Third Party Threat Hunters
A dialogue with leaders in Cybersecurity and Third-Party Risk Management led a leader in the field: Gregory Rasner (author of three books in TPRM and one in PAM)
Third Party Threat Hunters
Change Healthcare and the Concentration Risk Nobody Chose, with Kayne McGladrey
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
In February 2024, a ransomware attack on Change Healthcare froze roughly 40% of US medical claims and left hospitals and physicians unable to get paid for weeks, even though most were never touched by the attackers. vCISO and author Kayne McGladrey explains why Change is still the best case study for concentration risk, why AI dependency is set up to repeat it (this time on purpose), and why "cyber risk" is really business risk with a different trigger.
We cover:
- Why Change Healthcare wasn't a black swan, and what the architecture guaranteed
- Same outage, two labels: ransomware vs. a hurricane
- Exclusivity clauses, switching costs, and exit strategy as architecture
- Why a backup AI model you've never tested isn't a backup
- What resource-constrained teams get wrong about TPRM
- This month's one move: three revenue processes, three owners, three conversations
Kayne's three free starter documents:
- Business Process Catalog: drive.proton.me/urls/EE82Y1609C#yMbrqTgQ2u58
- Business Systems Inventory: drive.proton.me/urls/WX6J4G3J18#433XPCYsHNLt
- Component Ledger: drive.proton.me/urls/H7PYXX9CFR#MD0LCZrlEntR
Free field guide from this episode: thirdpartythreathunting.com/podcast/kayne-mcgladrey/
Kayne's book, Cyber Risk is a Myth (CRC Press), is available wherever books are sold and at your library. All 60+ workshops and templates from the book are free at kaynemcgladrey.com/myth. Newsletter: kaynemcgladrey.com/newsletter. Kayne also offers vCISO services.
Also mentioned: the June 2024 CDK Global outage, when thousands of car dealerships couldn't process sales and financing.
Free field guides from every episode, plus the BEACON pack: thirdpartythreathunting.com/podcast
Welcome And Guest Introduction
SPEAKER_00Hello and welcome back to another edition of Third Party Threat Hunters Podcast. Today I have Kane McGladry on my desk. I want to make sure I got your name right. And well uh Kane is a DRC advisor, virtual CISO, author of Cyber Risk is a Myth. Today's topic, we're talking about why change healthcare breach is still the best use case for understanding concentration risk, and especially in the AI vendor case. Let me give you an opportunity, uh Kate, just to tell the audience a little bit about yourself and your practice, and then we can dive into the subject.
SPEAKER_01Thanks, Greg. I really appreciate it, and thanks for having me on your show. As you said, I am the author of Cyber Risk is a Myth, which is coming out on CRC Press. Or depending on when this goes live and when you're watching it, it's already out. It's already also available at your library. So if you don't want to buy a copy, petition your library for a copy, uh, even as an ebook. I am an independent virtual CISO and I generally work with mid-market and small enterprise companies on meeting their regulatory, legal, contractual, and cybersecurity requirements. And generally in plain English, I try to make sure that we hew to what the business needs, not necessarily to compliance for compliance's sake or security for security's sake. I'm really interested in how can we effectively defend businesses against modern uh the modern threat landscape.
SPEAKER_00I preach require perfect perfect. That sounds great. All right, so let me just ask if you could can give people a refresher on what happened at Change Healthcare in February
Kane’s Work As A Virtual CISO
SPEAKER_002024, and I'll let you take the floor on that one.
SPEAKER_01Okay, yeah. And and it's been a minute, right? Uh the news cycle moves fast. So change healthcare, it's not a hospital, and most people, I don't think, had even heard of it before February of 2024. That's really the first thing to understand because their anonymity was really the point. But they sat in the middle of the American healthcare system's plumbing. The company, from a metrics perspective, they processed about 40% of the country's medical claims. They acted as the clearinghouse connecting providers and insurers and pharmacies, and they handled the routing that lets a pharmacist verify your coverage at the counter and also to bill your insurer nearly instantly, right? And then they got hit with ransomware. The attackers got in through a remote access portal that didn't have multi-factor authentication enabled. And when they were inside, the company had no choice but to take their entire payment and claims network offline. And that's really when the problem started, because claims stopped clearing, prescriptions stopped verifying, hospitals and clinics that they'd done nothing wrong. They weren't even attached by the attackers at all. They lost their ability to get paid. And the survey numbers that came after can't really tell us the story of how big the blast radius was on this event. 94% of the surveyed hospitals reported a financial impact, and about a third said they were losing more than half their daily revenue. And the thing I can't really get over is the American Medical Association went out and pulled physicians, and they said they were recovering their payroll and their supplies out of their personal funds because the money just there was no more money. For a company that nobody knew, a single intrusion disrupted the healthcare economy of the entire United States for weeks. So when we talk about change healthcare, we're not talking about one bad day or one ransomware thing at some little company. We're talking about something so central that when it failed, everything connected to it failed alongside.
SPEAKER_00And that's where it really points to it's no longer third parties that you have to be worried about. But uh I don't want to get off into a another topic that we'll never get out of as well. But uh let me ask the first question out of that out of that great history lesson is uh 40% of the U.S. medical claims processing froze, I think you said, and 193 million people data exposed. That's nearly 200 million
What Happened At Change Healthcare
SPEAKER_00people. That's a large portion of the United States population if you look at that in that in that sense. Uh doctors dip in the retirement savings to keep their practices open. The news has kind of moved on, as you said, to AI vendors. It's been a couple of news cycles and frontier concentration. But change healthcare still is a great case study. Why does it still tell us about today's risks?
SPEAKER_01So just to take your earlier question, the way they all found out was when they didn't get paid. It's a really compelling way to find out, is you you issue, you know, you go you go to accounts receivable and they don't hear back from accounts failing and go, huh, something seems spoken today. But the reason this is important is this is not a history lesson. This is a preview of the future. When the incident happened, the everyone's instinct in cybersecurity was to say this was a black swan event. This was a rare alignment of careless vendor and just a bad day in the industry. Seems comforting and it's also wildly wrong. Like the thing that made change healthcare dangerous was not carelessness and it wasn't bad luck, it was risk concentration. And every essential function, if you think about your modern enterprises today, they've been consolidating for 20 years, and healthcare is just a good example. Payment routing collapsed into a handful of clearinghouses, data's been collapsed into a few cloud vendors, vendor after vendor has merged until entire sectors are running through a small number of checkpoints, often without anybody deciding, like, hey, this seems like a good plan. Change healthcare ended up critical partly through mergers and acquisitions, partly through contracts that made switching nearly impossible, and mostly just through inertia. Nobody ever gets up and says, let's go with fragility. They just kept choosing convenience, one renewal at a time. And that's why the case still matters. Like if we strip away the ransomware, the story holds anyway, because the architecture that was in place guaranteed the outcome. There is one node, one no redundancies, no exit path, and tens of thousands of organizations downstream of a single failure, regardless of whatever caused it. And we're starting to see this come up again. I think the next concentration wave is artificial intelligence. And this time companies are running towards this. We've got single model dependencies, we've got single vendor stacks, we've got entire workflows that have been built around one provider's uptime and one regulator's ongoing goodwill.
SPEAKER_00Yeah, so what you pointed out is that concentration risk and what what happens when the impact, and it's not a black swan event. It's just an it's just another example. The AWS outage is a great example of concentration risk. You've talked about this and your examples. I my example is when I teach, I often would, before that happened, would use the US hey class, what do you think to the financial system would happen if US US East ate up the AWS node went out for a while? Well, everybody found out. Um the internet kind of crashed for a bit to some extent. It was just it was nuts, but it's just one data center. And so you're right. I I really like it. The change healthcare example is an example of what happens with that concentration risk. And and most of us are, as you said, unknown of what that concentration risk is. We just don't understand how shallow the pool is, really. We think it's deep, but it's actually inches deep, I think is kind of the perception.
SPEAKER_01Yeah, I think there's a real lesson here on business resilience that we could probably go into. But I know I think you had an I think you had something you wanted to poke on here on this one. So before we get why I need for background, for the listeners, Greg had sent me some questions in advance, and I'm trying to remember what the next one was.
SPEAKER_00Oh, it's okay. No, you're good. I I this is this is great. I mean, uh you know, uh organic is better sometimes, but it's we everybody knows we're going to prepare a little bit. You you want to you want a conversation that leads towards the the topic that we want to we want to cover. Otherwise, you and I will just end up going off on tangents for the for the 30 minutes and people will lose us. Oh, my my follow-up to this, how how would you compare this to the anthropic export controls ban? Is there a parallel in this space?
SPEAKER_01Anthropic. So Yeah, yeah. If you all remember, June or July? June, I think it was. So regulators suspended anthropic's ability to export model access to uh what they call certain jurisdictions. But what happened is overnight, the customers in those markets lost their AI capabilities. And they didn't get like a big notice, like, hey, there's uh an outage coming. So there was no real mitigation window, and it wasn't like you could negotiate that. But I want you to want to think about what's like what's missing from that scenario. In cybersecurity, like there's no there's no attacker here, there's no downreach, there's no vulnerability, there's no patch, there's no zero day. The most serious availability event so far we've seen in AI, and no security control could have prevented it or detected it or responded because there was nothing classically to prevent or detect or to respond to. When I think about how this like the parallels to change healthcare is the shape of it. We had one supplier, total dependency, no alternate path, and a root cause that turned out to be completely irrelevant to your business. Whether the trans trigger is a ransomware happening or an export order that's happening out of Washington, D.C., your CFO is seeing the same outcome,
Why Concentration Risk Is The Story
SPEAKER_01you stop getting revenue. And I mentioned like earlier, change healthcare was involuntary concentration. That's what makes AI worse. Companies are building this dependency on purpose with enthusiasm, and they're writing the lock-in to the AI model of choice themselves. Greg, I've lost your audio.
SPEAKER_00It's just because I had it on myself on mute because I'm going to make sure the background noise, but thank you for saying something. Yeah, no, I was just saying that that I worked in the finance space for quite a bit, and and you have a concentration risk there about a you're you're talking about healthcare. It's in almost every sector. There's this concentration risk in and through mergers' acquisitions, through through regulate regulatory requirements, the same thing. You've seen this concentration of vendors. And when a big vendor, I won't name vendors, but when some of those vendors go out, we've seen impact in that space for this for the same interest. Luckily, not to the impact that we've seen with some of it, but some of the uh there was the car dealership one. I'll have to look it up and maybe post it for follow-up on this one. But there was one where the car loan dealership wasn't the car loans weren't being originated for a while because of a third party that just impacted everybody else downstream. So I'll look it up and post it on the show notes because I think it's important for everybody to see another example of how kind of like change healthcare, just you get this unknown concentration risk. Let's move on to your book because I'm really uh I love being an author, I I love seeing new books written about this space. I know it takes time to write a book, uh certainly the effort it takes that you've put into it, and I appreciate the effort that you did. Uh your your title is Cyber Risk is a myth. Do you want to just expand on why you mean it? What why do we what do you mean by that, and what should we change to kind of get around that that belief or that that that myth thought?
SPEAKER_01Well, the reason that I I chose the provocative title is that there's the claim of cyber risk. I don't think it exists. What we have is we have business risk, and sometimes cyber events are a trigger. But here's the thought experiment I use. Imagine you've got a manufacturer on the Gulf Coast. The Gulf, I was about to say the Gulf Coast, but let's just go with the Gulf Coast, just in general. I was up in Canada the other day, they pressed me on which Gulf Coast is that game? That's the Gulf, yeah. But imagine you've got two scenarios that happen. In our first scenario, ransomware encrypts the plant systems and production stops for, I don't know, let's say two weeks. And or in the second one, let's say you get a hurricane, it makes landfall, and production stops for also two weeks. Same plant, same outage, same revenue impact, same contact, same contracts. All of it's missed. And go ask the CFO and ask her to explain the difference in business terms. There isn't one. There's an outage, and it's an outage. But we've built a whole cottage industry around pretending these two events are in different universes. The ransomware event gets classified as a cyber risk, handed to some security team, it's measured in CVSS scores and mitigations and control frameworks. The hurricane, by comparison, gets classified as business continuity. It's handed to the operations team, and honestly, if they know what they're doing, they're going to manage it quite well. But that taxonomy failure. That's why boards feel like they're hearing two different languages in every meeting. The security team talks in vulnerabilities and severities, and the executives, they just talk about dollars and days. And they're not wrong. They're just not talking to each other. Third-party risk is where this fails the hardest. We've seen it with the change healthcare incident, companies downstream of it. They spent months afterwards arguing, is this a cyber event for reporting or insurance purposes? But the actual damage was revenue interruption, which was identical to a supply chain failure. So the argument I'm making is not that security doesn't matter. It's that we're asking people the wrong question. We don't
AI Dependency And Export Control Shocks
SPEAKER_01need to keep asking them, like, are we exposed to hackers? The question is, what dependencies of any kind could interrupt our revenue? Once we ask it that way, the third parties really sort themselves out fast. Like your company that goes to coffee service, they're a vendor. And whoever pays you or clears your payments, that's another category of vendor, and they deserve very different amounts of your attention.
SPEAKER_00Well, Katie, yeah, I was gonna you slid right into it. I was gonna ask you, how does this affect third party? But you slid into the it's a risk-based approach, right? You have two different types of vendor. Well, you might have numerous vendor classes, but in the simplest choice, you have vendors that can impact your business operations. The coffee vendor arguably could, because not enough caffeine makes people a little slower. But the impact is certainly minimalist compared to uh a a full-on a breach that that stole your data. That that's those are two much more impactful scenarios. And you're right. Oh, sorry, I used vendors, but so you're you're you're AW, you're a your cloud vendor. That's just pick an easy one. Your cloud vendor is certainly more critical from a from a perspective. And we we always teach that because uh if you try to beat yourself out like chunky peanut butter, you end up with that result. It's just uh you don't you don't get much of a you don't get much of a uh of a view on what the real risk that and that's kind of what you're addressing too, Kane, is address the risk that really matters to the business impact. That that's that's the concern. I I like it. Cyber risk is a myth, is it's fine with me as a title. I think it's a great it's a great way to get to get readers interested in how you're approaching it. And I don't think you think that there isn't such a thing as a cyber risk. We just need to approach it from the business the business perspective. And I I Yes, totally 100%. Because if you're right, if you don't put it in plain business English, you you're I think your your point is we're talking across each other, right? I mean we've been for decades now. Yeah, we probably will continue, but hopefully you know, through folks like yourself and just as we get better at it, maybe we'll just get better
Why “Cyber Risk” Framing Breaks
SPEAKER_00at it. Uh let me get it to the third question security problem or contracting problem. More than a third of change uh healthcare's clients' c uh contracts had exclusivity clauses. About 67% of the hospitals have said switching clearing houses was difficult or very difficult. And this is not unique to you know uh change healthcare and and their their customers. So it's a great think about it in your own space, listeners. How much of third-party risk today is a security problem, and how much is actually a concentration and contracting problems?
SPEAKER_01I mean, as a as a as a CISO, it it this is going to come as a startling statement. I don't think this is about security. This is about economics and it's about incentives. Change healthcare, just to finish this one out, they came in through uh the the threat actor came in through a Citrix portal without multi-factor authentication. And my my colleagues will say that's a security failure. But the reason the Blast Radius was so catastrophic wasn't the lousy passwords, it wasn't the lack of MFA, it was concentration. Like you said, over a third of the hospital contracts, they had exclusivity clauses that made switching vendors legally difficult. This is not a technology thing, this is a legal thing. They said contractually, we aren't going to switch. And like you said, those two-thirds of surveyed hospitals, they said switching is going to take us months of operational work. They were trapped contractually through fragile processes. And now think about like all the AI processes we're building. The concentration story is a lot worse because the lock-in, it's voluntary. Companies are writing their own binding agreements every time they integrate with a single large language model. You don't need an exclusivity clause, you don't need a legal barrier, you just need architecture. Build your workflow around one provider, and you've created the same problem-change healthcare head, except you did it willingly and nobody stopped you. And exit strategy, it's just not like it's not a contract clause anymore. This is technical architecture. Can you move your data? Is the format proprietary? What happens when the vendor decides that they're going to sunset a feature? Going back to Claude again, the Fable V thing, like the trigger does not matter. You can be taken offline by criminals or regulators or a product decision 3,000 miles away. The CFO, though, what do they see? The money stops coming in. And the label on it doesn't help. We have to bring together security and procurement and legal to meet before any contract is signed. If they're done separately, we end up with security recommending tools that procurement can't buy and legal can't enforce. That's how you end up getting stuck. And just so people don't think like Gaines an AI doomer, if you're going with a single model, make sure you've got a business continuity plan that says here is a backup model. Because if you don't, I think that your customers are going to not really tolerate that. Now I'm not saying like come up with five different model scenarios, but businesses are expected to operate continuously these days. And if you cannot provide that basic level of fallback capability, I back in the old days we called this what business impact analysis and business continuity and you know all the old metrics, right? I think those are still relevant in today's AI world. We just have to make sure we're not getting locked into one single path because we've seen how fragile it is. Yeah.
SPEAKER_00I I think one thing that as I was thinking through kind of the scenarios you've talked about is if you were asking a vendor on the way in, and business more specifically, how long how how many other choices do you have of this vendor? And if they come back with this is one of only two, that's a problem. And then how long will it take to replace this vendor is another question you should ask an intake. I think those are two really valid questions that will start to sift through some of this, you know, this stuff that we're seeing. But um you uh it's a I and I and in the really good intake uh intake um assessment questionnaires, I see that. On the bad ones, they miss that. But if you're asking those right questions, you should you should maybe start to see it. It doesn't gonna give you full visibility because this seems this is only gonna be the new services coming in. But I'm just trying to think of as practitioners come through this, you're providing us with some really good insights. I think one of the ways we could do is uh I'll think of things that we can provide. And we'll add that as a takeaway for the for the for the uh podcast, uh Kane, as we talked about earlier. All right, uh question
Contracts And Vendor Lock In Traps
SPEAKER_00number four what small teams get wrong? And again, this is I want to draw on your virtual CISO uh uh experience here, especially. Uh you work with growing firms, uh, they generally are resource constrained, which is why they've they're they're choosing um uh a fractional sometimes. One, what what can you assess? How can a small team like that assess every vendor? And how can it what do they consistently get wrong about TPRM? So I'll ask it in two parts. Let's do first, what what do you see them consistently not do well? I think that's probably a better way to say it.
SPEAKER_01Well, I I I like the question as you've phrased it, so I'm just gonna run through this. Because I don't think that they can try to hit everybody all at once, and and that's that's a fool's errand. I think treating every vendor as being equally threatening is uh is a mistake. If you spend a week with any like a one-person security shop, you'll find them grinding through a questionnaire that's been sent to the uh the gardening maintenance service and the payment processor, and they get the same 10 minutes of attention. That's not diligence, that's that's compliance theater. The second mistake we make is relying on point-in-time artifacts, your stock reports, your questionnaires, your attestations. Those documents describe the vendors pasture last quarter under conditions you probably can't verify using questions that were written by somebody who never saw their environment or your environment. So we put them, we file them away in desk doors, they expire quietly, and nobody connects them to whether or not your claims are being cleared this week by your payment processor. But I think we can use that resource constraint to our advantage. Big enterprises, they have tens of thousands of vendors, so they end up buying software to manage the inventory and end up monitoring an average of pretty much nothing effectively. I think a small organization, you've got maybe a couple hundred dependencies. You can actually know all of them. You don't need to catalog them, you need to know them. So don't start from your vendor list. Start from the three highest revenue processes and work downwards. Like what keeps it running, what happens to the money if each one stops, and then who do you call? Because the vendor list is going to bend itself from there and it's going to be very short. Like the people who do your landscaping, they're not interested anymore. Payment processors, they definitely are very interested anymore.
SPEAKER_00Yeah, that's right. Uh great points. And I I I love that you keep hitting the uh the risk-based approach, right? That that it's it it is not every vendor is not creating coal. That that is something I've said multiple times, and it's great to hear it from somebody else.
SPEAKER_01It's revenue risk more than anything else. It's not like I have seen people with from a technical background who say, well, they've got high CBEs or they've got a history of data breaches. No, I want to know where is the money going coming in from and where is the money going to? Because honestly, the rest of the business, these vanity metrics that we've been selling them for years aren't interesting.
SPEAKER_00Right, right. Well, and and and your your your theme also fits well with it. Even if you're a technical person or uh uh a dork like me, the zero trust stuff is totally uh about business value. It doesn't talk about CVEs in that sense, it talks about finding your crown jewels and protecting your crown jewels from a resiliency standpoint, not to your and so you're you're right. You can get it, you can look at it from the business perspective if you if you have the right mindset and tool set. Your book and zero trust perspectives are are great ways to look at that. All right, uh question number five. Well, actually, this is more just a kind of a wrap-up.
What Small Teams Get Wrong
SPEAKER_00So we're gonna take the the kind of what we talked about here and give folks, listeners at home, a way to take someone back to their desk, and that's always a great way to wrap it up. Um, if a listener is running a third-party risk management program and you're their virtual CISO, uh, Kane, what would you want them to change or look at one concrete thing this month that they that they could really help bend the risk curve? Business risk curve.
SPEAKER_01I mean, I'm gonna go back to saying like pick your three highest revenue processes and go find out who owns them. That that's your whole assignment. Like, not something about vendors, because everything else depends on this. Sit down with each owner in person or on a call, maybe get a cup of coffee, and ask them two questions. What systems does this process depend on? And what happens to your revenue if each one of those goes down for a day? Write the answers down, maybe a page per process. And if you do this by the end of the month, you're gonna have a defensible answer to the question, which vendors actually matter. If you can point at your revenue stream, not a gut feeling or a vendor risk tiering spreadsheet that somebody built three years ago that's not based on reality. We need to identify three processes, three owners, and it's three conversations. If a listener does only that, your next incident call is gonna go measurably better.
SPEAKER_00That's a great way to wrap it up,
One Concrete Fix And Closing
SPEAKER_00Kane. I like the approach. Kane's book is Cyber Risk is a Myth. It's gonna be available probably by the time this puck comes out. I would guess this is two weeks from the recording time. So do go look for it on all the major resellers, right? Amazon, uh all all the uh all the other libraries. Everybody buy books. If it's not your library, uh go petition to get it. 60 plus workshops, playbooks, resources from the book are all free at uh Kane McGladry.com slash myth. Did I get that right? That's right.
SPEAKER_01Yeah, yeah. They told me I wasn't writing a textbook, so I just added in all of the workshops and templates so that people could use those as resources.
SPEAKER_00That's great. I I that's a great good good for you. That's great as a as an author. I like doing that. Kane's new newsletter is also available on his site. He also offers uh virtual Cecil services. Uh I if you think this is one of the vendor exposures that you also kind of find your yourself in, uh, that's what their parties recording does too, so look us up as well. Thanks for listening to the the podcast. And also if you like the podcast, please subscribe and and leave a comment.
unknownThanks.
SPEAKER_00Thanks again for being a guest, Kane. Thanks, Greg.