Welcome to The Shiproom where we learn from tech leaders
at some of the world's most successful companies.
I'm Brad Anderson.
I'm the Vice President, Microsoft 365.
Today I'm talking with the Information Security Director
of St. Luke's University Health Network, David Finkelstein.
Thanks Brad, appreciate you having me on.
Your health care system is just massive.
There's over 300 locations across a massive section
of the East Coast.
And the organization itself traces
its origins back all the way to 1872,
and all those decades of personal records,
HIPAA compliance checks, come down to you.
What types of threats are you seeing
that use the pandemic as a way to target people
and how are you working to counter those threats?
Early on in the pandemic obviously our biggest thing
that we had to take care of was PPE.
What people were doing was they were sending in invoices
to our financial side of the house just to have them pay
for things that we never even bought.
The nice thing is that,
our organization has spent a significant amount of time
on phishing scams and phishing attacks and things like that.
So they caught it right away.
There's two other big things
that really come into play here is DDoS attacks.
So when you've got a 1000, 2000 people
like we did go remote overnight.
And obviously every piece of networking
and every piece of hardware and every piece of stuff
that we had in IT and across our clinical spaces,
went to those providers that were helping those patients.
A lot of times, hackers were going in there
and pushing DDoS attacks to bring down those systems,
bring down the EMRs, bring down the devices
that they needed to use.
A myriad of things for this attacks perspective.
Welcome to The Shiproom.
You're here with David Finkelstein, who's this?
Anderson, you barnacle-faced sea dog.
You scrompulent harbor poltroon!
Oh sorry, is that too much?
This here pirate filter I'm using is set to villainous.
Let me adjust these settings a bit.
Is that better?
You see bro,
David spent 12 years in the Army Signal Corps.
They started in the 1860s.
You send messages to the battlefield, by waving flags.
As you know, we pirates are lifelong learners.
Lately.
I've been studying the manual
from the International Code of Signal Flags.
And to help me prepare for the final exam,
I'm going to show David a series of flags.
And David will tell me.
If I'm using the right meaning.
Here we go.
First up I need some help steering this boat.
That's false.
That one be true.
What? What?
Next.
I have your mail.
I'm gonna say that's true.
Also true.
This one says,
can you check if there's a submarine under me?
That's false.
'Tis false.
How about this one?
Does anyone know where I put my phone?
I will tell you this it's probably something
that our brigade commanders definitely want to have,
but that one's false too.
This is a favorite of mine.
Singles in your area are excited to meet you.
Well maybe if you go to France,
which is what that flag looks like, but that's false too.
Here's one I use all the time.
Back up, I'm about to make something explode.
I'm gonna go with true just to make it fun.
And finally.
Nice boat, is it new?
I'm gonna say false.
Ah, thank you me matey.
But before I set sail to me pottery class,
I'd be having one last question for you.
You've a really deep background in security,
and it be up to you
to determine the safety and reliability
of software on a regular basis.
How does ye go about evaluating the software
you be using in your organization?
There's a couple of ways that we do it internally.
So one of the very first things is we really have
to determine the scope.
What are we trying to do within the organization?
Once we've figured that out,
I have a pretty robust vendor risk assessment process
that we use.
Where we put the vendor through the ringer.
One of the things that I've had a lot of feedback
from the vendors is, they feel like a lot of times
they're going through an overall security audit,
which is really what I do.
We put them through that audit and we make sure
that they meet our internal healthcare standards
to make sure that they're not gonna cause any major issues
with our organization.
Once we get that idea of how that works
and whether or not it meets our requirements
of what we have to do and they're secure,
then we kinda take an a deeper dive.
We want to see if the product can do more
than just one thing.
Can it do multiple things?
Can it build a platform that allows,
for let's use an example, scheduling, texting,
moving through Epic data, getting information,
moving things around.
That way, not only does it help with that particular niche
but it also allows all of our providers,
all our clinical staff to have a better efficient workflow
when they're dealing with patients.
You've made extensive use of Microsoft 365.
What were you looking for?
And what did you find in Microsoft 365
that led you down that path?
About two years ago, I kind of put myself on a journey.
We had so many different point solutions and,
and point solutions are nice
because they tackle a particular issue.
But, they get expensive and they add up.
I mean my budget was getting a little bit out of control.
I didn't wanna continue to push that
to my CIO and say we gotta pay this bill
time and time and time again.
Let me see if the Microsoft security tools
can really do what I needed to do.
So I took about 10 months working
with various people in your organization.
And what I decided on and what I saw
was the fact that the Microsoft tools allow
for integration of data.
One of the biggest things that my CIO
talked about all the time was the fact that
we've gotta be able to see the data.
The data is what's gonna allow us to do
what we need to do.
So, in the point solution area you got one interface
or one dashboard that lets you see a particular area,
like encryption or antivirus.
But they don't talk to each other.
They don't, they don't mesh, they don't talk to each other,
they don't learn from each other,
they don't get the data back and forth.
You can't see the full picture.
Implementing the Microsoft security suite,
and we pretty much did the whole thing right,
kind of at the last stage of implementation.
We're putting in the MIP and the AIP,
which is advanced information protection into the mix.
And the amount of data that I get out of that,
the ability for me
to truly see my threat landscape
across all of my end points, all of what my users are doing,
has been staggering.
So, that was really the catalyst that pushed me
over the edge to move to the Microsoft suite,
in the conversations I was told that,
and then the initial testing phases of things,
we saw it almost instantaneously.
I think about a month into our implementation,
we had MCAS running.
And one of my senior engineers,
she was in my office probably two or three times a day.
"David look at this, look at this."
"We can see this, now we can see this."
And then what that allows us to do
is have a different conversation with the business.
It really allows us to say,
here's what's actually happening,
here's what that user is doing,
or here's what this endpoint is doing.
This is what we need to do to fix you
or fix your machine or fix the user behavior.
And now there's data that they can use to say look,
you went into this particular application, you did X, Y, Z,
we've gotta make sure you do this.
And then it allows the operational cadence
or an operational workflow to adjust
to be much more efficient
and also to be much more secure.
I gotta be honest with you I've been doing this many years.
This past year's, obviously besides COVID hitting,
has been some of the most fun I've had
in security putting in a set of security tools.
Usually putting in security is just like,
it's annoying and it's daunting and it's taxing.
You're up 16 hours.
I actually enjoyed hearing my staff come back to me
and say hey we got this in.
Okay let me see all the data.
And then you spend a lot of time looking at it.
But again, it's fun to be able to see the full footprint
of what you have to deal with from a security perspective.
You talk about expense, but it's even far more
than just the expense of the licenses,
the cost to try to stitch that all together
and then keep it working it.
It's brittle.
And the big thing with it is that,
when you're dealing with point solutions
and you're dealing with that aspect is,
you're always having to put another agent onto a system.
With a Microsoft tool it's one.
And it's already embedded in the operating system.
So all you're doing is deploying that information
and getting that information back.
So the performance of the end point,
which in healthcare is absolutely critical.
Those machines have to work on a dime
because a patient's life is in jeopardy
if that device isn't working.
Having those security solutions
behind that Win 10 operating system
and being able to do all that stuff
and not have to deploy so many agents
and not have to deal with making exceptions here
and making exceptions there
and tweaking it and opening up our systems
to risks that we're not able to see,
has been again has been just a lot of fun.
Now as someone who's spent a lot of time
in the healthcare industry,
I bet you've seen some pretty unexpected things.
So I'm gonna read you a lot of side effects
and I want you to tell me is it a real warning,
on popular medication, or just something
that The Shiproom writers invented
when they were calling in sick on a Friday.
Okay, this is gonna be fun.
Purple sweat.
I'm gonna say fake.
Purple sweat is cause that scares me.
But I don't, yeah.
Bones that glow under a black light.
I'm gonna say that's real.
Decreased height.
I know that that's an issue as you age.
However, I'm gonna say no.
Tongue multiplication.
Tongue multiplication?
I'm gonna say that's real.
Three pack Abs.
I don't know, I don't know if that's a medical condition
or the fact that you need to go to the gym more.
Missing fingerprints.
I'm gonna say fake.
I read in an interview you said you saw Teams
as a way to maximize productivity and minimize risk.
Can you tell us how does teams help you
limit security threats?
The security behind Teams is built in.
But there's also a significant amount of governance
that can be applied to Teams
based upon the organization that you're in.
So, obviously healthcare is really regulated
about sharing PHI and sharing PII.
And so it really allows us to put a significant amount
of governance around that to say "All right."
Internally you can have those conversations back and forth.
But the beauty of it is with my 365 security suite
I can see all of that data.
I know where all that data lives.
I know what people are putting up in there.
I can have the conversation with somebody and say,
you might not wanna put that data
in that particular Teams channel,
Let's make it private, make it more secure,
put certain levels of protection on there,
only allows certain people in there.
And then I can put alerting mechanisms through MCAS
and through some of the other tools that I've got
that I can watch over that
and make sure that they're not sharing that outside.
That's other thing.
If it's identifiable information that's confidential
to the organization,
and things that can't go to a personal computer
or a personal email,
Teams allows me to have that control
and that governance over it.
So even though they may collaborate
with somebody outside the network,
that person can't pull that information down,
that person can't hold on to that information.
That's one of the nice things about Teams:
It allows our organization
to become very, very collaborative.
And allows me to sleep at night knowing that
that information is not gonna go anywhere
where it's not supposed to go.
The other piece of it is it allows us to find everybody
that's in our network, almost instantaneously.
Especially going remote over the COVID crisis.
The number one thing that has really allowed us
to be successful was our Teams adoption.
Was using Teams as our way to communicate.
Email is great.
And I've said this multiple times to multiple people.
Email is great when you're trying to send something
to somebody as a way to mark an event
or mark a communication.
"Hey I just wanna let you know,
here are all the action items that we've gotta do."
Teams really became the way for us
that we were able to communicate
and not feel like we were remote.
While we've been talking,
our very own Shiproom AI has been analyzing our conversation
and has come up with the 12 most relevant questions
based upon our discussion.
Now you make your own furniture.
Do you have a whole workshop full of tools
or just one very reliable Allen wrench?
I wish I just had one Allen wrench that I could use.
I have a whole, I have a couple of rooms
full of tools that I use.
What's the next most famous food in Philadelphia
after cheesesteak?
Pretzel.
Now you also do artistic wood burning.
How often have you accidentally burned down a chair
you just finished building?
I'll be honest with you, I have set things on fire.
I've had to put down the burning tool
and walked away for a little bit and come back
and the piece of wood that I've built is half on fire.
Back in the military,
what was the most creative insult you ever heard
from a drill sergeant?
A lot of them are not very PC.
How many apples a day would it take
to keep an entire hospital away?
All of them.
Well thanks for hanging out here
in The Shiproom with us David.
Now before we go, if people wanted to learn more
about you or your organization, where would they you?
Either go to LinkedIn
or they can go to the St. Luke's webpage, SLUHN.ORG.
Thanks David, and thanks everyone for watching.
We'll see you next time.
Official state beverage is milk.
I think that's New Jersey.
Home of the world's largest furry convention.
That's gotta be PA.
The setting of more Soprano episodes than any other state.
New Jersey.
Leads the country in pretzel bakeries
and sausage production.
That's PA That's PA