(engine whirring) (lively music)
- It's lunchtime,
and this is Brad Anderson's Lunch Break.
(lively music)
Two of my favorite things about Microsoft
are the smart people that constantly visit campus
and the great fleet of shuttles.
Wherever I can, I try to take advantage
of both of these things,
and grab lunch with some of the tech industries'
best and brightest.
(lively music)
Today, I 'll finish talking with John Houston,
the Chief Information Security Officer,
at the University of Pittsburgh Medical Center.
(lively music) (engine whirring)
I've been super impressed
with how you have driven the culture at UPMC.
There's gonna be a lot of people
who are gonna be listenin' to this
who can see that there are challenges
and issues in the organization,
and they need to go push a culture
that is a lot more aware of and pushing security.
What advice would you give?
- First of all, I think when it comes to security,
you can't let security get in the way of the business.
You look at allowing security solutions
to help enable the business or at least making sure
that your decisions around security don't get in the way
of the business, in the case of UPMC delivering healthcare.
If we can find the security technology
that maybe makes access easier,
then it's a win for both of us.
But, if I come up with a security technology
that-- - Cumbersome, gets in the way.
- By example, if it takes a physician five extra seconds
to log into his or her computer
because of a security technology I layered on top of it,
that's gonna be unacceptable,
because that physician-- - five seconds
- may log into that computer 20, 30,
50 times a day. - A day.
- Add up that time.
- Yeah.
- And I think it does become disruptive
to them doing their job.
- Oh yeah.
- It's easy for a lay person to say,
"Oh, but that's not a lot of time."
- But it adds up, over and over again.
- To the physician who is already doing long hours
and is trying to be as efficient as possible,
it's past being an inconvenience.
It becomes a major inhibitor of them doin' their job.
- Yeah.
(comical music)
Let's play a game called this or that.
- Okay.
- I'm gonna give you two subjects.
- Go for it.
- Then I'm gonna read you a list of descriptions,
and you can tell me which of the two subjects
that the description applies to.
Okay, network intrusion or a box of donuts.
Those are the two choices you have.
- Okay.
- Once it gets past the premer,
it spreads in all directions.
- Network intrusion.
- I've seen donuts with the engineering team
just to (mumbling) (laughing).
- All right. Contains a payload that's very harmful
to your employees.
- Donuts or both.
- Both. That's a both.
Experts can identify the people who made it
just by looking at it closely.
(comical music)
- Geez. Probably in some ways neither.
- Neither or both.
- Or Neither or both.
- That's right.
- We used to work for a company
that did a lot of defense work,
and they had the MIL-Spec Catalog
for all the different military specifications,
and one of them was donuts.
- Did they really? (laughing)
- If you're gonna buy donuts for the military,
there is a specification for donuts.
I've seen the specification.
- They're often introduced by a well-meaning employee.
- Both. Absolutely.
- Agreed, I agree.
There's a lot more headed your direction.
- Not a lot of donuts left in my direction.
I cut that out before I turned 50.
(comical music) (engine whirring)
- Tell me a little about the decision making behind going
from on-prem into the cloud with email, files,
collaboration, etc.
- From my perspective, and maybe I don't speak
for IT leadership, but I look at things like email
as being almost a commodity.
Is it really part of our core business?
We want to make sure it's available.
We want to make sure that we have an effective environment,
but we have a lot of other things that we need
to worry about, and if we can provide that service
in an effective cost-efficient manner,
I don't necessarily think we should be in that business.
- Really. Just focus on what your core is,
and if there's a way to get the service
that you don't have
to spend your precious resources on that.
And then I would add to that,
as you move to these Cloud services,
like Office 365, you're on the latest technology,
you have the latest innovations,
- You don't have to worry about it.
- you have, exactly.
And that's one of the things I think really the world
is really come to understand in say, the last year.
- Today,
maybe 25, 30 percent of our data is in some way,
shape or form in the Cloud.
- And the destination you need to go get to is?
- 100%, - Wow.
- without a doubt, and more and more
of that data will be primary copies of data.
But I really do see over the next two to three
to five years that all of that data is going
to be in the Cloud and much of it's really gonna be
data that we're gonna rely upon very directly
to deliver patient care.
There's a lot riding on getting this right.
We can't be afraid of it either.
(comical music) (engine whirring)
- It's been a sincere pleasure to go drive around
and talk a little bit.
- Yeah. Love the car.
Don't give it up.
(laughing)
- All right. The next time I'm coming to you,
and we're gonna go drive one of your cars.
- Absolutely, would love to take you out.
- Thank you so much.
- Thank you. Have a great day.
- Yeah. You, too.
(comical music) (door slams)
(comical music)
Next time on Brad Anderson's Lunch Break.
- One of the things that I've always seen
in my technology coverage over the years
has been that even when the technology is fantastic,
it can't succeed if the organizational culture is wrong.
The lesson there is that you have to be willing
to change your culture, as well as your computing,
to make best use of technology.
(engine whirring) (comical music)