While healthcare organizations often know in general what they need to do in case they’re faced with a ransomware attack, the devil is in the details of how comprehensive and well-rehearsed that incident preparedness plan is for optimal response, said Rick Doten, vice president and health plan CISO at Centene Corp.
Those details include the availability of cyber insurance coverage, incident response teams, ransomware negotiators and other critical aspects of the response that often get overlooked until it’s too late, said Doten, who in his role at Centene often works with the company’s healthcare customers when they are hit with disruptive cyberattacks.
“These are all things that will aid in the response and reduce time for recovery” – if they are well-planned in advance, he said in an interview with Information Security Media Group during the recent HealthSec USA 2025 conference in Boston.
Among the often-neglected aspects of those strategies is a plan for having “a completely out-of-band, off-network way to communicate and make decisions and to get data to each other,” he said.
That’s because in an attack, the adversaries “now control your environment,” he said. “Therefore, they could be reading your emails, watching your chats – and they could be part of the text chain if they inject themselves into it,” he said. “You need to understand that everything that you are doing on the network is being observed – and adversaries can respond to that,” he said.
Without having those types of details in place, “it will certainly extend the recovery if you keep making plans and they keep thwarting them because they can predict what you’re doing before you even get to that,” he said.
In this audio interview with Information Security Media Group at the HealthSec USA 2025 conference in Boston (see audio link below photo), Doten also discussed:
- Critical mistakes to avoid involving back-up data;
- Tips for negotiating with ransomware extortionists;
- Maneuvering the delicate balance between not sharing enough – and sharing too many – details about cyber incidents with the outside world.
Doten is vice president of information security at Centene Corp. and CISO of the company’s North Carolina Medicaid health plan in Charlotte. In his prior role, Doten worked as a virtual CISO supporting international companies. During that time, Doten educated corporate boards, developed and matured security programs and created the curriculum for a cybersecurity master’s degree program for an international university. Doten is on the Cloud Security Alliance CXO Trust Advisory Council, and the boards of his local Charlotte ISC2 and CSA Chapters. He works with several venture capital and go-to-market firms reviewing security technology, and serves on the board of advisors for several startups.