I'm Mary Ann Kolbasak-McGee, Executive Editor at Information Security Media Group. Today I'm speaking with Martin Litman, SISO at the Kelsey Seabold Clinic in Houston, Texas, and Steve Moore, a former Security Analytics Leader at Health and Charter Anthem, who is currently Vice President and Chief Security Strategist at Security Forum Examine. So Martin, as your organization responds to the COVID-19 outbreak, what is the situation in your region and what are some of the new or expanding cybersecurity challenges that you're facing? First of all, in Texas in general, we are probably in better shape than some of the rest of the nation.
We certainly have seen increasing infections within the population. Early on, we prepared ourselves to respond to this crisis, both from a health care standpoint, in terms of how we would care for our patients and plan for that situation, as well as from an infrastructure standpoint. And, you know, okay, as you may know, Mary Ann, we were very well positioned to operate a remote workforce and move people quickly to remote if that was necessary. So Steve, based on your time at Anthem, what are the cybersecurity challenges that you potentially see health insurers facing in the COVID-19 crisis?
What are some of the new difficulties that these insurance organizations are facing from a cybersecurity perspective and dealing with the situation? I think that the big thing to look at is defense still matters, response still matters. You have two issues. One, the people and the resources you protect very likely over remote.
So you need to have the operations to support that. And that includes your staff of the people in your SOC. You don't want things to get missed ever, but it's easier for them to be missed when everyone is remote. So think of things like a 24 by 7 security operations center.
As you do shift turnover or shift change, you're working on an incident, you don't want things to get missed or get dropped. Another item would be just general communication and escalation. So the threats are largely the same. Some are being exploited, but I'm more concerned about the operation of protecting the expanded remote workforce and then making sure you connect all the pieces necessary in defense when everything is virtual.
You can't just tap someone on the shoulder to respond. You've got to do it virtually. That's what I'm more concerned about from an operation standpoint. And Martin, as your organization is supporting more tele workers and also perhaps telehealth, what are the top security issues that you're dealing with?
How are you addressing those issues? So I would agree very heavily with what Steve just said, for the most part, the threats that we have working remotely are really not much different from what we had before COVID. We were architected to support security internally and externally. Our entire design of the organization was built with security in mind.
So while we've seen increase in phishing attacks, we've seen increase in social engineering, we've seen increase in an ability to distribute malware. We also see that our security defenses are prepared to handle those just as they had been before the crisis. From a patient standpoint, we already had an active telehealth program in place. We weren't doing as many visits as we do today.
But we've largely moved our organization from seeing patients in clinics to seeing patients in telehealth environment. And we do that through secure connections that were already established with our EMR solution. Martin, were there any other additional steps that you had to take as you expanded some of these activities in light of COVID-19? Did you have to do anything more with access and IT management?
What additional steps did you have to take or do you recommend that others take as a venture through these times? Absolutely. So there were a couple of things that certainly sped up. For example, we were licensed at a level for telehealth based on our current volume, and we had to increase that licensing capability.
We did have people working remotely doing two-factor authentication, and those workers were familiar with that process, but many of the new people who had to do remote work, all of whom had to do two-factor authentication where they had not been doing it before required a bit of an educational process. In addition to that, we had to step up collaboration around providing an accelerated means for them to make those requests and become enabled. And also, there's frankly a real challenge in once people are remote and are having technical issues and or security issues, us being able to work with them to be able to address their support needs. And that takes a bit of patience on the part of the people responding and helping them.
So now Steve, I understand that while you are at Anthem, you helped the company navigate the mass of 2015 cyber attack that impacted nearly 79 million individuals. What is the top lesson from that cyber incident that you think is particularly important right now as the healthcare sector does navigate this COVID-19 crisis and sees an escalation of attempts to hack their organizations, phishing attempts, and any other sorts of cyber threats that might be either surging or perhaps new ones that are emerging. Again, many of the same kind of attacks and vectors aren't going to change much, but in the situation that we're in now where everyone is remote, this creates problems for response. It can also create sort of blind spots for detection.
And so if you have to manage a large incident or hopefully not, but a breach, understand what I need to look at, what are the things that are likely to be attacked, understand that it may take longer just like we heard earlier on response to say, hey, how long does it take me to get a laptop back or how long does it take me to figure out what is normal? How do I know a good login from a potentially malicious login or maybe even closer to IT if I have a lockout? How do you know if it's a normal lockout from normal behavior or an abnormal or potentially malicious lockout? And so what are your processes for that?
Gone are for your executives, maybe the assistance that they have that's outside their office, even pull them through and navigate these times, right? We know that many of the breaches that we read about start with a phishing email, you mentioned, that's very, very common. And oftentimes those are sent to important people and they make mistake. And so all of this is very much the same, but I think response in this window of time is going to be slower, which can be more costly.
The other thing I'll note is communication is key. So if you're bad at communication during good times, meaning that escalation, that's SOC process, that is communication to executives and to the workforce, if you're bad at it before and now we're in this sort of stress time, you're going to be worse. So Martin, what about you and your security team during the COVID-19 crisis? What's changed most in your roles and your processes?
And what are the biggest challenges you're facing in navigating everything that you and your team needs to do now to keep the clinic, your patients, and their data protected? From our perspective, the security organization that I run today runs a distributed SOC type of operation. So as opposed to a dedicated SOC center, everybody who's on the security team is involved in sharing responsibility for looking at alerts and responding to them, etc. So communication is absolutely a key component.
We need to ensure that as somebody is addressing an alert, they look at that. I would probably put a caveat in here that we've implemented tools within our organization from not just the security that we have for email and for network security. Our logging system has significant intelligence in it that is beneficial in identifying alerts. We do monitoring the PHI as well.
And so our teams are frequently exchanging email communications back and forth. They're exchanging messages through Skype or through teams, sometimes even through text messaging. It's critical that that interaction is going on. I made reference to the telehealth explosion that we've had within our organization.
So where before COVID-19, we had a select number of people who were doing televisits. We now have a very large population of our providers who are doing televisits. So we had to work through, as they use the Epic HIKO and Canto mobile applications for that technology, we have a kind of a white glove process that takes them through being authorized and able to do that. All those alerts come to my team and they have to handle those calls and interviews with physicians to verify that the people who are authenticating and using the technology are who they say they are.
So there is an absolutely an increased level of activity and presence. And it extends beyond the normal work hours as well because to service the patient population, we really operate in extended hours compared to what we were doing in normal operation. Thanks, Martin. And thanks, Steve.
I've been speaking to Martin Litman and Steve Moore. I'm Mary Ann Cole Basek McGee of Information Security Media Group. Thanks for listening.