National Physicians Week 2021

by Contributed | Mar 30, 2021 | Technology

This article is contributed. See the original author and article here.

Claire Bonaci 

You’re watching the Microsoft US health and life sciences confessions of health geeks podcast. A show that offers industry insight from the health geeks and data freaks of the US health and life sciences industry team. I’m your host Claire Bonaci on this episode we celebrate national physicians day with a special podcast with Dr.  Clifford Goldsmith our US chief medical officer. Clifford shares his unique journey that led him to become a doctor and discusses the importance of technology for physicians. Hi Clifford and welcome to the podcast

Clifford Goldsmith 

 Thanks nice to be with you

Claire Bonaci 

so you have been at Microsoft for quite some time now around 21 ish years but you were also a practicing physician for a long time before joining Microsoft do you mind giving us a little bit of background about why you became a doctor in the first place

Clifford Goldsmith 

well you know I think I it was a calling you know in a sense that i wanted to help patients it was a it was very much a feeling that I wanted to be able to make a difference and for individual patients and it as I studied medicine and went through medical school I actually became interested in community health as well and growing up in South Africa in under apartheid it became it became very obvious something that is fairly obvious to us today yeah after seeing health inequities in the us those were just as obvious you know during apartheid where you could see that inequity and so I started to get interested in in community health as well and and so that it was it was really around doing the right thing for people and for populations or groups of people

Claire Bonaci 

And so you did mention the apartheid briefly i heard through the grapevine that you kind of had some underground hospitals during that time can you explain a little bit more about that sure

Clifford Goldsmith 

so as you probably will people know Nelson Mandela headed up the African national congress which was the leading opposition to apartheid and for his for the work that he did and many others did they were jailed many people were jailed he was jailed for 27 years on Robin island but even as he was jailed on Robin island he was still able to influence the what was going on and so in the in the country and and through and he did this in this case so we got approached a group of us that were in fifth medic fifth year medical school at the time were involved in the anti apartheid movement but hadn’t done much in terms of health care and we we got approached by someone who had spent five years on Robin island in direct contact with Nelson Mandela and he said so he came to us and he said one of the things that Nelson Mandela feels is necessary is that people in South Africa were being victimized after they had protested and the way this was happening was that the government was shooting rubber bullets shooting real bullets but spraying a dye that pretty much like the mace dyes that we see here today and that guy was on their skin and identified and then they would go they would send policemen or agents to the hospital the local hospitals to put into jail anyone who came in with an injury that had this purple or whatever color die was on at the time and so people were afraid to go to hospitals and he we discovered this from through Nelson Mandela indirectly but then we’ve also shown by an internal wing of the united democratic friend we were taken to churches in black communities and shown what was really happening and I was horrified I have to tell you I vividly remember a 21 year old woman who had an open chest wound and had had an open chest wound with a collapsed lung for seven days and she was so afraid to go to hospital because she knew should be arrested so what we did is we started an underground system that would when somebody was injured and needed care like that they could call a triage center and the triage center then would make sure that they could be taken out of that community to a different community where they would know where there wouldn’t have been oversight over the hospitals so that was essentially what we did and we created a fairly extensive underground health system that led to unfortunately some of the doctors being killed off by the police as well the person who was triage during the coals was killed by the police and so it was it was in that period that I lived there was also a movie that was done and I agreed to be part of that movie so that only if the movie was only released after I’d lived South Africa and so in 1986 the movie was released it’s called witness to a party

Claire Bonaci 

Wow that’s that really is amazing what was kind of the reason for you to stop practicing medicine or was it to just go to the US and leave that behind

Clifford Goldsmith 

yeah so the main reason was to leave the to leave South Africa, I had to leave. There were other reasons I had to leave as well. I tried. Well, let me let me go back one step. So even after all of that, I tried really hard to stay in South Africa, but there was compulsory conscription. And every white male had to spend two years in the Army defending the country, I was able to defer that when I started medical school, as many doctors do, because they wanted doctors in the army. And so I deferred the medical training, I deferred the army. But when I finished medical school, I immediately got conscripted into the army. And unfortunately, someone who had been an opponent of mine in political circles, us, who was a right wing medical student who had led the pro apartheid movement on my campus, knew me, he had now become a colonel and a surgeon in the army. And he used that opportunity to really to, to, to exempt sort of what he thought was a form of punishment on me. And so I got sent into the very front lines of the pro apartheid army, fighting against Southwest African peoples organization, which is the organization in Namibia, in previously southeast Africa. And, and so and that was traumatic, there was incredibly coming, I was I was put on foot with reconnaissance mercenaries. And and it wasn’t something I ever would have wanted to do in my wildest dreams. And so I ended up having to me, it was at that time that I made the decision that I needed to leave. And so I deferred the second year of my army, specialized in order to specialize which they allow me to do, and in the process of specializing, made plans to come to the US. And so that’s why I came here.

Claire Bonaci 

Wow, that is an amazing story. I really, I would have never guessed that, to be honest. And so if you had qualified in the US to continue practicing medicine, is that something you would have wanted to do? It sounds like you would really, you’re in such an arc of practicing medicine and seeing such horrible things? Is that something that you wanted to continue? Or were you really looking into moving to do something more in a technology company,

Clifford Goldsmith 

you know, as horrible as it was in South Africa, and the trauma that I saw, there was some sense of satisfaction, if you want or sense of gratefulness, that I was able to help. And so it was a really good it’s, it’s hard to say this, but it was a really good experience. And I’ve got many sort of vivid memories, not just of the people that we helped through the the underground health system for my emergency health system. But even in the army, I there was some sense of helping people in Angola that were I was placed outside of Southeast Africa. That was also quite rewarding. I think I if I had, I had to finish specializing. And so I was a pulmonologist by then came to the US. And unfortunately, we’re fortunate unfortunately, we live in Massachusetts, and there are only some states that require that I go all the way back and redo my internship as well as my specialization. And I didn’t really become very interested in technology. In fact, while I was doing my residency, could registrar ship in South Africa. I also did, I worked in technology, I got trained in computer programming, I loved computer programming. And it was through computer programming that I got my first job in America, I needed a job right away, and I got a job at Harvard Medical School. And the two hospitals that worked with in their hospital systems, the Beth Israel in the Brigham and Women’s Hospital. And it was through that group, the Center for Clinical computing, that I became really, really interested in technology. If you ask me today, I would have loved to and I would still love to have been able to practice a limited amount as I see many of my informaticists physician colleagues doing, I would like to practice day, a week, two days a week. And, and and worked in technology as as I do, which I love and enjoy, you know, three to four days a week.

Claire Bonaci 

Interesting. Well, that’s great. And Microsoft, we’re very lucky to have someone of your background and your experience here. And I know I’m I feel very lucky to work with you every day. I’m curious. So have you been in contact with the doctors that you had worked with there? or How was the relationship after you went to the USA and left a lot of those people there?

Clifford Goldsmith 

It was a very hard time coming to the US from that perspective. I mean, I loved I always loved what America offered. I love the opportunity offered. I love the innovation and creativity in the US. And so I’ve never ever turned back on that. But when Nelson Mandela was released, I was I left South Africa in 1986. Nelson Mandela was released in 1990. He became the the Prime Minister of South Africa, the President of South Africa actually in 1994. That was a very hard day for me because it happened that exactly on the same day that He was inaugurated, as the new president of South Africa, I was also made a permanent resident. I mean, I received my US citizenship. And and it’s a hard day because the the realization that what we’ve been fighting for came about. And so, you know, I, my friends, many of my friends were able to stay through that summit going back that I know, some, some didn’t. But but some of them have gone back and played a very significant role in the new health system in South Africa. And it’s a great system. It’s a, it’s a system that really views health equity at its core, which is cool.

Claire Bonaci 

That’s, that’s really interesting. I’m glad you kind of saved part of that as well. So given that you have seen both worlds of being a practicing physician, and on the technology side of healthcare, what do you think the role of technology is to a doctor who is so focused on the patient, you know, 100% of the time.

Clifford Goldsmith 

So I actually think that our role as technologists, I feel just as good, making technology that helps other doctors do their job as I did as a doctor in a way. In fact, I consider my approach to informatics as part of the Hippocratic oath. And the Hippocratic oath that we all took in medical school was to do the right thing for patients and for populations. And to today, I mean, I’m heading populations in the early days, it was really focused on the individual patient. And so it was really exciting. And I’ve just written a blog about this for for doctors day. And that it was really exciting to do things like when I read the Institute of Medicine reports in 1999, and 2001, which was the second part of that report was called Crossing the Chasm. It pointed out how technology could improve patient safety. And it was incredibly exciting to read that. And then it was incredibly exciting to spend the next 10 years implementing physician order entry, because we knew that physician or he was going to make prescribing more accurate and patient safer. And that was the joy of it. What I do worry about today, and in the last 10 years is we’ve heard about physician burnout, we’ve heard about physician dissatisfaction. In fact, if you remember there was this quadruple aim that the triple aim, which was came from the Institute of Health Improvement IHI and the triple aim was was about better care, better health at a lower cost. But no one thought about the fact that as you use technology to do that, you are going to create the possibility which unfortunately, sometimes happen of dissatisfaction or burnout among clinicians, physicians and nurses. And so it’s quite disappointing that our technology has led or is bearing the brand, in some cases have this feeling of alienation, that doctor said, and so what would I like to do? I’d like to make sure right now that technology goes gets back to the point where it’s actually empowering, and not alienating doctors and nurses. And and I think that’s, you know, it’s certainly we’ve seen that in many industries. And I think that healthcare is on the cusp, and I’m very excited about what Microsoft’s doing around the Microsoft Cloud for healthcare, because I think that’s our opportunity to really make to put physicians back in a position where they feel productive, they feel empowered, and they feel grateful for how you know, technology’s living them practice what they love doing, which is caring for patients.

Claire Bonaci 

100% agree, I think you really hit the nail on the head around just that physicians and nurses they’re so burdened with having to do everything and whether that’s they have the technology to do that it’s still a burden to end the the curve to learn that to implement it and to of course, be there for the patient 100% as well. So definitely anything that Microsoft and other technology companies can do to help that I think that’s our end goal overall. And so 10 this podcast, I just want to say thank you again, Dr. Goldsmith, for being on the podcast and for sharing your story and Happy National physician day

Clifford Goldsmith 

Thank you. Thank you so much for the opportunity to do this. And thanks for all you do. These podcasts that you’ve done over the last year or more have been wonderful. So thank you.

Claire Bonaci 

Thank you all for watching. Please feel free to leave us questions or comments below. And check back soon for more content from the HLS industry team.

Security baseline for Office 365 ProPlus (v2103, March 2021) – DRAFT

by Contributed | Mar 30, 2021 | Technology

This article is contributed. See the original author and article here.

Microsoft is pleased to announce the draft release of the recommended security configuration baseline settings for Microsoft Office 365 ProPlus, version 2103. We invite you to download the draft baseline package (attached to this post), evaluate the proposed baselines, and provide us your comments and feedback below.

This baseline builds on the previous Office baseline we released mid-2019. The highlights of this baseline include:

• Restrict legacy JScript execution for Office to help protect remote code execution attacks while maintaining user productivity as core services continue to function as usual.


• Expanded macro protection requiring application add-ins to be signed by a trusted publisher. Also, turning off Trust Bar notifications for unsigned application add ins and blocking them to silently disable without notification.


• Block Dynamic Data Exchange (DDE) entirely.


• New policies added for Microsoft Defender Application Guard, protecting users from unsafe documents.

Also, see the information at the end of this post regarding updates to Security Policy Advisor and Office Cloud Policy Services.

The downloadable baseline package includes importable GPOs, a script to apply the GPOs to local policy, a script to import the GPOs into Active Directory Group Policy, updated custom administrative template (SecGuide.ADMX/L) file, all the recommended settings in spreadsheet form and a Policy Analyzer rules file. The recommended settings correspond with the Office 365 ProPlus administrative templates version 5140, released February 26, 2021.

GPOs included in the baseline

Most organizations can implement the baseline’s recommended settings without any problems. However, there are a few settings that will cause operational issues for some organizations. We’ve broken out related groups of such settings into their own GPOs to make it easier for organizations to add or remove these restrictions as a set. The local-policy script (Baseline-LocalInstall.ps1) offers command-line options to control whether these GPOs are installed.

The “MSFT Office 365 ProPlus 2103” GPO set includes “Computer” and “User” GPOs that represent the “core” settings that should be trouble free, and each of these potentially challenging GPOs, each of which is described later:

• “Legacy JScript Block – Computer” disables the legacy JScript execution for websites in the Internet Zone and Restricted Sites Zone.


• “Legacy File Block – User” is a User Configuration GPO that prevents Office applications from opening or saving legacy file formats.


• “Require Macro Signing – User” is a User Configuration GPO that disables unsigned macros in each of the Office applications.


• “DDE Block – User” is a User Configuration GPO that blocks using DDE to search for existing DDE server processes or to start new ones.

Restrict legacy JScript execution for Office

The JScript engine is a legacy component in Internet Explorer which has been replaced by JScript9. Some organizations may have Office applications and workloads relying on this component, therefore it’s important to determine whether legacy JScript is being used to provide business-critical functionality before you enable this setting. Blocking the legacy JScript engine will help protect against remote code execution attacks while maintaining user productivity as core services continue to function as usual. As a security best practice, we recommend you disable legacy JScript execution for websites in Internet Zone and Restricted Sites Zone. We’ve enabled a new custom setting called “Restrict legacy JScript execution for Office” in the baseline and provided it in a separate GPO “MSFT Office 365 ProPlus 2103 – Legacy JScript Block – Computer” to make it easier to deploy. Learn more about Restrict JScript at a Process Level.

Note: It can be a challenge to identify all applications and workloads using the legacy JScript engine, it’s often used by a webpage by setting the script language attribute in HTML to Jscript.Encode or Jscript.Compact, it can also be used by the WebBrowser Control (WebOC). After the policy is applied, Office will not execute legacy JScript for the internet zone or restricted site zone websites. Therefore, applying this Group Policy can impact the functionalities in an Office application or add-ins that require the legacy JScript component and users aren’t notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones.

Important: If you disable or don’t configure this Group Policy setting, legacy JScript runs without any restriction at the application level.

Comprehensive blocking of legacy file formats

In the last Office baseline we published, we blocked legacy file formats in a separate GPO that can be applied as a cohesive unit. There are no changes to the legacy file formats recommended to block.

Blocking DDE entirely

Excel already disabled Dynamic Data Exchange (DDE) as an interprocess communication method, and now Word added a new setting “Dynamic Data Exchange” that we have configured to a disabled state. Because of the new addition from Word the existing GPO has been renamed to “MSFT Office 365 ProPlus 2103 – DDE Block – User”.

Macro signing

The “VBA Macro Notification Settings” policy has been updated for Access, Excel, PowerPoint, Publisher, Visio, and Word with a new option. To further control macros we now recommend that macros also need to be signed by a Trusted Publisher. With this new recommendation macros not digitally signed by a Trusted Publisher will be blocked from running. Learn more at Upgrade signed Office VBA macro projects to V3 signature.

Note: Enabling “Block macros from running in Office files from the Internet” continues to be considered part of the main baseline and should be enforced by all security-conscious organizations.

Application Guard policies

We’re excited to announce the integration of Office with Microsoft Defender Application Guard. When Application Guard is enabled for your tenant, the integration will help prevent untrusted files from accessing trusted resources. New policies for Application Guard are added to the baseline to protect users from unsafe documents including enabling “Prevent users from removing Application Guard protection on files.” and disabling “Turn off protection of unsupported file types in Application Guard for Office.” Learn more about Microsoft Defender Application Guard.

Other changes in the baseline

• New policy: “Control how Office handles form-based sign-in prompts” we recommend enabling and blocking all prompts. This results in no form-based sign-in prompts displayed to the user and the user is shown a message that the sign-in method isn’t allowed. We understand this setting might have some issues, and we value your feedback during the Draft cycle of this baseline posting.


• New policy: We recommend enforcing the default by disabling “Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine” (Note: This policy description is a double negative, the behavior we recommend is the security checks remain ON).


• New policy: We recommend enforcing the default by disabling “Allow VBA to load typelib references by path from untrusted intranet locations”. Learn more at FAQ for VBA solutions affected by April 2020 Office security updates.


• New dependent policy: “Disable Trust Bar Notification for unsigned application add-ins” policy had a dependency that was missed in the previous baseline. To correct, we have added that missing policy, “Require that application add-ins are signed by Trusted Publisher”. This applies to Excel, PowerPoint, Project, Publisher, Visio, and Word.


• Removed from the baseline: “Do not display ‘Publish to GAL’ button”. While this setting has been there for a long time, after further research, we believe this setting is used to ensure good deployment practices and not to mitigate security concerns.

Deploy policies from the cloud, and get tailored recommendations for specific security policies

Deploy user-based policies from the cloud to any Office 365 ProPlus client through the Office cloud policy service. The Office cloud policy service allows administrators to define policies for Office 365 ProPlus and assign these policies to users via Azure Active Directory security groups. Once defined, policies are automatically enforced as users sign in and use Office 365 ProPlus. No need to be domain joined or MDM enrolled, and it works with corporate-owned devices or BYOD. Learn more about Office cloud policy service.

Security Policy Advisor can help give you insights on the security and productivity impact of deploying certain security policies. Security Policy Advisor provides you with tailored recommendations based on how Office is used in your enterprise. For example, in most customer environments, macros are typically used in apps such as Excel and only by specific groups of users. Security Policy Advisor helps you identify groups of users and applications where macros can be disabled with minimal productivity impact, and optionally integrate with Office 365 Advanced Threat Protection to provide you details on who is being attacked. Learn more about Security Policy Advisor.

As always, please let us know your thoughts by commenting on this post.