For hospitals, a cyberattack is more than an IT disruption. Patients still need treatment, ambulances cannot be turned away, and critical procedures cannot simply be postponed. Cyber resilience must ultimately support uninterrupted clinical care.
In this ISMG interview at the HealthSec NYC Summit, Dr. Guru Gurushankar, senior vice president and general manager of healthcare and life sciences at ColorTokens, speaks with Marianne Kolbasuk McGee, executive editor at ISMG, about why healthcare organizations must shift from reactive cyber defense to proactive resilience.
Guru explains the concept of a minimum viable digital enterprise, where hospitals identify and isolate the critical functions that must continue operating during an attack. These include electronic medical records, patient intake, and discharge management.
In this interview, Guru discusses:
- Why AI-driven attacks demand threat containment at machine speed
- How microsegmentation limits lateral movement across hospital networks
- Why cybersecurity investments must prioritize uninterrupted clinical care
With 25 years of leadership experience across global healthcare organizations, Guru works with hospitals, clinical research organizations, pharmaceutical companies, and medical device companies to help secure critical patient data.
Watch the interview to understand how healthcare organizations can strengthen cyber resilience and keep essential clinical services running during an attack.
Marianne K. McGee: I’m Marianne Kolbasuk McGee, executive editor at ISMG, and I’m here today speaking with Dr. Guru Gurushankar. He is senior vice president and general manager of healthcare and life sciences at ColorTokens. Welcome, Guru.
Guru Gurushankar: Thanks for having me, Marianne.
Marianne K. McGee: Thank you. So you’re here at the HealthSec New York City Summit speaking about why it’s so critical for healthcare sector organizations to shift from cyber defense to cyber resilience.
Guru Gurushankar: Yeah.
Marianne K. McGee: And, as we know, we’ve seen a lot of ransomware attacks and cyberattacks on critical third parties in the healthcare sector that have caused massive disruptions. What is it that the healthcare sector really needs to focus on when it comes to shifting over into a more resilience-minded security structure?
Guru Gurushankar: Yeah. Thanks for having me. Moving from cyber defense to cyber resilience is important for anybody in any sector. But I would argue that it’s even more important for the healthcare sector.
Very simple. I can be in any other sector. I don’t want to say I can afford to have downtime, but I can have downtime, and then I can recover the material losses. In healthcare, I cannot turn away patients during the downtime. I cannot turn away ambulances. I cannot skip or reschedule elective surgeries and even emergent surgeries. I cannot push them back, which in the healthcare world is called continuous care, or uninterrupted care.
So cyber resilience actually plays a role in delivering uninterrupted clinical care. The concept of delivering uninterrupted clinical care is extremely important, and cyber resilience plays a role in that. So that’s part one.
Part two of it is, how do we get there? Until recently, cyber defense was our main area of focus, and probably that was enough.
And even there, I would not say that every one of us had gotten to that point. Because if all of us had gotten cyber defense correctly, we would not have had so many incidents. The fact that incidents kept happening means that our defense is still weak. The vector that is adding to cyber resiliency is all around AI and how it has amplified it.
Marianne K. McGee: Mm-hmm.
Guru Gurushankar: The breakout time, the time to contain, the time for our SOC operations to monitor something, react, and contain it, used to be a matter of hours, maybe minutes. Breakout time in minutes has been reported. Now, if you look around, with AI coming in, everybody’s talking about zero as the breakout time.
So when your threat vector is acting at machine speed, how do you contain it at machine speed? When you start containing at machine speed, it’s no longer reactive. You have to be proactive. When you do that, you automatically move from defense to resilience, cyber resiliency.
So the external forces are forcing us to go there, and we have to go there, back to the original point, to deliver uninterrupted clinical care for the patients.
Marianne K. McGee: So with that said, what does operational cyber resilience look like in practice for healthcare institutions, especially when there’s unacceptable downtime for clinicians? What’s involved with this?
Guru Gurushankar: Yeah. The way we think about it is, for uninterrupted clinical care, what are the necessary tools that deliver uninterrupted clinical care?
All of that gets into, in some ways, in other industries, what we call the minimum viable enterprise. Think of it as an enterprise that is facing an attack, and in the face of the attack, it continues to operate and deliver certain business outcomes.
A hospital has to think along the same lines. In the face of an attack, what are the three, five, 10 functions I need to continuously operate and deliver uninterrupted clinical care?
So to answer your question, the framework has to start from that thinking. And then I assemble these eight, 10 functions, and I isolate them. How do I bring resiliency into that with the thinking that this is the minimum viable business enterprise?
In the case of the hospital, this is the minimum viable digital enterprise that keeps the hospital running even in the face of an attack.
So that’s the framework. What goes into it? It can be electronic medical records. It can be your discharge management. It can be your patient intake. It can be anything that the business process of the hospital decides goes inside that, and that becomes your… I don’t want to use the word “crown jewel.”
That becomes your critical processes that make it survive even an attack.
Marianne K. McGee: So what’s part of the technical framework to make this all happen? What do you have to do, from a technical perspective, to contain this and keep it from causing all sorts of havoc?
Guru Gurushankar: Two or three things. First and foremost, ask yourself the question. Almost everybody has been having a whole host of tools. Tens, if not hundreds, of millions of dollars have been spent on a whole host of tools. They are all good, and the industry continues to have hacker attacks.
That means there is still a missing piece of the puzzle in our toolkit. The way we like to think of that is the missing piece of the puzzle is still microsegmentation.
How do you isolate workloads to make sure that an unauthorized entry stays contained inside that and doesn’t traverse around and cause havoc?
So if you really look at the macro data, the penetration, the market adoption on that is still around a few percentage points, and that is number one.
Microsegmentation has to be core essential because that is the proactive way in which you prevent a simple breach incident from becoming a large-scale catastrophic incident.
That’s number one.
Number two, the technical framework is, in the past, it’s been difficult to implement microsegmentation. But with new technologies, like what we have introduced, we can integrate with your existing EDR tools and use an innovative progressive segmentation approach.
There are multiple new, innovative tools that we have introduced that ensure it’s not a three-year, four-year project, but something where the results can be seen within the same quarter.
So that’s very important. It’s the framework, the right assembly of tools, and most importantly, the leadership framing it as a leadership imperative.
It’s not a question of how risky my enterprise is, but it almost elevates to become a leadership, C-level conversation or a board-level conversation.
Can our hospital survive an attack and continue? And if, God forbid, a breach happens tomorrow, will we turn ambulances away or not?
That has to be a board-level question, and then everything follows from that. And the technologies and tools that I just talked about, they fit into that to deliver that higher-level business objective.
Marianne K. McGee: Those are important topics.
Guru Gurushankar: That’s very important. And once you do that, it’s not just about tools and technologies. Budgeting, mindshare, leadership mindshare, everything comes in.
And then once you’re able to deliver that uninterrupted clinical care, you are delivering a resilient hospital, a digitally resilient hospital.
Marianne K. McGee: Thank you, Guru. I’ve been speaking to Dr. Guru Gurushankar of ColorTokens. I’m Marianne Kolbasuk McGee of ISMG. Thanks for joining us.
