The Cybersecurity Vault - Rohit Parchuri on the Challenges of Securing Future Healthcare

Welcome to Cybersecurity Vault. I'm your host, Matthew Rosenquist, cybersecurity strategist and CISO at Eclipse. Today we're going to talk about data security challenges in the healthcare industry. I'm going to be talking with Rohit Parchuri, who serves as the CISO for Collective Health, and the security challenges are rapidly changing in the healthcare industry. We've got all sorts of of new complexities and it's evolving, well, for the benefit of the patients and also the infrastructure itself. And so we're gonna talk a little bit about the best practices, about some of those challenges and how cybersecurity for healthcare, it just has to evolve. And today's podcast is created in part by Eclipse, which provides an elegant capability to secure data in transit across insecure networks between untrusted endpoints and cloud instances. Welcome, Rohit. Thank you for coming and talking with us.

Thanks a lot. Glad to be here.

Now, the security challenges in the healthcare industry, kind of paint the picture for us. Help us understand some of those issues with the explosion of data and new devices and new players in the industry. Where are we at?

Yeah, absolutely. I think, you know, like you rightly said, healthcare is one of those complex environments where you have a lot of data. You're inundated with a lot of data into your systems and how you run through the policies and your existing workflows itself is, you know, it has a certain overhead to it. And now within healthcare, we're also talking about the ecosystem. Without that ecosystem, we wouldn't be able to serve to our, to our clients or consumers or patients for that matter. And so that happens to become a critical infrastructure ecosystem in a sense. And so when the data comes in, you're not only ingesting that within your existing environments, but also disseminating that into the third parties. And when we talk about ecosystem, we're talking about the vendors, we're talking about the partners and how they in turn use the data, process the data, and also store and archive that depending on, you know, whatever the data is, the nature, you know, of the purpose of, or the intent of the, you know, the, the transaction itself. And so in, in terms of that, I think, you know, data governance takes the cake, right? Of all the risks that we can think about, you know, within healthcare, uh, the overarching policies and how we set those up, and also having some level of visibility to the end consumers, you know, I, I, I, I believe that there is room for improvement and maturity for us as healthcare security practitioners to actually take a deeper look at how we do that. And also what kind of prevention mechanisms can we actually attribute towards that? So if anything, I think, you know, data protection, you know, data workflows and, you know, how we, you know, kind of extend, you know, not just within the existing environments, but also go beyond that and think about the overarching risk there, I think would be, you know, the biggest risk for me, at least for me, that's what, Majority of my time is invested in trying to ensure that the right levels of checks and balances in terms of how data is being retrieved and how we're sharing that with our third parties. Because one thing within healthcare itself, you're either a covered entity or you're a business associate. And in both cases, you are actually having some level of PHI that's flowing through your systems. And with that, you are heavily regulated, right? From a federal, a state, and a local agency standpoint. You need to have certain controls set up, and that's a legal requirement. And if you fail on that, you know, technically, of course, you're looking at liabilities, you're looking at class action lawsuits, and beyond that, you know, also there's an impact to the brand reputation. And I think these are all the things that are, you know, considered when, you know, myself, I'm assessing the risk and, you know, within that domain, and, you know, what kind of things that we have to think about, you know, even before we actually go into specific business. And, you know, when I say business, I'm talking about, you know, the, the business partner relationships that we go into and also having a foresight into what the risk could be. So yeah, I think, I think that that's where I would definitely see the biggest risk for healthcare.

Well, and you mentioned the, you know, it's, it's all about the data and the fact that there are regulations. And, you know, let's talk about that data. I mean, we're talking about healthcare data, right? I mean, this is, this is something that's private and not necessarily, you know, people don't want their data or information out there. It could be a detriment. But on the other side, it's also hugely valuable as part of their care. So, I mean, what kinds of beyond security or other elements of security are we talking about, you know, protecting that privacy of it, anonymizing it? Do you and the entire industry, do they somehow classify this? I mean, what are those basic steps beyond just kind of, okay, you've got to comply with HIPAA or something else. It's all woven together. From an end user, what should they be thinking about that you really have to kind of manage?

Yeah, no, that's a great point. I think you talked about it. Classification is a big part of that. You know, it still, you know, hurts me right now is that the classification concept, although the importance and criticality of that, we as an industry haven't really understood, you know, how we need to start, you know, compartmentalizing the data in terms of the classification itself and how we need to place them, you know, with the right attributes in place. So an example would be, yes, let's talk about, you know, maybe let's go beyond PHI, right, for a moment. Let's talk about the business confidential information that commingles with the PHI. And if that BCI ends up as a part of PHI, then your classification doesn't work out anymore because there are two different classifiers fires as a part of that. And now that dataset itself is much more critical than what you originally thought. You're not only talking about a legal requirement, but also you're talking about a policy violation within the company that you're having, you know, both the BCI and PHI together. So it's not only how we, you know, provide this information to our clients or end users, but also how we, you know, disseminate this information to our partners too, and how it operates within their own environments. So when we talk about the classification, you know, we're not only talking about how we classify the data, you know, within, within, you know, as, as a business associate, for example, if you're actually grabbing the data, you know, ingesting that into our systems, let's say we have a mature process to classify that. What happens as soon as the, you know, the data transfers into a different environment now, is that going to stay the same? Is that going to actually, you know, add on additional attributes towards that? And now the classification is going to change. And what kind of controls you need to have on top of that. So that the data lineage aspect of things, I think it's still, you know, immature, and how we need to kind of, you know, figure out, you know, what kind of controls exist in your BCI, in your PHI, do they, you know, apply to, you know, the data as it travels. And also the, the provenance aspect of it is very interesting, right? Within healthcare, like I said, there, there's co-mingling, but also there's unstructured data which means you're talking about eligibility files, you're talking about claims adjudication files. Majority of the time, right, more often than not, we get the unstructured data by our processors and we have to take that in and, you know, we apply, you know, some kind of an ETL, like extract, transform, and load kind of pipelines, which kind of, you know, changes, you know, transforms the data into a semi-structured or structured data. But how do you kind of, you know, map it out in such a way that, you know, okay, this is PHI based on the identifiers that are received. This is non-PHI, you know, based on the information that I have. And how do you kind of enforce those controls in place? So one is having a good understanding about how this data travels. Second is where it's going to be placed. And third, of course, is actual controls themselves. And also, how do you want to enforce that? The biggest problem that I've seen in my experience is that you have all these policies set up, right? So you get a policy from a HIPAA or a HITRUST or ISO, et cetera. But those are all policies written in plain text. How do you translate that into a code variant so you can actually enforce the controls on it? And that's been the biggest problem for me. How do you translate that so that you can actually execute on a policy? And there are a few things that, you know, kind of worked for us and we're still digging into that aspect of risk. But, you know, I think that still remains, you know, a pretty big risk, you know, in terms of how we kind of identify and enforce these, you know, different risk variants on top of that.

So one of the biggest challenges I'm hearing is you have to not only gather all this data, you have to interpret it, especially if it's not structured, then you have to classify it. And based upon that, that's going to determine what security controls that you're going to apply it to. And it could potentially change over the lifecycle of that data and wherever it goes. Am I getting that correct?

That is absolutely correct. And also, let me add on another complexity there. There's also— okay, and there's an obligation in terms of how we set up the environments too. It's because once we get to the access of the data, I'm not talking about the access of the, the user access to the data, but really the employee and contractor access to the data. So we need to have different environments set up specifically for that reason. And there's a PHI and non-PHI environment, and there are different, you know, criteria for each of those environments. So like, for example, within the PHI itself, there is no de-identified or anonymized data, but that's not the case with the non-PHI. You got to have the identification. This is really trying to control access and also making sure in the worst-case scenario, if there's a compromise on that environment, how applicable or how realistic is it for the adversary to actually get to the client information? So the controls vary. You have a standard baseline set of controls for a non-PHI, but you have an enhanced set of controls for a PHI environment. And you gotta be so specific because even if there's a single iota of a PHI identifier that results in a non-PHI environment, technically you are violating that principle in the first place and everything is gone. Everything is out the window, not from a breach standpoint, but really from a violation standpoint, right? So if somebody, you know, there's a breach and somebody comes in and does a forensic analysis on your environment, they're like, hey, you didn't do your job. So, you know, you are liable to all these just because you had that one aspect of PHI that entered into the non-PHI environment. PHI. So it's a cruel world, man. And definitely healthcare in the middle of it. It is.

Okay. So let's add to that cruel world because let's talk about the amount of data. I can only imagine with, you know, all these devices, it's no longer just the conversion of the paper records from the, you know, the primary healthcare provider. You know, we all went, used to go into the doctor's office, you know, the color-coded folders. It's a lot more than that. Everybody's gathering data and there's more information that needs to be shared. How does that complicate this spike in data that the entire industry is getting?

Absolutely. I think it definitely complicates a lot of things because irrespective of how you put these controls in, it's a constant maintenance and upkeep in how you ingest this data and how you place them together.. And every single time there's an ingestion happening, you gotta be aware of if there are additional identifiers or if there are additional indicators that you have missed maybe in the previous iteration. So things like that are always on the go, right? So having, I think, you know, some things like if you also, I'll, I'll talk about, you know, why sometimes it may not be a problem as long, as long as you have the basics and fundamentals, right? If you really have the workflow set up in such a way there's some level of context awareness, to the data that's actually coming into your systems, and then you apply those directly in the form of like, you know, like Infrastructure as Code, for example, where you're automating the process and controls are being enforced automatically on top of that, then sure, it's not, it's not so much of a big problem, but at the end of the day, you're still relying on the data retention policies and data archival policies because you don't need all that data stored because there's, there's always more data, right? If you want the data, you can always get— you can get the active data, you can get the passive data. You know, passive, when I talk about the wearables, if you have wearable, you're talking— you're not only tracking the user information, you're tracking the device information, you're tracking the software information. So all that information makes it into your systems. So it really comes to, you know, how much do you need that and how long do you need to keep them, right? For me as a security practitioner, I'm sure this applies to you too, The less the data, the better it is for us because at that point, even if a breach happens, nothing bad is going to— well, not nothing bad, but at least we're reducing the risk in terms of the exposure itself. That's what it comes down to for me, especially. Not the ingestion part, but really the storage and archival part of things.

Managing data can be a challenge, and especially if you've got too much of it. Trying to narrow that down because old data or too— it simply can be a liability, right? It becomes caustic over time. So trying to shave that down, I completely get what you're saying. So it becomes more manageable. And I mean, that's a great best practice and wanted to pick your brain. What are the other best practices in this whole data management space, right? You talked about ingesting it and classifying it, right? Interpreting what it is. You talked about making sure that that classification is accurate, right? It has to be accurate, otherwise you're, you know, one bad apple kind of spoils it for you. And managing that over time, especially in reducing what you have to manage. What else, what else, you know, in the forefront of your mind are you looking towards from a strategic perspective to be able to handle this properly? Best practices, give me your top 3.

Yeah, absolutely. I think those are all, you know, great questions, right? I think, you know, when we're talking about best practices, really talking about how to mature the program to a part where we can control and have, you know, right kind of measures in place. And data is no exception to that. And so when I report up to board, let me just, you know, give you a snapshot about the risk that I talk about to the board, and then I'll make my way down. So one of the biggest things is the asset monitoring. And when I say asset monitoring, I'm not really talking about just the systems themselves, but also how the data classification, like we, you know, aforementioned about, you know, the data classification and how that, you know, kind of ties into the processes and all that, how that maps into your existing systems, which actually captures this data that you currently have, and how does that use it to disseminate that, you know, elsewhere. So having a good understanding and a map of that assets is the first place. And I can't emphasize enough, you know, how much, you know, how important that really is. And asset monitoring spans across your enterprise. Don't just take that in a data fashion. Data fashion is somewhere you can start, but that's not the end of it all. You can extend that into different places where, you know, if you, if you're thinking about IT systems, like, you know, data is everywhere, right? Data is not dying. Data doesn't go anywhere. So data doesn't lie, right? It's always going to be there. And I think having that, you know, kind of map helps out. That's the first one I would say. And the second one we also talk about is the automation in terms of how we enable both the review aspect of data and also how we go about enforcing these controls like I spoke about. So the thing I was mentioning about before, like the controls that we had, is the whole infrastructure as code. So we use currently CloudFormation and Terraform to make some changes to data or, you know, also run our ETL pipelines., and also create some compute services on AWS for this data to reside. What we did, what's something that helped me and my team was, you know, tap into that, tap into that so we could actually translate our compliance obligations, our contractual policies into that. So we are actually having a compliance and security as code as the template itself. Every time there's a run on a Git, every time there's a push, we automatically look at that and scan through the data. And then we know like, what kind of data are we, uh, are we ingesting?, and where should this be placed, which environment, like is it a PHI or non-PHI environment? And if, you know, for example, if PHI, you know, ends up in a non-PHI, that's a violation, right? So that's where we get the alerts, you know, in terms of, okay, hey, there's this violation happened and this is how we detected it. And we go about, you know, there's another process that ties into it. I'll talk about that in a minute. But also we are also looking at the controls themselves. So if there are any configuration drifts, In terms of we know these controls exist, this is the baseline of the controls for this environment or for the system. If there's a configuration drift because of this PR that just got checked in, we need to know about that. We need to, we need to understand that risk. We need to identify that right away. Right. We don't want to delay that. Like I said, because the importance of PHI is so, you know, it's like I said, I can't emphasize that enough for healthcare. It's super important. And every time there's a delay in how we act upon these alerts or any threats, I think the worser it gets. So that's another one. The third one is really the monitoring piece I would think about, you know, which really helped me out is the whole incident response and the forensics nature on, you know, on the data itself. One is getting a good situ— one is knowing the situational awareness, right? Do you really understand where exactly the data sits and how that kind of translates into all your, you know, rest of the workflows that you have set up? But also second, like if there has been a breach or a potential incident or anything of the sort, how can you take that information that you gathered from that alert and perform your incident response operations? And that's a risk for us right now. And that's something where, you know, that's where there's more room for improvement for us is that have some level of automation for us to put some kind of thresholds in terms of what's a violation versus what's not. Because in order for us to scale, right, we can't look at every single incident and we can't really, you know, have a process that ties to it. So we got to figure out, you know, where exactly is that balance, how much the tool can help us out and how much a person, and when the person actually needs to step in and, you know, perform these operations for us. So if it, you know, if, if it helps, I think that overarching data security itself spans across the ingestion, spans across, you know, the, the controls themselves on the systems And then of course the monitoring aspect of it, which is, you know, really the post-deployment aspect.

Got it. So you need to have good metrics. You need to be able to provide that to be able to, you know, oversee and manage the system, especially to the board and to the C-suite. You need to embrace automation simply because of the scale and the complexity of all the data that's coming in. If you can't automate that, you know, you're sunk, right? You're overtaken by the tsunami of data. And then third, if I heard you right, it's the ability to be able to monitor what's going on, to be able to detect when you have anomalies, when you have issues, so you can rapidly move in to disposition that and then circle that back around to improve your processes, automations, and metrics and everything. Did I get that right?

That's exactly right, yep.

Okay, so all this is great, but there's still a wild card there, right? We live in a world where you've got intelligent emergent threats, and those threats are constantly evolving. So what are you worried, right? When you've got your system running, what are you worried on the horizon? What are you seeing with the threats that are changing and adapting?

That's a great question. I think, you know, if anything, pandemic has introduced new kind of variants into this whole risk landscape of ours. And some things that me and my team, you know, have been focused on since last year, since the pandemic began, is, you know, in terms of how do we protect our users and contractors, right? When I say users, employees and contractors too, who are actually getting access to our systems, because now, until now, we had a notion of perimeter, we had a notion of network edge, and that's where users would come from, right? You have, you know, people come into the office, they do their job, they leave, and that's the end of it. But now we are extending that beyond. And now it's all, you know, it's all happening in the remote workforce and you still have access to the same systems. That didn't change. The way you access it, the threat vectors, the threat actors, right? That whole threat landscape itself changed. So I think for me, if anything, the post-COVID world, right? I think that is going to stay in terms of how the remote access and remote infrastructure itself would be, you know, still alive and how users accessing those, I think, would still follow the same models as we're doing right now. I don't think that's ever going to go away. I think what we could do as security practitioners, I think really, you know, from a risk standpoint itself, I'm thinking about, you know, how do we, first of all, you know, bolster the right controls with our remote infrastructure that we have in place? So this could be, you know, having a proper understanding about the zero standing privilege, right? The whole zero trust architecture aspect of things. You start with nothing, but you validate and verify, and that's how you get access to the systems or data. And also there's an aspect of the endpoints themselves, right? So now you have a corporate endpoint or a laptop that you're actually taking home and it's connected to your own Wi-Fi and it connected to your own printers and your own personal devices. So what's that risk going to look like, right? How do you have the controls on the endpoint themselves? Do you think about endpoint detection? Do you think about anti-malware? But also I think we have to go beyond that a little bit and also see, you know, how does that impact the, you know, when, people start transferring or retrieving the sensitive documents, in our case, let's say PHI, are they allowed to print it, for example? Are they allowed to print it to their own printers, for example? And because within the policy itself, we do mention that specifically, that if any printing of any sensitive data has to happen, that has to happen in the corporate situation. But now you don't have a corporate situation, right? You have a home situation and you got to print it there some way. And there's a legitimate business reason. Don't get me wrong. I'm not saying that people are doing the wrong things. I think there's a legitimate business reason, but there's also this exposure of risk that we haven't seen before. And now this is a new variant that came in. And so having a good understanding about, you know, I think everything starts back again, going into the asset monitoring, really knowing what data exists and who has access to that data. I think that's the first control. The second control is also trace it in some way that users, you know, either accessing this data and also, you know, having, you know, printing the data out and having clean desk policy, for example, things like that. You can't really enforce that. I think the only way you can really do that is empowering people, you know, to do the right thing, right? You got to have the training and awareness in a way that kind of sticks to them, right? You know, every employee is an owner of the company themselves, you know, in some fashion. And I think they have to really take that into heart. And that's how they would operate. Like, no matter how many controls you enforce, people are always going to find a different path to take that. You know, if the control is enforced on my laptop, for example, just thinking through an attacker, right? I would easily email that to my personal email, that same PHI, and I would go to my personal laptop and still print it if I disable the printing on my corporate laptop. So that's really not going to stop people from doing bad things.

I think that they find workarounds. They do.

Yes, absolutely. Absolutely. Yep. And that's, that's the bane of security existence, right? You gotta, you gotta figure out where exactly, how exactly you gotta draw that line. But that's, that's one aspect I would look at. But yeah, I think, I think those, if anything, those are, you know, a few things, you know, at least from a pandemic sense, where some of the lessons that I learned and, you know, how to think about risk. But also there is another one on the horizon, and this is something you're aware of. Everybody in this, at least in the security industry, is aware of the supply chain, right? The whole issue that happened with the FireEye and SolarWinds and all that. So, you know, we can't turn a blind eye to the supply chain risk. I think that is as important or more important than it ever was. And more and more business relationships, more and more vendor relationships that we have as a company is actually increasing that risk more and more. And now having some way of validating the provenance of code provenance of binaries that actually make into your system or into your CI/CD pipelines, it becomes even more important. So I think we need to have disciplines not only in terms of, you know, how we enable those workflows to identify or validate the provenance, right? But also what happens with the telemetry, right? If something bad happens, are you able to detect that? Do you have the right traceability in place? Do you know where exactly the systems exist? Do you know exactly how the data is being retrieved and sent off to like a command and control server? Or, you know, some nation-state attacker comes in and they're able to pull something, they're still within your system, for example, are you able to identify, you know, where, what exactly is happening? Do you know, like, if there's a lateral escalation that's happening? And, you know, I think these are all things like we can all, we can throw all the keywords and I certainly don't want to do that. But I think the, you know, the crux of the issue itself is how do you manage that aspect of supply chain? How do you validate your suppliers? We do a point-in-time assessment today. There's one audit that you perform, and then after that, you really don't get to it until the next year rolls in. And you only— when the renewals come in, that's when you go back and reassess the controls or the gaps that the supplier has. There has to be a mechanism. And this is— I'm not talking about a specific industry. I think as a security community overall, I think we need to think about what's a continual risk assessment processes that we can have in place when we're having suppliers. Within our ecosystem? And also, how do we prove that auditability, right? If something changes, do we know the controls that we agreed upon within the contractual agreement? Does that still apply or do we need to change that? Like, as the gaps exist, you know, we also need to think about controls. If that's not happening, then technically that process is broken. And I feel right now we're actually in that space. And I'm not saying we're not doing anything. I think there are a lot of leaders that are actually, you know, putting a lot of thoughts into that process, but I think we just need to do more from that execution standpoint.

Third-party supplier risk, you know, is a huge challenge. We're, you know, we're seeing with the, you know, the major breaches out there, we saw SolarWinds and we're seeing Microsoft Exchange, and that's not going to slow down. It's a whole new paradigm. And, you know, sadly the industry, well, even though we've known about it, we haven't really been prepared. So, I mean, what you're talking about is crucial, and there are some really brilliant people out there trying to come up with ideas. But even if they do, we still have to implement them. And it all comes back to trust. And you're right, if you're only doing a, you know, a SOC, you know, or a SOC 2 or SOC 2 Type 2 type of certification, it's kind of a point in time until that rolls around again. And really, what's your confidence? Because a lot of things can change in 12 months. A lot of things can change in 3 months. So if we're not understanding the changes in the technology landscape and how they're opening up, it's a major risk. So, and COVID was a perfect example of that, right? As you mentioned, the entire technology landscape where people were now working remotely, printing remotely, and still having to have access to the data to do their jobs, but those normal controls that we relied upon, the normal network perimeters or subperimeters, they kind of started to evaporate very, very quickly. And I want to touch more on this third-party supply chain because I think you came up with some great ideas, and it's really about that kind of data lifecycle and how you manage that. And not only are you, right, as a CISO responsible for figuring out what threats that third parties are to you, there's a potential for the services and software that you're providing or the data interfaces that you're providing to your partners, you could also be a risk to them. So how in your mind are you approaching this problem? How are you making sure that you're not the risk to your partners and downstream suppliers and vendors?

That is such a good question. I'm glad you asked that. So I think, you know, one thing I've been fiddling with in terms of how we implement the solutions in terms of protecting ourselves, right? I think you spoke about the risk transcends, the risk transcends both ingress and egress. I think when it comes to ingress for us, which means we're taking some of the data, right? We're not only sending the data, but also we're receiving the data. So I think this is where the supplier and the provider kind of relationship really helps understand where exactly, you know, what's the shared responsibility there and also who's responsible for what exactly. The roles and responsibilities and also what within that I think should be prescriptive. And something that helped me with my conversations when I talk to these vendors or partners is that not just going through the SOC 2 Type 2 assessments, not just talking about HIPAA or BAA for that matter, It's also drilling a little deep down into the technical, logical, administrative controls that they have in place right now with their own toolsets and also what they would like us to have in return too, because we're also, you know, kind of a risk advisor in the same form as they are for us. And I think we need to work collectively in that realm. One thing that helped me specifically is to have is some kind of a proxy infrastructure before, you know, either the, the data goes out or the data comes in. What I mean by that is a proxy infrastructure, let's say it's a system that actually strips out some sensitive data elements before, before it sends out. And so technically what we're doing is we're trying to, we're trying to extend the demarcation into a place where we can still control it And we're in control of the data that is still sensitive for us within our environment, what we feel is important for our customers. And we're only sending the data what's really, you know, following the, you know, the principle of least amount of data that should be, you know, sent over to third parties. The same thing happens on the reverse. So when they're sending the data, we're very specific about the things that we don't want, right? Which means this is where PHI or BCI comes in. But like, we don't want to take that responsibility because there's no reason for us to in the first place because we don't need the data to do certain processes. So instead you, you can leverage this, right? All we're saying is that leverage this infrastructure, leverage this principle so you can actually have something similar in your own environment. And then you're stripping off the data that you don't need. So you're reducing the risk on your side. At the same time, you're reducing the risk on our side. So that's, that's one control mostly on the technical front. And also it has a relationship with how we write the contracts. You know, this is because we're talking about the risk and we're talking about the coverage in terms of the data that's flowing within these systems. We actually write those down and also, you know, ensure that we apply. And I think, you know, from a maturity standpoint, I think we still have ways to go in terms of, you know, how we identify all the different identifiers. And there's a lot of data coming in and there's like, like I said, the unstructured data is, you know, the epitome of healthcare industry. So that's always going to be there. So for us to really identify those workflows would be You know, something that, that, that takes a while. We have ways to go, which is, you know, which is why I think, you know, we have to enforce on the principles. But from an execution standpoint, we got to keep improving.

And you mentioned two things there that really stuck out to me, right? I love this idea of a pre-prod or a validation, almost holding zone where you can sanitize, clean up, you can validate. Yes. Is this the the right amount of information, right? Not too much, not too little, but the right amount of data going in or coming out. I love that idea. And that protects your environment and the sanctity of all the work that you've done previously in Klasselheim and everything else. But the other thing, and you've mentioned this a few times, is you've talked about how you codify these expectations in contracts and you're taking that and translating that into the tools to help your automation, again, to help your metrics, things that you were talking about. And I'm seeing this cohesive picture starting to come together where you've got reinforcing layers that are repeatable and it's, you know, designed kind of in a comprehensive way that you're setting yourself up to be scalable, to be able to be able to, you know, to adapt not only to the threats, but even to new potential partners. And the other thing, you know, you mentioned is really about that collaboration and communication with those suppliers, those vendors, those partners upstream and downstream, that it's really, really important because you can't do it alone, right? You're part of this chain. And we've covered so much here. So, you know, I'd like to know from your perspective, Right? And it sounds like you've got a good system going and you're following best practices that we've seen in the industry, and that's awesome. But again, more data, more users, more expectations, maybe more regulations— well, certainly more regulations that are coming— greater infrastructure and new types of data sources and everything else that people are going to have to deal with. All at the same time that expectations are going up from patients to partners to, to you name it, right? What are the best practices that we need to be thinking about tomorrow given all of that? Where do you think the industry's mind has to be looking towards?

Yeah, it's good. Good question. So I think also let me just add on to the data part there are other variants that actually come into picture too, right? Because we're talking about this modernization in terms of the digital transformation, the technologies that we are trying to implement. And you see the AI, the VRs, ARs, you know, 3D robotics, you know, the robotic process automation is something that I've learned recently. It's been, it's been there. It's embarrassing for me to actually learn this recently, but it's been there for a while. But when you think about it, there's a lot of data that's coming in a format that you typically wouldn't recognize it. You wouldn't really have the awareness in terms of, hey, is this data actually something sensitive? Should we keep an eye on it? Or is this just the noise that's actually coming into our systems and just taking up the space? I think majority of this data that we are seeing right now, we don't really have a good understanding of that. So like you said, adding on to the data, it's more data and more data and more data. I think we got— you got to figure out, you know, I think this is where it helps to classify that and also really understanding what exactly that means to us as an organization and also to the broader community. What are those specific things we need to look out for? So in terms of the best practice itself, I think this is a good time for us to, you know, from healthcare, from a healthcare standpoint, let me just touch on that first. There's still a lot of antiquated processes and, you know, you spoke about the paper and that's still existing today. Not a lot of providers, not a lot of partners really understand how does security come in between all of this and help us actually enable the business too, right? I think that's the mentality about blocking the business versus enabling. I think that still exists, like especially within healthcare. And I think that people have to be educated the right way. I think first and foremost, your board of directors and executive team, they need to be educated in terms of what exactly is security bringing to the table and how are we trying to enable the business? And this is not just about protecting something, but this is also about the reputation. This is also about, you know, improving the revenue for the company. You know, if you're coming up with a new product line, right, you know, think about how security can actually help us out. So that's one. And the second one is also, you know, forecasting the risks. I think quantifying them in a right way would be super helpful. And something that helped me personally is if you're going into a business in the, let's say, European Union, right? So GDPR, as you can think of, So that's just an example, but not a lot of people do understand the privacy laws. Not a lot of people do understand the cybersecurity laws within that, right? So this is a good time for you to talk about them before you even go into the ideation phase. This is where you can actually set yourself and set your organization to success before the, you know, the rubber meets the road. So that's, that's one thing you can always think about. And also I think, you know, the workforce in general, I think the I think we're still back on how we train our employees. Yes, we do have all the awareness, uh, you know, training and, you know, the, the security training and all that, but it has to be more effective in terms of applicability and usability for their specific roles. I think that's where we lack as an industry today. More micro— I don't know what they— how they call that, but they say like nano courses or micro courses, microlearning or something like that, which is more role-oriented, role-specific. That, hey, if you're looking at this course, for example, you right after that, you know exactly how to deal with security problems. And I'm not saying you're not, you're not, you're not, you know, dealing with all sorts of security problems, but at least the ones that fall into your responsibilities and roles. I think that's one thing we could do better. And also, I think the access aspect, you know, this never gets old, right? The access is always going to be there and how much access you need to give, you know, you know, apply the proper, you know, principle of least privilege and also role segregation. I can't emphasize that enough. I think that's really the basic. Yes, basic in intent, but not really basic, not basic in terms of effort. It takes a substantial effort to actually set something up, but that's like a pillar. Like once you have a strong foundation, you can really build a lot of things on top of that, but you got to really focus on that first to begin with. And access really falls into that specific arena.

So when it comes to access, it's not only setting up the right access, it's maintaining it over time, especially as people expand or contract what they need to be able to touch and manipulate. Yeah, I mean, that's a tough problem. Well, so you talked about a lot of different best practices there. You talked about making sure that it's not just the technical controls that you need to look at and implement and leverage. It's also the behavioral controls in training and educating your employees and maybe even your users, but definitely your partners and and everybody else, because you're, again, you're all on the same side. You talked about how CISOs really need to be that champion, not just of, of trying to keep risks down, but also working with the organization and understanding how do you progress the overall goals? How do you seize those opportunities? How does security help enable the business achieve the goals that it needs to achieve? And it ties back to what you were talking about. You got to have the metrics and the data to be able to show all of that. I mean, you covered, you covered so much, and especially in that partnership with those suppliers and vendors and who you're getting data from and who you're shipping it off to.

It's—

I mean, that's truly fantastic. And all of that with the background that, you know, data is going to get more complex, it's going to increase in the amount, and there's going to be metadata that right now we don't think will undermine the privacy or regulations, but later on it might, especially with these intelligent AI systems that can start piecing together disparate pieces of data to identify people. I mean, it's, it's a constant, constant change. And that's why, well, CISOs don't sleep. So one last question. You know, looking at all this different technologies and behaviors and processes, and how it has to evolve and keep pace, right? Is there a particular technology or something, a pet project that you're kind of looking at in the industry and keeping an eye on that holds promise in your industry in managing the data security of healthcare?

Yeah, while there are a number of technologies in play right now, I think, like I said, the digital transformation is real and we do see a lot of solutions, you know, coming to the rescue, if you may, you know, within the healthcare spectrum itself. And I want to talk specifically about security within that. But one thing that, you know, one thing we're researching and one thing also, you know, captures my interest itself is blockchain. And we talk about this blockchain in different variants, we talk about it in different contexts, but when it comes to healthcare, I believe it has, you know, wide range of applications to it depending on the scenarios, depending on the nature of the business itself. But, you know, I think the important component of the blockchain itself is the ledger, you know, technology facilitation, right? So you got some way you could actually go back and validate, you know, different entities and entries within that. So, you know, for sure that this is, you know, this is where the identity began. This is how the data flew and also, you know, where the data lineage itself is. And then you basically, you are actually making sure you're, you know, validating that provenance piece like we spoke about in the supplier. In the supply chain attacks. So, you know, I think there are multiple applications to that. Like, one I can think of is like a secure transfer of patient, you know, medical records, you know, which, you know, pretty much, you know, every healthcare associate or a vendor is, you know, within that mix anyways. And also managing the whole supply chain events, you know, that's really the promise for me and what it holds. Like, if we actually get to the part of implementing something But that's something we're looking at. And also the other benefit I can think of, and I'm not sure how exactly it will be in practice because I've never implemented one, but just how, you know, just the concealing of the identity of the source. And in one sense of things, it's bad because you can't really prove the non-repudiation part of it. But also from another sense of things, so for de-identification and anonymization, That's super useful for me specifically because we're trying to map those into different environments. And if it's a non-PHI, if blockchain can automatically, you know, do that workflow for me directly as opposed to having an additional control do it, I would do it any day because that's a part of data that I don't want any kind of relationships with the patient records. So I think those are the two things I would look at, you know, if we, you know, end up going into blockchain. But currently we're just looking into it to see if this you know, would I even fit the requirements?

Well, that's fantastic. I mean, it holds a lot of promise. A lot of people think blockchain and they're only thinking cryptocurrency, and that's only one use case, right? There's dozens of use cases just within the healthcare that are beyond cryptocurrency, you know, protecting the privacy and doing transactions and, and, you know, making sure that data is available. Whether it be a private blockchain or a public blockchain, there's probably lots of different opportunities in that space. So I agree with you. I think you're absolutely right that this is an opportunity that could, you know, profoundly impact and improve healthcare and help it keep pace with all those changes and all the security expectations that are coming forward. So I want to thank you, Rohit, for coming in and sharing all your insights, especially all those best practices, because it sounds like you've got a good grasp on the challenges and how to tackle those and some great insights looking forward with where your entire industry needs to go.

Thanks a lot, Matthew. It's been a pleasure. I think all these practices, you know, something that it keeps me honest myself, like when I'm actually going through this, like these you know, these talks help me so that, okay, I'm talking one thing, I don't want to do something else when it comes to the action. So it helps me in a way as well. So I think, you know, one thing we can all do as a community is, you know, be collective in terms of knowledge sharing and also think about these, you know, these risks that we face as an industry right now. It's just not a job of one company or, you know, one thought leader. I think it has to be collective. It has to be in a way that we can present that and also scalable at the same time. So I'm happy to be, you know, at the place where I would— I'm able to convey the stories from my perspective. And, you know, I'm looking forward to additional talks so I can learn something from them too.

Yeah, definitely. We have to do talks in the future. Thank you again.