James Case, VP/CISO with Baptist Health, says the CISO role is all about understanding and communicating IT risk to operational leaders, and including them in prioritization.

LISTEN HERE USING THE PLAYER BELOW OR SUBSCRIBE THROUGH YOUR FAVORITE PODCASTING SERVICE. 

Bold Statements

“ … my thought would be to ask: is this your interest, what you have an affinity for, what you find yourself reading about on the weekends and at night?”

“I think a key part of my job is to make sure that informed decisions are made based on risk by the right people.”

“ … every organization has risks, cyber risks, whether they’re talking about it or not, or they’re managing it or not, or they’re prioritizing it or not – it’s there.”

“I think humility is a good word, because you’re always going to have weaknesses. So it’s about finding them before the bad guys do.”

“It goes back to ownership and, to me, a big part of my security leadership is making sure that each application, each system, has a business owner and a technical owner, and making sure that they’re not only identified but they are aware of their role and their responsibility … ”

Anthony: James, thanks for joining me.

James: Thank you very much. It’s nice to be here.

Anthony: Tell me a little bit about your organization and your role.

James: We’re a 5-hospital system in northeast Florida, across 4 or 5 counties with many, many doctors’ offices as well, and freestanding EDs. We’re the only locally owned and governed health system in northeast Florida. That’s very nice.

My role as CISO is new. It was a new position created late in 2021which is, I think, a good testament to the investment and the priority that the health system is making in cybersecurity. Because without the role of a CISO, I really feel not enough attention, not enough of the right conversations are happening at the right levels and the right planning and the right identification of pain points. That’s a really key thing that I’ve been thinking about for years.

Anthony: It sort of demonstrates to the organization how seriously leadership takes security by having that role.

James: Yeah.

Anthony: Very good. CISOs are an interesting bunch. They come from all different avenues to arrive where they do. You certainly had an interesting journey. A few highlights here that you can take us through – you studied electrical engineering. Then, it looks like you sort of bounced around between financial services and healthcare. Tell us a little bit about your journey and how you wound up where you are today and what drew you to healthcare information technology.

James: Good question. I mean, I would say the key parts are project management. Starting at project management, infrastructure project management and really learning – I’d say the entire infrastructure, all the wireless networking, storage, server, applications, nursing hands-free things, really rolling all that out and then, several security projects. That’s really what got me into security about 12 years ago.

Then, 12 years ago, we didn’t have a formal security program, I really kind of took over these three programs which at the time if you said security at Baptist Health, 12 years ago, it would be – well, the team in charge of doing access management, right. That’s really all it was back then. It was less focused on cyber, cyber, cyber.

I took over the team and started really consolidating, bringing in the network security and all the different pieces of security and built the program ...