The COVID-19 crisis has meant a leap in the move to digital transformation at three major Canadian institutions, say their CISOs.
Talking Thursday during a webinar sponsored by Palo Alto Networks, Adam Evans of the Royal Bank, Suzie Smibert of Vancouver-based Finning International, the world’s largest Caterpillar heavy equipment dealer, and Scott Currie of Toronto’s Hospital for Sick Children, said the pandemic has meant new opportunities in addition to technical challenges.
“For example, for 10 years, we’ve been talking about how important virtual care is, about being able to interact with our patients in a virtual way,” said Currie. “But for a variety of reasons, including clinical care has always been a personal model, it’s really never been adopted.”
Now, he said, “we’re cancelling non-critical ambulatory clinic visits, we’re cancelling non-critical surgeries, we’re encouraging patients to stay out of the hospital because we don’t want to expose them to further risk.
“And by doing that, we have forced ourselves to adopt a significant set of technologies to enable us to have conversations with patients who can’t or shouldn’t come into the hospital. And that has driven significant innovation in the way we think about engaging in a clinical model.”
He admitted some physicians are cautious, worrying about privacy online, “but we’re finding the necessity of doing virtual care has actually enabled us to provide better clinical care in many settings.”
The hospital treats patients from across the province, he noted, and many regularly make a two-hour drive for appointments. Virtual consultations make it easier for them. In forcing SickKids to overcome the attitude, “we’ve always done it that way.” The crisis has provided “a new way of delivering healthcare, and I’m really excited to see how that evolves because of the opportunity there.
“And as a security person, as a CISO, we’ve got to make sure we address and manage the risks that come with it, which are not insubstantial. But in having to rapidly adopt this technology, we’ve had to rapidly adopt a different framework for how we manage risk. And I think thus far we’ve been very successful.”
After the webcast the hospital told IT World Canada that between March 16th to May 15th, SickKids clinicians had over 22,000 virtual visits with patients and families through the Ontario Telemedicine Network (OTN), other video conferencing platforms or over the phone. During this period, there was a daily average of 504 virtual visits. For the same period in 2019, the daily average of virtual visits was six.
New equipment has been deployed to support virtual care, including tablets for clinical use. The hospital’s guest Wifi network is being upgraded to support stronger internet connection for inpatients given the current restrictions on visitors to the hospital as well as for virtual learning during the COVID-19 pandemic.
Full-time remote IT staff
The other theme that came from the webinar was that by forcing more people to work at home the crisis has accelerated the unthinkable: Allowing some cybersecurity staff to work remotely full-time.
Niall Browne, Palo Alto Networks’ senior vice-president and CISO, said he wondered if there would be a performance hit at the company’s internal security operations centre when all staff were sent home. He suspected mean time to respond to an alert, which had been four minutes, would leap to 35 minutes. Instead, it dropped to one minute.
Will the on-premise SOC at the Santa Clara, Calif., headquarters be revived after the crisis? “Absolutely not,” Browne said. He just allowed an engineer to move to Ohio to be close to his parents.
Focus on the outcome of staff, not what they are doing daily, he advised CISOs.
Smibert said management at her firm had an attitude that “if you’re not visible [in the office] you’re not doing any work.” That has changed.
“We have to drive and lead by outcomes and not really care how and when people work,” she said. The question managers have to ask staff is “‘are you committed to producing the outcome you’re committed to doing, are you delivering the results we need as an organization? If you do it in two hours, five hours or 10 does it matter? You’ve done the outcome.”
Think about outcomes, not hours
Evans said it’s crucial leaders are equipped with the right resources and information to lead through remote working, so they can track outcomes.
“We are also equipping them to think about the outcome and remove the mindset that if you’re not in the office, if you’re not logged in to your computer, you’re not producing … The company is never going to go back to having a massive headquarters and massive campuses and rows of cubes. We’re going to have a distributed workforce because we can get talent from everywhere in the world for significantly cheaper. If you can’t lead or manage a team that is not in front of your we won’t want you in our organization. So get on board or you’ll be the one exiting if we have do to a workforce reduction.”
“I was just on a call and our CIO said, ‘We are no rush to get back to the office'” said Evans
Rather than staff being distracted at home, being closer to family, backyards and the ability to take a break by just stepping outside and going for a jog must be seen as advantages — as well as eliminating an hour or more a day of commuting a day.
He finds his team still can focus during one-on-one or group online chats. “The productivity, I think, is going up … “They’re in a better frame of mind, and they have a break before they get back at it. And it’s not so much a work-life balance as figuring out how to blend work into the day. I think that’s the new normal.”
Smibert said remote working will also allow her to broaden her hiring. It had been a company rule that IT staff had to be near to a Finning office. That meant hiring staff in the Maritimes was out. No longer.
“With this new remote, I’m really looking forward to hiring talent in Eastern Canada,” she said. “There’s fantastic cybersecurity talent there, but there’s no office. Now I’m going to go there. In fact, she added, she’ll be able to hire anywhere in the world.
However, she acknowledged there’s still a salary issue to be worked out: Can the company pay a staffer in a developing country where the cost of living is low the same wage as one in Vancouver, where the cost of living is high. Finning will “have to be very smart in managing that, and be transparent to our employees.”
“It will be a steep learning curve for me and other leaders,” she said, “but I’m excited about it.”
On the other hand, she cautioned, if your organization isn’t good at retaining staff the increased ability to hire globally won’t matter. “You have to keep your employees wanting to work for you because they will have a world of opportunity.” The challenge, she added, will be keeping staff engaged by giving them meaningful work.
(This story was updated from the original to include detail from the Hospital for Sick Children)
