← Risk Never Sleeps Podcast
Risk Never Sleeps Podcast
Episode #101. Effective Risk Management in Clinical and Research Environments, with Adam Rosen, the Chief Information Security Officer at Roswell Park Comprehensive Cancer Center
00:27:28
Loading summary
Transcript134 lines
- [00:00]
A
Foreign.
- [00:06]
B
Welcome to Risk Never Sleeps, where we meet and get to know the people delivering patient care and protecting patient safety. I'm your host, Ed Gaudette.
- [00:18]
A
Welcome to the Risk Never Sleeps podcast in which we learn about the people that are on the front lines delivering and protecting patient care. I'm Ed Gaudette, the host of our program and and today I am pleased to be joined by Adam Rosen, the Chief Information Security Officer at Roswell Park Comprehensive Cancer Center. Welcome, Adam. How are you today?
- [00:38]
C
Thank you. I'm doing well.
- [00:39]
A
And I hear you're from Buffalo.
- [00:41]
C
Yes.
- [00:42]
A
How's the weather?
- [00:43]
C
Weather right now is good, a little cool. Don't ask me any questions about the bills because I won't be able to say anything intelligent about it.
- [00:52]
A
How about the Sabres? You a hockey fan?
- [00:53]
C
No.
- [00:54]
A
Pretty much.
- [00:54]
C
Same position on the and I'll show up for games there from time to time. Enjoy the stadium food. But that's about the extent of my sports participation. Sounds like me.
- [01:06]
A
So we'll probably get into what we did when we were kids. Were you D and D? Were you Dungeon Dragons place? Yeah, me too.
- [01:12]
C
It's very much a ghost sports ball.
- [01:15]
A
Exactly. All right. That was a little off the cuff, but we usually start with a little bit about you. Your background, your current role and your organization.
- [01:24]
C
Sure. Currently I am Chief Information Security Officer at Roswell Park Comprehensive Cancer Center. We are an NCI designated cancer center. That means that aside from our patient care mission as far as curing and treating cancer, we also have research areas and very heavy focus on cancer research and also on education. Those three bind our mission as far as it relates to cancer. So we're very focused on that particular area of medicine. We were the first NCI designated cancer center in the U.S. if my memory is serving me. And then as far as what got me here before talking about too much about what I do, I've always been into computers. My father was a computer person, did sales and I think the first computer we had in the house was a Compucolor which nobody ever has heard of. It seems like when I talk to people. But pre D, then we got an Amiga, we moved up and then very early IBM laptop back when it was a big box with a small screen and got me into like basic programming and just fiddling and tinkering around. It was something I was always interested in. And so then through high school and into college, the focus was computer science and engineering and originally was going to be start my own game studio. That was my original plan.
- [02:51]
A
That's cool.
- [02:52]
C
And Then went into grad school and started getting into security there, at least theoretically. I went to work as an independent study on a security project that wasn't what I was expecting. It was really around user behavior analytics in the sun environment and analyzing and detecting unusual activity patterns. It was written I think in Java, which was not my language at that point that I was familiar with, especially with the GUI programming. And I spent two out of the three months of the semester tearing this apart trying to understood how it worked because I couldn't figure it out. And it turned out all he did was UI stuff and it wasn't me. It was like I just figured I was missing something when I was tearing it apart. So that was my first security project that didn't really pan out the way it did, but from after grad school I went to the Naval Undersea Warfare center island and did some ATM networking but also did some work with on firewalls with an allied submarine program there. Started getting more into security and monitoring in that role and I was there for about three years and then we moved back to Buffalo. At that point I started my own IT consulting company because I figured it's easy just hang my shingle and a lot harder than that. But I had a set of clients and just naturally my focus started becoming more on just the basic security of small business security. Antivirus, backup recovery, disaster resiliency setup, early cloud backup to my own data center kind of environment. And then turned one of my clients that was a small healthcare provider became my. They were becoming my larger clients and they ended up just becoming my full time job. And I had shut down the shop that I had started and I was doing everything there. The only IT guy, soot to nuts, VMware design, resiliency and SAN configuration. But focusing more and more on the security side. It was just getting more interesting and the HIPAA compliance and it was just given the different projects that's where I'm willing to spend my time. And so after a certain amount of time there I decided to seek out just a security focus. I came here as a security engineer under the previous CISO who was the first CISO here that escalated quicker than anticipated. I was there for about six months and she came and decided that I was going to be her succession plan for when she left. Two, three years down the road and she wanted to start getting me up to speed and on some of those operations she left eight months later. So a little faster than planned. And then just. It was a leap, but one that was. I liked the challenge that took me into the role and for a while I was doing double duty. I was doing my old duties at it, but the new stuff, but that has mostly settled down over the intervening years.
- [05:56]
A
Interesting, interesting.
- [05:57]
C
So that's what brought me into this role. And it's been challenging. It's been interesting. It's joining a community that is in healthcare security has been an experience where you have a lot of people to lean on and good people to commiserate with when you're sharing your challenges that everybody shares. It's a role I've been enjoying most days. And then as far as how what we're doing here, I don't think it's too much different than seeing most healthcare organizations, except it can be a little more challenging because we have the academic and we have the research and we have a clinical, all in that same environment. Serving different masters can provide some of its own challenges. Balancing and enabling the researchers to be flexible and access the services they need while making sure that the phi is secure, the environment is secure, because patient care is number one and this is.
- [06:51]
A
Like an IRB research function. Interesting. And how are you working that into your overall security process? Because obviously I'm assuming you're exchanging data. The parties that are involved in the research, how are you managing that process?
- [07:05]
C
We interface with legal and privacy teams. We work to make sure that wherever we're giving our data, it's third party vetting to make sure that they're following the appropriate controls and that we have the assurance that high level of assurance that our data is going to be kept secure. Contracts are in place, BaaS liabilities, cyber insurance. But I've always taken the stance of those are good things to have. They help mitigate the overall impact. But from a patient privacy perspective, regardless of how much you're going to be reimbursed for it, the records are just as brief. You haven't protected the privacy. We focus a lot on that due diligence and looking at the architecture for exchanges, a lot of which have been standardized at this point through various platforms. Whichconics things a little bit easier. We don't have to keep reviewing everything as its own entity.
- [07:59]
A
And are you an EPIC shop or no?
- [08:02]
C
We are not.
- [08:02]
A
Okay. And when you look out over the next 12, 24 months, what are some of the top priorities on your plate?
- [08:09]
C
Number one has really been that I'm trying to change the way communicate and involve the business in risk. One of the especially when I first started starting the job, I would talk about risk in very Technical terms about what's on our risk register, about not having a hole in our DLP or configuration that wasn't secure, but that just goes over the heads leadership and then supportively nod their heads and expecting to take care of it and do our best. What I've been focusing on the past six months, and this is an evolving process, is really working with the business. So first of all, risk is the intersection of impact and likelihood. So my line has been my team is proficient in determining the likelihood of something happening, but we're not the best at determining the impact. Right. And where it's scale the scale is. So instead of us doing a thumb in the earth, where do we think it falls on that matrix? We've been bringing in the business very heavily. So like privacy compliance and legal, you tell me what level of number of records is a medium impact, catastrophic impact, et cetera. So that we're all talking the same language when we come back with risk. And then we're following better governance because we're creating tolerances about where we need review when the risk level hits a certain threshold. And we're doing that with financial. You tell me what the dollar values are for each of these different criteria. Catastrophic, essentially being something that jeopardizes our ability to operate. And we're doing it with intellectual property and reputation, which has been more challenging to qualify. And also with clinical impact. Right. From a senior executive level looking at, you tell us if this particular system meets the criteria that an outage would be a catastrophic impact. Obviously the EHR qualifies as that.
- [10:14]
A
Sure.
- [10:14]
C
That lets us talk more about the risk on an equal footing because we've gotten that buying in and everybody's aware of what we mean when something is a medium risk or a medium high risk, et cetera. The other part of what we're doing that I've been really focusing on is really talking to senior leaders and executives about the high level business risks and some of the technical risks. And we've revamped our risk register to take, I think we've got about 40 business risks like loss of clinical availability due to ransomware, breach of privacy due to ransomware or external attacker in general, breach of privacy due to internal threat, loss of the data center because of fire or flood. Right. Environmental risks and. Okay. And then we're taking our risk register and we're tying each of those technical findings to one or more of those business risks and then mapping that out on a risk matrix to the what do we feel the risk of all of these business Issues are that they care most about and then we can talk about the technical things we're doing to address them. For example, loss of phi to a third party change, health care, Blackbaud a few years ago, that's up in the high dark red because you look at a five year period, which is how we look at it, it's pretty much guaranteed to happen. And the impact as defined by the business of the loss of that number of records is a high impact. When we talk about that being high up in the upper right corner, they understand that and it's not an arbitrary decision on my department. And then we can say, okay, well can we reduce that if and and same thing with ransomware. And then what we're doing is then we're taking the various information security projects that we're working on now or proposing for the near future and we map that so you can actually see in the dashboards that we built. This project touches these risks that are distributed hopefully usually in the high risk areas because those are the ones you want to address, giving them that feedback and that hopefully clear understanding of what we're trying to do on an annual basis with our projects.
- [12:38]
A
Got it. And where does the adoption of AI fit within your priorities and your scope today?
- [12:45]
C
It's something we're actively working. We're trying to create best practices around how to use it, and not just from a cyber perspective, but from a data quality perspective, bias perspective, copyright and the legal aspects of it. And how do we manage that? How do we make it effective and enabling for the business? As we've sampled certain AI technologies that are more consumer focused, we're looking at it in clinical areas about how it can improve physician productivity and patient experience. But all of these from the security side, we're creating our standard expectations around it. A lot of these things, especially when it's cloud based or SaaS based, so much of it is just the same due diligence you would usually do.
- [13:34]
A
Right.
- [13:34]
C
But then it's what do you go above and beyond with when it's okay? How are you taking prompt data and integrating that into what can be returned and making sure that access controls is properly is respected when you're returning data and then when we're talking about internal, internally developed projects, what are our expectations there? And ideally I'd like to say to make sure that your model is not subject to model poisoning attacks, but we're not quite at the point where we even know what does that mean in an AI world that we can be providing them the guidance as to what you have to do to an AI model to make it resilient to that.
- [14:15]
A
Yeah.
- [14:15]
C
Not learning.
- [14:16]
A
And how are you handling governance? Have you set up a governance process, committee policy yet?
- [14:23]
C
Yeah, almost. We've had some other stuff in place and checkpoints and conversations, but we're working on getting that last piece of formality and structure.
- [14:33]
A
Yeah, a lot of folks are on that journey today. Sue, when you think about your current job and what you do, what would you be doing if you weren't doing this role? What are you most passionate?
- [14:42]
C
I go back to that game programming. That was my original dream. I found out during one of my projects in grad school. I am horrible at 3D modeling and animation, so I probably would have hired out tons of it, but I missed some of the programming days from my earlier experiences. That was always very rewarding to face a puzzle and get to work it through to completion and see the finished product, which is harder in security because you've never done. We do wrap particular projects, but when I look at the big picture of what I'm trying to accomplish, it's just there's the next thing and. The next thing.
- [15:23]
A
Yeah. Interesting. What games did you play? I assume you're a child of the 80s or.
- [15:28]
C
Yes.
- [15:28]
A
Yeah, yeah. So what were your favorite video games?
- [15:31]
C
Going back to Nintendo, I think Zelda 2 was one of my favorites. Moving into, like, high school and early college, I worked at an Internet cafe. So this was before everybody had computers. Games were not networked for Internet connect shim in place for those. So my friends and I would get together at night after the cafe closed and we'd go. We'd play Duke Nukem Descent and just kill doing those. While I'm running back and forth, getting people sodas and coffees, various snacks and keeping the register going for my boss. So he was.
- [16:08]
A
I love the game. I don't know if you. You remember Tempest?
- [16:10]
C
Yeah, Yep.
- [16:11]
A
And Defender. You remember Defender This.
- [16:14]
C
Tempest was that one where you go around the circle.
- [16:16]
A
Yeah, yeah, yeah, yeah, yeah. They'd start to start from the bottom and come up and.
- [16:21]
C
Yeah, I think that was the first. What, vector graphics.
- [16:25]
A
That's right, yeah. And Defender. The spaceship. And I would just go linear some.
- [16:32]
C
Yeah, I think I know which one you're done.
- [16:34]
A
And then the first one where it was animation. Dragon Slayer, I think it was called.
- [16:38]
C
Oh, yeah. Dragon Slayer. Prawn was my other. One of my other favorites in the deadly discs.
- [16:43]
A
Oh, yeah.
- [16:44]
C
Arcade.
- [16:45]
A
Nice.
- [16:45]
C
I was just good at it, but I liked it.
- [16:47]
A
Nice. Yeah, We Talked about D and D earlier. Were you multiclass?
- [16:52]
C
No, I was always. I was typically the wizard.
- [16:54]
A
The wizard, huh?
- [16:55]
C
I spent way too much time on my prop spell book that had for my one character that was going through the campaign and I had all the pages and I burnt the edges so it looked like I had been thrown in a fire. It was just nerdtastic.
- [17:08]
A
Those are the good old days. Yeah. So if you could go back in time, what would you tell your 20 year old self?
- [17:15]
C
I think the easy stuff is hard and the hard stuff is hard too. But so much is from the technical perspective and I faced this early on when I first started in this role and we needed to do a much wider MFA deployment that we've heard that we had at the time. And from a technical perspective, it's you flip a switch, you put everybody in the right active directory group and you're done. And you're done. Or maybe you're nice about it and you send people instructions on how to enroll. Yeah.
- [17:48]
A
Until the uprising.
- [17:49]
C
Yeah. So it's going into these things saying, yeah, technically it's easy, but it's culture change. Yeah, it's again, we're heavy research and so the researchers are saying, we don't deal with phi. It's mouse data. Why do we have to. Yeah, but you're on. You're in our email system business compromise, you're on our network. Getting that, that buy in throughout the organization was a bit of a culture change for some of the key players. Making sure that again, you just from that technical perspective, you're just that from that engineering background I have, I just was so used to just being in control of it. You turn it on and make it work and you make it work as easy as possible and it smooths only from there. But when you're dealing with that large organization with people at different skill levels, you gotta make sure that the supporting infrastructure is there. Right. Like the service desk understands how they have to support and handle calls that are going to come in. What's the rate of enrollment before you're overwhelming the system and the people that are supporting you? Yeah, it's just, it was that early mindset that it's just, just flip the switch and you're done.
- [18:55]
A
Yeah, it's great. Hardest lesson in your career.
- [18:59]
C
Just like the fragility of the ecosystem, you look at change, you look at crowdstrike, it's not coming from where you expected. We're defending our borders and our perimeter and our applications and you look at Kronos a Few years ago, you're aware of the impact of third party and supply chain. But Kronos didn't affect the entire healthcare ecosystem the way Change Healthcare did and was focused on that one industry. And then CrowdStrike, the tool that you have to prevent outages, is the tool that created the outage. And you just start having to look at everything with a different lens and start weighing the risk of bringing on this new tool. We evaluated the other endpoint tool agents that we have on the system from a security perspective and could they do that? And how are we rolling them out and staging upgrades? Are we doing the best way? And so we made some changes there. It's just how fragile the system, the entire environment can be.
- [20:06]
A
Yeah. That was amazing to see the crowdstrike debacle because you would, one would expect after so many years of rolling out client software and having the scars that we would have still been faced with an outage of that scale of magnitude.
- [20:22]
C
But when you're doing your evaluation for software, how many people are asking if it's operating at ring zero and then bringing in.
- [20:29]
A
They're not. Nobody is. No, they will now. But. Yeah.
- [20:32]
C
Or what are your.
- [20:33]
A
How do you roll out upgrades? Do you Big bang? Do you stagger them? Like, how are you.
- [20:38]
C
We were N minus 1. Right. With the sensor, we were N minus 1. So we figured we're covered because we're looking at that piece of it. Not same thing with when semantic or whatever your endpoint agent of choice was before. We never questioned the impact of that definition. You could have.
- [20:54]
A
That's right.
- [20:55]
C
That's right.
- [20:56]
A
All right, I've got to ask this question. This is the Risk Never Sleeps podcast. What's the riskiest thing you've ever done, Adam?
- [21:03]
C
And the problem with that one is I'm so tame. I don't believe it. Everyone says that.
- [21:07]
A
And then I hear these stories and I go, wait, that's pretty risky.
- [21:09]
C
Risky. Okay. I don't know if this qualifies as risky. I'll tell it anyways. Getting drunk on stage during a play and then taking a bow and almost falling off stage, I think that's just stupid. Behind it. He made me do it.
- [21:28]
A
Okay. Who made you do it?
- [21:30]
C
The stage crew. Oh, they did.
- [21:31]
A
Oh, Were you part of the theater group or.
- [21:34]
C
Yeah, I was part of a theater.
- [21:35]
A
Oh, awesome.
- [21:36]
C
We were doing a series of one act plays.
- [21:38]
A
Oh, cool.
- [21:39]
C
One that I was in. It starts off with me and my father sitting at like a kitchen table sharing a bottle of wine, talking about my relationship, problems with My wife. And then halfway through, the lights go down on us. And it's dim. You can still. And we would pantomime talking. And then the scene moves over to my wife and my mother talking.
- [21:58]
A
Her side having the same type of conversation.
- [22:01]
C
So the last night of the show, we go to. To drink our wine. And it's actual wine. They gave us a bottle.
- [22:09]
A
Oh.
- [22:10]
C
And so the lights come down. They're like. We're in the middle of the scene and we realize. And we got to hide it. But as soon as the lights come down, I say to my partner on that, we're finishing this bottle. So we're just downing a glass after glass because we've only got a few minutes while the other half of the sea.
- [22:30]
A
Oh, no.
- [22:31]
C
Downing this. And I thought it was fine. And we were the last of. I think we were the last one. So right after that was curtain calls. And that almost did not go well.
- [22:44]
A
Almost a little bit of a mosh pit stage dive. Nice. That's pretty risky. I guess. Not so much stupid. I'm glad you told the story best.
- [22:54]
C
I got him. Sorry. Never.
- [22:56]
A
No white water raft. You worked at a nuke sub, right? Didn't you work in the warfare?
- [23:00]
C
Didn't get to go out. I went on a couple subs for configuration. I almost had to get flown out to one that was at sea and having technical issues.
- [23:10]
A
They must airlift you. Right. Drop you down.
- [23:13]
C
Yeah, that's pretty. But I did. But in the end, I didn't have to do it. They fixed the problem. But it would have been interesting. But at the same time, like, if they had to dive, I'm cut off for weeks or however.
- [23:23]
A
Yeah, you're in a sub. Pretty risky.
- [23:26]
C
It didn't pan out, so I don't have any good stories.
- [23:28]
A
Well, that's pretty funny. That's good. All right. What I asked this. I'll ask you this question. You probably are steeped in the finer parts of culture, music and movies. What are your, let's see, desert Island Top 5 records or movies you'd bring with you?
- [23:45]
C
I bring books. You can bring books?
- [23:47]
A
Sure. Yeah. All right.
- [23:48]
C
Ender's game.
- [23:50]
A
Oh, okay. Now you're talking. My language.
- [23:52]
C
Zen and the Art of Motorcycle.
- [23:54]
A
Oh, Robert Persing. Beautiful.
- [23:57]
C
I'd bring the Matrix.
- [23:59]
A
Oh, how about Cryptonomicon?
- [24:02]
C
That one I don't know.
- [24:03]
A
Oh, that's. Oh, Neal Stephenson. You have to read that.
- [24:06]
C
Okay.
- [24:06]
A
That you're a cyber guy and.
- [24:08]
C
Yeah, I know the Cuckoo's. Cuckoo's egg.
- [24:10]
A
Oh, no. This is fantastic.
- [24:11]
C
This is One of the.
- [24:12]
A
Yeah, it's a historical novel. So if you like historical novels, they bring in these three time periods together and it's all. It's about cryptography.
- [24:21]
C
All right.
- [24:21]
A
I mean, it's a great. It's big, but it's a good book.
- [24:24]
C
Okay. It'll keep you booted.
- [24:25]
A
Yeah. Let me know what you think.
- [24:26]
C
Okay.
- [24:27]
A
Awesome. So no music.
- [24:29]
C
Oh, I'm pretty Margaritaville, the Jimmy Buffett best of. But Ocean by John Butler, I don't know if you know that one. That's my Zen. That's my amp up music.
- [24:40]
A
Oh, okay. Oh, I'll check it out. John Butler.
- [24:43]
C
Yeah. Yeah.
- [24:44]
A
Nice.
- [24:44]
C
Ocean is the song.
- [24:46]
A
Okay, cool. Any advice? Last question. Any advice to folks coming out of school? They want to break into cyber, they want to break into healthcare.
- [24:55]
C
Dabble in a lot of things. Some of this is my bias, I think, coming in from that general technologist perspective where I've done programming, I've done active directory administration, I've done networking to a certain level, VMware administration, including site recovery and replication. All of those have contributed in some way to the. My contribution to security. Even the stuff that I'm not good at anymore or haven't kept up with just understanding the jargon, understanding the ecosystem, understanding some of those big picture challenges that the infrastructure people are dealing with on a daily basis, that I think has value. I think having that broad understanding and not just. I've done pen testing and coming through, just having done those kinds of tasks, but not understanding how it's going to interact with Active Directory or the other aspects. I think that broad view is very valuable. Yeah, I love that nowadays.
- [26:08]
A
Yeah, it is. Yeah. I love that though. It's be a multiclass technical infrastructure and cybersecurity.
- [26:14]
C
Yeah, no, it definitely comes in handy. You didn't used to have people that graduated cybersecurity. You did it and then you specialized. And I understand why we're moving away from that model because there's so much that's necessary, even if you don't have that as part of your formal training. Build the lab, play around.
- [26:32]
A
Yeah, yeah, yeah. And that third dimension is that you brought it up earlier is understand the business and understand how to communicate to the business. Yeah. Which is great. All right. That's a great way to end. Adam, thank you very much. This is Ed Gaudette from the Risk Never Sleeps podcast. And if you're on the front lines protecting patient safety and delivering patient care, remember to stay vigilant because Risk never sleeps.
- [26:59]
B
Thanks for listening to Risk never sleeps. For the show, notes, resources and more information and how to transform the protection of patient safety, visit us at senseinet. Com. That's C E N S I N E t dot com. I'm your host, Ed Gaudet. And until next time, stay vigilant because risk never sleeps.