This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

This episode is brought to you by Intraprise Health. Make cybersecurity a priority, not a headache. Cyberattacks put patients at risk and cost healthcare organizations millions.

But with convoluted software systems and risk and vulnerability data lost in silos, leaders know their organizations are vulnerable, and they feel little control over the safety of their patients, reputations, or bottom line. Intraprise Health brings together cybersecurity experts with over 100 years combined experience to offer a comprehensive suite of innovative software and services.

It helps leaders finally unlock a unified, human centric cybersecurity approach. With Intraprise Health, you can improve your cybersecurity posture, protect your patients, and simplify your employees lives. Visit thisweekhealth. com slash Intraprise dash health to find out more.

Introduction

Drex DeFord: Hi, I'm Drex DeFord, a recovering CIO from several large health systems and a longtime cyber advisor and strategist for some of the world's most innovative security companies. And now I'm president of This Week Health's 229 Cyber and Risk Community. And this is Unhack the Podcast, a mostly plain English, mostly non technical show about cybersecurity, and Risk, and the people in process and technology making healthcare more secure.

And now this episode of Unhack the Podcast.

Welcome to Unhack the Podcast. I'm Drex de Ford. It's funny how after you do these things for a while, the podcasts, every episode's your favorite, or at least there's stuff in the episode that is your favorite, and this one's no different. I've obviously been in this business for a long time with a lot of discussions under my belt.

talking to CISOs and security execs. And if there's one thing you can always count on, is that they have some odd story about the crazy and interesting path most of them took on their way to their current CISO jobs. It's also funny to hear how most of the execs in this podcast, for the most part, never intended to become a CISO.

The strange reality was that the chief information security officer job wasn't really even a thing when most of them started their full time job phase of their lives. Maybe that's just the speed of change that the internet has brought to most of us over the past 40 years. There are security and technology jobs that didn't even exist 10 years ago.

Just like a generative AI, the progression over the past two years, there's a ton of jobs that are going to be invented tied to that technology over the next several years. So sometimes kids grow up wanting to be firefighters or police detectives Those were the jobs that were there when we were kids, but for a lot of us in health technology and the security business, We just happen to be in the right place at the right time, so good for us.

But even though I talk about being lucky in my career a lot, it's not all been luck. I've also received some really great advice and guidance along the way. And coming up, you'll not only hear how the CISOs and security execs in today's show progress through their careers, you'll also get some good advice on how to keep your career on track.

In this episode, you'll hear from Doug Fee at Moffitt Cancer Center, Dee Young at UNC Health, Aaron Wiseman from Mainline Health, Hugo Lai from Temple University, Jesse Fasolo from St. Joseph's Health, and Michael Mays from KU Health. And then we'll wrap up things with Shana Hofer, the CISO at St. Luke's in Boise.

The two of us will do some post game discussion. You'll hear her talk about her background. Which is also actually really interesting. There's some great insights here from some solid healthcare cyber community leaders. Don't blink, it'll go fast. We talk cyber career progression. There's some good insights and some good advice coming up on Unhack the Podcast.

Dee Young: everyone has a funny path. So mine was right out of college I sold drugs. I was a pharmaceutical sales rep for Abbott Laboratories. loved the knowledge neurology and psychiatry. hated the sales part. so I started looking around and I really wanted to figure out what other career path could I start at the bottom and work my way up.

So I bought an A plus for dummies book and in my spare time I learned computers and started at helpdesk and worked my way through. I was in the networking area, so routers, switches, firewalls, , then I was a IT director, then a regional IT director. and then pivoted over to security. For me, I always say there are two jobs in technology that everyone should at least do for a few hours or days or months.

And one of them is helpdesk. Because I think it's one of the hardest jobs there is.

Drex DeFord: Agree.

Dee Young: And the other one is project management within technology. And so those both have really helped me. And I think it also helps me to remember the challenges that other roles have. That, security is not first thing on anyone's mind, except for us.

Getting their jobs done is, and so I think it's really important to remember that and to mentor people up. I think as far as some of the best advice I've gotten, it's all about relationships. I think one of the things that I saw as a technologist that I did, and I see others doing it earlier in their career is they fight the fierce battle for the wins within their department.

And sometimes that jeopardizes the relationships with other departments. And I think as you rise up the relationships are the most critical part of the job. And I think making sure that you understand the other demands of other leaders, especially clinical and business leaders helps you to be a better leader within security.

I think the other thing that I've learned is not to take myself too seriously. I have so many experts that are so much smarter than I ever will be on my team and other teams. And I think it's really important to understand what you know and what you also realize as you're moving up that I'm not a geek anymore.

I wish I could be. I loved it when I was, but the higher I rise, I think the less savvy I get. So I think it's really important. To make sure you have those subject matter experts and you lean on them and allow them to shine within their field.

Hugo Lai: yeah, so I started off my IT career as a helpdesk analyst many years ago, actually. And I really enjoy that opportunity, if you will. It really gives me a lot of different perspective because, that position allowed me to work with different stakeholders. understand IT infrastructure, the day to day operations, and allow me to put, actually, perspective into cybersecurity, right?

So cybersecurity is always about concepts, and how do you put context into those controls? I think that would mean a big difference, to stakeholders. So I found that opportunity to be extremely useful to me in my later career. I also spent many years actually as a security consultant supporting various government agencies.

And those experiences are also very useful as well, building relationships, understanding how a larger enterprise environment, right? And typically they are very complex. Allow me to understand, the different technologies out there. And I think consulting is a very interesting industry in a sense that you get to learn the different technologies out there versus, you're supporting just one organization and you can be stuck with the same technologies for a very long time.

And IT Technologies, it replaces, it refreshes, on a very regular basis. So I think, that consulting experiences that I have certainly helped me to become, where I am today SAC. I certainly found that, those two. Unique opportunities are very helpful to my career.

And I'll also advise that stay outside of your comfort zone. You'll never know how those skill sets will help you in the future. I started off as a very technical engineer. And then I learned about reading the different NIST documents. And certainly those are not sexy, right?

They can be extremely boring. But yet it allows me to become a better CISO today when I think about it, because I understand, what are the controls that should be implemented within an enterprise, right? It gives me a much larger perspective into

Drex DeFord: about great career path.

Did you get some good advice from a mentor or a leader along the way that you think would be worth sharing?

Hugo Lai: Yes building relationships are very key. I learned that during my very early consulting days. It's not about what you know, but it's about who you know. And I think those principles still applies even nowadays, as I mentioned earlier getting to know the people that you work with on a regular basis, whether that is someone above you or someone underneath you, you always want to have that close relationship so that if you have a favor that you need to ask you already have that relationship behind you.

Michael Meis: . So my path to becoming a CISO was a lot more direct than most. I started in the military and it transitioned into an encryption slash information security role. And then I held a variety of different roles spanning the whole security spectrum from identity, SecOps GRC before I landed in my first CISO role.

I think that the evolution and maturity of security as a discipline and as an industry means that we're moving away from a lot of the CISOs who have had these kind of strange paths towards security. You hear of a lot of the CISOs of today and yesterday that just backed into the role because it maybe got created while they were there, they were the first person to raise their hand, et cetera.

And I think that they have done tremendous work getting the industry where they are today. But I think the CISO of tomorrow are the ones who really embrace the CISO role as an objective on their career path and intentionally build skills towards getting there. And I think the skills of the CISO tomorrow is going to really need to understand is going to be much more similar to what other business executives are expected to understand, rather than purely from that security practitioner role.

And so I think it's important for anyone who wants to pursue a CISO career path to Yes, you need to understand security and you need to understand how security applies in a technology environment. But I think the more pressing skill sets are going to be understanding corporate governance, how corporate governance is supposed to work, what it looks like in various types of organizations, whether that's a privately held company versus a publicly traded company?

What's the role of an executive versus a non executive director? And how does that function in a healthy organization? And then taking the time to understand finance how does an organization operate? How do they create revenue? Where can revenue be impacted? Because these are things that when you go to operate amongst other members of the C suite, amongst other executive members, when you report to the board, these are things that are just expected for somebody to know just at a senior director VP level, let alone at a C level title.

And so I think it will be important for people to spread their wings beyond those traditional, what we call security skills and really focus on those non security executive skills. And so I look for training courses that aren't even specific to CISOs anymore. Things that are just meant for overall business executive success.

And it's really taught me a lot of skill sets that I think are, Very important towards success, especially in larger organizations as I continue along my career path.

Drex DeFord: Tell me about some of the good advice and guidance you've gotten along the way and how you've leveraged that.

Michael Meis: The most important advice that I ever received was from a mentor of mine.

And he said that it is more important to be able to persuade people rather than command people. And I saw that firsthand when I was in the army, because you would have these officers who had all of this power that was endowed to them by literal legal authority. If you didn't do what they said, you would go to jail for it.

And you still had people that didn't care what they said. And then you would have these people with no rank that would have people that would run through a brick wall for them. And so as I've progressed in my career, I try to focus very much on building influence and building buy in with people.

Because especially in the civilian sector, your titles don't matter at all. The size of your org doesn't matter at all. People don't buy into you and buy into the vision that you are pitching for the team and for the organization. Your title is not going to get them to do it any more than being an officer in the army is going to make your subordinates do it.

Jesse Fasolo: from a career path perspective trying to keep it to cyber for me personally, I started out at the lowest levels of IT IT support help desk services when I was much younger than I am now.

And I think the path forward at that time in my career, there was no cyber security, there was no CISO, there was no, Information security. It was turn it on and make it work. And, shut it off when you're done. my career has grown from learning everyone's jobs and everyone's positions around me and kind of learning the department and learning the people, learning the organization, and taking those insights and growing each role into the next level.

That relationship building with the technologists and the technical folks being able to adapt and move forward in your cybersecurity career is, I think, really valuable. You really need a mindset of, I must learn. And with cybersecurity, there's so much new coming down the pipe that you need to be a sponge at all times. Yeah. You learn from everyone around you, you learn from every new project, you learn from vendors.

I can't tell you how I've grown over the last five years, just by having relationships with vendors and learning the new , skills, learning the new capabilities of tools and systems that are out there.

But I think every new implementation, every project, every job is an experience and exposure that will make you ready for the next step. And you just have to take it. What about great advice that you've received along the way about career and career progression? Career growth is staying power. While some technologists and technology and cybersecurity folks, they work, they work a year or two, they implement new systems and new technologies and this digital transformation, but they never stay long enough to actually see the benefits of the digital transformation or this new cybersecurity system, or what benefits from a risk perspective, the decreasing risk across the organization become from the hard work that you've done.

So I've learned that staying power is pretty important, the higher up in executive and management levels that you go, because, you know, it's You don't ever get to see the dessert, so to speak, the end result of this five course dinner. And I think it's well worth it if you're growing and learning throughout the way.

But I think more defined advice that I was provided is creating value, I think is one of the biggest ones. Create value organization, for your team, for those that you serve. It's easy to fall into a space where you're very comfortable and you're good at what you do and the tasks are the tasks and you check the boxes.

For me, learning and growing afforded me the ability to move from role to role, to grow and take on more responsibility. Each responsibility you're given, you're given one, trust, and then two, you're given the ability to grow and learn within yourself.

And once you do that, that trust and that relationship and your responsibilities start growing, like I joked about in the beginning, where you're, if you're good at what you do, you get more.

Are you ready to get insider access to the latest health IT innovations? I'm Drex de Voort, and I want to personally invite you to one of our upcoming webinars, Fireside Chat, Cutting Edge Conversations with Top CMIOs, sponsored by Dr. First. This is your chance to hear directly from some of the brightest minds in health IT as they share groundbreaking insights.

from one of our 229 executive summits. We'll cover the transformative power of AI, strategies for optimizing healthcare operations, tackling physician burnout, and the latest in population health management. Don't miss this opportunity to Stay ahead of the curve and bring these cutting edge ideas back to your organization.

Register now at ThisWeekHealth. com slash Fireside Chat. That's Fireside dash chat. ThisWeekHealth. com slash Fireside dash chat. Thanks. See you there.

Doug Fee: so I explain, you know, it's really awkward when you go to their school and you do this, you know, what does your dad do for a living type of thing? And, and somebody asks you and you're talking to a group of kids or whatever, and you're like, well, did you want to do this when you grew up?

And I'm like, I didn't know this was even a thing when I was growing up, right? You don't just, you know, as a kid waking up and you're going to school, what are you going to do with the rest of your life? I'm going to be a CISO. No, no, that don't happen. So, you know, like a lot of other people, I kind of fell into it, right?

I was originally going to school got my undergraduate degree in mathematics, right? So my I guess career in life that I wanted to do was become a mathematics professor. And interestingly enough, you know, Like a lot of people going to school had to figure out how to pay for it.

Right. So I was got hired with this IT company, right? So this was back in the eighties or whatever, when, you know, IT wasn't as big as what it is now. And so guess I've done pretty well because when I graduated from the university the company offered me a full time job, right?

So that was pretty cool, right? So I guess at that point it was the slippery slope that just led into the IT career. So yeah, I'd done that. And never kind of looked back at that point. I was like, Hey, this pays pretty well. You know, it's a pretty good gig. And so I just stayed in IT.

never went back and got my master's and doctorate in mathematics. Went back and got my master's in computer science, actually. So that was a little bit different kind of situation. I remember standing up in front of, you know, , the class at school and trying to answer questions about, you know, your job or whatever, and, you know, if you ask my kids at the time, there's like, dad just attends the meetings all day.

That's all he does. And I'm like, oh, basically you're right. That

Drex DeFord: is

Doug Fee: all

Drex DeFord: I'm doing. Yeah. Yeah. No, I totally get it. I mean, there's a lot, obviously in your job. I mean, I think in a lot of healthcare executives jobs, the a lot of it is sort of helping people understand the challenges and risks that are involved in the work that they're doing and how they can kind of be part of the team and pull this off, because you certainly can't do it alone.

It's absolutely a team sport.

Doug Fee: Yeah, it definitely is. I mean, I've done an IT thing like I said, right out of college and, and at the time, you know, everything was mainframe. So I've done stuff with VTAM. I've done some COBOL programming that type of thing.

Huh. And you know, I was actually working for the Department of Medicare and Medicaid Services at the State of Kentucky. And you know, they was like, well, we need somebody to kind of specialize in this. And, you know, security was thing, but not really a thing, if you will. It wasn't that mix of you know, what we consider traditional security.

But privacy was never one of Those things involved with it. So they needed somebody to do this. I'm like, Hey, I'll try. I'm like, Mikey, I'll try anything. got involved with security with the company at that point in time. And just, I've loved it and never kind of went back from that point.

Aaron Weisman: So, my career path, I started out as an attorney, and I got my LLM, which is a Master's of Law in Information Technology Licensing and Global Intellectual Property Law. I always wanted to be in technology. I don't have a technological background, which in law makes it very, very difficult to do that. I got very lucky in that I was hired by the Commonwealth of Massachusetts.

So, You know, was able to sort of wiggle my way in by building out some of that audit function, supporting that audit function, and then later moving over into the technical side of that. Best advice you ever got from a peer or a mentor or a coach?

I think some of the best advice that I've received From some of my peers is, you know, don't assume you know everything you know, and coming from a legal background, like that seems very easy, right?

Because I don't have the technology background, but, you know, when it comes to building out a security program, read the room and definitely understand. what other people are prioritizing, what they're feeling about how information security plays into that, and, really what they're feeling about how technology plays into business operations.

I'm constantly reminded here at Mainline Health that our business is patient care, right? It's not technology, it's not information security. Those support patient care, but safe and excellent patient care is our core business. So everything we do has to focus on The delivery of that care.

Drex DeFord: Hey everyone. Welcome to the wrap up segment of Unhack the Podcast and welcome to one of my favorite people, Sean Hofer from St.

Luke's in Boise. How you doing? It's good to see you.

Shawna Hofer: Wow, you're so kind. It's great to see you too, Drex. Thanks for having me back.

Drex DeFord: I got to see you in person just a couple of weeks ago. We were at a 229 Summit in Florida, and we played dodgeball with a tropical storm slash hurricane, but everybody

Shawna Hofer: We did, but I wouldn't change it. It was a great event. We had great people. Great takeaways. So it was worth the risk

Drex DeFord: yeah. We're always talking about risks. So that's a good point. All the clips that preceded this segment, we do the wrap up show regularly on the podcast.

Anything in there surprise you, anything that you loved?

Shawna Hofer: Yeah, I was surprised at the number of people in that segment who started the help desk.

Drex DeFord: Yeah,

Shawna Hofer: there was more than I expected.

Drex DeFord: Yeah. Me too.

Shawna Hofer: Yeah.

Drex DeFord: Where did you start?

Shawna Hofer: I started my education is in accounting.

I started my career in consulting and working for Deloitte and doing basically IT audits. So it was that intro to general IT controls and risk management, et cetera.

Drex DeFord: It's I started in the help desk, so I did. It's interesting, right? I'm older than you and a lot of people, but we were running I was in the air force at the time we were running Honeywell mini computers, DPS 695.

use

today. It's it's weird how this is all come all the way around, but I was one of the service desk guys for that.

We built like really early networks because that wasn't really a thing. PCs had just started to come out. And so we were actually building networks at the time, but I was a help desk guy. That's how I started too.

Shawna Hofer: What's fascinating about that is you think about the scope that you just described as a service desk hack, and at least for us, It's changed a lot.

Oh my

Speaker 3: gosh.

Shawna Hofer: You just described at least three or four different roles today because things have gotten so complex and complicated.

Drex DeFord: Yeah.

Shawna Hofer: Where, yeah, so that's actually really cool. What great experience.

Drex DeFord: It's interesting to me as I listen to everybody go through their background and history too, that, this just logically makes sense, but nobody like in high school said, I want to grow up to be a CISO.

They all did other stuff and kind of meandered their way through their career doing this or doing that. And then at some point it became like, you're the person who's probably the most qualified in our organization to take this responsibility. Did that happen to you too?

Shawna Hofer: Absolutely. And I like what Jesse said, where, he said he started at the help desk too, and as he said, there just, there wasn't cybersecurity then.

There wasn't a CISO, right? And so I think, in that time, it just wasn't a career that people were thinking about going to. So yeah, as they almost all said, you just found your way there.

Drex DeFord: What about some of the advice that we heard from folks that advice that they had gotten as they went through their career?

Shawna Hofer: What was your favorite of that?

Drex DeFord: Oh, man. Think Hugo had one of those that just is always. useful and that everybody should know or behave this way. And that is the get outside your comfort zone and stay outside your comfort zone. That's the only way that you learn things. You got to go out, you got to make mistakes, you got to break stuff, hopefully you don't break anything too important and you sweep up all the glass and kind of say, okay, that was a good lesson.

And then you go on from there. And think all of the folks who were. In those segments, all I, them, I know them. They're all people who are very much a, they do not sit back on their laurels and just enjoy the ride. They're always exploring. So you're that person too, though.

Shawna Hofer: it's harder to do, I think sometimes than it is just to talk about it.

And I think about that through even just the lens of. The teams that we support, I think, especially in this industry and healthcare, I think that concept of go out and break stuff is a little more of a delicate balance than maybe in some other industries. And I find that can create.

Some nervousness and the support you want people to do that, but also, hey I need to be really careful because this might impact patient care. So I'd love to see even more of that. How do we get people to be more comfortable with being uncomfortable and taking those chances?

And I, to me, it seems that it. At least in healthcare. That's a little bit more of a challenge.

Drex DeFord: Yeah, I think we're pretty risk averse, generally speaking, and I think that's why we have to create these sort of universes or these bubbles so that it's okay if you break something in this space because it's not going to affect you.

Patient care, or it's not going to take radiology offline, or it's not going to do, all the things that we've seen happen.

Shawna Hofer: A vulnerability scan that takes down all the medical devices.

Drex DeFord: Oh my gosh. There's so many of these things that we all have the t shirt. Where it's like, Oh, I didn't know just by pinging that device, it would cause it to go completely haywire.

Shawna Hofer: Yeah. And I think knowing that though, I think what you just said, getting that t shirt or kind of that banner of, Hey, I've been through this. It really helps others understand that they're not like the newer ones who are now doing that and experiencing it, that they're not alone. I've had that conversation with my team members of, hey, first time, good for you, this happened before.

Drex DeFord: it's definitely the advantage though, I think of having That seasoned leadership and the sort of the things that you pass on to your team and your leaders about let's talk about a lot of these things before you do them, because maybe I've already stepped in that pothole at some point in the past.

Yeah,

Shawna Hofer: exactly. Yeah.

Drex DeFord: What's some of the best advice you have received in your career?

Shawna Hofer: I'm going to try to think of one that isn't the example we've already talked about, because think that could be it. But above and beyond that, I think some of the best advice I've received to focus so much on perfection.

And say that personally, that's something that I've struggled with and wanting to make sure that everything that is done for my organization or on behalf of my team or by me it's absolutely perfect. And It causes delays, it causes stress and anxiety that is absolutely unnecessary.

And, I think that as a leader it's cascadable. That feeling of it has to be perfect and I think is counterintuitive to what we just said of go out and break stuff, right? You can't really do both. And so I think finding the right balance of you want to do a great job. But also we want to be flexible and we want to be nimble and agile and be able to accept when, things weren't perfect, but we learned, right?

That's the key, as you mentioned is we've got to, we've got to learn and grow. You can't do that when you're so focused on making everything absolutely perfect.

Drex DeFord: That's the perfect is the enemy of good conversation, but it's also, the perfect is the enemy of good inside the construct of the risk conversation.

It's okay. We talk a lot about here inside our team about, crappy first drafts or, and that's not just a thing that you're writing. That's a thing that you're doing too. It's just a concept for us. It's okay to have crappy first drafts and put them out there and, make mistakes and get feedback and all of that.

But it's all within a context of risk, right? You don't want a crappy first draft version of EHR deployment. There's There are things that you have to be like, this has to be like, this needs to be like a minus work before we release this for all of these reasons.

Shawna Hofer: Yeah, I think, through that it's really the, what's the impact and if the impact is lower, we can be more flexible, but I think that conversation, I've had it with several peer CISOs around, wow, we can't tackle that initiative because.

We, the cyber team wouldn't be able to do it perfectly and we don't want anyone else to do it because we know they won't do it perfectly either. And I think that, let's just make progress mindset is really helpful in that scenario. Again, depending on the context and making sure that it truly is acceptable if things aren't perfect.

Drex DeFord: Yeah, I was just thinking about like my I've had a lot of great advice over the course of my career, but probably the thing that motivated me more than anything else during my career was that at some time very early on. I was running supply chain at a small hospital and my enlisted time, I had been a computer guy.

That's where I was at the help desk and ran those many computers. I went to school and I finished my degree, got commissioned as an officer and became a hospital administrator in the Air Force. So I was the hospital administrator. Who knew something about computers and that was way before there was a CIO job or any of those kinds of things.

And I had a senior officer come to me because I was automating everything in supply chain because it was so logical to do. That everything had a number and you could count everything and you could track supplies and where they were moving to and you know all that stuff. And I had a senior officer come to me at one point and say, you gotta knock it off with this computer stuff.

There's no future in it. And I know, and that was the point at which I was pretty sure that was what I was going to do. Because that whole conversation made so much nonsense in my head that I was like, I have to be on the right track. There's no way somebody would say something to me like that.

So my best advice was terrible advice. That's

Shawna Hofer: awesome. Yeah. I love that. I love how you. Not only heard it, but then almost took it as a challenge of let me prove you wrong, and boy have you, and making a career out of it. Yeah, that's awesome.

Drex DeFord: Hey, thanks for doing this. You're always great on the show.

I really appreciate it.

Shawna Hofer: I love being here. I honestly the opportunity to hear from my peers and the, and get to know them more but also be able to share that out. I think it's just a really cool thing you're doing, Drex. So thank you for the opportunity.

Drex DeFord: That's a wrap for this episode of Unhack the Podcast. Do me a favor and share this episode with your peers. And by the way, your feedback matters, so please subscribe and rate and leave a review wherever you listen to podcasts. I'm your host, Drex DeFord. Thanks for spending some time with me today. And that's it for Unhack the Podcast. As always, stay a little paranoid. I'll see you around campus.