Ahead of the HealthSec Summit, we sat down with Justin Vlahacos, Director of Cybersecurity at R1 RCM, to hear his thoughts on the state of cyber security in the healthcare sector today, as well as some context around his presentation session at HealthSec on May 23rd – 24th in Boston.
The HealthSec Summit is an annual gathering of Cybersecurity leaders from across the Hospital & Healthcare, Medical Equipment, BioTech, Pharmaceuticals, Life Science, Diagnostic Labs industries and more. The event is an opportunity for them to come together in one space with the focus on how to best protect their organisations from cyber attacks.
Read on below for the full interview!
Please introduce yourself and tell us a bit about your background…
I’m Justin Vlahacos, and I’ve been in the Tech Industry for about 12 years now. I began my career working as a help desk and worked my way up to my current role as a Director of Cybersecurity for R1 RCM, Inc. I’ve touched a lot of areas of operational IT, from system engineering to networking to security architecture, and I think that has helped me have a lot of success in my career as a security professional. Outside of work, I’m a huge outdoorsman. I love hiking, swimming, biking, basically anything that gets me away from a computer screen on the weekends. I do also like to game on occasion, still playing Eldin Ring when I can!
What do you think are the biggest cybersecurity risks affecting healthcare and life sciences today?
At this point, I think that the 3 biggest risks to the industry are as follows: vulnerability management, supply chain management, and security awareness training. The biggest technical threat to our industry right now is ransomware, and the biggest non-technical threat is data theft. All 3 of these risks that I’ve specified enable both of these to occur if exploited by an external threat actor, and sometimes simultaneously, as most ransomware groups will collect sensitive data as a monetary fallback, in case they do not get paid their ransom. I think these are areas that we need to work on improving drastically to see security posture improvement changes over the next few years.
What do the next 5 years hold for your industry?
We will more than likely see the end of ransomware as the primary technical threat to our industry. Anti-Ransomware capabilities from our peers in the AV and XDR spaces are becoming more intelligent and functional every year. Once we get to a point where most ransomware attempts are caught at the execution stage, most ransomware groups will move onto other means of making money.
I think we will see credential harvesting and impersonations becoming a much larger threat in the next few years. With the advent of things like ChatGPT and the overall OpenAI project, I think we see an equal oppurtunity for using that technology for the benefit of security but also for the benefit of the adversary. We are already seeing success by unsophisticated credential harvesting techniques like phishing, whaling, and other social engineering attacks. As the technical ability to impersonate another person improves, we will very quickly see it adopted as method of attack by the adversary. The best way to protect against this, in my opinion, is to work on security awareness training for our standard end users and team members, they are the frontline of our security postures, and they will be the ones hit by this type of attack the most when it starts happening.
Can you give me a taster of the main point you are going to make at the HealthSec Summit?
As the panel discussion I’m taking part in revolves around data security regarding PHI. The main point I would like to get across is the absolute importance of oversight when it comes to data security in any healthcare or life science org. I’m sure I will be preaching to the choir with this point, but it is the most crucial point to the entire discussion. We can implement thousands of technical and policy-level controls across every org in healthcare, if we do not know without a shadow of doubt, where our data lives, not a single one of those controls is worth the time it took to create it. How can we be certain that the controls are actually functioning appropriately if we do not know where the data lives?
What is your top advice for other cybersecurity professionals?
Always stay up to date! Watch webinars, take trainings, and if you have the time, build a HomeLab just anything to keep yourself fresh with what’s going on in the industry. The adversary is always looking for new techniques, new technologies. They are always innovating; so we have to be learning. We must know a little bit about a lot, otherwise we cannot help with identifying the dangers that new technologies pose as they enter the operational space of our industries.
Catch Justin at the HealthSec: Cybersecurity for Healthcare Summit on 23rd – 24th May as he takes part in a panel discussion: ‘Securing Patient Data Against the Threat of Cyber Attacks’! Join us for his session and enjoy live Q&As throughout the summit by registering at healthsec.cs4ca.com/register/.
