By Dan L. Dodson, Chief Executive Officer, Fortified Health Security
LinkedIn: Dan L. Dodson
LinkedIn: Fortified Health Security
Every year I look forward to National Cybersecurity Awareness Month. The posters are fun, the guides are helpful, even the extra phishing tests are fine though they aren’t necessarily my favorite. But it’s really the conversations that happen during the month that I look forward to.
At Fortified Health Security, we believe that only by working together, sharing knowledge, expertise, and motivation even, can we truly improve the cybersecurity posture of healthcare.
Therein lies the challenge. Getting healthcare security leaders to talk candidly with one another, about what actually happened and what actually worked, runs against nearly every instinct the job rewards.
Here is what six years of hosting a monthly roundtable for healthcare cybersecurity leaders has taught me about the value of building the kind of room where that conversation is possible, and how you can build one yourself.
Why Healthcare Security Leaders Stay Quiet
The pressure on a healthcare security leader is unusual. You are accountable for patient safety, care continuity, and some of the most sensitive data in the world.
This trifecta of pressure makes speaking openly about an incident feel like exposing internal risk, or, worse yet, admitting weakness. So most often the true story never leaves the building, and what your peers hear is the version prepared for legal review.
With the number of attacks on healthcare organizations, his silence does not make us safer. It makes us stagnant.
Our First Roundtable Had Three People
Our first roundtable was small. Very small. To be more specific, it was myself, Fortified’s COO, and the single provider CIO that managed to make it on a call during COVID, comparing notes on what remote work had done to our environments.
I won’t lie; it wasn’t exactly encouraging. But we showed up again the next month, and the month after that, and then again and again. No vendor presentation. No sales pitch. Just a few topics we knew folks were struggling with and whatever the people on the call wanted to discuss.
Our typical monthly virtual roundtable now brings 60 to 90 healthcare cybersecurity leaders, and the reason is simple. They trust that what they say stays in the room, and they trust that the hour spent in the room will be worth it.
Chatham House Rule Is the Whole Design
We run our roundtables under the Chatham House Rule, the convention that lets participants use what they hear but never reveal who said it. Nothing leaves the room with a name attached, and honoring that single guardrail is what allows attendees to feel comfortable describing valuable details about what happened in their environments instead of the approved, high-level version of the story.
It also gets leaders off their “islands.” If you run security at a hospital or health system, you are very likely the only person in your organization doing that job. You may have colleagues, but it is unlikely you have peers. A roundtable puts you in front of people fighting the same battles at other organizations, from the same seat, in the same week, against the same threat actors.
Peer-to-peer is often how good ideas move, especially the affordable ones that healthcare so desperately needs.
For example, during one of our roundtables, a chief information security officer shared that they changed the font color, the size, and the placement of their external email banners every month so users did not go blind to the warning. It cost virtually nothing, and it produced a measurable drop in risky click behavior.
Ideas like that do not make it into conference keynotes. They come from small insights exchanged in trusted settings.
Out Collaborate the Adversary
Nobody in healthcare is competing for patients in the security operations center. In healthcare cybersecurity we share a mission, and with it a responsibility to help those fighting the same fight.
So, this October, join a roundtable somewhere, share more in your group chats, or call a peer and open a new conversation about some of the challenges you share and how you’re overcoming them.
If you’re feeling extra ambitious, get a few peers together and have your own roundtable. If you do, here is what we learned the hard way:
- Start small – One coffee conversation is enough.
- Set expectations – Trust and discretion are non-negotiable.
- Focus on learning – No pitches, no presentations. Not from you or anyone else.
- Be consistent – Trust builds over time, and only over time.
- Focus local – Your most consistent collaborators may be a few miles down the road.
Our adversaries collaborate. We need to be better at it than they are.