Matthew DiDiano, CISSP

United Healthcare suffered a breach this winter that created devastating ripple effects for patients and providers. An attack on February 21st shut down UnitedHealth's Change Healthcare Unit, which many doctors depend on to verify insurance coverage and file claims. Without it, providers face an impossible choice: turn away patients or pay for services out of their cash flows. Mel Davies is the CFO of Oregon Specialty Group—an independent practice that more than 16,000 patients rely on to receive treatments for cancer, infectious disease, and autoimmune conditions—explains that: "We have an impending disaster on our hands... If this doesn't get fixed, we can't treat patients because we won't have the money to pay for labor to even keep our doors open". This incident is a stark reminder that, for healthcare organizations, the cybersecurity stakes are even higher. When operations are interrupted, real patients are impacted in ways that can be deeply upsetting and even dangerous. #Cybersecurity #Healthcare #CyberCrime

18

1 Comment

Recently I was afforded the amazing opportunity to co-author an HBR article on cyber risk. We tackled a topic that has been challenging our industry for years: are we seeing the forest from the trees as part of our risk management processes? We posit that it needs to change and it’s time to start realizing that each of us is not the center of our own collective universe, but that we are all nodes in a system, connecting and inducing risk to one another. We broke our solution down into the following steps: 1. Establish a baseline of core practices. 2. Identify and protect risky connections. 3. Identify convergences of materiality and high risk and improve resilience to recover. 4. Improve detection of attacks and the sharing of information when they occur. 5. Establish government oversight and formal recognition of critical organizations. A big thank you to John Glaser and Janet Guptill, FACHE, CPHIMS for being co-authors on this. I’d be curious to your critical thoughts and criticisms. What did we get right and what did we get wrong? https://lnkd.in/gSDzHQzm

151

23 Comments

Healthcare data breaches are followed up with a public apology and a formal letter to stakeholders: “Oh Btw, your SSN is public, but we did our best and called the right authorities”. HIPAA doesn’t have enough controls to dictate the long term ramifications of these breaches. Why are the companies that allow these breaches, not penanlized over the basic provisions of HIPAA for a longer period? How about involving more engineering to fix the problem than lawyers? I don’t trust lawyers.

2

The Endor Labs "2024 Dependency Management Report" is out. A good thorough read about the risks with software dependencies from AI to timelines to risk assessment and remediation. Take a few minutes and digest this one. https://lnkd.in/gEQFJkxR A few highlights that raised my eyebrows: - 95% of version upgrades contain at least one breaking change (in other words test upgrades before rolling to prod!) - 69% of security advisories are published AFTER the corresponding security release, with a median gap of 25 days. - Tensorflow identified as having a high number of vulnerabilities -- this is the open source library for AI development -- what does mean for current state of AI products? #cybersecurity #informationsecurity #devops #development #devsecops #opensource

8

New York appears to be leading the state regulatory landscape for healthcare hospital cybersecurity. Implementation, adoption and funding challenges will be lessons learned for state and federal regulators. And for those of us doing the important work of creating an ecosystem that protects all of us. 🧐 https://lnkd.in/eH-2Ay7E

93

7 Comments

Start at the very top and culture will change for the better. Hold executives responsible for problems caused and they will be cleaned up quickly. Throwing money at the problem is just going to exacerbate the issue, and make rich corporations who sell products and services that aren't implemented correctly. Understaffed departments who are managing systems will simply be managing more, not necessarily managing better. Hospitals should not be buying SKUs, but building better process that will hold up with any vendor

5

1 Comment

Erik Pupo, not all is doom and gloom, and the rumors make things seem much worse than it is. If you look at UHG's first quarter results (see link): it shows UHG revenues grew nearly $8 Billion Year Over Year ($99.8 Billion) https://lnkd.in/e3_uTieh In their earnings call, Roger Connor (CEO of Optum Insight) stated (see link) "If you look at the biggest areas where we have the largest number of customers, that's pharmacy, claim, and payment, we're up to 80% functionality and that's continuing to improve day by day." - see: https://lnkd.in/e-wJ2nWr

7

2 Comments

A couple of great articles published by CISA and other leading international organizations on developing and utilizing AI in your environment. As with everything #security related, a layered approach is the way to go, along with continuous checkpoints in the process. We'll worth the read #Cybersecurity #ciso https://lnkd.in/ez5E8gYY https://lnkd.in/eZGYgthJ

7

1 Comment

Hope we find more of these going forward. Healthcare doesn’t need any of this. If transactions between hospitals and vendors / entities are required to be more transparent, it’d help curb healthcare costs and drive out illicit players. One of the best ways to pickup connections like this would be to track entities like Medical Education Solutions and Rush Oak Park Hospital, and the fact that former vendor was a vendor that Mr. Spadoni controlled… and doesn’t seem like it really offered much services. Graph-based views (whether you use traditional SQL or more native graph databases) allow these “x-hop” connections much easier than relational databases. Imagine requiring this view from hospitals.

3

If you're in the CT area, register for the next Cloud Security Alliance Hartford chapter event: Fueling Cloud Governance with NIST 2.0 and Posture Management. great topic and great location to boot! https://lnkd.in/exZDNPN

43

Sometimes we all wish we could turn back time, undo a mistake, retract a message. But as they say, hindsight is 20/20. Making an error doesn't define us; it's an opportunity to learn and grow. Embrace the lesson and implement checks and balances to avoid repeating it. #Crowdstrike, known for its top-notch end-point protection, recently faced a hiccup during a global roll-out. However, one misstep doesn't diminish its effectiveness. Trust in their capabilities; they will rectify the situation. Stay positive and stay focused on improvement.

75

5 Comments

CISO reporting to 'The Board'...Scary? Yeah probably. It should be. Its real accountability, and an open challenge to your visions and strategies, and your ability to execute accordingly. As a CISO, I often get questions about how to present to 'The BoD' directly. Truth is, there's no single model - Every business is different, and every Board is different. But you know that already cuz you're in a position of leadership and discernment for a reason :) The right message always remains the same- How does your own leadership role, function, and focus contribute to the greater good of the organization? How does it help the business to determine where and how to accept and navigate risk? Not just avoid it. Sounds simplistic. But you may be surprised how many CISO messages don't answer that basic inquiry sufficiently. Your message, at this level, needs to clearly align to a broader forward-looking strategic narrative. If it doesn't, it doesn't resonate, and you haven't positively moved the needle. You never want to be the best checkers player in a chess match. I’m looking forward to demystifying this exact topic at the CISO ExecNet National Member Symposium July 23rd at the Willis Tower in Chicago with colleagues Eric Galis, Susanne Elizer Senoff, and Michael Calderin. #cisoexecnet #ciso #executiveleadership #boardreporting

131

7 Comments

My friends and fellow #SeattleU School of Law Compliance and Risk Management program alum, hospital/healthcare specifically, look at this compliance role. This is the benefit of an MLS, showing competency without the JD. :) #SeattleUniversity #MLS #ComplianceWithAConscience #Compliance #Ethics

8

1 Comment

With the increasing number of cyberattacks on healthcare, it's crucial for hospitals to prioritize cybersecurity to safeguard patient health information and safety. Last year, HHS examined the cybersecurity resiliency of US hospitals and has published recommended Cybersecurity Performance Goals (CPGs) for Healthcare and Public Health. These CPGs are grouped into Essential and Enhanced Goals and define a subset of the NIST CSF controls that may be prioritized to achieve the greatest impact on cyber preparedness. #cybersecurity #healthcare #patientprivacy #publichealth https://lnkd.in/eRSwPY4k https://lnkd.in/eJRYqt5R

37

1 Comment

Vaco got its start in managed services in 2012. With a focus on advising, designing, building, maintaining and operating functions—not just shipping tasks offshore (although we can do that, too)—Vaco tailors its approach to individual client requirements, whether onshore, nearshore or offshore, to enhance efficiency and maintain quality. How the engagement ultimately takes shape really depends on the organization and what the client needs. To read more about the variety of managed services Vaco provides, check out this article by Vaco Holdings Chief Revenue Officer Steve Kass. https://lnkd.in/eqtwV7C4 Staffing Industry Analysts | #managedservices | #outsourcing | #businessinnovation | #businessstrategy

3