reduction in risk crosses over. And that is the optimal point where the program should reside and shoot for. And when everybody understands that that's the part that we're shooting for, that's the optimal point of investment and risk reduction organizationally, and you couch it as risk because that's what it is, then we all, we all understand that anything beyond that is risk we have to accept. Be. Not you. And so it's a different conversation. You say, okay, we can all agree that this is the point and we have to accept this risk.

They go, ah, it's a lot of risk, I don't want to do that.

Okay, great, give me some more money.

Infinite resources, infinite opportunities.

That little slide of it goes money. And, and so it's a more relevant conversation because then we go, okay, great, so I maybe I can't invest in that one more urgent care clinic because I need to put it here because it actually reduces the risk organizationally for the other 300 we have. Okay. But then the conversation is less about like the security nerds in here wanting more nerd knobs to, here's organizational risk and we know that if we move these measures, it's gonna adjust this thing. It's like little sliders on an audio board. And then we're gonna end up with a result here and we're gonna have to be happy with that result. Results, or maybe not happy, but accepting of it and own the accountability at the organizational level.

So you've covered several different aspects, right? You've talked about the threats and how they're changing and some evil geniuses, geniuses potentially could be in play here changing the threat landscape. You talked about disruptive technology like AI and how that's fundamentally changing to the very fabric of how organizations have to operate. And you've also talked about the mentality, right, that security is not binary. It isn't you win or we lost, but there is an optimal level of security that balances that investment, that friction to the organization, and, you know, the potential costs of everything going on.

Okay, great.

Rate, looking at all that and where the healthcare industry is today, what are the top 1 or 2 opportunities for positive change that you would like to see the entire healthcare industry move towards in the next year to 2 years?

Wow.

You can use finger puppets if you need to. We're resetting the finger puppets. You can use those if you need to.

Finger puppet queue has been reset. Um, let me approach it a little, a little bit differently because I mean, if I'm talking about a few things, so in, in hospitals, you know, they're old. I mean, the healthcare is old, 100, 100 years, 150 years for some, some organizations. And I mentioned that because they bought the original IT environment way back when, in the olden days. And so we are still dealing with mixed era technology in healthcare. Things from the 1990s, probably biomedical devices living next to 2025 and '26 cloud native platforms. So we have legacy OT that has not caught up with modern threat profiles. So I'd say right now, OT, um, or medical IoT, MIoT, uh, now accounts for probably about 60 to 70% of the attack surface in a hospital because it's unmanaged, because it's unmanageable, was never built for that. So we have a lot of third-party reliance. So I, I see threat actors looking to exploit exploit that brownfield reality of healthcare. You know, they weren't— hospitals weren't built for modern threat surfaces. Attackers know it, know it, and are, and are starting to exploit that institutional lag. So we have a cyber-physical threat landscape that we really have to address and we have to address it quickly. That's back to that exploitability. I mean, I can lock all those things that are vulnerable away behind things, I still have to deal with it. So I think there's that component. I did mention that ransomware is really going to shift from just data theft to care disruption. I think that's reality. So we're going to have a triple threat there. AI-driven attacks, they're going to outpace human monitoring. Already happening. Automated spear phishing. Will make modern, today's email defenses look obsolete. So, and that's everything. So including business processes. For instance, AI can craft clinically accurate fake orders, fraudulent insurance claims, or spoof provider notes. These, these aren't classic attacks against technical infrastructure. So we're going to really start changing how start looking at that. And I guess finally we have things like third-party risk and it's very rapidly becoming one of the biggest systemic weaknesses because again, we're all interconnected. I mean, there was the Change Healthcare incident that was provider to a provider to provider. It's like an nth party that impacted, I don't know, 80% of the largest healthcare systems.

Yeah, you don't have to attack every hospital, just attack their billing service provider. That's all you gotta do, right? It's all connected.

Yeah, so healthcare isn't one entity anymore. It's an ecosystem. And ecosystems fail at their weakest link. I love it.

It's scary, but you know, I love it. It's a great list, right? You've got OT, IoT, because we're talking about medical devices, right? That the scanner in the other room and all these other systems, you've got the evolution of ransomware and they love healthcare because again, it is timely, it is urgent and you can get money. There's money in healthcare for them. And AI impacts both at the scale as well as the effectiveness of the innovation using AI. For those types of attack, and then the third party, right? Going after the weakest link. And I don't think a lot of people understand how many third parties there are in healthcare. It is such a complex distributed system. You know, think about all the drug companies and transportation and vehicle and patient care and patient transportation. I mean, all these different things, plus your doctor and your dentist and your, you know, emergency room staff and long-term care. It's mind-boggling, right?

Well, again, we're talking about the evil pair here. If I want to disrupt healthcare in— his finger's back. If I wanted to disrupt healthcare in— as an ecosystem, why don't I take out a supply chain provider for IV fluids? Yeah. Yep. What's that do? I can act, I pretend I'm a hurricane, right? What would a hurricane, if I was a hurricane, what would I do? I would destroy that thing over there on supply chain. I would knock out with that. Or I would breach this one thing that is connective tissue for the ecosystem. And it very rapidly, well, I think it is an actuality, a breach anywhere becomes a breach everywhere. Lateral blast radius extends across state lines. To me, if a hurricane blows through some provider of, like I say, IV fluids that's in Florida as an example, and a hurricane swooshes through there, nobody gets IV fluids.

I think in my evil moment to undermine healthcare, I would go after the very small number of labs that healthcare relies on to send samples to, to get results, to understand how to treat, what not to, you know, to diagnose and everything else. There's only a handful of lab companies out there doing the vast majority of that. And if I can disrupt their operational capabilities, guess what? No more labs. You wanna see a medical institution come to a crashing halt is when they can, especially if it's emergent, right? Emergency rooms and so forth. If they can't get lab results back, yeah, it's let's go pull the books out and see what these symptoms could be, right? Kind of thing.

You just don't know who's going to make that risk decision.

Nobody's going to want to, right? Nobody's going to want to make a decision. Do we give them this? But we don't know the labs. We normally have to wait for the labs to confirm this condition. To give this medication. Oh, is the insurance going to pay for it if we don't have labs to show that they have the condition? So even if we give it to them, we don't get paid. So we're certainly not going to give it to them.

Right.

I mean, it just, I think it would start to just crater, just crater.

Well, it does. And, you know, to one evil you up, why not? To one-up evil. For the lab stuff, why not take out the provider of the reagents, the ingredients needed to do that, to be able to do those? So why take out one lab? Why don't you take out, you know, the guy who's grinding some sort of like mineral somewhere in an office trailer somewhere outside of a mining location, right? That's super well protected, right? So you, you, you take out that component there and it's no longer, so So now you're talking about a denial of service through denial of supply. And then, and you hit that there. Um, and let's, let's pick another one out that you can do since we're on the evil, this, this turned into the evil podcast.

This has turned into a very dark, dark discussion.

Exactly. And, uh, you know, in post you better not put like horns on me or something. But let me think of like, yeah, just a finger, just a few little finger buttons. The, think about a denial of wallet attack, denial of wallet. So let's say I start, I put an AI in front of a chatbot that's out there. And each time somebody uses that chatbot, it reaches a token. Each time it uses a token, it burns some money, burns some time on a computer out there. Why don't I just have all of my chatbots talk those chatbots up and then run your bill up till tens of thousands of dollars a day through your self-help portal.

Yeah.

So what was supposed to save you money now costs you 15, 100, 10,000 times what you thought it was. And then you can't afford it. You can't afford that. You have to shut it down. You have to shut that down or something else. There's a denial of wallet attack.

And at the same time, if you've got control of that, let's push some malware, some Trojans down to all those customers. Customers using the healthcare portal, and now you've compromised all those systems as well, right? Lots of fun. Okay, so I got to get back to the positive side.

Here's some malware. Look at the silly monkey. Look at the silly monkey. Here's some malware.

Click on this and authenticate.

Yes.

Give your Microsoft credentials. Give your work credentials. Yes. Okay, so back to the good side of the house, right? Taking off the Matthew, evil tie. We've covered a lot of ground here, and there are a lot of tremendously passionate and capable cybersecurity professionals in the healthcare industry. And I've got a tremendous amount of respect for the challenges we talked about and the ones that we didn't, right? There's just so many out there. So if you could give some advice to healthcare professionals out there, cybersecurity professionals that are listening in to us, What would you tell them to do to be able to help move that industry forward, help enable cybersecurity to show that value, to help patient outcomes and manage cyber risks?

I'm going to say it two ways. Spread the risk, spread the wealth.

Okay?

Make sure everybody understands that the risk is everywhere and support everybody everywhere to the best of your ability. So don't leave anybody out on an island. Somebody reports something, even if it's the 15th time they reported and it was sort of a, you know, Chicken Little situation, they're always thinking the sky's falling, one of these times it's going to fall. So actually, you know, but support it. Go ahead and look into it. Honor it, because you want people's hearts and minds in this game. And I think that's the biggest thing. And now, hearts and mind go from, like I said, individual contributor up to the chairman of the board of directors. Be clear, be transparent, be real, and let everybody know that you're there to support them as they support you. Organizationally with funds and their specific expertise. I like to say it when I go into the, um, when I go talk to our board, first thing that comes out of my head, first thing I'm thinking when I'm there is like, dang, I am the smartest person in this room. They're going to be able to watch this, right?

Oh yeah. They're going to love you for this. They're going to love this, right?

I think, I think, I think I am the smartest person in this room. Just looking at everybody. But it's immediately followed, I'm also dumb as a box of rocks.

So are you saying your board is dumber than— no, never mind, never mind. We're not going there.

I'll even put it this way, but here's the trick to say, hey, you know what? I am the absolute smartest person in the room for the things that I'm here for. And so is everybody else. And recognizing it, this is intellectual humility. This is personal humility and ownership. You have to bring your best self to that conversation in cybersecurity and say, hey, you know what? I am the person you hired here at the enterprise to make these decisions, to give you this advice and know this. And so I am your expert. I am your Huckleberry when it comes to this. Now, I'm also holding a box of rocks and I don't know what the clinical business, the rev cycle, the component, all these things are. You are the absolute expert in that. Here's the trick. I'm here to help you hold your box of rocks that has a bunch of cyber stuff in it. You're here to hold my box of rocks that have maybe a bunch of RevCycle stuff in it, because then working back and forth, we're now stronger together because of it. But you can only get there by being transparent and being really honest, radically honest about, hey, where's my expertise, where's not? And if we look around that room and there's boxes of rocks that nobody's helping hold, that's where we got to go get some more expertise. That's where we have to be intellectually humble enough to say, we don't know this, we don't have this, let's go get that expert. And if you look around the room and you have to allow somebody, you have to accept their help. This person is the expert in this thing. I'm going to let them help me and I'm going to defer to that expertise because they defer to my expertise. It's a shift to that versus like trying to hoard knowledge like a dragon. This is all my, this is all my knowledge. Good luck getting into my gold, warrior. No, it's a bunch of friendly dragons, what we want. Everybody's got a bunch of gold. Everybody's got a— let's get together and share and buy us— buy an island somewhere and live there as friendly dragons. Um, but I think that's the biggest point. Get it across that, uh, two things. One, you don't know everything. Two, you know a hell of a lot. Okay, you have to represent both those things as a cyber expert in your organization if you want to be at the adults' table, then act like an adult. Own both sides of it. Offer your help. Accept the help and move the mission forward. I think that's probably the biggest thing. Don't think— don't show up like, dang it, they didn't give me all the money in the world to do everything I wanted to, and stomp. Because guess what? That's not the optimal point. So understand your role. And I think that's the hardest part for some people to be like, I could do a lot if I had a lot, right? What do I have? What can we do with that? Is the rational part of the organization? How would I know that? By asking the organization. I'm not going to guess at that. I know what the rational use of funds and resources is at this level in the organization. This is the risk we can cover. This is what we can do. Is that where the organization wants us to be? And why? So I think it starts with communication, but also radical transparency, intellectual humility, and the ability to own both those things. Own, own, own your responsibility to give the help and accept it.

I love that, right? It is transparency. It is trust. It is teamwork, right? Everybody bringing their best.

Yep.

And the goal is not to get your biggest budget possible. Right? And the goal isn't to eliminate all risks. The goal is to get that team to decide what is that optimal point to make the best decision for the business. And they have to weigh and juggle, right? They don't have infinite resources. So they have to manage the trade-offs. So let's get them to the best possible decision. And that's how we all move forward the best we can. I love it.

That builds, that's built-in accountability too, by the way, we all agreed this was the spot and this is what we do, both from a business objective and a technology objective. So, right.

Wise words with finger puppets. Wise words. Jason is the CISO of MultiCare Health System and founder of Limitless Cyber. Be sure to check out his insightful podcast, Drink Coffee, Do Cool Stuff. Finger puppets are optional. Thank you for sharing your insights today with Cybersecurity Insights.

Always a pleasure, Matthew. Thank you for having me.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.