Episode 18: Rady Children’s Hospital with Special Guest Sahan Fernando

00:00:13:02 - 00:00:23:12
Justin Kohler
Hi. Welcome back to the Know Your Adversary podcast. My name is Justin Kohler and I'm Jared Atkinson. And today we're joined by Sahan Fernando from Rady Children's Hospital. Sahan awesome to see you.

00:00:23:13 - 00:00:26:01
Sahan Fernando
Thanks so much for having me. It's great to see the both of you again.

00:00:26:02 - 00:00:33:20
Justin Kohler
Yeah, likewise. Before we get all into all the stuff we want to talk about today, can you just give us a, like a background of you for the folks listening in?

00:00:33:21 - 00:01:14:20
Sahan Fernando
Absolutely. So the shorter version is I am chief information security officer for Rady Children's Health San Diego. We are one of the largest pediatric health care institutions in the United States. We focus predominantly for Southern California, but provide services all throughout. And I've been here a little under six years. Before that, I had my hands in managed services consulting, worked at a shop that kind of worked heavily in regulated industries, particularly finance and healthcare, and have been really fortunate to have really stepped into information security from the get go.

00:01:15:00 - 00:01:47:22
Sahan Fernando
But I worked while kind of cutting my teeth, especially at a managed service provider, also helping on helpdesk and doing some instant response. And a lot of those other real experience building opportunities that happen at smaller places where you're willing to raise your hands. So outside of that, I do what I can to stay away from computers and my free time, you know, do some coaching for a collegiate rowing team as a volunteer and try and enjoy the outdoors and a whole bunch of other activities.

00:01:48:01 - 00:01:55:19
Justin Kohler
Awesome. And you were you were just with us a couple months ago at SoCon. What was your biggest takeaway from that event?

00:01:55:21 - 00:02:22:05
Sahan Fernando
Number one is that there are some absolutely brilliant people working on the problems around attack path management and trying to expand how we're thinking about the entire concept. Obviously, there are some folks who really trailblazed, you know, that that are on the SpecterOps teams around this whole idea of attack path management and really looking first at Active Directory.

00:02:22:05 - 00:02:44:18
Sahan Fernando
And as we talked about, especially at SoCon, having been in the audience when it was first announced, the first version of BloodHound, I think that really changed the game. And at SoCon progressively, this was not my first one. You continue to see how people are expanding the idea beyond just Active Directory, right? We've we've seen this progression from AD to AD and entra with hybrid identities.

00:02:44:18 - 00:03:17:00
Sahan Fernando
And now we're starting to see expansion through all these other attack surfaces. And how how can we visualize that? How can we see where an attack an attacker would move through an environment? And how do we start to see the systemic risk at an even broader scale than before? And really, I think, does such a great job of tying into over the last six years, six, ten years, whatever it is around everyone trying to move towards that zero trust architecture and have stronger identity.

00:03:17:00 - 00:03:38:19
Sahan Fernando
And we've seen all of the statistics where identity is one of the most common vectors involved in an attack. I think it all just really converges on some of the stuff that we see at so conference, since where they're showing hey, here's how we looked at I think it's okay to say this looking at GitHub and how that ties in.

00:03:38:20 - 00:04:00:14
Sahan Fernando
Right. It's still a lot of identity problems, but it really just makes you makes you feel a little small. I would say at times because there are such big problems to address. But it's also really inspiring because it pushes you to continue improving your game and think about how does this apply to me and how can I? How could I even contribute?

00:04:00:14 - 00:04:10:13
Sahan Fernando
What are some things that the community hasn't thought of yet on this topic? So outside of that, obviously the location always has some great views of the Potomac.

00:04:10:14 - 00:04:27:04
Jared Atkinson
There we go. One of the one of the interesting things, kind of like tying together the original presentation and kind of the recent developments, I think is is really cool. One of the ways that I think about it is one of the, the really cool elements of the original BloodHound was this idea of unrolling these nested group memberships, for instance.

00:04:27:04 - 00:04:51:14
Jared Atkinson
Right. And being able to see you directly have this membership. But because of that, you have all these other memberships kind of upstream. And one of the things that we found when we started messing with OpenGraph and adding all these other platforms into the into the mix is especially kind of like in this modern kind of identity architecture is all these systems are combined in certain ways through like Saml authentication or whether that like sessions in the browser and so on and so forth.

00:04:51:15 - 00:05:10:22
Jared Atkinson
And what we found is that you have kind of like a similar nesting, but like at a level of abstraction that's higher, higher up in the, in the hierarchy. So it's like GitHub as an example. Let's say you have. So from entra into GitHub, usually the GitHub administrator will know that that's that's a thing right. And so they'll they understand that they have a security dependency on entra.

00:05:10:22 - 00:05:32:23
Jared Atkinson
And the, the security of the entra environment is inextricably intertwined with the security of the GitHub environment. But what they don't know necessarily is that that environment is dependent upon password synchronization from Active Directory. And so the security of the Active Directory, like Active Directory, becomes a security dependency of GitHub through this kind of like same nested kind of hierarchy.

00:05:32:23 - 00:05:44:04
Jared Atkinson
And like once you get into real environments and you start looking at all these different platforms that, that kind of like mess, that nested kind of, you know, rats nest of, of relationships becomes very complex to kind of untangle.

00:05:44:10 - 00:06:13:00
Sahan Fernando
Yeah. Every, every time that I talk about this topic, it always is the It's Always Sunny meme to me, where it's just you look a little bit crazy, but it really is. I kind of also think of it like like an ant hill, like there are all these passages that are all connected, and it's so hard to calmly explain it because it can just go from 0 to 100 so, so quickly.

00:06:13:01 - 00:06:38:19
Sahan Fernando
Obviously, the buzzword that I know we want to talk about later with the acceleration of, you know, the use of AI and being able to leverage that in terms of exploring attack paths and changing abilities and all these things. It really has, I think, increased the level of importance on understanding where your risk is and how these things can be pulled together very, very quickly.

00:06:38:19 - 00:07:11:04
Sahan Fernando
And obviously preaching to the choir on this, but before you had to at least figure out here is what's possible, and then maybe you're you're a strong enough tester that you can chain together a few exploits and keep moving from here. You know, we've obviously read some great trade crafts. Folks like yourselves have performed some great tradecraft. And now that barrier has just been democratized, democratized in such a significant way that we still sound a little bit crazy, but it's it's common.

00:07:11:07 - 00:07:40:23
Justin Kohler
Yeah. I mean, we maybe just like parroting your point. We we do some training with the UK AI Safety Institute, like they use our infrastructure to test like these, what they call complex attack chains, which is honestly just an attack path. And that's what we're trying to get people to understand, is AI is just like another way to do the same thing that used to take very skilled adversaries to do, whether that be getting an initial access and like breaching through some server side exploit to then reach into the identity that's backing that.

00:07:40:23 - 00:08:00:15
Justin Kohler
So if I have a web application and I breach through that front door, I get the service principal that's powering it and then I can start executing my attack similarly, or just, you know, really, really, really interesting phishing attacks, you know, through really, really targeted work. But long story short, they're just they're just using the same thing and they can do it really, really quickly.

00:08:00:15 - 00:08:23:08
Justin Kohler
And like to your point, it's democratizing it. It used to take some skilled adversary, you know, maybe some amount of time to execute those, but that's going to drop and keep dropping until it reaches, I mean 0, like it's just going to become free. So like from our perspective, it just puts gas on the same problem that we've been trying to, you know, solve for for a long time.

00:08:23:10 - 00:08:48:13
Sahan Fernando
Yeah. Fully agreed. And there's just not easy answers. I think being in in healthcare particularly that extra sensitivity around anytime you patch the implications of a patch going poorly, I think we will always have dealt with the stereotype around patches you have to treat with kid gloves and everything could go bad, and I've always been a bit skeptical about that.

00:08:48:13 - 00:09:18:23
Sahan Fernando
And fortunately it's rare that I'm proven wrong on that. But that risk does still exist. And I think that unfortunately, when that risk gets realized, do you want to be the one that is at the bedside, connected to a machine that isn't working all of a sudden, or something of that nature? And I was I was recently at a CISO sort of summit, and it was mostly tech CISOs and the like.

00:09:19:03 - 00:09:44:00
Sahan Fernando
I would say I was one of a handful of non-tech CISOs, and there was a lot of conversation around frontier models and how do we handle this? And it was really interesting to me, the dichotomy between where they were at versus where I was at. And I was asked to share a few thoughts, and that was the point I brought up, is, is it's great to talk about, you know, you have to get faster patching and also you sort to manage all the risks from a supply chain standpoint.

00:09:44:00 - 00:10:07:18
Sahan Fernando
So yeah, pin dependencies would also be ready to patch patch them as quickly as possible. And more resiliency, and especially those of us in the provider space, are still trying to make it a non-issue to patch everything every month. I mean, it's so, so difficult. And we're, you know, moderate to large enterprise. We're not even anywhere close to the biggest providers, and it still is a thing for us.

00:10:07:18 - 00:10:29:18
Sahan Fernando
And that to me is a part of the, you know, to tie back in is that's a part of how we design so much of our program. And compensating controls is we have to assume that it will take us some time to patch. And what are the attack paths that we're comfortable saying that we have enough of the right compensating controls in place, that that's that balance is achieved.

00:10:29:20 - 00:10:52:16
Justin Kohler
The strategy that you choose to take starts with understanding what you have, which is kind of like turning the lights on to the problem, which is community edition or enterprise doesn't matter shows you that when turn it on, it's like we we used to make a joke like, you know, when we were talking about Active Directory, just like turning the lights on on a problem that you kind of didn't want to see, but you always knew what was there.

00:10:52:16 - 00:10:53:04
Jared Atkinson
And now then.

00:10:53:04 - 00:10:53:08
Justin Kohler
All the.

00:10:53:08 - 00:11:18:04
Justin Kohler
Roaches scurry. Scurry out. Oh, yeah. And then and then now it's just like it's exacerbated with open graph and the again, the point of, well, can somebody abuse that? I think that question is going to really quickly go away. You know, it's funny because like we've, you know, community people or there is utility to this. But we've always heard feedback about waiting edges.

00:11:18:05 - 00:11:34:23
Justin Kohler
Right. Certain edge edges in the graph may. And when we say waiting edges we're talking about different styles of attack that you can do to take over one identity or another. And it was like, well, we want to wait them because some of them are higher cost than others. And it was like I've always said that, yes, that is true.

00:11:34:23 - 00:11:48:23
Justin Kohler
And it helps for some level of prioritization. But don't think that that can't be executed. And that's always dependent on the opinion of the person that's applying that weight. And I think, again, AI is just going to remove that weight entirely.

00:11:49:04 - 00:12:07:17
Jared Atkinson
That's why I was going to say earlier, you kind of alluded to this, and I was thinking about the weights and the AI point about democratization, but just in general, that's what that's what tools are like. So like scripts are kind of a rudimentary version of a tool, but tools in general take something that is multifaceted. There's several steps, right?

00:12:07:18 - 00:12:22:13
Jared Atkinson
There's all this complexity that you have to know all the details, and you write a script once, and once that script exists, the cost becomes zero. Right now, there may be, like we often talk about, like changing a user's password is more maybe not as tradecraft savvy or like maybe it's something you want to avoid as a bad guy.

00:12:22:13 - 00:12:35:08
Jared Atkinson
If there's some other, you know, nondestructive kind of path that you can take. So there's some merit there. But like, as far as the complexity of one attack primitive over another, I think it kind of like trends towards zero, especially with the, with the AI point that you're, that you're making.

00:12:35:09 - 00:13:00:08
Justin Kohler
I think also on like Sahan, like I, I think you, you have to understand like defense in depth like compensating controls whether that be like like EDR or something on the box. But it's funny, I was talking to another customer recently and they were like, our team has just been injecting things custom and thwarting EDR to again, it's not to say that understanding those compensating controls because you can't fix everything all at once.

00:13:00:08 - 00:13:13:11
Justin Kohler
You have to focus on what you can fix with the limited resources you have, and hopefully you make the best call there. Right? So there's not not to say that prioritization isn't helpful, but that doesn't mean that those still aren't problems that hopefully one day we can solve.

00:13:13:12 - 00:13:41:02
Sahan Fernando
Absolutely. And it's yeah, you can get very philosophical very quickly. But I think from the leadership position, you know, some some people have heard if they're listening to the right forums, right. Being in the the level of accountability at the CISO or similar level, it's we'll never identify all of the risks. But you also have a duty to do risk identification and mitigation and treatment and all those things.

00:13:41:02 - 00:14:08:15
Sahan Fernando
And so there's a really I'm still working it in my own mind, but there's a really interesting nexus, I think, that is coming towards us, where AI makes it really hard to say, I didn't know about this. And then if you're in a position where you're held accountable for something happening because of attack, path was was leveraged, whether it's ultimately ransomware or even just extortion.

00:14:08:15 - 00:14:38:03
Sahan Fernando
Right? It's tiny. Hunters have really been on a tear lately. How defensible is that really. And so it's really just forced a lot of conversations. And those are conversations that were an eventuality. But some people were really happy with the idea of we run a pen test and, you know, we find some things and if you're regulated, we do a gap assessment and there is some comfort in the repeatability of that approach.

00:14:38:03 - 00:14:59:23
Sahan Fernando
And this really throws that out the window. And kind of like you mentioned, not kind of exactly like you mentioned those things that were previously weighted as not as important or not as practical. If you think about the whole idea of AI making everything essentially faster, those things suddenly don't become impractical if they are trying to move that quickly.

00:14:59:23 - 00:15:23:09
Sahan Fernando
So it could be a disruptive thing, like changing user pass users password, but from time to breach to outcome. If we're only talking 30 60 minutes, that's really not that material, right? I mean, you don't if all you want is to go do a smash and grab job and you know, your the artifacts that you're leaving are really not useful for my attribution standpoint.

00:15:23:10 - 00:15:26:23
Sahan Fernando
I mean, that is very likely in my opinion.

00:15:27:01 - 00:15:45:20
Justin Kohler
I think like the the other point on that, like you mentioned, smash and grab, that brings up another point that I've tried to highlight to is it's not about AI augmenting a threat actor whose executing a single path as they work their way through an organization. And, you know, maybe they weren't skilled before and now they can do some really neat attack.

00:15:45:21 - 00:16:06:00
Justin Kohler
It's actually there's another thing where you can just launch thousands of attacks and just overwhelm, right? It's like a dose of attacks. And can you like, could you or all of them going to light up, you know, alarms. Sure. But can the team respond? And before I can reach my objective, you know, who cares if they can see me?

00:16:06:00 - 00:16:29:14
Jared Atkinson
Yeah. Detection is not response or remediation. Right. And so that's like one of the I come from. I mean, both of you know this I think but I come from a detection engineering background. And a lot of times when we think about the problem, we think, how can I know that this happens, that this happened when it does in fact happen, but you don't necessarily always think through the okay, now that I know what happened, how do I make sure that I solve this problem?

00:16:29:14 - 00:16:46:10
Jared Atkinson
And once I know how to solve the problem, how do I make sure that I do that in a rapid fashion such that it actually has the impact that I hope that it does? And yeah, like, you know, detection engineers don't like to say this, I know that. I do like to say this like prevention is an ounce of prevention is worth a ton of detection, I think.

00:16:46:11 - 00:16:59:12
Jared Atkinson
Right. And so, you know, prevention isn't always the practical opportunity that you have at your disposal. But like where you can you should. Right. Because that just makes detection easier. Right? It reduces the variability that you have to account for when you're dealing with detection.

00:16:59:13 - 00:17:22:21
Justin Kohler
You mentioned like a like doing quarterly tests or that kind of stuff. I'm like partly that into like a similar question for those like you're a technical CISO like not coming from a technical organization, but like an actual technical individual in the CISO role, where there's like various ways that a CISO various backgrounds of CISOs very kind.

00:17:22:21 - 00:17:26:15
Sahan Fernando
And I'm going to quote you on that.

00:17:26:17 - 00:17:51:22
Justin Kohler
Okay. So take my grain, take my word for it. If you knew of the problem of attack paths. But what if you if you were talking to another CISO who didn't understand that, what would you say to like try to get their head around it or draw them into like trying to understand that this problem exists? Like, I'm sure I'm curious if that's ever come up and like, what do you tell people?

00:17:52:00 - 00:18:21:08
Sahan Fernando
It absolutely has come up. I can think of a few instances where I've actually sat down and said, you know, have you thought about this? This is something we're actively working on and walked through our tenants in BHE just to illustrate the points, points a bit. So the the conversation, I think it'll always depend on who you're talking to and their level of understanding of Active Directory and those things to begin with.

00:18:21:08 - 00:19:07:08
Sahan Fernando
Because there are, as you're maybe implying, but there are some more non-technical CISOs. And that of course does not make them a bad CISO. So it's just different, different backgrounds. And so I really try and illustrate the point though around we all know that identity is one of the main issues. And until AI was the main issue, I think in the last year saw that you were starting to see a comeback on vulnerabilities, which was crazy to read, but the ability to just move laterally and Provost was it's a bit abstract, I think, to folks, and it really makes it concrete and very visual, and it's a very powerful image to share with someone.

00:19:07:08 - 00:19:36:06
Sahan Fernando
If you can show, you know, here's if you use pathfinding and show that here's random person or here is a very specific person and here's target, whether it's Da or enterprise admins or some specific group that could be Germane to the conversation at hand. If you're talking about someone internally and show that there is a fairly short amount of, you know, or small amount of nodes and edges involved.

00:19:36:07 - 00:20:13:18
Sahan Fernando
I think that that helps to drive home the message of this is something worth remediating. And then similarly, if you are tasked with risk remediation, a visual around nested groups or excessive privileges, I mean, that again, really does show what's actually what's actually occurring. And so I know when I joined AD was had some room for improvement. And we pretty commonly would show, hey, here's regular accounts in the amount of administrative access that they have.

00:20:13:19 - 00:20:40:08
Sahan Fernando
That's not in alignment with our policy. Right? I mean things just happen. We have 20, you know, literally 20 year old domain. And, you know, we've got some cleanup to do because if we can see it, so can they. And that conversation just becomes real. The momentum starts to build from there, in my experience, because you're showing what can happen and you can reference attacks where it's happened.

00:20:40:08 - 00:21:10:21
Sahan Fernando
And bringing it back to your original question around when you're talking with other security leadership CISO otherwise, I think it really just helps them understand risk that they didn't fully grasp or weren't truly aware of. When you're doing the education thing, and if it's someone who's working on it already, then it's a great opportunity to talk about some of those mitigation strategies, because people will have the same findings and very different problems in how to remediate those findings.

00:21:11:00 - 00:21:17:09
Sahan Fernando
And so that also is a lot of great conversation. I would say.

00:21:17:11 - 00:21:39:02
Justin Kohler
Switching gears entirely back to back at or on. SoCon you were talking about mergers and acquisitions. It was part of your presentation. That's a hard thing to do. I'm curious, like from your perspective, what is what is kind of the first thing you went through when you know, this was going to happen? And so where did your brain go?

00:21:39:02 - 00:21:50:05
Justin Kohler
And then kind of how did you make that happen? If that's a that's a generic enough question, but it's a hard problem and it's a very risky time for an organization.

00:21:50:07 - 00:22:29:12
Sahan Fernando
It absolutely is. And especially we always call M&A. But usually it's acquisition is my observation. There's very few straight mergers. And that's what we have gone through is an actual merger. Obviously there's a lot of specifics in what that merger means. But, you know, two fairly similarly sized organizations, the exact same mission and bringing them together. So when it was when we started to go through the due diligence process, we were very fortunate that IT and security were involved fairly early on.

00:22:29:12 - 00:23:01:22
Sahan Fernando
It was obviously driven by legal and other other parties first, but there was an understanding that the organizations, before they closed on the merger, that one of the things was to do due diligence, which involved also technology risk. And so I didn't get to the specifics of, hey, we should do this and this per se, but we wanted to at least have a risk assessment and understand because we want to understand what are we getting into with each other.

00:23:01:22 - 00:23:34:15
Sahan Fernando
And then also on the other side of it. What do we need to start doing to bring things together? Because the other side is people want to start integrating as quickly as possible and have essentially become one as quickly as as feasible, and technology is a massive part of that. And that's certainly that's certainly been my experience, is there's a lot of a lot of healthy demand for technology to help the business move forward as it goes through those activities.

00:23:34:15 - 00:23:58:00
Sahan Fernando
And if your organization's the right has the right approach, they want to also ensure that, as you pointed out, those are risky, turbulent times. People are moving fast. They're being asked to do quite a lot. How do you manage risks that weren't previously a thing? Right? I mean, you're making a lot of changes. Are you introducing risk unnecessarily or unknowingly?

00:23:58:01 - 00:24:30:09
Sahan Fernando
I think that constant monitoring is incredibly important, and identity is a huge part of that, because people want to have a common collaboration platform, common identity, common email, all those things. And as you're trying to migrate applications and people, it it's a lot. And organizations will always have different approaches on how they've handled very tactical items, like the level of segmentation for privileges or for instance, just the amount of cleanup in AD, right?

00:24:30:10 - 00:25:00:07
Sahan Fernando
Those things will always be varying in levels of maturity, and it really adds a level of complexity that I was anticipating. Thankfully, I knew that there would be some, but it's it's a good problem to have that the organization wants to understand risks as it undertakes different initiatives, especially those related to technology. And again, to my earlier comments around the sensitivity of healthcare.

00:25:00:09 - 00:25:24:18
Sahan Fernando
We don't want to ever be down for those most people aren't aware, I know you two are because we're we're close enough. But for the listeners, pediatrics is a very specialized area of medicine. It is a specialty just like gastro or cardio or anything like that. So your regular adult facilities aren't as well positioned to take care of kids.

00:25:24:18 - 00:25:50:14
Sahan Fernando
And that's everything from, excuse me, the beds to the providers. Do the anesthesiologists know how to to take care of those kids? Are they trained in doing so? It's completely different giving Anesthesia two to a child versus an adult. There's all these things that add up, and so you tend to be almost like a safety net, because if we go down in San Diego, Orange County is the next closest level one trauma center.

00:25:50:19 - 00:26:15:05
Sahan Fernando
I mean, those aren't exactly the closest, even with an airlift. And so if you need level one trauma care, that is the difference in an outcome for a patient. And so we always try and tie it back to mission first and the outcome there. But these all these attack paths and anything that takes away from our resiliency, those are all important and very material in my mind.

00:26:15:06 - 00:26:19:02
Sahan Fernando
So I hope I answered your question. I feel like borrowed a bit.

00:26:19:04 - 00:26:46:00
Justin Kohler
And actually two, two, two fun, two random points. So didn't know this before we knew Sahan, but come to find out. I mean this has real like actual personal connection. We have folks here at the SpecterOps Side who had folks in the NICU at Rady's. And then the other thing that makes this like you had shared this previously, it's the there was a scientific study on the effect of ransomware and infant mortality.

00:26:46:00 - 00:27:08:14
Justin Kohler
And it just exactly like it highlights your point. If Rady's goes down, there is not just like business outcomes that are threatened. It's lives like. And I actually share that as an inspiration to our team. Right. Like we're doing more than you can possibly understand. And I would say that that just applies to anybody in security, right. Like that's not just saying like BloodHound and SpecterOps is doing that.

00:27:08:14 - 00:27:21:18
Justin Kohler
But but there is a big thing here. This isn't just about like, you know, making people's connections work in a safe way. There's like a, there's like a big thing on the business side that's being enabled. Jared. It look like you're saying.

00:27:21:21 - 00:27:38:07
Jared Atkinson
I have a random question that we did not prepare for. So I'm kind of putting you on the spot, but you made me think about this. So a lot of listeners and I'm sure you in particular are familiar with this idea of privilege zones that we're kind of like instituting and coming up with. And the idea is, is that we want to isolate tier zero kind of as a starting point.

00:27:38:07 - 00:27:52:19
Jared Atkinson
But then there's there are certain systems that are more important than others throughout your enterprise, and you don't necessarily have to become a domain admin to affect those. And so we want to start to segment them. And this is based on what was just talked about. This is going to be a really weird comparison. But I live in Las Vegas.

00:27:52:19 - 00:28:15:16
Jared Atkinson
So the way that I've conceptual sized it is like there are systems that you don't even conceptualize our computers that are on Active Directory. So like in Vegas casinos, slot machines are often Active Directory clients. Right. And so like, you know, the big the big casinos were ransomware in the past few years. And like that takes down gaming operations because like the slot machine doesn't work anymore.

00:28:15:16 - 00:28:39:22
Jared Atkinson
For instance, maybe even not even maybe definitely more important are these systems that are like life saving and, you know, related to related to the actual like, work that you're doing in the hospital. Have you thought about like how you might conceptualize those, like a zone around something like those, those systems that are being used actively with patients and thought about looking at like what the attack pass directly to, those might look like?

00:28:40:00 - 00:29:13:08
Sahan Fernando
Yeah, I'm going to be honest, I hadn't gotten that specific. And now I have some homework, clearly, because we've had a fairly, I would say not super mature. I mean, yeah, we're all doing the best we can. And we've had segmentation of privilege, and the goal was to keep moving towards the multiple layers. And that's where we're at as we're actively implementing several, several tiers, not just the two tier system, which progressive maturity is, is important.

00:29:13:08 - 00:29:35:15
Sahan Fernando
And there's a change management element and all those things. And I honestly, really am curious now where we will land on that exact question because we we do have there are medical devices or ancillary devices that are domain joined in some capacity or rely on domain join systems to work because, you know, network access control, things like that.

00:29:35:16 - 00:29:37:23
Sahan Fernando
And then the dependencies are everywhere. And so.

00:29:37:23 - 00:29:38:06
Jared Atkinson
Sure.

00:29:38:07 - 00:29:52:14
Sahan Fernando
Sure, we just take a straight domain joined modality. Where does that fall on the tearing. Are we saying it's tier zero or not. Because that also kicks up the level of scrutiny that we put in on the controls for access and such.

00:29:52:14 - 00:30:04:03
Justin Kohler
So you wouldn't want to include it in tier zero. We do have customers that are putting like their epic systems, for example, in a different zone below that kind of control plane. You know, the control plane is the control plane. There's no kind of, you know, it's.

00:30:04:03 - 00:30:09:00
Jared Atkinson
More of. An IP specific kind of thing as opposed to like a business operations type of thing.

00:30:09:00 - 00:30:30:20
Justin Kohler
Yeah, but the business operations, like like obviously anybody that manages the control plane of an identity provider will have access to anything. It's just kind of like the default. But you know, that next layer down like the business critical things like again, like we have folks today isolating those systems with like different zones right below the control plane, which is pretty neat.

00:30:30:22 - 00:30:57:16
Sahan Fernando
Yeah. And definitely seems like the right approach because it's it's a funny thing where it is so broad of a term and the folks who support the modalities are generally in it. But aren't your, your normal systems administrators. Right. And so there's a high level of privilege, and you have to really ensure that they're educated on the responsibilities of those privileges.

00:30:57:16 - 00:31:20:00
Sahan Fernando
And, you know, it's really it's a really good example of where you can spiral quickly in terms of are you are you doing are we doing enough to set those folks up for success and set our, our patients up for success? Because right now it feels like we could do more maybe, you know, and I was recently on another an interview.

00:31:20:00 - 00:31:49:06
Sahan Fernando
And whenever I get asked the question, you know, what keeps you up at night? I'd say, well, lots of stuff. And I don't sleep well anyways. But the biggest fear I always have, well, not always, but at least in the last few years, is, yeah, ransomware is really bad. But the idea of those modalities being compromised and used from a hostage standpoint, you know, whether it's a pump at the bedside or, you know, they they take over all the MRI machines and we can't do anything from radiology standpoint.

00:31:49:06 - 00:31:59:19
Sahan Fernando
That is a really big deal for the clinicians and all these devices these days. They are networked in some some capacity. So for sure.

00:31:59:21 - 00:32:17:17
Jared Atkinson
And this is this is you know, like obviously there's tons of value in reducing the exposure of the control plane because that that's a proxy. Right? It's a proxy for if you one of you mentioned this, I've now have forgotten who. But once you get control of the control plane you have control of everything else. And so it doesn't it doesn't really matter.

00:32:17:17 - 00:32:45:15
Jared Atkinson
But then I think the real value comes from this idea of being able to isolate business like business operations and like in this case, medical operations. But the one of the problems we face is that's idiosyncratic, right? So like every business is going to have different configurations. And so how do we how do we try to provide the ability to guide people through that process to, to identify, you know, like I didn't know I didn't know that MRI machine was was domain connected, for instance, like that.

00:32:45:17 - 00:33:00:17
Jared Atkinson
You see them I don't know that you see them every day, but you see them occasionally throughout your life and then you and you never even think twice about it. But like, that's something that somebody that works with that specialty that you're talking about would know. And so it's like, we just need to get in contact with that person and start to like, work through, work through that, that type of thing.

00:33:00:17 - 00:33:07:20
Jared Atkinson
But that's unique at like every company in the world. And so how do we try to scale that? As always, an interesting problem that we're trying to solve.

00:33:08:01 - 00:33:34:08
Sahan Fernando
But you're taking the right parallels, which is great. I mean, to your point, everyone's different, but manufacturing has OT that is mission critical. Whatever it is, it's as you as one of you put it before, right, the business operations, whatever that means, having a privilege zone around that and, and trying to do some threat modeling there is really quite useful because it all just goes back to are we understanding the risks and communicating those and prioritizing our limited resources accordingly?

00:33:34:12 - 00:33:36:19
Justin Kohler
Are we going to see you at Black Hat Def con?

00:33:36:21 - 00:33:47:09
Sahan Fernando
I will be in Las Vegas in two months, gosh monthly and hopefully have some more exciting news to share on that topic soon. Awesome!

00:33:47:10 - 00:34:00:15
Jared Atkinson
For what it's worth, we lost vegans. We we see that part of the city to to you people when you show up. So that so I think there's like there's like a citywide mandate not to not to go down there unless you have to absolutely have to.

00:34:00:17 - 00:34:11:06
Sahan Fernando
Which is fair. I've learned my lesson. I don't stay on the strip anymore. I suddenly, you know, the world is just a little bit less tiring that week by staying half a mile off the.

00:34:11:07 - 00:34:14:03
Jared Atkinson
There you go. Yep. It doesn't take much. It doesn't take much.

00:34:14:04 - 00:34:28:17
Justin Kohler
Well, thank you for joining today, Sahan. And maybe if you if anybody's listening to see us at Black Hat and Def Con, maybe you'll actually see someone as well. But again, thank you for spending the time with us today. Awesome conversation and hope you have a great rest of your day.

00:34:28:19 - 00:34:31:14
Sahan Fernando
Thank you to be invited. Thanks so much for the conversation, guys.