Insights & Ideas

Written by Stage7 Systems with Robert Myles, former CISO, UT Southwestern Medical Center

The first 90 days in any executive role is a critical time. It’s a time when existing policies, procedures and technologies are re-evaluated, when new objectives are set, and a time when someone new to the position – potentially from the outside – finally has a chance to put their spin on organizational strategy. As anyone who’s been through it will say, the first 90 days is intense and often comes with a steep learning curve. Along with that can come the unveiling of opportunities to shift policy, optimize internal procedures, identify technology gaps, and define areas for improvement that may have otherwise been missed.

Upon arriving to the executive post of Chief Information Security Officer (CISO) at UT Southwestern Medical Center in Dallas, it was essential for Robert Myles to kick things off by understanding the current state of their information security organization. This is the case in almost every similar scenario and at UT Southwestern, a host of existing attributes were evaluated, including:

1. Organizational structure
2. IT security tools & technologies
3. Policies, procedures & oversight
4. Cultural & environmental factors

In following along with the results of his evaluation of each of these areas during his first 90 days on the job it becomes clear why this approach was used, where some near-term opportunities for improvement were identified, and what’s being done particularly well already. The information gleaned from this process will be critical to creating a go-forward strategy for UT Southwestern’s information security group.

ORGANIZATIONAL STRUCTURE

UT Southwestern’s information security group is divided into specialized teams that coordinate and execute their team’s directives. For example (not a complete breakdown):

• The System Account Management (SAM) team is responsible for all user provisioning, de-provisioning / termination, account changes, and access control for the university enterprise including all students, residents, faculty, staff, hospitals and clinics
• The Help Desk team is responsible for providing user-level support for the university enterprise
• The Network Engineering team is responsible for internal and external system vulnerability management, endpoint protection, and a number of related activities

At its core, the information security group is charged with protecting all electronic data that flows in and out of UT Southwestern’s control ensuring that it maintains the confidentiality of that data (patient, financial, research, and student data) while adhering to federal and state compliance mandates. Currently, the group’s efforts touch roughly 1,300 servers, over 14,000 workstations, and approximately 40,000 IP points within the network environment. Simultaneously, the group needs to manage the security of external connections with several outside health systems.

With information security touching nearly every aspect of the health system, including research & development and a growing student / resident population – roles that are unique to academic institutions, splitting into smaller teams with specific objectives helps with streamlining the group’s efforts. Thus far, this approach to organizational has enabled the group to “do more with less,” a theme common among health systems nationwide.

IT SECURITY TOOLS & TECHNOLOGIES

This area is where the majority of newly appointed executives find the most need for improvement, so evaluating the existing toolsets within the first 90 days is critical to getting off on the right foot. As it turns out, UT Southwestern already has an effective set of tools in place but at the same time, there were definitely a few areas identified that represented opportunities for the health system to further automate the security function.

During the initial review, it was determined that they already had:

• A robust, centrally managed vulnerability monitoring toolset, which actively scans for weaknesses at the network and operating system levels
• A standard set of security metrics that are regularly reported on so the team knows what’s going on in the environment
• A centralized help desk ticketing system that enables service desk representatives to efficiently retrieve and resolve user support requests
• A centralized storage management environment that helps to streamline the data backup & encryption process
• A separate network segment used for research & development and for internal groups that need to have elevated access to resources outside of the organization’s direct control
• A new anti-virus / anti-malware platform that provides better protection to user endpoint devices
• A log aggregation toolset that centralizes the collection of security logs from various systems in the environment that can be used to analyze potential vulnerabilities

All of the above seem to point toward a theme of automation and centralization and in keeping with that theme, the one opportunity that becomes most apparent is the prospect of extending their theme of automation to the SAM team, which is responsible for the user provisioning & de-provisioning process.

By quickly identifying that opportunity, it gives the executive team the chance to have an immediate positive impact by taking the initiative to explore automated identity & access management platforms. In doing so, the risks associated with performing the SAM team’s tasks manually will decrease dramatically and the overhead required by those manual processes will follow suit – further enabling the information security organization to “do more with less.”

POLICIES, PROCEDURES & OVERSIGHT

After initial evaluation, it was determined that UT Southwestern had 38 active security policies and now, a complete review of those policies is under way. The information security group, along with the university’s policy office, will jointly conduct the review of these active policies with the objective of finding opportunities to standardize and better align the policies with what’s in place today.

In addition to working with the university policy office, the information security team has a number of other constituents including the privacy & compliance group, the internal audit department, the patient & security privacy committee, and an executive compliance committee.

With so many dotted-line relationships it can start to get confusing but each group & committee plays a role. At a high-level, the policies & procedures defined by each are designed to address a variety of questions and scenarios, particularly around PCI and HIPAA compliance.

During regularly scheduled meetings, issues are reviewed (or perceived issues are brought to light) and the information security group coordinates with HR, legal, etc. to ensure those issues are appropriately addressed.

Reflecting on these relationships and understanding how they fit into the overall organizational strategy is key to leveraging them as changes are introduced.

CULTURAL & ENVIRONMENTAL FACTORS

When stepping into a new executive role, especially from the outside, the cultural and environmental differences experienced in the new role can be one of the more challenging aspects of the job – at least early on. Taking a moment to recognize these differences will be helpful to implementing the changes that will help the organization in the long run.

In the case of UT Southwestern’s new IT security chief, he was stepping into an academic health system from a for-profit health system previously. This added new angles from which decisions had to be evaluated because not only are you working in a health care environment but you’re also adding the research & development and education components to it.

In health care, there will always be the normal dichotomy of IT security and health care where everything needs to be open, transparent, interoperable yet secure. When you add the research & development aspect to the mix it can get a little more difficult because their job is to break boundaries, to think outside the box and researchers look at things from different perspectives. These types of groups are often less rigid and less predictable than the typical groups you might find in a for-profit health system, for instance, which makes securing them and their data more challenging.

In addition to understanding the environment and culture across the organization, it will be helpful early on to identify where you’re likely to get the most pushback when implementing change. In nearly every organization, you can’t simply change and expect everyone to embrace that change with open arms. If you do the outcome is likely to be less-than-desirable. At UT Southwestern, it’s proven critical to have a champion in each key group (physicians, faculty, research & development, etc.). No one group has a louder voice than another but it’s definitely a balancing act to make sure that each need is addressed on an equal scale as the needs of one group may not necessarily equate to the needs of another. And including them in the change management process ensures that they agree that their needs are adequately being met.

In going through this evaluation process for yourself, it’s important to remember the following key points:

• What you do with your first 90 days is paramount to ongoing success in your new role.
• Don’t succumb to the temptation to focus only on the tools & technologies category but also evaluate the structure that surrounds you and the culture of your new environment.
• Your first 90 days will present you with many opportunities to have an immediate impact on the organization, take advantage of this “honeymoon period” as colleagues and board members will likely be more receptive to your recommendations.
• The effective communication of your plan, strategies, and ideas will be critical to building trust with your constituents.

ABOUT UT SOUTHWESTERN MEDICAL CENTER

UT Southwestern Medical Center ranks among the top academic medical centers in the world. Its mission is to improve health through innovative patient care, research, and education. Founded in 1943, UT Southwestern has evolved rapidly into a premier research institution, pioneering breakthroughs in cancer, cardiovascular disease, neurosciences and women’s health. UT Southwestern’s faculty includes four members awarded Nobel Prizes since 1985. Patient care is provided in their university hospitals and clinics, where they offer the latest advanced treatments and technologies. For more information, visit www.utsouthwestern.org