Do you know why it's called Taco Tuesday?
No, Todd, why is it called Taco Tuesday?
It was because Taco John's was using two TWAO for two
tacos on a Tuesday was their deal,
and now it got switched to Taco Tuesdays.
And now everybody uses it kind of like the old
traditional Kleenex Qtips, that whole concept.
And that surprisingly,
other organizations out there not naming other taco in
their title names may not really love the fact that
other people have a copyright on it.
Yeah, wow, what a great icebreaker.
That was good.
Well, I guess so do people in this group?
Do you talk on Tuesday or is there a meal that you are
like every Friday like meatless Fridays or fish
Fridays or things like that?
Is there like a day of the week that's always
consistent for your meals?
I mean, I do Taco Tuesday just because it's easy to
remember and easy to make.
So I'm a Taco Tuesday person.
I was just sharing with the group that we had tacos on Monday
and the leftovers will be Taco Tuesday for us again this
evening.
But my boys like the concept of the Taco Tuesday.
Pizza Friday?
Pizza Friday is good.
I don't do those, but I do for whatever reason love to order
delivery pizza when it snows like crazy.
I do tip well when it snows though.
Who delivers your good snowstorm?
That's clutch man.
Do you do the same if there's like a rainstorm too?
Just like they have to go out in the rain and get soaking wet
to deliver your pizza?
I don't know that I crossed my mind in the past,
but OK, snow absolutely.
Sure.
Well, we're not talking about snow for a long time
because it's now beautiful weather.
So it's out of our vocabulary.
Matthew, did you talk about Tuesday or Tuesday?
No, or any kind of meal?
I was too erratic, it's really just whatever's
taken us for the next couple of days.
So I suppose the only thing would be we do lasagna
for big celebratory lasagna is kind of our thing,
which I've spoken about my love for lasagna on other podcasts.
So I'm going to stop before this becomes the lasagna podcast.
I don't know that might be my new favorite episode,
but I'm with you that I'm like, I don't know.
Grading my husband does most of the cooking.
So whatever he's cooking is whatever, you know,
whatever day of the week.
But I also.
Whatever he puts in front of you?
Yeah, I'm like, I've ordered ingredients
to make vegan tacos, and then I've just never
gotten motivated enough to shred up the tofu and actually do it.
So it's on the wish list that one day I'll
try making vegan tacos.
Nice.
Well, kind of related.
We're talking about food and.
We can make the back.
I can't hang in there.
I can do it.
I don't know.
Well, today on our Tech for Business podcast,
Kelsey, Tara, and myself are joined by Todd, our CIO,
and CISO, and Matthew, our GRC analyst.
And we're discussing why doctors are refusing to use MFA.
And I thought it was so interesting looking back.
We're about a year out from our first MFA podcast.
And we're still talking about it.
So what's the deal?
Why are they not using it?
Why are people not buying in?
What's the disconnect happening here?
Well, mildly interesting and not directly related to health
care, but I actually was just at a banking conference earlier.
I guess it was last week.
And they were saying the adoption rate of MFA
is still only 17% nationwide.
And that was not specific to industry, but nationwide.
And that seems low to me.
But somebody slung that stat.
So I think the answer is, is because the adoption still
stinks on it, which is probably a great topic for today.
I'll take a first stab at it.
I think the reality of why that MFA is so heavily resisted
is because people think it's complicated.
It's cumbersome.
It causes them to do something else that's very inconvenient.
So again, dating myself a little bit
like I tend to do on some of these podcasts.
When I first started a job, well over 20 years ago,
I had implemented MFA at that particular location.
And it was the old FOB.
So you had the rolling six digit e-card that kind of came in.
So you type in your password, and then you
had to dig the key FOB out of your pocket.
You had to look at it, and you had like 10 seconds
to enter it before it expired.
And it was just painful as ungodly people hated it.
But MFA really isn't like that anymore.
Yeah.
I mean, for me, the experience I've
had with people who are not implementing it,
it's not going to happen to me.
They're thinking that they're not a target.
And so the implementation and teaching staff,
and then training the staff, updating staff,
getting hardware, software changes, implementation,
the whole project seems like an unnecessary, either
expense or time sink.
That, as Todd just said, kind of used to be the way it was.
There was no real better way that was commonly available.
I'm sure we all remember the movies that
came out in the late 90s and early 2000s of people suddenly
having extra badges and eye scanning and fingerprint
scanning.
And that all seemed at the time like it was science fiction.
And now there's so many different things
we can do that kind of fall in line with that.
They can make it not just easier and less time consuming,
but also, I don't want to say it's a little fun.
But there are times when it does feel a little bit fun
and spy-like to use MFA in certain ways.
Yeah, I mean, I guess I'd throw in a couple of barriers
to entry.
And you did mention a few of them.
One of them that we see an awful lot,
especially in the health care industry,
is that there still tends to be a lot of shared accounts.
And there is a little bit of inconvenience
in how you set up a multi-factor for a shared account.
So it could just be, we'll just say nurse as an example,
but it happens in senior living and so on and so forth
as well.
But he said the login is nurse one, nurse two, nurse three.
And you may have 20 people that do it,
or you have people coming in to do it temporarily or whatever.
There still is ways to do it.
So that's one barrier of entry.
As we talked about, the inconvenience factor
was one in the past.
And then the third one that I see come up often is cost.
I don't have the equipment, therefore, I
have to invest in it, which actually
has a mild tangent to another one that we typically see often.
When you have those shared accounts, especially
in senior living, is you'll say, hey,
I want to use a tool like your phone
where I can use an authenticator.
And the staff member will often say, well,
you don't pay for my phone, so I'm not
going to put your application on my phone.
That tends to be real problematic too.
It actually isn't.
But it's a barrier to entry.
People are like, I don't know how to overcome that.
They tell me they're not going to carry a second phone.
I don't want to pay for another phone, et cetera, et cetera.
But we'll dig into that a little bit further.
But those are some of the main barriers
to entry as to why people are like, this is just too much.
I can't move forward on it.
Yeah.
One thing I want to mention quickly before we move past this
is I'm not sure if there's a different term for this
as it relates to organizations.
I know it from software development,
but it's the idea of a thing called technical debt.
The idea is that when you're building a program,
if someone's requesting something
and it needs to be pushed out very quickly, corners are cut.
Things are done that wouldn't be done if you had more time.
And that results in something being released
that maybe was done in a way that's suboptimal.
Going forward, if you need to redo that
or if you need to do something else that builds from it,
you're building and creating from a suboptimal position.
And so the idea of going back to fix it
becomes more and more expensive from time,
human hours, everything.
And cost of paying everyone to do it,
as well as the potential of having to take the software down
to make the fix.
Now, when it comes to, I see that a lot,
and we talk about that a lot in software development,
but when it comes to your environment,
this may be what you're feeling
when you think about implementing something new.
You're thinking about changes that may need to happen
to the network, updates that may need to occur,
what else needs to be implemented,
can seem really overwhelming.
And that's because it's a real thing.
It's very, very difficult to wrap your head around that,
especially if you're unsure on the technical side already.
So it's something to keep in mind.
And it's important to remember that
it is something that can be undone.
MFA can be put on top of it, it can be worked around.
Having someone come in who can kind of dig into the system
or knows the MFA systems better may be able to tell you
that implementing this is far easier than it seems.
So it's just something to keep in mind
and everyone's dealing with it.
We do see it a lot of places.
It's still worth looking into.
Yeah, I'm gonna kind of circle back
to one of the things that you mentioned a little earlier too.
As you had mentioned that there is the,
what is my risk level?
I perceive that my risk is low,
therefore I don't need to worry about it.
And again, I know I've mentioned healthcare a few times,
excuse me, I mean, senior living in a lot of times,
people will think, well, it's just senior living, who cares?
The answer is everybody cares.
There the amount of data that healthcare people have,
both on PII.
And I'm gonna sling some acronyms around there
and hopefully you guys are up to date.
And if you're not, we got a ton of podcasts
that kind of get into the variety of very ones,
but that one's your identifiable information
on a personal level.
And then there's the PHI, which is health information.
And that information is very desirable from attackers.
Again, I mentioned I was just at a conference
and one of the guys that was at the conference
was big on fraud and he talked about
how he could use any piece of data.
And it was basically anything,
use first name, last name and how he could pivot to that
and get social security numbers, addresses,
date of birth, et cetera.
Once they start to get that information
because so much of it is readily available,
which is why they keep trying to get it,
they can buy information for roughly $2
and then they can pivot and start to create fraud off of it.
So the short answer is the data itself is desirable
because it can be sold.
And if you think $2 isn't very much, it's not.
But when you sell 2 million of them at $2 a pop
is worth an awful lot of money.
And then again, they're using that to create fraud
to generate additional revenue.
So that's the core reason why healthcare
is such a big concern.
And of course, as an individual,
people care about their privacy.
That would be the other major thrust that comes behind
why it's important to protect that data
and kind of going back into MFA, why MFA?
MFA is what is really protecting most organizations data
for the most part.
And if you don't have it, you're probably not very protected.
Exactly, MFA is really the, there is no gold standard.
There is no one thing, but the thing that's going to help
the most with potentially the least effort is MFA.
And here's why.
So MFA, multi-factor authentication breaks down
into this idea that instead of just entering a password
or a username, you have three different things
that the information could be pulled from.
So we call this something you are,
something you have and something you know.
Now the short version of this is something you know
is generally considered to be your password,
something you are such as your fingerprint
or voice recognition, eye scans, et cetera.
And something you have, whether that's a key card
or most of us probably have some form of authenticator
on our phone now, even our phone itself
if it's text messages, right?
Those three things make up MFA.
And the idea of MFA is using one, two, three,
six different variations on this depending on how paranoid
you get to create something that is secure.
In certain scenarios, I've actually found situations
where people's usernames are also non-standard now.
And so in certain situations where I'm allowed to do this,
my username for a thing I have to sign up for,
especially if it's financial, will be just a random string
of numbers and letters as well.
Makes it even more difficult to get in.
Anyway, so the goal with MFA is to use two of these things,
preferably different from those different sections
of those three, something you are,
something you have and something you know,
and create a sign-in method that allows the person
to do this smoothly with as few steps as possible.
The most common one and the one that most of you
are probably doing or have seen before,
especially if you're banking via your phone
is probably signing in with a password
and then getting a text message for a one-time code or an OTP.
This is what most of us think of,
and I'm sure all of us who work in this industry,
and I'm sure Todd and I have more than enough stories
of people telling us, but it's a pain.
It's just time-consuming.
That can be true, it is an additional step.
But as I mentioned earlier,
there are a lot of things that have come through recently,
and not just so much recently,
but have become available to more people recently
that can really streamline this process
so that it's not exactly what you think it was before.
Yeah, I had things in mind.
I'm not sure I knew exactly where to get it off of here,
specifically, but a wonderful overview.
I thought it was fantastic.
Some of the things that I had in mind was,
Matthew covered it quite quite well when he talks about,
the reason why you have it ultimately
is it's inconvenient or it's perceived to be.
The push was one of the major breakthroughs
in multi-factor authentication,
in my opinion, that really transitioned it
from being difficult and painful to,
oh, it just popped up when I signed in
and said, is this you?
And I hit a button that says, yep, and I'm in.
That was a significant progress.
Over the years, there have been other things
that tend to go on with it too.
So again, that inconvenience piece,
I'm gonna make a correlation to doctors.
Doctors get a paid a lot of money.
Doctors are very busy.
They talk to patients,
they go from one thing to the next,
and they tend to be kind of behind the schedule
almost always right.
And they don't generally,
whatever you can give them to the bedside manner,
but they're trying to go through things as quickly as they can,
and they perceive that log on process as being inconvenient.
This is true in senior living,
when you're trying to dispense medication and so forth,
as well as it's complicated, there's a lot going on.
They're trying to be as efficient as humanly possible,
and this is just slowing them down.
Now, when I got into the push concept,
the reason why I was bringing that up is because,
MFA continues to evolve.
It's starting to get even more frictionless.
There's proximity-based multi-factor.
So if you're in the room and you've got a token
that's based this way, it'll automatically log you in.
Most people in healthcare today,
if you go to the doctor or the clinic,
more often than not, and if you're in the US,
this may not be nationwide yet,
but if you're in the US, more often than not,
you're using something like a key card,
or facial recognition, or proximity,
or something along those lines to,
for all intents and purposes,
they instantly log those individuals in.
So if you're talking about the time it takes for them,
how many minutes of the doctor messing around
with a password, typing it in five times
because it's complex, and then throwing a multi-factor in,
you can quickly add up hours in a day,
thus the reasons why they're unhappy,
and you can start to justify the cost with it.
What do they make?
And I honestly have no idea what the hourly rate
of a doctor is, but I suspect it's high.
And if I'm wasting hours of their time,
the cost is very, very high too.
So when we got back into the technical debt,
the cost of the barriers of entry, et cetera,
once you start removing that friction,
you can still get the tools that you need
at a reasonable cost, if you will, or ROI,
if you need to space it that way,
and then you still remove the friction.
So it is still possible to move forward.
Agreed.
You mentioned a couple there,
and I'll mention a couple that I've seen,
the key cards that slot into workstations.
People still need to enter their password,
but the additional step of putting in your key card
is not very time consuming, because it's already there,
or it's even noticing that you're nearby
rather than having to be put in.
Those things were really common,
and they're becoming more common.
I wanna remind everyone from this
that just a key card is not MFA.
That's just one form of this,
something you have, which is your key card.
So if you are just using that,
if someone could just take that card and use it,
that's not MFA, they need something else
to keep that security level high.
There is a solution that I implemented previously
for a clinic, that in short was a single device
that included a fingerprint scanner.
So the provider would get to their PC,
plug this device into the workstation,
put their fingerprint against the fingerprint reader
on the device, and get into their machine straightaway.
So providing this to the clinic,
the first time I showed the doctors,
you would have thought they were seeing true magic.
Before that, they'd been typing passwords,
they'd been using MFA on their phones,
and there had been maybe some issues with providers out here,
not sending text messages through
as quickly as they'd hoped they would.
So there was some slowdown where maybe the one-time code
they needed via text message wasn't as quick
because they'd hoped it would be.
So being able to just walk in
and really not even think about it too hard
was an absolute time saver.
And the cost of that alone, like Todd said,
the cost of saving the sit down at your desk,
type your password in, make sure everything comes back up,
of just having to do it all in one movement.
Five seconds if you got the USB slot on the right time,
which with USB-C is even quicker now.
Instantly made up, I say instantly,
but within a couple of weeks,
they probably made back the cost of that project
that we implemented for them.
We also talk about fingerprint readers,
I just mentioned there.
There are some which are straight out
of a Mission Impossible movie.
People registering your gate as you walk through rooms
is something that is available now,
whether how widely used it is, is separate.
There are some clinics that may have that implemented
and especially for certain rooms
where you already have to key code to get through it.
Maybe this is a better solution for you
than additional tools.
Maybe you already have a camera system in place
that can implement that as well.
Those are the big ones that I think of.
That solution, that individual card
is still one of the coolest things
that exists on the market in my opinion.
Yeah, I mean, I think you nailed it.
You really do put in a tool set that
will allow you to remove the friction,
be quick and still give them everything they're looking for.
I also mentioned earlier that it is possible
to still multi-factor shared accounts.
So there are tools out there.
I know Duel has something that they can work with
throughout the app and whatnot as well
through the Windows login system.
I'm a big fan of Windows Hello.
I think it was a game changer when you started to mix in
facial recognition with passcodes and whatnot.
So that format MFA was a huge change for me.
For what it's worth at CIT,
we use a minimum of 15 character passwords.
And I know my password inside now,
we keep them around for a year
because we follow that standard.
I still crank that thing in wrong multiple times a day
and it's annoying as can be.
So moving to something that's less friction based
like Windows Hello or Fingerprints or whatever the case,
maybe does make a massive difference.
And it just makes people feel good.
So again, touching on various workforce
where they can easily get overwhelmed and whatnot.
Something simple like that can be a big difference
in their day of just being able to remove
a little bit of that pain in their lives.
I agree.
If the worst part of having to move between your office
and the exam rooms and everything
is having to sign in every time
and more than likely you've heard that complaint.
This is probably not, it's already slow enough
for why would I wanna add additional time to that process?
It doesn't have to be in addition to that process.
It can be a detraction from that time.
It can be as quick as you're willing
to look into letting it be.
We haven't really covered many of the NFC
or the near field communication proximity stuff.
There are a lot of those tools as well.
They do tend to require a little bit more on-site hardware,
but they're becoming more and more common as well.
Facial recognition through camera systems as well,
the ability for them to recognize you as a first step
so that when you do something,
calcium through as well.
I'll also say,
and this is probably a paranoia thing coming through,
but it wouldn't be a podcast with me if I didn't mention it.
You don't have to stop it too.
Why not try one from every section
and then a separate one as well?
Yes, it may increase time a little bit,
but you're also getting that additional security.
Again, going back to those Mission Impossible movies,
people wanna wear masks that look like you.
No one's gonna be doing that on a regular day.
That's not something someone's gonna do just because.
But hey, try and come up with a scenario
where your system and your MFA solution will get around it.
Maybe it'll always stop the things that you can think of.
If streamlining the process is what's important,
still keep that additional security in mind.
Maybe you require just a pin code on the computer
instead of a full password along with MFA and a fingerprint,
along with a hardware token and a fingerprint.
Six digits instead of 15
when you've already got everything else in place,
still a bit of a time saver.
Yeah, another one that would fit really well into that
is conditional access as well.
And I don't know if we've ever talked about conditional access,
but there are certain conditions
that you can create that'll allow you to add security layers
as well as adding while reducing the friction.
So for example, one of the conditions may be
the IP of where you're located
is the building that you would typically work in.
So if I'm working remote, Starbucks, for example,
I'm not meeting that condition I'm denied.
I have to go through additional layers
of authentication to get in.
But that does give you that additional layers
that Matthew was talking about.
I also wanted to kind of swing back
because I know I talked about the friction of,
hey, I own my own phone,
I'm not gonna put your tool on it.
And so typically some of the things that you could do
is there's a lot of different ways.
One, you can just say we're going this direction.
If you don't like it, we'll buy you a phone,
which is incredibly expensive.
I wouldn't do that, but sometimes just having
that conversation is enough for a staff member to go,
I'm not carrying two phones, not a chance.
I'll put the stupid app on my phone.
Other options are, right, so that's free.
So that's layer one, it's just free.
You could easily get there.
And it really is not that convenient.
It doesn't have access to their contacts and camera
and blah, blah, blah, really isn't that bad.
Number two is kind of Matthew was talking about this,
whether you're looking at USB keys or key cards
or something along those lines,
those are relatively inexpensive.
We'll use like the UB keys as an example,
they're about 20 bucks.
You can get them with the near field on them and everything.
And so if you bought two of those for an employee,
you're looking at 40 bucks and that's way less
than trying to buy or pay for a phone.
So you can get there now.
The more friction you're removing,
the more security you're putting in place.
The cost will change, like Matthew said,
there is infrastructure that may need to go in there.
If I'm trying to go super proximity based,
all kinds of other stuff, the cost may change.
But again, if you start to look at,
okay, now that I've reached these higher layers of cost,
how am I paying for it?
That gets into the stuff we talked about before.
How much am I paying for somebody to plug in their password
wrong and mess with their phone and yada, yada.
So that's kind of the last couple of things
that I would throw on there.
I'll be quiet for a little bit.
I'll add something then that's potentially
gonna upset some people.
Instead of coming up from the,
speaking directly to anyone who wants to do this as I have,
even if your organization hasn't implemented them
across the board, you can get these types of devices
yourself.
CIT does have a way for me to implement mine
and use that as part of my process
because they planned for this
and were very nice to let me.
But if you're a physician or if you're a provider
who is worried about this and maybe you're,
if you're using Windows machines, whatever it is,
and you have one already, maybe ask,
maybe you can be that push to kind of implement
that internally.
Maybe you can have some others and discuss with them
why it's better.
A lot of the tools and I'll call out Windows Hello,
like Todd did, allow you to add these UB keys again,
just to call one out that I know does it,
to a system that already exists as a type of MFA
to secure that system better.
So there are ways that you don't have to just accept
what's in place with your organization,
but please speak to your IT team
before trying to take any changes, just speak to them first.
But there is a potential for you to implement something
or assist in creating a safer space for you
within that environment.
Something that is just unique to how you use it,
especially if you're doing things that,
I mean, we all do things that are important to us,
but if you're working in a space
where you're accessing customer data
and you're unsure of the security of the network you're in,
you can try and increase it yourself.
Definitely push for the whole organization,
but you can definitely stop that.
Yeah, and I guess as we're probably getting close
to the end of here, the one thing that I'll say,
and I've said it in many, many of our podcasts,
and I'll say it again, some of the most important
security tools you can do is, number one,
I would start with MFA.
Start with MFA, start with MFA, start with MFA.
If I had a 1A, 1B, I'd throw EDR in there,
but we've done that podcast too.
But it is incredibly important, it is a dramatic increase
in security, start with MFA.
Agreed.
And yes, we're talking healthcare,
but also please do it for all your banking.
Just as a PSA for everyone, just add it to your banking.
Or credit cards for that matter.
Or credit cards, yeah.
Yeah, for sure.
And I liked Todd mentioned earlier in our chat
our how many MFA tools do you have on your phone?
So we'll definitely have to bring that up next time.
I'm trying to count how many I have as we're talking,
like so many for so many different things,
and so many things for personal as well.
So we're talking healthcare, we're talking business,
we're talking banks, but just you and your day to day,
it's probably important to look into what an MFA
can do for you and what you can use it for.
So thank you, thank you, Todd.
Thank you, Matthew, for joining us today.
If you have a question, if you'd like to learn more
about MFA or any other topics you want us to talk about,
reach out to us at info at cit-net.com
or head out to our website, cit-net.com slash podcast.
And we'll be back next week with an all new episode.