Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Kevin Tambascio on balancing security with availability of services in healthcare
Guest:
Kevin Tambascio
Published:
Updated:
Duration:
32 min
Episode summary
Integrating security into the product development lifecycle is a tall order for any industry. It’s particularly challenging for healthcare, with its wide range of critical needs from HVAC systems to medical devices. Kevin Tambascio, director of cybersecurity data and application protection at Cleveland Clinic, juggles the need for constant vigilance and staying updated on fast-moving threats to hospitals.
In the latest episode of WE’RE IN!, Kevin discusses the importance of compliance and risk assessment, noting that while compliance with rules like HIPAA is crucial, it’s equally important to pressure test controls against real-world threats. Ransomware targeting hospital data is the primary threat, while phishing and potential abuse of generative AI also pose significant risks.
Listen to hear more about:
The benefits of forming an AI task force to enact safe and responsible procedures while enabling clinicians and researchers to explore AI’s potential
Effectively communicating cyber threats to non-technical staff by relating them to potential impacts on patient safety and business operations
Application security in healthcare; applications often have access to sensitive patient health information and can be potential entry points for cyber threats
Listen to the episode
S3 E11 · Kevin Tambascio on balancing security with availability of services in healthcareWE'RE IN! Podcast · 32 min
Key takeaways
Start with requirements and threat modeling Kevin's team moved beyond static code analysis by getting involved at the first stages of development, with security and privacy requirements and threat modeling, so cyber is not showing up the week before a release.
Scale processes to very different builders A hospital has world-class software teams and doctors or researchers who just want to publish a website, so secure development processes have to work in both directions.
Compliance is a gate without a fence Kevin compares compliance to a driveway gate with no perimeter fence and argues for analyzing who attacks healthcare and pressure testing controls against those specific tactics and techniques.
Patching is hard for end users After years writing vulnerability disclosures on the vendor side, he learned that patching infusion pumps that use infrared dongles and run around the clock is far harder than simply telling customers to patch.
Translate risk into patient safety Clinicians do not connect with SQL injection or buffer overflows, but they do connect with diverted patients, disrupted imaging, and lost trust, so the message has to fit the audience.
Topics covered
Application Security
Compliance
Vulnerability Management
Notable quotes
We really view cybersecurity as not the department of no. It's really about how do we enable the business?
Nobody likes when cyber comes in at the last minute. Right? I mean, that's always a bad conversation.
Our CEO always says trust is earned in drips and lost in buckets.
We're the last of the lines. There's no one else to kinda transfer, you know, the risk to.
Questions this episode answers
How do you build a secure software development life cycle in a hospital?
Kevin started by understanding which groups build software and how mature they are, then worked with directors to add security and privacy requirements and threat modeling early. Teams get tools to help while coding, and externally published applications go into the bug bounty program. Read this section
Is HIPAA compliance enough to secure a healthcare organization?
Kevin says compliance is important and useful for showing outsiders where you stand, but he finds more value in a risk view: analyzing who is attacking healthcare and pressure testing controls against those tactics. Read this section
What is the biggest cyber threat to hospitals?
Ransomware remains the number one threat. Phishing still targets people, attackers use perimeter applications as a gateway to pivot inward, and generative AI deepfakes may make phishing more convincing. Read this section
How does Cleveland Clinic review AI projects?
A cross-functional AI task force of clinical and nonclinical roles, including legal, compliance, and cyber, reviews proposed projects for policy compliance, ethics, clinical viability, and how data will be protected or de-identified. Read this section
What lessons from industrial control systems apply to healthcare?
Hospitals are full of connected things, from infusion pumps and MRIs to HVAC systems whose temperature and humidity affect surgery. As in manufacturing, availability is king and both sectors are under constant attack. Read this section
About the guest
At the time of recording, Kevin Tambascio was director of cybersecurity data and application protection at Cleveland Clinic, where he also sat on the organization's AI task force and previously managed its attack surface reduction team. Before moving into healthcare, he spent eighteen years in software engineering and product security at Rockwell Automation, where he wrote vulnerability disclosures and worked with CISA. He studied computer engineering after starting college on a pre-med track.
And welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and I'm thrilled to have Kevin Tambascio join me on the show today. Kevin is director of cybersecurity data and application protection at Cleveland Clinic, a nonprofit academic medical center that processed over 300,000 surgeries and procedures throughout its health system in 2023. Kevin will share insights from the front lines of protecting IT and cyber physical systems supporting 23 hospitals and tens of thousands of employees worldwide. I'm excited to jump into the conversation, but first, here's a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
So we often talk about vulnerability from a cybersecurity standpoint. Right? How a software flaw or something that an attacker is trying to exploit can actually cause problems for organizations. But in your line of work, you deal with a different kind of vulnerability, and it's, you know, people are often coming to Cleveland Clinic at the lowest point in their lives and hoping to recover from, you know, sometimes life threatening conditions. How does that all change the stakes for IT?
Yeah. Absolutely, great question. I think everyone here feels that responsibility. You know, within my team, we're with, our responsibilities around data protection, application protection. We certainly see how important it is to protect some of the most sensitive details about our patients' lives. We feel an enormous amount of trust with our patients. You know, in many cases, it's our own information. It's our own friends and family and our own personal health information that we're trying to protect. So we certainly feel that responsibility every day. When we look at how do we keep these applications safe, keep our data safe from attackers, we're thinking about that, all the time. So definitely a different level of responsibility. I think we all feel that on our shoulders, but we also take pride in it, we use it for motivation to do our jobs every day.
I was gonna say we we often hear about the stresses facing doctors who can work really strange hours, and I hear tell of, like, twenty four hour shifts sometimes. I don't know how they do it, but there's also a lot of pressure on both the confidentiality and especially the availability aspects of the old famous CIA triad relevant to your work. How do you deal with that pressure?
You know, like, if we look at our our main campus hospital, our our Starbucks is... Doesn't have doors on it. It's never closed. Right? It's a 24 operations. I mean, our our our clinicians work incredibly hard, have incredibly challenging roles. We always have to, you know, look at that balance. I mean, just like everything in cybersecurity is a balance. Right? We could turn off applications and make them 100% secure. Right? But certainly, we wouldn't be enabling the business to do what it does. So I think like everything else in security, we we always look at the balance there. We have good policies and and standards that that help us really make good decisions. We really view cybersecurity as not the department of no. It's really about how do we enable the business? How do we partner with them to find solutions that are going to work and, you know, balance the need between security and also the availability of care.
Availability of care is really so important. Just because of a cyber incident or some type of operational disruption like that, you know, patients don't stop having conditions where they need care. Availability is so important. It has to be a balance though between the different aspects there.
Right. I guess that old mantra of how do you secure a computer by by turning it off doesn't doesn't really fly in the healthcare field. That's... You don't wanna be turning a lot of these computers off, suppose. So let's talk about the software development life cycle. How do you go about building a software development life cycle for a hospital?
So previously, had experience trying to help build security into a product development life cycle at my in my former company. It was different there in the sense that, you know, it was an engineering company and we had a lot of well developed structure and process around how we engineer products from start to finish. Coming into healthcare, it's a little different. We have everything from groups with, you know, software engineers building, you know, world class applications that we use for patient care. And then the other end of the extreme, we might have a doctor or researcher who wants to just make a website to share research data with the world. So it's a little bit different here. We've had to work to try to understand the different groups that are building software and what kind of maturity they have, work with them to define a set of processes that are going to scale in both of those directions.
So we started with just understanding like, what are we doing today? And when I took on this role about two years ago, we were more focused on static code analysis. We started to look at what do our development teams really need here. The first step was understanding, like, how do we start to have security requirements and privacy requirements, you know, at the first stages of software development. So really that shift left mentality where we wanted to start to have cybersecurity get involved early. Nobody likes when cyber comes in at the last minute. Right? I mean, that's always a bad conversation. Everyone's upset. It never goes well. Right? Team wants to ship something next week, and then cyber finds out about it, and...
Yeah. So so when I came into this role, I started talking to other directors who have software activities and saying, listen, we want to get involved early. We want to provide you resources. And in my opinion, requirements and threat modeling are the best place to really start. Let's make sure off the bat that, you know, we have the right requirements, security and privacy, both to make sure that team is successful. So we kind of started there. We brought in some tools to help our teams with that aspect of it, and then continue to help them as they build their code, and also to make sure that, you know, their applications then get, when they're published externally, get into, you know, the bug bounty program as well. And so it was really about understanding where can we help you. I think everyone in healthcare wants to do the right thing. There's nobody who doesn't want to support HIPAA, for example. Due to the regulations, it was really about, well, how can we help you get there faster and better and and hopefully, you know, more efficiently?
So definitely, interesting problem. We had to find ways to kinda scale this to both the more professional development teams as well as maybe, let's say, the more casual development team who wants to publish something.
You mentioned HIPAA and obviously compliance is a huge part of the healthcare industry. That's perhaps the most prominent set of regulations. I I even forget exactly what it stands for. I'm sure you know it like the back of your hand, but I've heard mixed reviews from practitioners on the impact these kinds of, you know, regulations can actually have on cyber investment. Where do you fall?
So I think compliance, obviously, you have a very complex set of requirements. We're also working with HITRUST for a lot of our electronic health record systems. Compliance is an important piece, but I really find more value in at it from a risk you know, perspective. What are the threats that are truly applicable to us, and how do our defenses match up to those threats? So for example, I like to go road biking, and I'm always riding past this one house that has basically like a gate across the driveway. Right? But there's like no perimeter fencing around the whole thing. So from a compliance perspective, the compliance might say you must have a gate. They have a gate. Right? But are they secure? Well, it depends on the threat. Right? Are they secure from a car coming in? Maybe. There's trees around and stuff, so maybe you prevent a car from going through.
But are they secure from someone walking up to their house? No. Right? So there's no entire perimeter fence to speak of there. So obviously, you know, compliance with requirements is important and we have extensive procedures around that. We also do a lot of pressure testing, right? We analyze our threats, we analyze who, you know, is attacking healthcare, how are they doing it, what kind of tactics and techniques are they using, and make sure that we pressure test our controls from top to bottom, making sure that we can defend against those specific threats. So I think it's a combination. You obviously need to be compliant. Compliance is a great way to demonstrate to outsiders, you know, where we are, but also what are the real threats we're concerned about? How does our real world controls live up to that pressure?
And speaking of threats, it seems like ransomware attacks have just really taken off. And across multiple sectors, not just health care, they've really taken their gloves off, but showing a willingness to target everything from cancer wards to children's hospitals. How do you defend against such a cruel and relentless threat? And and what trends are you seeing in the ransomware space?
Certainly, ransomware continues to be the number one threat we face. Even during COVID, groups were, you know, ratcheting up attacks against health care, against supply chains, against, you know, vaccine producers in some ways. Certainly it's 20 fourseven nonstop. We definitely again feel that pressure, that responsibility, you know, to protect that information because that's what they're going after. They're going after our most sensitive details that our patients, you know, trust us with. Our CEO always says trust is earned in drips and lost in buckets. A successful attack would be, you know, that buckets or multiple buckets lost in that sense. In terms of trends, still a big focus on, you know, phishing. It's still targeting people. Also, I see stories of, you know, people getting in through applications or getting in through things on the perimeter where they're able to not necessarily attack that application, but that application can be that gateway, that that door into the organization and where they can look to pivot through the organization.
Certainly, I think one of the threats too with generative AI, while generative AI is awesome and a lot of potential, also the potential for abuse and for attacks. Having, you know, I've seen stories around, you know, deep fakes and things like that using generative AI platforms to generate videos and things can, you know, potentially enhance some of those phishing attacks. Certainly, it's still the number one thing we're we're focused on. It can be, you know, through people, through applications, and unfortunately, being taken advantage of with AI as well.
Yeah. Well, I know, as I understand it, you sit on the AI task force at Cleveland Clinic. What what can you tell me about that? What's coming around the bend there?
So I think very, very early, we recognized the potential that artificial intelligence has for healthcare. But definitely needs to be harnessed and used in good ways. It definitely has the potential. And we see already, you know, a number of our caregivers coming up with amazing ideas to try to utilize AI to improve healthcare, to improve outcomes, to improve efficiencies. And of course, in cybersecurity, looking at how can we use that to get better or improve our own efficiency. So one of my colleagues, Kevin Mooney, who's overseas our data governance program had the idea to start creating an AI task force to start to kind of wrap our arms around the problem. Again, we wanted to have safe and responsible procedures, but at the same time, we want to enable our clinicians and researchers to use this technology.
So we put together a cross functional task force made up of clinical and nonclinical roles, several clinicians, as well as people like legal compliance, cyber, and others, where we all kind of look at the proposed AI's project and look at how does it comply with our policies, our standards. Does it hit the ethical considerations? Is it clinically viable? Which of course I have no say in, right? That's not something I can really understand. But then, okay, I have questions around, well, how are you protecting the data? Right? How are you going to potentially de identify this data or, you know, make it safe, you know, for us to use it? And so it's it's very interesting conversations, again, seeing kind of the the brilliant things our researchers are coming up with. And also, you know, I feel good about, hey, we we've got some some good guardrails in place.
I think every institution like us probably needs to think about it that way. How do we enable research? How do we enable the outcomes? Because there are a lot of great promises and abilities out there. But at the same time, we still again, we're a regulated industry. We have to remain compliant with HIPAA and other things. Right? So how do we facilitate that for our clinicians while also staying in favor of those regulations?
Definitely, and AI, it's so exciting what's happening with AI in the healthcare space. I know it's neither of our purview as far as like actually digging into the weeds, technically getting it to work in a responsible manner that can be applied to patient care. But you still see some of those amazing leaps and bounds types of progress. Like, you talk about the AI hype cycle. I feel like health care is actually one of the few areas where there's, like, a super legitimate use case of helping doctors diagnose, helping find better patterns and treatment breakthroughs and whatnot that that can definitely be kinda hidden in all those all those reams of data that you probably have. But...
Yeah. I mean, think every... I mean, I don't know how many times a day I get a message from somebody that, yeah, they're they're putting AI in their product. Sometimes it doesn't make sense, but I think when it comes in in my area for data protection as well as application protection, there's definitely some some great possibilities. I mean, when you think of data protection, machine learning is great at consuming data. Well, guess what? We have tons of data. Right? And so you can start to apply those principles to understand the landscape, understand where are there excessive permissions, where are there policy issues with retention. We can start to look at how information's being shared. Should it be shared externally? Right? And I think these platforms can help us. And then same with app security. I see a lot of potential for enhancing like our ability to understand our perimeter. I mean, I think like many large organizations, it's challenging to understand what are all the applications, what are all the things exposed on your perimeter?
What's your attack surface look like, right, externally? And then I think we're also see AI tools that can help with, you know, pressure testing those applications, looking for for gaps and maybe augment, you know, security researchers who can, you know, kind of find maybe the more complex things. Also helping developers write more secure code, suggesting, you know, fixes to developers and trying to, you know, maybe a developer who's earlier in their journey and and maybe is still learning how to write secure code. Can an AI assistant help with trying to suggest better ways or suggest fixes for vulnerabilities? I don't think we're at the point where we'll blindly accept code changes from a Gen AI platform, but can it be that helper? Can it suggest, hey, maybe there's a more secure approach, you know, to that SQL injection issue to help them, you know, off the bat, write more secure code.
So I definitely see a lot of potential for application and for perimeter and hopefully finding vulnerabilities sooner. I mean, I think we all wanna find our vulnerabilities sooner or prevent them from getting there in the first place.
Definitely. And since we're talking about coding a little bit here, I wanted to flip back to the software development life cycle, the SDLC. How... Does something as as wonky sounding as that, right, for the uninitiated connect to patient safety?
Yeah, so many of our applications, you know, directly support care. There are applications that are used by clinicians for calculating drug dosages in certain situations, or a lot of times we're building applications that kind of bridge different systems together. Or they could be just our main website, which is allowing people to schedule appointments with providers or find the information that they may need for whatever condition they might have. I look at it as, you know, if we help our teams build more secure applications, we're overall improving the resilience of the organization. Like I said before, the applications themselves can be a target, and many of these applications have access to patient health information just by nature of what they do, but also how can this application be an entry point to pivot further into the organization.
So I think application security is incredibly important in this space. It can be that that way that somebody gets in that front door that somebody can defeat. And whether it's bringing down an application or stealing the data from within or pivoting further into the organization, those all directly affect patient safety. Again, if these applications aren't available, our patients, you know, will feel the effects or the the loss of trust, the the reputational harm if, you know, data was extracted through one of those attacks.
Well, hopefully not. And I'm I'm sure your teams leverage the MITRE ATT&CK framework. Attack with that ampersand in the middle. Kinda love it. That sort of library of adversary tech... Tactics and techniques. If anybody from MITRE happens to be listening to the podcast, which I hope there are a few of them out there, what's something that you'd have on your wish list for for changing the MITRE ATT&CK tool?
Looking at some of the most recent changes to MITRE ATT&CK, I don't know if I have a specific idea for a change. Just looking at the new version 15 that was released, there's a lot more content around relevant threat actors, more cloud, which my team is also responsible for protecting our cloud workloads, more application security content, AI tactics and techniques. So I think they're doing a really good job of incorporating new content into the framework and making sure it's relevant and modern and able to meet our needs. I definitely like how they are decomposing industrial control system in the variation of the framework. I spent eighteen years in the industrial control space. There's a lot of unique challenges and problems, some of which are also in healthcare. And they're definitely trying to kind of look at what's the real world attacks, real world incidents, and how can we bring that into the framework to help organizations understand.
That's interesting that you mentioned that ICS connection because, obviously the cyber physical nexus is so important and it's only growing more prominent and more of a... You know, you worked at Rockwell Automation, which might not be a household name. Right? But I would posit that it absolutely should be because its products and technology contribute to all sorts of everyday necessities, like clean water, access to electricity. What are some of those lessons from your time at Rockwell or just from the industrial control system space writ large that carry over into health care.
You know, I I I came into, you know, coming from that manufacturing background into health care and initially kind of confuses, like, why why would they want someone like me in health care? But I quickly realized that hospitals have this incredibly diverse set of, you know, things of connected things where I kind of look at inner ring as the medical devices that are actually touching a patient and delivering care like infusion pumps, MRIs and things like that. We have systems, HVAC systems that are all connected and HVAC isn't just like a comfort thing. We actually have parameters around delivering care. I mean, you can't perform surgeries if the temperature and humidity is out of range, right, because that that correlates to infection rates that can happen. Lighting systems, elevator systems, emergency systems, you know, parking systems, even, you know, Xboxes in the children's hospital, right, to allow them to have, you know, a sense of normalcy as they're staying with us, you know, for care.
So incredibly diverse set of things in this environment. Every type of IoT device is here. Again, availability is king when it comes to healthcare and in manufacturing. Manufacturing from a cost perspective, any moment of downtime is potentially very expensive. Pharmaceutical manufacturers, if that process gets disrupted, you know, they have to throw away millions of dollars of chemicals because they can't validate the quality of the drug at that point. And again, healthcare, the availability of care, you know, it's nonstop. People need care no matter what's happening at the hospital at a given time. Healthcare and and many areas that that Rockwell served in the critical infrastructure verticals, we're all under attack, you know, for different reasons. We all feel that that pressure. Back at Rockwell, I was helping pharmaceutical customers, food and beverage, water treatments, electricity, you name it, critical sectors that provide, you know, services.
And so again, in health care, you know, definitely that that same pressure, that same sort of target on our backs. A big change though was moving from the vendor side to the end user side. I used to write a lot of the vulnerability declarations at Rockwell. So if we had a product that was a public vulnerability, I'd work with CISA and and get those published. And at the time, it was very easy to say, hey, you just need to patch your system or you need to update this or, you know, and Why
Yeah. Or... Yeah. You know, hey. Just... Yeah. Just go ahead and patch. How hard can that be? Right? And then I I come to a place like Cleveland Clinic and, you know, for us to patch our infusion pumps, it's like, well, you know, they're still using, like, you know, infrared dongles and and things. We have to get a person to come from the vendor to patch, you know, these devices. Our devices are being used, you know, twenty four seven. How do you reboot a server that's patched? How do you restart, you know, these these applications? Just kinda learning firsthand how incredibly hard it is, you know, for end users to to manage security. We're the last of the lines. There's no one else to kinda transfer, you know, the risk to. Hospitals across the industry are struggling to get the resources, the tools, you know, for cybersecurity. A lot of times, I see, you know, people comment about hospitals not spending money on on security and not doing enough.
But I think the reality is right now, especially in health care, margins are incredibly thin right now. We're getting hammered with inflation and things. And, you know, hospitals are struggling to find talent to to buy tools. I mean, a lot of these cyber tools are very expensive. And so I think hospitals want to do the right thing. They all wanna protect our patients' data and and and care and have, you know, positive outcomes. Many hospitals are are struggling, you know, to find the resources. They all want to do the right thing, but actually getting it done is really, really hard in health care.
Yeah and unfortunately you know you talk about obviously everybody kind of in this together wanting those positive outcomes but a few major healthcare organizations have been in the news recently for for some of the wrong reasons. You know obviously I won't ask you to comment directly on those cases, have been covered in the media. Anybody can find them ad nauseam. But I I would be curious to hear how cyber news events actually factor into your day job. Like, what's the impact when Cleveland Clinic president and CEO Tom Mihaljevic reads about a health care breach And when he's scanning the news headlines, does he call you up and, Kevin, what are we doing about this?
Yeah. I'm I'm sure he talks to our CISO and and has questions, wants to, you know, be reassured, you know, that we're in good standing, that we're protected against that threat or or what we're doing, you know, about it. Many of these attacks, we look at what are the tactics and techniques, what are the threat actors that are, you know, behind it, what kind of things are they doing. And then I... As I mentioned, I used to manage our attack surface reduction team, which was, you know, our pentesters and Red Teamers. And, you know, we'd say, okay, here's the playbook for this new threat actor. How do we test our controls in a safe way to see, you know, would we detect this attack? Would we be able to stop this attack, you know, if it happened in our organization? There's a lot of great organizations out there too, like Health-ISAC that shares, you know, indicators of compromise and shares that with all the different health care delivery organizations so we can ingest that into, you know, our protective tools.
So I'd say overall, we we try to learn, you know, especially if there's, like, a novel component to a new story or situation. You know? How can we take a look at that ourselves, and how do we stand up to that? What can we do, you know, to improve our our stance, our protected state against those new threats? The ransomware groups are continuing to to look at health care. So it's a nonstop mission, right, to understand those attacks and measure how we are able to stand up.
You told the Dark Rhino Security Podcast last year that, quote, people in cyber are not normal people, end quote. I mean, you gotta suck out of that because it is so true, but you still have to relate to normal people and try to get normal people to appreciate good security practices and hygiene. So what's your strategy there?
I also would, I guess, kinda liken it to, like, if you talk to an ER doctor. Right? I mean, an ER doctor has seen things that would blow away normal people in that sense. Right? We're so used to this. You know, we're so used to the the the bad news and the threat actors attacking us. You know, when I talk to nurses or clinicians about some of this stuff, like, they're just kind of blown away, you know, by all this stuff happening. Ask questions like, are we getting attacked all the time? And and, you know, I'm like, yeah, absolutely. There's attempts every day, every second. So I I think it's really important for cyber practitioners and leaders to connect with the the quote unquote normal person and and explain in a way that they can understand. If if I go to a clinician or a leader in the clinical side and start talking about SQL injection and all these bad things that can happen with SQL injection, buffer overflows, like they're they're not gonna they're not gonna connect with that.
Right? But if I go in and talk to them about here's how it could impact patient safety, here's how it could impact our data, which is a patient trust factor with us, right? Here's how this system could get taken down and disrupt our imaging processes or our ER systems. Okay. Now I get it. Right? It's a patient safety issue. So I think you always have to find the language. You have to find something that people can relate to and really help them understand. So some some leaders, if they're, know, clinical patient safety, tying it to patient safety might be really important. If it's more of a business person talking about how this could impact financials, regulatory practices, if it's a lawyer, you really have to find a way to make it approachable, and you have to explain why this is important. I feel like you just dive into what you need to do.
If I just go to a leader and say, Hey, you need to start doing this and start doing that. Like, well, why? Why do I care? Okay, well, here's an example of an organization that got hit with an application security vulnerability, Here's how somebody got in and they disrupted care or patients had to be diverted to a different hospital, which could impact the outcome of that condition. This is what we don't want to have happen here Right? And try to get their buy in, try to help them understand why. So it's it's really a self awareness thing. You have to really understand the audience, understand what what matters to them the most. How do you make it approachable? I think it's important to to show the bad, to show what can happen, but also really help them understand it in a way that they can approach it.
Well, based on what you said earlier, it does sound sound like there's CEO level buy in here. I thought Tom Mihaljevic's quote of trust is... What was it gained in drops lost in buckets is is so apt for the cybersecurity space. I mean, that that really says it all. So... Well, thank you so much, Kevin, for for joining me on the podcast. Really fascinating, important discussion. Lots of really interesting work you're doing. There is one question we ask of every guest on the WE'RE IN podcast, which is what's something that we wouldn't know about you, Kevin, just by looking at your LinkedIn profile?
So originally, I was going to go to medical school and be a doctor. So when I was in college, I was pre med initially, and I was kinda walking down that road, and I was kinda surrounded by a bunch of guys who were like computer science, computer engineering majors, and I got drawn into all the cool stuff that they were doing. Ended up changing my major to computer engineering, and then spent eighteen years in software engineering and product security at Rockwell, and then found myself back in health care. And so it's kind of cool to be looking at, I guess, what my original career aspirations were and then kind of marrying that up with technology and computers that became my second love here. I'm humbled to, you know, serve this organization. I'm humbled to to try to make a difference here. And it's been really cool to see the computer skills applying into health care, which is the area I originally wanted to go into.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
We're in is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
