Challenging the Security Status Quo with Harvey Ewing

Harvey Ewing: When you say security is a team sport, you hit the nail on the head. This is something that we have to be spot on with our operators, our clinicians, the people that are supporting the process, front, middle and back, in addition to our technologists. We focus across that spectrum. I don't think that there's a better way to put it today in that it has to be a team sport because as you well know, the perimeter is essentially gone in today's day and age. We have to focus from a human aspect all the way down to the lowest level of the technology stack that we have.

Announcer 1: Hello and welcome to Security Visionaries. Working in the healthcare industry has many challenges, but patient data is a top priority. From doctors to operators and technicians, that data has to remain secure and private. Harvey Ewing, Chief Information Officer at R1 RCM is ensuring that everyone in his organization acts as a human firewall. Harvey has over 25 years of experience in cybersecurity and governance risk and compliance. At R1 RCM, he is responsible for security, delivery and improvement of enterprise technology. The Security Visionaries podcast is powered by the team at Netskope. At Netskope, we are redefining cloud, data, and network security with a platform that provides optimized access and zero trust security for people, devices, and data anywhere they go. To learn more about how Netskope helps customers be ready for anything on their sassy journey, visit N-E-T-S-K-O-P-E.com. Please enjoy this interview between Harvey Ewing and your host Mike Anderson.

Mike Anderson: Welcome to today's episode of Security Visionaries. I'm your host Mike Anderson. I'm our Chief Digital and Information Officer at Netskope. Today we are joined by Harvey Ewing and Harvey has got an amazing story because he started his career out as a security leader, all the way through and then became a CIO. So as we talk about our theme, security as a team sport, I feel like Harvey would be the best guest to come talk to us about that journey. So Harvey, how are you? Tell us a little bit about your background and that journey from, and that pivot from, CISO to CIO.

Harvey Ewing: Absolutely. Doing well, Mike. Great to be here. Thanks for having me. Very interesting story. I actually started out many years ago on the business side of things, so I actually have a business degree. That turned very quickly in the mid nineties into information security, which has been something I've had a passion for to this day. My last role at MoneyGram International, I was actually hired in as a Chief Information Security Officer there. About eight months into my tenure, my boss at the time, Camilla Chittle, came to me and said, "Hey, we'd like to move you into the CIO role, which I think is an excellent opportunity to bring the teams together." I was a bit reticent at first and I thought this is a significant change. However, one thing that did stick in my mind was I can bring a couple of groups of technologists together that traditionally don't play well together. That was really the drive behind why I took the role as CIO for MoneyGram. I also kept the CISO role at the same time, which was a very unique experience. Obviously doing two jobs for the price of one was great for MoneyGram, but beneficial to me as well.

Mike Anderson: That's great. Now you've pivoted over to R1, so you left kind of the financial services space. I know you spent time in energy and in various industries. A lot of our people listening, maybe you aren't familiar with R1, so maybe give us a background on R1, the business you're in today. We'll kind of dive into more of the team sport.

Harvey Ewing: Yeah, absolutely. So you're right, big transition from financial services into healthcare. R1 is a revenue cycle management company and what that means is R1 will assist healthcare organizations with optimizing how they take care of the revenue stream for their patients. So we essentially will allow healthcare providers to focus on what matters to them most, their patients and the care that they're delivering. R1 will assist with intake of patients, the management of the patients throughout the payment and claims process, all the way to post care in some cases as well. So we also have recently acquired a company that will focus on revenue intelligence as well. So R1, the combined entities, really focus on providing the ability for healthcare providers to receive pay for the services that have been rendered, in turn allowing them to focus on what matters most and that's healthcare in their patients.

Mike Anderson: So if I hear you right, so when I go in and I pay my medical bill, I put my credit card in, it's actually you that's processing my credit card and taking the collections for them.

Harvey Ewing: That's exactly right. So R1 does assist in that manner. That's correct.

Mike Anderson: That's great. So, I imagine security is going to be of utmost importance when you talk about healthcare and then taking payment from patients that are going in. I know your CISO Cecil and we have a lot of good conversations. Talk about security and kind of the focus you've got on that as you look at R1's business and how do you prioritize that related to other areas of investment you're making as an organization?

Harvey Ewing: Yeah, that's a great question and something that R1 is incredibly focused on. Considering the amount of information that R1 has access to based on the services that we provide our clients, it's every piece of private information that you can think about, all the way from PII to private health information to payment information when services are rendered. So security is something that is at the forefront, which is a great thing. There's a tremendous amount of support at R01 for Cecil and the cyber security aspect. Obviously HIPAA is a very important part of everything that we do. Both the security and privacy role drive a lot of our response. But I will say that it's something that we can't do alone. So when you say security is a team sport, you hit the nail on the head. This is something that we have to be spot on with our operators, our clinicians, the people that are supporting the process, front, middle and back, in addition to our technologists. We focus across that spectrum and I don't think that there's a better way to put it today in that it has to be a team sport because as you well know, the perimeter is essentially gone in today's day and age and we have to focus from a human aspect all the way down to the lowest level of the technology stack that we have.

Mike Anderson: No, absolutely. You brought up earlier that the security teams and perhaps the other teams they have to work with, there can be a little bit of friction between those two. You've got Cecil owning security, you've got the infrastructure team that owns a lot of that network side and then you also your application teams obviously that have to be part and parcel to that. How are you helping bridge those teams to make sure that they're collaborating well together so you can accomplish some of the secure outcomes you're trying to drive?

Harvey Ewing: Absolutely, and that's another good question, Mike. The first step, much like MoneyGram, was putting the appropriate infrastructure, security, network people in the same room to make sure that we're collaborating and we're sharing information and to take the emotion out of a lot of things that occur obviously in traditional infrastructure and really making sure that those teams are acting as a team. So one of the things that I talk about within IT is really something I call healthy conflict. What that means is driving to be the best that we can be in a positive manner. I want to make sure that everyone across the team, no matter what level in the organization they're in, that they know that they're to challenge the status quo, to make sure that they understand that their voice matters and to do it in a positive way, which can sometimes be difficult. All technologists seem to want to think that they're the best and smartest in the room, which is not always a bad thing. But sometimes we have to make sure that we're doing this non emotionally and people aren't concerned around someone challenging what they've done or how we've always done it. I think that's a good thing and I hate the phrase, "Well, this is how we've always done it" and challenging that phrase is something that is at the base of what we do. The other aspect that you mentioned as well is really bringing together application developers. A lot of people talk about shifting left, but it's not really talking about shifting left, it's actually shifting left. That can be difficult because as we move through the CICD process, as people are moving into the cloud, as infrastructure becomes less of a challenge a