Why Healthcare Needs Cyber Resilience, Not Just Cybersecurity

Speaker A: Welcome to the Cybersecurity at Vive series on the Beat podcast, where we break down the fast moving world of cybersecurity and what it means for your healthcare business, your data and your everyday life. In this series, we'll go beyond the headlines to explore real threats, real defenses, and the people on the front lines keeping our digital world secure. And now your host, Sandy Vance.

Speaker B: Hey everybody. Welcome back to the Cybersecurity at Vive series on the Beat podcast. I'm your host, Sandy Vance, and today I'm here with Chad Alessi, who is the Managing Director of Cybersecurity for ctg. Welcome to the show, Chad.

Speaker C: Hey, Sandy. Great to be here. Uh, thanks for having me.

Speaker B: You've got it. So Chad leverages decades of experience in technology, cybersecurity and operational strategy across large and mid size sectors to meet the evolving cybersecurity needs of clients in the US he's actually been in IT consulting. He's got a background in chemical engineering and is a U.S. marine. Thank you for your service, Chad.

Speaker C: You're welcome to be here.

Speaker B: I'm glad to be sitting down with you. It's kind of cool to get to talk to somebody who's worked in cybersecurity across different industries. Now your focus is more on healthcare, but, but as part of ctg, you focused in other areas in the past, is that right?

Speaker C: Yeah, I spent a lot of time in the energy space, uh, early in my career. Kennemat, as you mentioned, as an engineer, worked in operational technology, so lots of legacy applications running chemical plants and processing facilities, uh, related to oil and gas processing, and then moved into cybersecurity not long after stuxnet really hit the market, if you will, for that. Uh, so it was a bit like we had to shift and transition from operational resiliency and continuity into more of cybersecurity and cyber protection. And so we had to learn how to protect those legacy assets that weren't built and designed for security. They were built and designed for reliability and uptime. And so I had to go and reskill and upskill and try to learn all of the items, cybersecurity terms and regulations and the things that we have to go through today. And so it's been, been quite a journey.

Speaker B: Yeah. So, and you, you actually have a degree in information systems with a concentration in information security from Syracuse. Was that after that transition?

Speaker C: Yeah, it was, yeah. Yeah. So I made the transition and then, uh, had to go upskill and get a little more education. So I went back and got a, uh, degree in that. So, yeah, it was part of that whole upskilling process.

Speaker B: That's fantastic. Was this all working within your previous industry or was this as you moved to healthcare? So, like, when did you get transitioned into the healthcare sector?

Speaker C: It was pre. Previous. Uh, so I was doing this and then got into security by. Before I left and went into consulting, and then left and went into consulting, um, about eight years ago now. Eight or nine years ago now. And that's when transitioned into consulting into other industries. So obviously still stayed in the heavy industry, critical infrastructure, still work a lot in that area. But then that introduced the healthcare, uh, space into my experience. So having to go out and learn all of the healthcare regulations, requirements and, you know, some of the needs that healthcare clinics and healthcare providers have has been a big learning experience for me as well. And trying to come in and apply best practices that we might have from other industries into healthcare and vice, uh, versa. Right. There are some things that healthcare does really well that other industries can learn from. So it's been great to be able to work within other industries and then bring some of that expertise to the healthcare industry as well.

Speaker B: Yeah, I think it's always so good to be able to bring fresh eyes into the healthcare industry because so often we get sort of caught up in the way we do things. It's just the way we do things. And there are some unique challenges, but there are also some challenges where we can stand to learn a lot from other areas. Right. I mean, how do you think that healthcare organizations and their sort of cybersecurity challenges compare to those other industries? Like what's unique about healthcare?

Speaker C: Healthcare has a lot of similarities to some of the other industries that we see, particularly around industries that run 247 and that have a, uh, required 100% uptime or 99% uptime or what we call, used to say the triple 9s. Right. The 99.9% uptime. Healthcare is that industry. Right. It's the ultimate of having to make sure that patient care is not impacted by any type of outage or downtime. So any effect to the overall supply chain in any form or fashion, particularly when it comes to a cyber event today, could affect or impact patient healthcare. And so that's a big, uh, issue. And so that's unique to the healthcare industry where people's lives are at stake, their health outcomes are at stake. Even, uh, if it's a minor surgery or a minor outpatient type of event, if it has to be delayed due to the fact that they had a ransomware attack and they can't get the service, uh, or they can't get that healthcare uh, that they need that could impact people's lives. So it becomes a big issue. And where we're starting to see some overlap is, and particularly like with network segmentation, we have more and more medical devices that are legacy type applications that cannot take patches like we see in some of the traditional IT services. Those systems have to be network segmented and they have to be uh, triaged in a different way to make sure that they don't have the ability to affect the rest of the network. And so in other industries like manufacturing, like healthcare, I mean like, uh, we have been dealing with that for quite a few years because of the OT experience and the operational technology experience that we've been working with. So we're starting to see healthcare organizations leaning on or reaching out to some of these other industries for expertise in how they've been doing it. How do you verify and validate that you have that network segmentation? So we're starting to apply some of the best practices that we've used in other industries to the healthcare industry to help them manage this risk around, uh, medical devices and particularly IoT type of devices on their networks.

Speaker B: You talk a little bit about the difference between sort of the traditional cybersecurity approach and cyber resilience. Maybe if you could just for our audience briefly talk about the difference between those two terms because I think one is becoming a little more relevant to healthcare these days. Right?

Speaker C: Yeah, yeah, absolutely. And ah, it kind of goes back to what we were just talking about with the healthcare outcomes, uh, being at the forefront. Right. Putting the client first, understanding what their needs are and ultimately that is their healthcare and their outcome of their healthcare. So when we look at security we get this question all the time, what do you guys mean by cybersecurity versus cyber resiliency and help me understand it. We look at it and the industry looks at it as a whole. If you look at this, cybersecurity is all about protection. What protections do we need to put in place to protect the assets that we need to be able to deliver the service that we're trying to deliver for our customers. Cyber resiliency is really about that continuity of operations. So making sure that we're staying in business and in that business continuity and operational continuity, meaning we have no disruption in service to our operations in the fact that we are going to have, it's not if but when we have an actual attack. So when we look at cyber resiliency it's about the operational continuity. And so it's not about if you're going to get impacted, it's when you're going to get impacted, and then how quickly can you recover from that and how can you reduce the amount of time you're going to need to be able to get back into full operations so that your clients, and in this case in healthcare, your actual individual patients are not being impacted by your outage, uh, that you're going to be facing.

Speaker B: One of the data points that you all, uh, put out was that breaches contained under 200 days Save organizations over a million dollars. What does that look like? I mean, how many breaches are contained that quickly versus not? And what practical steps can healthcare systems take to sort of accelerate detection and containment of those breaches?

Speaker C: Numbers can be a bit confusing at times, right? When you start to look at that and people go, oh, well, how do you measure the 200 days? We're not necessarily talking about dwell time. It's essentially from the time that you realize you've had a breach to the time that you're actually able to put in the steps to contain it and protect it.

Speaker B: Okay, am I crazy, or is 200 days a really long time?

Speaker C: It is a long time. Uh, but nowadays it's very difficult to actually determine whether or not you had an indicator of compromise or you've been compromised. And so a lot of bad actors will actually compromise your system and sit idle, idle on your system, just collecting data, collecting intel. And then they may actually deploy an actual exploit after they've got enough information to be able to do that. They could be gathering everything from your identities on your system to what information's being communicated across your system, what information is encrypted, what's not encrypted, what information can they steal? How can they get passwords to be able to escalate their privileges and then be able to traverse your network either laterally or even vertically, and escalating their privileges and being able to execute an executable document. So that dwell time, when we look at it from the breach contained under 200 hours, that is essentially saying that's not even accounting for the dwell time. It's accounting for when the breach actually gets exploited. And then how long does it take us to actually isolate and triage that particular exploit to ensure that it's been eradicated, or at least contained within that? So when we look at how they do that, um, it's really about this whole move from the perimeter security back to the identities so identity first security is a must nowadays. So things like enforcing MFA privileged access management, identity telemetry, understanding telemetry is just a fancy word for collecting data on your identity, what are you doing so that we can actually see that it's materially different than your normal activity. So something that you may log in every day, you go into Word, you create a document, you attach that document as an attachment and you send an email. That's a kind of normal work path that you're going to work through. If you're logging in, trying to create ah, an executable or trying to drive an executable, uh, in your environment, then that's probably something that's not normal for Sandy. Right. So Sandy's not an IT administrator, wouldn't be doing that. So that's out of character for your profile. And so being able to really collect that data on identities and then shorten that dwell time. So understanding that this particular identity doesn't normally do these things that they would normally do and what we're seeing and so that shows an anomaly, that behavioral analysis shows the anomaly and allows us to identify it quicker, sooner. So we know we've got people in the environment that shouldn't be there. And so we have to triage, meaning isolate your identity, your account and then do a full investigation. And so that gets added into this breach contained time period as well. So time to actually triage and find out what's going on with that. Again you have to be careful because if it's a false positive, we don't want to necessarily take you out of providing for patient care unless we absolutely have to. Right. And so we want to be careful with how we don't just take a, we call a shotgun approach to trying to triage all of these tickets and all of these indicators of compromise that we're specific about how we're going through it. So that takes time. Right. And it leads into some of the shortcomings of uh, SOC today versus the new modern soc using some of the new technology. But we'll talk about, talk more about that. But I think the identity first is something that has to, is a given that you have to do. There's um, integration of IT across clinical systems. There's still a lot of silos you see, so there are some visibility gaps that we have. So not being able to see the full environment within a healthcare system can be a problem, especially when you're trying to figure out what's going on inside of an environment, which environments are connected, which ones are separate. From each other. And then how can we triage particular events uh, that won't affect another part of the event? So if we have something in the EHR system, is that going to affect something on the medical device network or vice versa? So do we have that true network segmentation or by taking one down, are we going to affect another? And then we have to look at those, and then what does that cloud workload look like? How much of these workloads can we offload to a cloud environment? Shutting down our on prem or vice versa and then looking at our remote access tools as well. How do we allow people into our environment? Uh, sometimes that can be our biggest risk for the remote access stuff. So looking at that integration across that and then finally we say identity, we look at the integration from the silos and then finally it's that 24. 7 monitoring. And we're really getting. Coming back to the conversation I was a second ago about the human alert and triage using technology today many of the bad actors are deploying automated exploits, they're deploying AI in their exploits, they're using agentic AI to try and do more and more sophisticated attacks. And we as security professionals have to deploy the same type of tools to keep up with them. And so we're looking at these human only SOC models are starting to be too slow to keep up. And so the use of AI in SOC to be able to do some of this initial triage and quicker time to react, uh, and respond is really important. So the 247 monitoring, uh, you can't protect what you don't know you don't have and that you can't protect what you're not monitoring. But then how quickly can you actually protect something and triage that issue once it's actually determined, detected. So being able to deploy some of the newer technology to help shorten that window of triage would be helpful.

Speaker B: You guys are leveraging Microsoft's unified SecOps platform. Do you want to talk a little bit about what that is and how that fits into this?

Speaker C: We do use the unified SecOps platform. Uh, we do use a lot of the products within Microsoft for our security operations center. So what that allows us to do is cut down on tool sprawl. Uh, we see a lot of organizations today, they're dealing with a lot of tooling inside of their environment and they're all uh, across different vendors and different packages. And there's a lot of interoperability issues that happen when you have different tools in your environment. So what the Microsoft Unified Security stack integrates with the identities as well. As we mentioned earlier, you know, the identity first security. So being able to have that integrated into um, Entre and then being able to use Defender for endpoints, being able to even use Microsoft, uh, Sentinel, the siem, and integrating that with our ah, security orchestration and automation layer is really important for us. And so being able to double down on that and be able to have a nice unified platform is definitely a benefit for us to be able to manage all the tools and uh, not have that tool sprawl that we see.

Speaker B: Yeah, how do you think that changes the experience for your clients?

Speaker C: So when we talk about usability and the things that they have to deal with, going from different screens, different technologies, uh, we've also built a customer data platform for our security operations center. So we aggregate all that data into an environment that they can go to one application and see their entire security operations center in one pane of glass. So that allows us to do that and uh, pull in all of that data from different sources and be able to see it all within one platform, which is important.

Speaker B: So Chad, as we look ahead, what emerging technologies or strategies do you think are going to shape the next generation of healthcare cybersecurity?

Speaker C: I hate to beat a, uh, dead horse as they say, but it's AI, it's going to be AI for the next few years. I think we're going to see this uh, AI assisted security operations continuing to grow and we're not going to see just generative AI, but it is going to be machine learning and agentic AI doubling down on behavioral analysis. So instead of having to have an analyst do the analysis of that behavioral analysis, we'll start to see machines really doing the analysis on the machines themselves and determining whether or not there is uh, an anomaly in the behavior of a particular profile and then taking that to another step and actually performing the triage and then we'll see how far down we get into the security operations portal. But we see that managed detection and then part of the response, not necessarily the full response, we start to see humans get more involved on the response, uh, once we do the initial triage, because humans still have to do the contextualizing of the actual assets and the environment themselves. So we'll start to see more and more agentic AI moving into the response side. And then I think long term you may even start to see them get into recovery as well once we get past this initial uh, response. And I think the other thing is we've seen it for quite A few years now where healthcare organizations are trying to deploy a zero trust architecture, they've not been able to do that on an enterprise wide level. They've been able to do it maybe in just their clinical services or maybe just in their surgical departments. I think that you'll start to see where zero trust gets rolled out across the enterprise where uh, it is a true end to end zero trust environment and they'll start to be able to get the funding and be able to roll these out. It's been a multi year phased approach. So most are starting with like an MFA initiative. So getting all their MFAs in place. Once they get that out then they'll start rolling out the other parts of it and then you'll see a full end to end zero trust architectural. And then finally I think regulations are pushing this as well. HIPAA has come out with a new regulation, uh, where they've changed some of the language from being prescriptive to more descriptive around saying you shall have network segmentation for some of your medical devices. So the legacy medical devices will need to have network segmentation. And then the next part of that is going to be, well, how can you prove that you have that segmentation? So they'll be asking questions. When you see healthcare organizations say ah, we have the segmentation, well then the regulators are going to say, well we need you to prove it to us that you have it. So they're going to see that as well. So it leads with AI and ends with the medical devices to ensure that you have those segregated and those can't be your weakest link in your environments.

Speaker B: Yeah, and those requirements are changing, the regulations are changing around them. So it's an important time to make sure that that's trued up. So ctg, you talked a lot about ctgs service offerings and how you can help with uh, the operations of the thing. But you guys also do advisory services, right. And can come in and help organizations figure out a roadmap and how to implement this and make sure that they are resilient from a cybersecurity perspective, right?

Speaker C: Yeah, that's right. So we have a, what we call the common Security Advisory, uh, framework where we come in and assess healthcare organizations on their security controls, their policies and procedures and we also look at their cybersecurity strategy and how does that strategy actually either align or is misaligned with the overall enterprise strategy. And so we help organizations at the end of that assessment where we put together a, uh, scoring around that, uh, is based on CMMI and CMMC compliance maturity assessments, and we build a roadmap to improve that over a period of time. So once we understand what your controls are in place, where you might have some gaps there, we look at your policies and procedures, review those, we identify gaps, areas of improvement there, and then we look at your overall strategy and then we put that together in an actionable roadmap that you can put into your planning sessions or even your funding and your financing discussions as well. So you can sit in front of your CFO and say, this is why we need the funding and this is what we're going to try and do and improve our overall. So we've seen that is really, really helpful. Um, and we're able to prioritize those findings based on the complexity to implement them. So is it very technically heavy on the technical side? Do you have the current skill sets in your environment to do that, or would you need to actually go out and partner with a third party company to actually implement those? Uh, and then finally we prioritize it based on the level of risk to your environment and risk to your overall security strategy. So putting all of that together, and this has been informed by the market itself. So they actually came back to us multiple times and said, you know, it'd be really great if we could see this. So we've kind of added all of those features into the assessments over time and it's something that clients walk away from at the end of the engagement, uh, saying, you know, thank you for doing this is really a great tool. We've never had this all in one location, one view that we can use it for planning purposes.

Speaker B: Well, thank you very much, Chad. I really appreciate the conversation today. To learn more about CTG and how they can help you with your CyberSecurity strategy, visit CTG.com have a great day everyone.

Speaker A: Hey, if you enjoy listening to this podcast, be sure to check out all the content around data innovation at 52026 by visiting health.com that's HLTH.com from M. There go to the Events tab and you will find recordings of nearly 100 case study presentations, podcasts like this, and white papers presented by leading technology solution providers. Be sure to subscribe so that you don't miss the next Vive event presented by Health and Chime.