'The Math Is the Easy Part': Tampa General Prices Cyber Risk | Unhack the Podcast with Dan Holland

This transcription is provided by artificial intelligence. We believe in technology but understand that even the smartest robots can sometimes get speech recognition wrong.

'The Math Is the Easy Part': Tampa General Prices Cyber Risk

[00:00:05] Jim: Hey, it's Jim from Zscaler. How you doing?

[00:00:10] Drex: I'm great, man. How are you doing? Good. So you were the CISO at Tampa General Hospital and now you've moved to the dark side at Zscaler. I did that too. So how's it going? How do you like it? Oh,

[00:00:27] Jim: it's great. They have the best pie and cookies.

[00:00:30] Drex: It's phenomenal.

[00:00:33] Jim: I did not know how much I could actually help because you never know. I've literally never done anything not for profit before. It's always in government or not for profit healthcare and then making the jump. I was like, what am I going to be able to do to help? And it has been awesome. I have met so many cool people, so many different programs. It's been amazing.

[00:00:54] Drex: It's amazing to me because once you get in there, you do realize how much you can help and not just with what people expect. Like, oh, you know, you're going to come and help with sales, but you can help with like product development and marketing and like there's so many things you can get involved in. And plus you guys, I don't want to talk about Zscaler the whole time, but you guys have built a really cool team. Frank is there. You just you continue to add people that are amazing and so super excited to see how you guys are progressing. Yeah, it's been

[00:01:25] Jim: super cool.

[00:01:28] Drex: So this is for folks who are like, what are we listening? What is this? This is UnHack the Podcast, but I every year when I go to Burning Man, there's always like 10 things that come out of Burning Man in my head. And one of those is on the way down to Burning Man this year, and it's like 700 miles from here and I pull a camper. And so I'm listening to podcasts and one of the podcasts I've kind of become addicted to is Good Hang with Amy Poehler. And Amy has this way of doing her podcast where she talks to somebody ahead of time who isn't the actual guest but knows the guest that's going to be on. And so I was like, I should do this as a version of UnHack the Podcast with all of the, you know, attribution to Amy and the, you know, please don't sue me. This is, you know, plagiarism is the most sincere form of flattery. But you're going to do this. You're doing this because I'm going to talk to Dan Holland in the next segment of the show. And Dan is the new CISO at Tampa General Hospital. And you guys have known each other for a while. The opportunity to kind of say good things behind his back. When did you meet Dan? And what was the, what's the story there? So I

[00:02:37] Jim: actually met Dan because he runs a or helps run a volunteer program to get cybersecurity into high school students and education across Florida. And I met him honestly through that. Trying to volunteer through or trying to actually volunteering through one of those things. And what happened there was we went out and taught incident response to kids. We played backdoors and breaches with them, the high school. It was really cool. And I ended up talking to Dan there and he's like, Hey, can you go to coffee? I was like, sure. And we sat and talked for like four hours. And so I've always been an operational guy. I've always been a cyber ops guy. And so what happened there is I realized the light of GRC. I was always like, Oh, GRC is, you know, whatever. And so I'm sure

[00:03:19] Drex: GRC will come through the computer at me here.

[00:03:22] Jim: But he showed me the way he actually is the reason for any success that I have had in Tampa General as the CISO from a GRC perspective. Like cyber ops thing, I had locked down as my, you know, history, career, whatever. But he actually, it was my little GRC sensei. So it was amazing.

[00:03:41] Drex: I love that you guys met doing volunteer work, which is not an unusual thing for most cybersecurity people. They're involved in something else, usually like two or three something else's. And so you guys met there. I love that you had a first date. It was like four hours long. That was a good, that's a good time.

[00:04:00] Drex: He, I'm just really looking forward to the conversation. He's got so many things that he did. He's done that I think we're going to have a hard time keeping it compressed. But sort of from an inside baseball perspective, going back to good hang, what's a question I should ask Dan that will open him up and, you know, people will get to know him better personally. So personal, not cyber question. It can be a cyber question. Either way, I'll, I mean, look, this is the grand experiment of format of UnHack the Podcast. So,

[00:04:34] Jim: well, if you want to do cyber, you can ask him about his $5 horse and how he should protect it. Because he introduced me to that concept. Okay. If you want to do a personal thing, you can ask him how to,

[00:04:53] Jim: how is, how is sim racing careers going? Because he is the best at risk

[00:05:02] Jim: reward. Analyzing from cybersecurity perspective that you can imagine. He's great with business. He's got a great business talk, but when we, we sim race together and you do competition stuff. And when you, when he gets in that car, usually a Porsche, his risk reward calculation just goes out the window and he will rubbin's racin', Robert Duvall, like he brings back the car into the pits and it's banged every corner. And so we have to repair, like it's a whole thing. And like, you can sit there and coach him as his crew chief and like, Dan, watch out. Just take it easy. This guy's a little nutty. Just let him go by. We'll get the position back later.

[00:05:41] Jim: And the next in the horseshoe at Daytona and, you know, yeah, we're towing back to the pits. So, uh, he just cannot turn that red off. And I think it's like, he's got to keep everything so risk averse and risk at work that he just lets it go. Yeah. And I don't fault him for it at all. Like it's like, we have a great time. It's hilarious. Um, but yeah.

[00:06:01] Drex: All right. Cool. That's great. Uh, you did your own racing. Uh, I texted you, I don't remember now as sometimes my days and weeks all run together, but you were actually on the track recently, right? No,

[00:06:13] Jim: unfortunately it wasn't. I will be next year. I went to Grid Life at Laguna Seca, uh, this last weekend. And if anyone has any enjoyment in cars whatsoever, um, you should go to a Grid Life event because it's a grassroots racing and it, um, it, they take all these, they have all these rules to keep the cars from being too expensive. So you'll be out there. Like there were Honda fits going around this track. And if you don't go to say, it's a crazy track. And then there's also Corvettes and Ford Mustangs and all kinds of cool stuff out there, Porsches, but, uh, it's a rate. The races are only 12 to 15 minutes long and there's like 15 a day and you just watching races and you can enter them yourself. I couldn't get my car out to California this time, but I will definitely be doing that next year. They also have them on the East coast. They have pretty much everywhere. It's a great event. And then at the night, it's just a giant concert. It's just like concert after concert after concert. It's a big fan event. Like it's just great. Everybody's cool. Ah, that

[00:07:06] Drex: sounds like a, that sounds like a great time. Uh, hey, thanks for doing this.

[00:07:10] Jim: No problem. And Dan is next. So, um, I'll see you soon.

[00:07:15] Drex: All right, man. I can't wait to watch it.

[00:07:51] Dan: Hey, it's Dan Holland from Tampa General Hospital, the Chief Information Security Officer there.

[00:07:56] Drex: Hi, Dan, how's it going?

[00:07:58] Dan: It's going great, Drex. I'm glad to hear you made it back in one piece from Burning Man, or at least besides the finger, you know, mostly whole. It's an awesome awesome time out there. I

[00:08:10] Drex: did. What Dan's talking about is I have a really banged up and it looks really gross. I'm not going to show you. I'm not going to show you any more than that. I have a banged up finger, and this is sort of the experience of Burning Man continues to try to kill me even after I come home from Burning Man. And if you want to know more, just drop me a note, and I'll send you the rest of the story. Congratulations on the new gig. Kind of cool. You are the guy. And it's not like you haven't been there, and these aren't programs that you've built. How's the transition going? How's it feel to be the Chief Information Security Officer?

[00:08:49] Dan: You know, the transition from, you know, to CISO has been really smooth for me, despite, you know, being in third -party incident response mode for quite a bit of it with all the breach activity that's been going on. The volume of information that comes to the seats in order of magnitude more, and, you know, navigating organizational politics. You know, I was a little shielded from that at the deputy level, but navigating that well, my boss, my predecessor, Jim Bowie, was the best leader I've ever worked for, and really set me up for success here. Built an incredible program, brought me along to all the right meetings. I had my first board presentation last week, and everything's been going really smoothly. So nothing to complain about. I'm surrounded by great people here at TGH.

[00:09:35] Drex: That's great. You know, we had sort of talked about the board meeting coming up, and of course, Jim, you know, everybody loves Jim Bowie, what can I say? And you're going to be at Lake Oconee with us for the CISO Summit, and Jim told me that he's going to be there in his new role at the CISO Summit. So we're going to have the big family reunion. It'll be a

[00:10:00] Dan: big reunion. North Georgia's we're as hard as still, and I'm glad he's going to make the trip out there for us. That's awesome. I mean, everybody that's coming, all the CISOs that are coming are also going to get the big benefit of spending time with Jim because he knows so much about so many things. Brilliant practitioner and a wonderful leader. Nothing but amazing stories. We could talk the whole hour just about Jim and tell stories about Jim. I know, and I've got a little bit of a

[00:10:28] Drex: surprise for you later when it comes to that. Hey, one of the things that we have talked about that I have found super interesting because you are probably the expert who has gone down this path, at least the one that I know of, that really, really you dove deep into risk and risk quantification, and you've built a program there around that concept. And I feel like we could turn this into a webinar or something and explain to everybody what you're doing because it would be a great thing for everybody to know. But give me the nutshell version of what you're doing, if you can, with risk quantification and how it works and why it's been such a cool thing at Tampa General.

[00:11:21] Dan: Definitely a passion of mine. In my entire career at cyber, I've seen technology leaders fail to get budget, fail to persuade the business to make decisions that they knew were the right thing to do because of the language that we use to communicate risk and what we know. Red, yellow, green, high, medium, low, 1 through 5, 1 through 10, all of those values don't have context. And context is everything, right? The words that we use really matter. Vulnerability is a likelihood, right? Vulnerability is not a risk, right? Our findings are not risks. A server that's unpatched sitting in a room that's not connected to anything isn't a risk. And so it's on us to translate what we know into terms that the business can understand. So risk is described as a probable frequency and a probable magnitude. Impact and likelihood, right? So everybody's familiar with that, but we used words like high, medium, and low to describe the likelihood and impact instead of taking it one step further and saying that that moderate probability is 20 to 30% over the next 12 months. And that impact would be 2 to 4 million dollars. So the annualized loss expectancy is $500,000, right? And that informs business decisions, right? When we started at the system level, right? So we didn't start at the board presenting loss exceedance curves. We've gotten to that point. But where we got buy -in was at the system level. There's this unpatched application that the physicians really like using that the vendor won't patch and it's running on server 2012 and TLS 1.0. But nobody's willing to touch it because the physicians really want it. Well, that's going to represent $750,000 of annualized loss based on the current configuration. It'll cost $100,000 to upgrade. Guess what? That thing was offline the next day when we did the quant. And taking that from the system level up to the business unit level and helping inform decisions, because that's really what it's about, is decision -making and helping humans make better decisions. So presenting this information at the system level, the business unit level, and then the organization level has informed our insurance policy limits, which we have doubled this year in light of the AI -enabled threat actors that are out there. But we informed that level of insurance based on the aggregate loss exceedance that we modeled using the FAIR methodology, the factor analysis of information risk that Jack Jones authored. And it's just been a really good program for us to, again, communicate what we know and determines that the business understands to inform those decisions. We've updated our risk management policy to reflect these. So what's the risk acceptance threshold? What's our tolerance? And then who has the authority to make decisions based on the level of risk that we've modeled? And if we said it's a critical risk that can only be made by the CEO's cabinet, what's that mean? How are we defining a critical risk? But by putting dollars to it, we've been able to put very explicit tolerance thresholds in place that ultimately speed up the process of governance.

[00:14:41] Drex: I love the math process around this. I think more and more we see folks who are bringing projects to the table, not just for cybersecurity, anything in the health system. We're asking them to create business plans for those. And then those business plans have to have numbers behind them, which is the ROI.

[00:15:07] Drex: They're like, good upside is on the actual balance sheet, or here's how it'll add revenue. Like that ROI, we're asking them to actually figure that out as they submit their business plans. This is sort of the cybersecurity version of this that says, here's the potential negative downside we could avoid. And what the odds are that if we don't do this, we're probably going to have to pay that bill anyway. When you went through this originally,

[00:15:41] Drex: in my head, I think there's probably two reactions that execs of the table would have. One is, you're going to have to explain this more to me because it feels a little bit like voodoo science and math. And the other reaction I think sometimes for some people might be like, what took you guys so long to come up with something like this so that really helps us understand instead of the emotional argument of high, medium, and low, but the actual, here's what it's going to cost. What reaction did you get from execs? And how did you explain it when they really wanted to get into it?

[00:16:19] Dan: What we did with the executive level and our cybersecurity governance council was we surveyed them ultimately to determine what those risk tolerance thresholds were in quantified terms, but asking them questions like, would you rather have a 10% likelihood of a $10 million incident or a 90% likelihood of a $1 million incident, got them thinking in terms and introduced the concepts like annualized loss expectancy. The math is the easy part. Doing a Monte Carlo simulation 50,000 times to calculate the what if. We're going to simulate 2027, 50,000 times and calculate this log normal distribution, this curve that shows what are the odds of exceeding that limit in a given year. I mean, CFOs must love you. When you start talking about Monte Carlo simulations, the CFOs must just, they start pouring drinks and they're really into it, aren't they? They get it, right? The heads are nodding and that's why our budget has gone up. It's largely, we've got a very supportive leadership culture here that understand the cyber risks, but the part of that success in getting the cyber budget that we've gotten support for is speaking in terms that the business understands. Speaking their language,

[00:17:41] Drex: yeah.

[00:17:41] Dan: Because we talk about cyber risk is business risk, but we need to communicate that cyber risk in business terms then. It's starting with a decision and then working back from there. What decision are we trying to inform? Because again, the math is the easy part. Coming up with the risk scenarios is where the most work is. Ransomware risk is not a scenario. Just like a vulnerability of finding and an assessment or a pentest does not equal a risk in a vacuum. There has to be a method. There has to be a threat actor. There has to be an asset and there has to be an effect. Four components of a risk scenario so that we can be very explicit in what decision we're trying to inform. That's where most of the work comes in and is working with the business to identify what those scenarios are that would be most probable with the highest effect, the highest magnitude.

[00:18:38] Drex: Do you teach a class on this? I'm thinking, do you want to do a, we should do a webinar on this and just so that people could, we can have CISOs from across the country or other folks from cybersecurity teams join in and just, this is a great way to think about the problem and how you talk about it and how you relate it to everyone else in the business. And I just don't feel like enough people are really doing it. So if you want to do that.

[00:19:06] Dan: I'd be happy to. I learned directly from Jack Jones, reading Douglas Hubbard's How to Measure Anything in Cybersecurity Risk. There's some great books out there that introduce these concepts. And I'm really parroting what I've learned from those pioneers in this space. But I became such a believer. This is the hill I was going to die on because again, I saw how much we struggled to get buy -in and support for the priorities that we have in security, our own budgets, but also just mitigating the findings, the actual risks that we've identified that present unacceptable risks to the organization. And we're just not getting the traction because it's falling on deaf ears. But we have knocked down so many of those walls by putting dollars to it that it's the proof in the pudding here at TGH, I'd be happy to help others embark

[00:20:00] Drex: on that journey. I love it. And you've legitimately lowered risk.

[00:20:05] Dan: Yes.

[00:20:05] Drex: And that's the key operation. You have another program that I want to talk about and we'll do it fairly quickly too. I'm not doing either one of these justice for people who are listening. There's a lot more to this is why I'm asking you about doing a webinar around risk client. But the second one is the security awareness gold stars program that you have. Tell me about that and how that came about and what you're doing with it.

[00:20:35] Dan: Absolutely. I started my career at the Coast Guard and we're big on training, training and recognition. And there's a big disconnect between what cognitive science knows about how people learn and how we have always done things in IT, in the business world. You send an annual phishing simulation. Everybody gets the same one. You check the box. Okay, our click rate was this and we'll baseline and move forward with that annual simulation. You do the new hire trainings. You get in front of folks and say, this is the behavior that's expected of you. Here's what to look out for. In October, you do a little bit more to the security awareness month, but we're not changing the culture. We're not making people feel an ownership of our security programs because everybody's a stakeholder. Everybody owns the cybersecurity program. We've got a cybersecurity department that I'm responsible for, but the program I'm a shepherd of and everybody owns it. And everybody has a role to play. And so we started looking for ways to change the culture and thinking about, okay, cognitive science, right? How do people learn? Well, it's repetition, right? It's gamified, make it fun and engaging, micro trainings, recognition, right? Give people a leaderboard, instill some competitive spirit into the thing and engaging form. So we found a platform that enabled this, what we call the cyber hero program, which is all encompassing the recognition that we're driving towards. And I've got a little badge here that's holding my badge with the cyber hero swag like that. I've got some challenge coins made to recognize people that get the most stars, but this platform called Hoxhunt is really the crux of it. And we were able to shift away from our old platform of the annual cadence. Everybody gets the same simulation and there's really very little training baked into it to now this AI enabled phishing simulation engine that tailors the simulations based on the people's roles. So it's relevant to them. And the frequency is a couple times a month that people are getting these phishing simulations. And if they report it, they get three stars, right? And if they don't report it, they click on something, that's okay, we're not punitive, but it opens up a training module for them. And it takes two minutes to click through and learn about the phishing simulation that they just built. Just in time, right? When you make the mistake, it says, hey, that was great. Good try. But here's some things you need to know and why you clicked on the wrong thing. Here's what to look for. Here's how they got you. And then when they complete the training, they get stars, right? And then there's a leaderboard and we're recognizing the leaders who have the most stars per teammate every month in front of 900 people at the leadership forum. I've had people coming out of the woodworks from across the business, nurses and other professionals in the health system saying this is the best training that I've ever done in my career. It's so engaging. It's so fun. My team and I are competing with each other to see if we can get the most stars. People have really taken it on, but it's because we've made it fun and engaging and we're not asking them to click through 40 slides once a year. Of course, we still have to do that because there's a compliance requirement that we do the annual update training, but it's the training program that is continuous and gives them that sense of ownership and buy into the program is the outcome that we've been driving towards that we've realized. And I'm really not as concerned about click rate because it's ad hoc and people are getting different simulations and there's a spicy mode for some folks. It's really tough to baseline an AI -enabled threat simulation, a phishing simulation, because the bar keeps rising as our threat actor is getting more sophisticated. Our training is keeping pace with that. And so a click rate is less impactful to me than the mean time to respond and report. How quickly are we getting the notification that they click on the button and report a phish? And that shows, oh, I see something, I'm going to report it. See something, say something. This gives us an opportunity to have a metric around that that I think is more impactful than just a simple click rate. So that's something I would encourage the audience to think about too. How much buy-in are you getting? And that's one way you can measure that.

[00:25:08] Drex: I think the non -punitive part of this too, the places that do this the best, there's always a running conversation with the folks in the organization about, and it's okay. These people are super sophisticated and they do come up with some really convincing things. And then sometimes you will click on it and after that you will think to yourself, ah, I don't know if I should have clicked on that. Creating an environment where it's okay for them then to call you guys, call the service desk and say, I just clicked on something and now I'm a little concerned about it without, oh man, here come the bears to tear you apart, but really good because that allows us to cut it off at the pass as opposed to you don't tell us cause you're afraid you're going to get in trouble. And then it really was a bad thing. And now it's a disaster for the

[00:26:02] Dan: You said it, Drex. We don't want them to click on the thing, but we're going to click on stuff we shouldn't sometimes, right? We're human and that, that culture of awareness and knowing that it's going to be okay. And that speed is everything is, that's the outcome. We're trying to mitigate risk here and that behavior is what we need to actually mitigate risk. And so well,

[00:26:23] Drex: well said. Yeah, it's good. Gold stars for you guys for putting together this really cool program. Okay. Here's kind of like the fun thing that happened. So before we started the, well, we talked a little bit about Burning Man at the beginning. One of the things that happened is I go to Burning Man every year and I always come back with like 10 things in my head about stuff maybe I could do differently. This time as I, as I drove down, it's a long trip to Burning Man from Seattle. I listened to a bunch of podcasts and one of them was Amy Poehler, Good Hang. I don't know if you've ever heard the podcast, but it's pretty fun and really interesting. And so this is the direct ripoff part of Amy Poehler's podcasts that I'm doing here. But I talked to Jim Bowie before I talked to you today. And I asked him to say some nice things behind your back and he did. And we'll put that at the front of the show. So you'll be able to watch that. He's obviously, he told me about your four hour date really early on when he first met you, you guys kind of had this click around a volunteer thing that you were doing.

[00:27:31] Drex: Anyway, he's, he's obviously a big, big fan. And I asked him for a couple of questions I could ask you. So this is the dangerous part of the program. One of the questions he said, ask him about his $5 horse.

[00:27:49] Drex: What's, what's that about?

[00:27:52] Dan: When we were presenting, you know, this concept of risk quantification to the leadership team, one of the slides that found a funny picture of a horse, but I said, you know, you don't want to put a $10 fence around a $5 horse. Right. One of the benefits of doing this, right. So, you know, you, we're trying to prioritize resources that are limited, right. And, and that prioritization is going to be informed by taking this, this data driven approach to measuring and communicating our risks. So that was one of them. We talked about some of the other benefits, but that's one of them too, right. We're not going to put a $10 fence around $5 horse. And he got a kick out of that when I put that up.

[00:28:33] Drex: Are you from the South? Because that sounds like something from somebody in the South would say, you know, like one of my uncles would say something like that. Are you from the South? Where are you from? I was

[00:28:44] Dan: born in Texas. I was raised by Texans and there's a bunch of kind of, you know, one

[00:28:59] Drex: other question, and this was kind of fun. He said for me to ask you about the amount of risk assessment that you do as part of your sim racing career. So you do sim racing. And Jim is your crew chief sometimes.

[00:29:19] Dan: Jim has gotten me into car, I was never a car guy. And it was a way to get from point A to point B. I never thought, you know, the folks that had these race cars were compensated for something. And then he got me behind the wheel of a Porsche 911 on a track, you know, a GT3 RS. And man, feeling that power and those brakes and the cornering and the G -forces, I was hooked. I can't afford to do that very often on an actual track. So he got me into sim racing. And now we've got a racing team on iRacing called Zero Day Racing. You know,

[00:30:03] Dan: a few of us are in it. And yeah, that is such a, you know, because you can't think about anything else when you're behind the wheel. But Jim has coached me to take a real risk -based approach because I'm by nature a pretty aggressive driver. And yeah, he said that a lot of your risk thinking somehow doesn't actually get into the car with you. The slow -in, fast -down approach, you know, and picking your spots and letting, you know, again, taking a risk -based approach. I have not done a good job of letting my risk management professional skills translate into the cockpit of a sim rig. But, you know, take a better approach to it, I'll say. It's something that I've been working on, and it's a great hobby. I encourage you to get into it. It's a lot of fun.

[00:30:55] Drex: He said your car has come back really banged up.

[00:30:57] Dan: Really banged up, yeah. I keep getting demoted and having to get myself back up there because I'm too reckless on the road and, you know, banging with other cars. It's, you know, I see that gap and I just, I can't, I gotta go. I start seeing red when I got the car in front of me and I, you know, there's some kind of hunter instinct that kicks in and I just, I have to catch them and I gotta pass them. It's, I can't not try. Yeah.

[00:31:21] Drex: Hey, Dan, thanks for being on the show today. A ton of fun. I really appreciate it. Looking forward to seeing you at Lake Oconee. And yeah, as always, yell anytime. Anything you ever need, I'm right here.

[00:31:35] Dan: I appreciate you, Drex. Thank you for the conversation. Enjoyed it.