RadiantLogic-Cisco-Dashboard-Reporting-Hero

What It Actually Takes: Identity Management & Defense from a Healthcare Practitioner

Speakers:

Paul Dant, Sr. Solutions Consultant, Radiant Logic
Kristin Hoppe, Director, Identity Access Management, Baylor Scott & White

Knowing how attackers operate is half the battle. Kristin Hoppe joins Paul Dant for a practitioner’s view of identity management and defense inside a major health system: the real constraints, the tradeoffs, and the decisions that hold up under clinical pressure.

Watch Part 1 - Healthcare is Under Attack: Make Identity the Perimeter

Read the transcript

Brooke Vixamar:
Welcome, everyone. My name is Brooke Vixamar. I’m the senior director of product marketing here at Radiant Logic, and I am so excited that we have part two of this two-part health care webinar series.

In part one, we shared some sobering realities facing health care organizations. We talked about health care being a prime target, as I’m sure everyone on this call already knows. Ninety three percent of health care organizations have had at least one breach in the last year, And the average ransom payment we’ve seen in health care is 1,150,000, which is the highest of any industry. So it’s certainly a big pressing concern, and so that’s why we wanted to bring this topic to the audience today.

In part one, Paul Dant shared some real life examples of his background in red teaming to share how the attackers are not just breaking down walls. They’re actually using identity to walk in the front door.

Really sobering reality, lots of interesting stories. If you missed part one, by all means, go back and listen to Paul’s stories. Today, I’m particularly excited. We’re pivoting, and we brought on Kristin Hoppe. She’s going to be sharing some real life practitioners perspective from her experience as the head of identity at Baylor Scott and White. Baylor Scott and White is the largest not for profit healthcare system in Texas and one of the largest in The United States.

Today, Baylor Scott and White includes 48 hospitals, more than 1,000 patient care sites, more than 9,600 active physicians, and over 48,000 employees in the Scott and White health plan. So certainly a large number of identities that she’s managing. And so we’re really excited to have her share her insights and expertise to all of us today. Paul, Kristin, thank you both so much for being here.

Paul Dant:
My pleasure. Thanks for having me.

Kristin Hoppe:
No, absolutely. Thank you for having me.

Brooke Vixamar:
I’m going to turn off our screen because this is really going to be a conversation today. We’re really excited to really just dig in and have an open conversation. As we kick things off, Paul, I thought maybe we could start with you and you could kind of revisit a little bit from part one on how was it that you got in? And then we’ll we’ll pivot back to Kristin and say, hey. This is your building. How would you think about closing it? So let’s start with you on just kind of giving us a little bit of a flavor of what we talked about in part one.

Paul Dant:
Sure, sure. Thanks, Brooke. So one of the key things that we talked about when it comes to identity is that good intentions often lead to bad outcomes. And what we really mean by that is traditionally as we’ve built identity programs, we’ve managed identity, it’s been built more for success and operational efficiency, not so much around security and understanding risks. We’re bringing that sort of mentality to identity in much more recent times.

And I think really what we talked about from a what’s missing perspective is the overall idea that identity data is strewn all throughout the enterprise. And when we talk about healthcare specifically, we have so many different types of attributes related to identity that grant us access to so many different systems and applications. It’s incredibly challenging to bring all of that together into a unified view. And that’s really where one of the things that we left off in our last webinar was part one was about how does the attacker ultimately get in?

Why is healthcare seemingly so vulnerable to these attacks as the media reports would tell us and what can we do about it? So, as you mentioned, I’ve spent quite a bit of time as a, we’ll say an offensive security researcher, forty years in fact, and hospitals and other healthcare facilities have been part of some of the targets that I’ve led coordinated attacks around from a research perspective. So one of the things that I’ll kind of just throw out there that I think is very unique and specific to healthcare is in particular within facilities, wow, excuse me, the susceptibility of someone gaining initial access onto a network and then finding their way through lateral movement to all of the really important things.

And of course, plays a critical role in controlling what an attacker can do once an identity is compromised.

And I think that’s really where we break into part two here is understanding from a practitioner and defender perspective, what does that look like? So I’ll hand it back over to you, Brooke.

Brooke Vixamar:
Absolutely, great. Thank you for setting the stage on that.

Kristin, we’ll put you in the hot seat for a minute. I want to start with a little bit of the elephant in the room. I feel like health care is such a highly regulated industry.

I thought, as someone leading identity for such a highly regulated industry, where do you start? How do you decide your priorities and programs and what you put in place? How do you kind of approach it from that highly regulated industry standpoint?

Kristin Hoppe:
Yeah, absolutely. So starting from a regulated identity perspective, when you’re in an industry that requires that, you really have to understand the regulations themselves. So you actually should be reading them, understanding them, forming relationships with your privacy and your compliance and your legal entities within your organization.

Baylor Scott and White’s unique. We have a couple of different umbrellas that are on the same infrastructure. We have a health plan. We have We have a digital health office. We have a developer area.

We have joint ventures. So we have a number of different arms within our organization, and each of those has competing priorities. And each have competing regulations.

Some must be SOC compliant, others do not at that point. So you really have to regulate, or sorry, you have to build your program to defend the regulations that you’re responsible for, and not at the sake of end user function and ease of use either. I mean, as Paul already talked about in his intro, that’s a key component. So you need to make sure that your experience is as frictionless for your end user across any different persona, across any different regulation or branch that they’re working in within your organization, but your security is always in the background, and it’s always layered.

Brooke Vixamar:
That, across all of these personas, across all of these different departments, I think that kind of opens up the conversation around I think you’ve called them the unicorns in the past, the multi persona challenge that is really big in health care. You have someone who is legitimately three or four or five different people, they’re a clinician, a surgeon, a professor, a researcher. How do you manage that complexity?

Kristin Hoppe:
That is, it’s a complexity that never goes away. So even if you’ve developed a program, and we we have actually developed a very successful program at Baylor Scott and White, it still never goes away. You’re always gonna have these people. You’re always gonna have a person that is a student, but also as an employee, but also as a volunteer.

And then they’re going to change one of those personas, keep the other two throughout the duration of their time. They’re going to shift from employee to a contractor or contractor, better way to say that, to a contractor and then back again.

One of the best ways to do that is truly having a unified identity, but also having a global unique identifier. If you’ve assigned an identity so that Brooke Vixamer is who she is across all platforms, across any persona that she enters, then you’ve succeeded because you’re eliminating duplicate accounts. You’re eliminating the need for merging. You understand the access layers that that persona has depending on the role that they’re in.

That’s a big lift. It’s taken over two years for me to get that program up and running, and it is now finally running and working really well.

Brooke Vixamar:
I assume that also would be helpful for things like the contractors, the traveling nurses, the Yes. All of those pieces. Yes. Just having something that’s unique to them regardless of how they’re coming in and out of the system.

Kristin Hoppe:
100%.

Brooke Vixamar:
One of the particular challenges we see facing health care also is there’s a lot of legacy technology, and there’s a lot of operational technology that you can’t just ignore it. It’s important, but it’s very hard to manage.

So these are devices that are a little outdated and you can’t really patch them.

So if you can’t fix the device, what do you do instead?

Kristin Hoppe:
Yeah, absolutely. I think that’s to me.

From a practitioner side, sometimes that’s not an identity issue so much as you’re going to work with your partners across infrastructure and you’re going to

Brooke Vixamar:
work with your partners across security itself.

And you’re going to isolate it.

You’re going to put it

Kristin Hoppe:
on its own network segment.

You’re going to put boundaries and foxes around that with different technological layers than just identity. Now, one of the key things with identity is just, I mean, even establishing your standard and creating buy in and having everybody speak the language that is new applications are coming in, or they’re looking at replacement, or you’re talking to the operational stakeholders about what it means to be on a modern technology, just having them understand base words like SSO and SAML or OIDC, having them be able to be your advocate as they’re going into these rooms that you’re not in is key, and that’s something that we do really well in my program as we teach all of our practitioners, all of our partners across our IT departments that as they’re onboarding new or they’re replacing old or they have old, that we have to defend that. And that’s and that’s the way we’ve done that by giving them a common language.

Brooke Vixamar:
Paul, I’m curious if you, that was a great explanation, interesting from practitioners. Do you have any other kind of insights on that legacy operational technology challenges?

Paul Dant:
Sure, sure. So, I think one interesting aspect of that is it presents a really unique physical security challenge for facilities where we have these devices and we, from an attacker perspective, really just think of them as network access points.

And when you look at any sort of given hospital, there’s certainly security and visitor check-in and all of those things. But in general, it’s largely a public place. And once you’re in, you’re not necessarily gonna be challenged for stay wandering into an empty room. Everyone’s way too busy for that. And that’s where some of my research really showed that unique physical security aspect where if I can gain access to one of these legacy systems. And of course, most of the time legacy means not great security, especially if we’re not able to patch it. So if I can get some sort of terminal shell access on one of these devices simply because I plugged my laptop into an open network port on the back of it.

I now have potentially a starting point for lateral movement into much more important systems. And Kristin hit the nail on the head where this isn’t necessarily an identity problem per se. It’s a blast radius problem for sure. And so much of that comes down to other compensating controls like network segmentation, all of that kind of stuff that we know we need to do, but we also know it’s really difficult to put in place.

Brooke Vixamar:
Absolutely. We will dive deeper into that shortly. Before we do, Kristin, you said something when we were chatting earlier that you can secure the person and not the hospital, which I thought was a profound and true line. Where does identity’s responsibility end and the SOCs begin?

Kristin Hoppe:
Oh, that’s a really good question, and I don’t know that it’s, I think it’s kind of always a partnership. Your SOC is gonna be always responsible for seeing anomalous behavior, but sometimes that anomalous behavior doesn’t trigger in the SOC. It might not register that way.

You might see it from the network team. The network team might go, that’s really odd. We’ve we’ve never seen this before. And if you’ve worked across your lines of a silo of, okay, we’re identity, we’re only focused here, and you’ve talked to your network teams, and you’ve built relationships, they’re gonna go, that’s weird.

And they’re gonna come over, they’re gonna hit you up, and they’re gonna ping you and say, hey, I see this I see this activity. And you’re gonna then pull in the sock, and you’re gonna pull in your identity teams or whoever. You might see one day you might see that, you know, our account lockouts seem really high. Why is that happening?

This is really odd behavior. That doesn’t always register at the SOC. It should, but sometimes the way that comes in and the alert doesn’t fire correctly, or it’s just below the threshold because sometimes attackers are really smart and can keep it below standard thresholds, and you’re gonna see that. So it’s always a partnership.

Obviously, the SOC does a lot of the, you know, our significant monitoring. They’re always gonna be working on that and looking for the anomalous behavior and that threat activity.

But Gartner coined the phrase a couple of years ago of identity threat detection and response and ITDR programs. And if you, as an identity practitioner, do not have an identity threat program that you’re managing, that you’re running, you’re remiss. You’re you’re kind of behind the game. There are a couple of solutions out there. You can do this with alert and monitoring, but you should be running that as well because you’re going to see different information in the patterns than sometimes others will.

Brooke Vixamar:
Oh, well said. Let’s, pivot now to kind of, like, leaning into that defense standpoint.

Relatively simple attacks that can happen can, healthcare in particular, but in all industries, have a much larger blast radius.

We know that simple things to come in and then the explosion can be huge.

What are the things that can shrink it? And it’d be really interesting to hear from both of you on this. Kristin, you can kick us off, but thinking about what are the things that can potentially shrink that blast radius that Paul mentioned a few minutes ago?

Kristin Hoppe:
From an identity perspective, if you’ve got an identity that’s been picked up, really making sure your access controls are tight, you need to be positive that your specific identity, if they compromise a physician’s credentials, that that has no lateral movement, that you can’t elevate privilege on that. That’s, I mean, it really is a credential that they can go steal a paycheck and that’s it, and that has significant impact to the individual, but it’s impact to the individual versus the organization. So there are kind of two things there outside of that that’s locking down all of your privileged access, no standing privileged access if you can get there.

It’s a really mature state to be in. And then you’re gonna layer in a lot of other controls. You’re gonna have a robust SOC. You’re gonna have a vulnerability program.

You’re going to make sure that network segmentation is as robust as your organization can support.

There’s a lot of layers to protect and remediate that blast radius. I would be very remiss in not stating if you don’t have your whatever your active directory is, we you know, we’re still an active directory shop. Some are not, some are Entre, some are whatever, but if you don’t have an actual isolated backup that you could recover from, you really need to evaluate that. Resiliency is key. I think everybody understands that in the world we live in now, particularly with the advent of AI, It’s sometimes not a matter of when it’s or it’s not a matter of if, it’s a matter of when and what that actually looks like. And so being able to recover from an event is gonna be as as well is is very, very key in controlling the blast.

Brooke Vixamar:
Yeah. You you we talked about it earlier and you talked about zero trust also, like that zero trust. You’re assuming that there’s vulnerabilities. You’re assuming that it’s gonna go wrong.

So that’s the whole point. You’re setting up this whole system as you’re talking about as like something can, something will. There’s vulnerabilities. Assume it, and then set up your program accordingly.

Right?

Kristin Hoppe:
Yeah. 100%. I mean, if your pen testers aren’t finding things, get new pen testers.

Like you want, I mean, you kind of almost want like your friendlies to find something because you were like, hey, that’s one attack factor that’s now closed down. They’ve done a really good job. They highlighted something we didn’t know about.

And that’s key. I mean, particularly when you look around lateral movement on legacy systems and directories that have been stood up for fifteen years. I mean, if you’re looking at a directory that’s 20 15 years old, you don’t know all the things that are there. There’s no possible way. So you need that external validation that it’s secure and locked down.

Brooke Vixamar:
Totally. Okay, Paul, I don’t think there’s a better setup than that.

Like, as someone Kristin, that puts some

Paul Dant:
you make it sound so easy.

Kristin Hoppe:
It’s so not easy.

Paul Dant:
No, that was a perfect response. I mean, there are so many layers. And I mean, at the end of the day, understanding blast radius, you know, that alone is easier said than done.

So unified identity is really where all of that comes into play to make sure that we not only have a unified layer of identity data, but also that we understand from, we’ll call it a unified access chain perspective. Any given identity, a particular account, what can that account do in what systems and what can it do in those systems that from a privileged perspective?

As Kristin was saying, if we don’t have a true understanding of that, when the SOC does detect something in so many cases, it’s well after the initial compromise. It’s well after the hours, days, maybe even weeks of lateral movement throughout the network to find the most critical points, the pressure points for a hopeful ransom payment, whether it’s extorting the organization through stolen data or DDoSing legitimate systems that allow them to stop say patient intake. Those things are catastrophic, not just for the business itself, but for us as human beings. That’s the really terrifying part around a lot of these attacks. So understanding blast radius from that perspective is arguably the most critical part.

Brooke Vixamar:
Okay. I have, I think, what might be a slightly impossible question to answer then.

What would you fix first?

Is it data hygiene? Is it like, what is there for someone that’s listening to all of this and is like, I’m overwhelmed, where do you start?

Paul Dant:
Who’s starting with that one? I I’ll I’ll give that one to Crystal first.

Brooke Vixamar:
I’m looking for either of you….

Kristin Hoppe:
Thank you. That’s so gracious. Gracious.

No, I, I mean, every prong of security and organization has a responsibility. So you have to have as much as you have to have identity identity hygiene, hygiene, you you have have to to have have a data loss prevention program. In the world we live in now, vulnerability management is more important than ever it’s ever been. We know it’s always been important, but now it’s it’s the most critical thing that we’re talking about.

It’s kind of shifting the layer from identity a little bit away is now we’re talking about, you know, making sure your vulnerabilities are patched within the same day because AI is highly exploitive and we’re everybody’s rapidly adopting that technology.

So it’s not a singular place to start.

There’s a couple of layers that need to be well in hand and understood. And even if you don’t have the fixes in place, if you understand the baseline of where you’re starting, you’re doing well. Like you need to understand your program and don’t have, you know, ego about your program. Understand that, Hey, I’ve got areas that I’m blind to.

Bring in a partner and have an assessment done. Do an assessment yourself. Poke holes in what you’ve looked at and where your maturities are, and then complete something and reevaluate. We reevaluate probably every few months, every six months, we’re constantly absorbing what’s changing, what’s going on, and shifting our short term and long term strategy to accommodate that, particularly within the organization.

We got obliterated by, AgenTik AI this year.

So let’s

Brooke Vixamar:
Thank you for admitting to that, and you’re certainly not the only one.

Yeah.

Kind of everyone a little bit, yeah. I want to lean into that assume vulnerability aspect.

In health care, literally this life and death. Like this is not, oh, the system broke down. It’s okay, manufacturing, we’re gonna lose some money. Like we’re talking life and death situation.

So the stakes are much higher. So when we’re thinking zero trust, we’re thinking assume vulnerability. Kristin, what does that look like when a clinician calls you at two in the morning and their credential isn’t working, access isn’t working? How do you assume vulnerability when the stakes are so high?

How do you kind of balance the needs and the, yeah, risk?

Kristin Hoppe:
Yeah, I mean, so you, there is

Brooke Vixamar:
a little bit of that where

Kristin Hoppe:
you have some naturally absorbed risk in the organization.

So in healthcare, you may not be able to patch as readily as you want. It may not be quite as aggressive as it needs to because you know that the particular items you’re patching are connected to patient monitoring. Okay, so that’s higher risk than our, you know, a server cluster that’s running our telecom. Still very important, but not quite as high necessarily as patient monitoring. So you have to look at what you’re actually doing when it regards to specific identity.

Identity verification is going to be the name of the game going forward. You really have to know that if you’re servicing a call from an individual that you’re really talking to that person and that they’re in possession of the device they’re talking about, because that’s probably on the individual level, your biggest risk, and that’s going to be eradicating bad multifactor methods. You’re going to have to have an identity verification. At some point, you’re probably going to have to have a deep fake one.

Those are things that are being adopted at scale. Service desks are really, really hard hit when you talk about social engineering on healthcare scale. They’re constantly being attacked and you have to provide them as identity verification, as identity, you have to provide them the right tools that allow them to do that, particularly if you look at a lot of service desks that tends to be an outsourced or offshore facility, and that presents its own challenge. You need to bring a tool in that’s easy to understand, that’s got a high efficacy rate, that’s not abhorrent to the caller because nobody wants to interact with something that makes them uncomfortable. It’s really hard to balance, but it’s necessary.

Brooke Vixamar:
Well said. Along those lines, I think it’s come up a little bit organically in the conversation, but what can you see today that you couldn’t see two years ago? What’s new that you are facing today that you didn’t?

Kristin Hoppe:
I mean, I think everybody at the top that the only answer here is AI and a Genentech AI. I mean, if you were involved in that world, I think you as an engineer probably understood that it existed.

If you were a practitioner in security, you probably tangentially knew it existed. I don’t think any of us just boots on the ground day to day realized it was going do what it did and how quickly it was going to shift the landscape.

Between that and the way that COVID changed the way we do business. I don’t think any of that was predictable, at least from my lens, it was not predictable.

Yeah. And that’s yeah.

Brooke Vixamar:
Well, yeah. And and even as you’re I mean, and then all of the derivatives of that as you’re talking about the classic or deep fakes and, like, the voice recognition tools. What do you do with that when a deepfake can mimic Yeah. Words.

I mean, there’s just so many different versions of

Kristin Hoppe:
the same old attacks that are now bigger easier an attacker to use, so.

Amplified. It’s even as simple as terminating an individual when you go through off boarding processes. You know, service accounts would continue to run and those were easily reassigned.

What do you do with agents?

You hope individual agents are just terminated part of the identity, which they should be typically.

But what about sub agents? Depending on that, if they were using multi tenant AI, it’s really challenging. It’s a really challenging process. And then how do you turn that new, how do you turn over the department’s agent to the right individual, to the right department? How do you make sure that that continues to run uninterrupted?

Those are big questions that we’re really starting to tackle and make sure occur well as we move into kind of the new age, I think. So life cycle management of agents is really gonna be interesting. And I don’t think ascribing it to we we’re struggling and we’ve kind of been working through this, but describing it to the kind of standard life cycle that we do to a human identity, it doesn’t work.

So we’re working on what that framework looks like. We’ve had a lot of, I think over the last six to eight months, we’ve spent a lot of time with other practitioners understanding what that new world’s gonna look like.

Brooke Vixamar:
Absolutely. We’ve talked about that internally a lot. We call it the uncontrolled inheritance chain where.

Kristin Hoppe:
Absolutely.

Brooke Vixamar:
An owner with an agent to an agent to a service account to data and when that owner leaves, what happens to the agent What’d do with it? To the service account. So having visibility in a way of flagging that and remediating that in real time, that’s a a big priority of what RadiantLogic is focusing on right now also.

Kristin Hoppe:
Yeah. We we’ve talked to Seb about it multiple times.

Brooke Vixamar:
Yes.

Paul Dant:
Yes.

Brooke Vixamar:
One other kind of part of the Augentica AI piece, so I guess you kind of already talked about it, but I just love this line that you said earlier, so I’m gonna say it. If you don’t know it’s there, you don’t know it’s there. And I think that’s the challenge, right, of these agents that are just you have to get ahead of it and get the visibility and know what they’re accessing and where they’re accessing it. Because it’s just out there and agents talking to agents.

That is terrifying. Question is gonna be to you. How do you get ahead of that? But, Kristin, how do you get ahead of that?

Kristin Hoppe:
So I think it’s it’s kind of a multipronged approach, so I think that’s kind of a theme for me is a lot of things are multipronged approach. Right? So you’ve got agentic discovery, and that’s a newly that’s a really fledgling area. There’s only a few partners that are doing it well.

A lot of it’s you’re kind of embedding. Microsoft is literally building the plane while we’re all flying it. They launched their AgenTik AI discovery in May. That was the first time it came out, and that was solely inside of the Microsoft tenant, and they’re starting to release outside of that.

So that tells you how new and how much this is in its infancy. But you’re going to really form partnerships with your data loss team and your data team so that they understand because they see how data moves and sometimes how data’s moving can highlight where you’ve got AgenTik AI running that you didn’t know about. And then you’re gonna run with security engineering because they’re gonna have a really, they should have a really strong program around authorized and unauthorized AI. And you’re going to run an authorized AI model.

So if it’s not on this list, it doesn’t get in the doors because everything’s changing every day, right? So you can’t continually block AI. You’re gonna have to say allow list only because, I mean, it’s ridiculous how much spins up every day.

There’s a new company, a new model daily.

All the Yep. Yep. So that’s, I mean, that’s kind of the way to do it. And that’s if you look at it from kind of a multi a multi area perspective, you can start getting your hands on that is still and then you’re going to have your own, you know, your own IGA platform around governance of that and what that’s going look like and where you’re ingesting that data to start seeing it and assigning ownership and moving that forward.

Brooke Vixamar:
Paul, I’m curious if you have any other, you in your role get to talk to a lot of customers.

This challenge is certainly not unique to what Kristin is facing.

How are you seeing people getting ahead of?

Paul Dant:
Yeah, it’s a Well, we don’t see a lot of people getting ahead of it just yet. We see a lot of people recognizing it. And, you know, I think what Kristin is describing is all of this really truly comes down to people, process and technology.

Solving shadow AI agents is not going to be technology alone. We have to build processes around it. We have to have people operating those processes in the technology. And it reminds me a lot of some of the other sort of shadow concepts that we’ve seen.

When AWS really started becoming mainstream, all of a sudden you have just people creating AWS organizations and spinning up EC2s that host websites within the context of this organization yet no one really knows about it. When those people eventually go away, what happens to those virtual machines that are just sitting there running? And, you know, it’s a very similar concept that we saw. Kristin, you had mentioned how much things changed with COVID, you know, organizations being forced into digital transformation, having to operate on the internet where traditionally they had never operated before.

Even if it’s just a matter of remote access, you had so many, what I’ll call shadow VPNs pop up where just controllers are thrown out there on the internet because people have to get into the systems. But then what happens when things start kind of getting back to normal and we forgot about that VPN server?

It all comes down to having to build people, process and technology around it to truly manage it. I think that’s the piece that we’re missing with the shadow agentic AI that we’re seeing in organizations. So we will get there, but it won’t just be technology that does it.

Kristin Hoppe:
100%. Smart.

Brooke Vixamar:
I neglected to say this at the top of the call, but if anyone does have any questions for either of our panelists, please put them in a questions portal.

To kick us off, I actually got a question from part one of the series, which I thought was simple and yet worth discussing kind of in a larger forum. So I’m gonna bring it back and Kristin, I’m gonna point it at you first. How do you help before the identity is compromised?

Kristin Hoppe:
Yeah, absolutely. I think this is gonna be, you have to have your foundations in order.

So if you’re still using, I mean, simple things, if you’re still using SMS as your multifactor strategy, it’s time to stop.

You can’t do that anymore. That doesn’t work in today’s modern world. You have to move that forward.

If you follow anything in the identity industry, you’ll understand that passwords are dead. Like passwords are one of the most compromised items. It’s kind of the key way to compromise an identity.

Time to look at password lists, time to look at password keys. Go look at the Fido2 Alliance, making sure you have a true unified view of your identities. You don’t have a way to view what’s in your system, then you can’t protect your system. So if you don’t know it exists and you don’t know it’s there, workforce identities are still going to be I mean, protecting workforce identities and even just non agentic NHIs is that hasn’t changed.

It’s amplified in the world we live in, in the world we’re operating in now. It is definitely amplified, but those core foundation things that you should have in your program and you should be doing did not change. And if your foundation is weak, then you can’t possibly continue to build a really exciting program. And so we, we kind of go back and look at our foundations against controls and against regulation routinely.

We do that every year. We, I mean, and if not more frequently. So we did that again more frequently this year a little bit than we had. Again, the advent of AI, we had to really reevaluate and we took a foundational approach to stuff.

We went out to all of our vendor partners and said, hey, we need health checks. We want to re, you know, basically reevaluate every system we have and ensure that we’re where we’re supposed to be and that everything is operating correctly.

We found a setting turned on in one of our systems that was really bad and went, oh, hey, we’re not going to have that anymore. And so we did an emergency change that day. One of my senior engineers found it. He raised the red flag and we sat on a call for four hours and remediated it.

Like, that was it. We stopped work and said this is to solve that problem because it was connected straight to our directory and it was going to be if it had been exploited, it would have been really bad. So, always looking at your foundational model, always looking at what the industry is doing and then moving that forward. It might feel impossible, but I mean, we’re moving a massive organization down a passwordless journey right now.

And you do it just in baby steps. So you get rid of, you deprecate really bad MFA, you deprecate short passwords, you deprecate expiration of passwords on silly intervals unless there’s a regulation that makes you do it because God knows why.

Brooke Vixamar:
Anybody has a health plan, HHS has a sixty day policy,

Kristin Hoppe:
so you have to adhere to HHS, things like that.

So you’re constantly evaluating and creating a foundation that’s really strong, and then that’s gonna help across the board.

Brooke Vixamar:
Brilliant.

Paul, I’m curious. I mean, you could take it from your SC side, but even from the attacker side, what do you think? How do you help before the identity is compromised? Would you answer any other insights on that?

Paul Dant:
Yeah. I mean, I think everything that Kristin spoke about is core to addressing what I’m looking for as an attacker, and that is just more access.

So as we build these foundations, we’re able to unify identity data. We’re able to better understand what identities are related to what accounts, are related to what service accounts. And, you know, we also have all of these delegated access constructs now like JSON web tokens and certificates. Those so often fall out of band of our normal identity management, even though they are part of the identity. They’re a manifestation or a delegated access to that identity.

So, yeah, I think it all really comes down to getting our arms solidly around access control and truly understanding, as Kristin has said, eliminating standing access, finally putting privilege access in place. We’ve talked about lease privilege for decades and decades. It goes back to the very first CISSP exams, but it’s still one of the hardest things to actually do when we have a business to keep running.

So yeah, I think that’s what it all really comes down to is again, it’s cliched but reducing the blast radius by finally getting our arms around access control.

Brooke Vixamar:
Yeah.

Okay, we did get one other interesting question in. For other questions that we weren’t able to get to, don’t worry, we’ll follow-up after the webinar. But this one, I think it’s kind of fun. Paul, this one is actually for you. What do defenders, practitioners consistently overinvest in that you don’t actually care about?…

Paul Dant:
So this is a tough one to answer without offending one group or the other.

But, you know, when when I look back at a at a lot of trends, one of the things that that I’ll say, and I’m I’m speaking largely to combating identity identity threats, things like lateral movement, escalating privilege once inside of a network.

Threat intelligence has kind of had its ups and downs.

From a commodity threat intelligence perspective, I think it makes total sense. You know, let’s track known bad IP addresses. But the challenge there is those things change so much.

The infrastructure that attackers are using today, it’s all ephemeral. So it’s spun up, it’s spun down, IP addresses are never the same.

But I also know that there are a lot of organizations that put a lot of effort, budget, other resources into threat intelligence.

And I wonder how much that is truly moving the needle, but many might say that it’s saved their organization in the past and I wouldn’t necessarily be able to argue with that. But as I’m just kind of sitting here thinking that’s the first that comes to mind when we’re talking about real tactical solving problems that make it harder for ransomware attackers to be successful.

Kristin, I’d love your thoughts on that.

Kristin Hoppe:
You know, think it’s actually don’t really disagree.

I also think it’s a world now we live in that you can really spin up an agent that does your threat intelligence for you.

It’s really important to know if you’ve got to have people out looking for like the key things of like attack vectors.

So Microsoft had one recently, right? SharePoint on prem. SharePoint on prem was highly, it had a really big vulnerability.

Okay, great.

I didn’t need three reports on that. I don’t have a single SharePoint on prem server. That’s fine. Like, checked off, we checked the list. We weren’t impacted. So that’s threat intelligence we didn’t need to consume. We don’t care.

So I think you’ve really got to really parse it out. It’s got to be pertinent to your organization. So if you’re sending threat intelligence, you need to be looking at it through the lens of your organization because otherwise it’s just noise. We don’t Nobody cares. Like, hey, cool. Yeah, SharePoint on prem was attacked. It had a really big vulnerability.

All right.

Cool story.

Also, how many other mitigating controls do

Brooke Vixamar:
you have before they can even get to that server, to where it was stored?

I mean, so that’sso I don’t disagree.

I think it’s got a lot

Kristin Hoppe:
of value and merit.

I think it also does make people feel very comfortable to know people are looking at it, And sometimes that that’s important that the lens is there so that they understand and can talk intelligently about what’s going on in the world that could be an impact.

But does that solve or stop where you’re shoring up your walls? Not necessarily.

Brooke Vixamar:
Right.

It’s almost like it’s, I mean, that’s when you think of cybersecurity, that’s like how the new the movies portray it, like that big dramatic intelligence part. And so much of the vulnerability is in overprivileged access of this little identity, which doesn’t seem like the big dramatic thing, but that is in fact where the vulnerabilities are taken advantage of.

Kristin Hoppe:
Yeah, I can’t overemphasize the importance of making sure your foundation is shored up and strong. Like, you the playbooks are out there.

It is

Brooke Vixamar:
time consuming and it is onerous, and it’s really not attractive work.

It’s not the exciting stuff of like, we did this really amazing thing. We did everything passwordless. We used digital pass keys for everything.

It’s not that, but it’s understanding that your OU structure works correctly and that

Kristin Hoppe:
your rules are written correctly and everybody goes into the disabled OU when they’re disabled and doesn’t just hang around somewhere where they’re still available and that all your identities that aren’t needed are getting deleted correctly, You know, that you’re not handing out domain admin privileges like they’re candy.

I mean, you shouldn’t have a lot of those. Have, and they should be really, really locked down.

Though, I mean, just what we kind of all laugh at as we’ve done this for a long time, but if you don’t have your foundations and your house in order with that, that is still going to be your biggest threat factor.

Paul Dant:
Is it?

Well

Brooke Vixamar:
said.

I just have kind of one final question for Kristin and then final thoughts from both of you as we’re kind of closing out the webinar.

Kristin, you’ve mentioned it previously, but I just kind of thought this would be a good place to kind of wrap things up. What’s the trade off you have between managing locking access down and a clinician that needs something right now? We touched base on it earlier.

In this conversation, when I’ve talked to you previously, you also kind of brought in the necessary bridge between ID, I’m sorry, between IT access and like the operational legal aspect of things, and I just thought that was really well stated, so worth kind of food for thought as we’re closing out.

Kristin Hoppe:
Yeah, I mean, when it comes down to like an individual clinician access, if you don’t have a well baked program, it shouldn’t be, it should never be a situation where you get a clinician coming in and saying, I need this right now, and it’s completely out of bounds from anything you’ve established.

You’re going to understand that your provider needs access to, you know, a

Brooke Vixamar:
whole gamut of things. And as long as they’re, they’ve met all of their onboarding criteria, so we can

Kristin Hoppe:
go back to people process, you have to make sure in identity, you don’t just get to hand out the access card and say, here’s all the things you need.

You have to double verify that they’ve come in through the right, from through the right door. And if you get them to the right door and you know, handing out the access is the least of my concerns. So if I’ve got provider x coming in and they’ve met all of their onboarding, I know exactly what a provider needs. If they come in and say, hey, I I wanna do this really cool thing.

I wanna go build an app. Great. We have a process for that and you can go build that app and you can go do that under these umbrellas and this is where the, these are the committees that approve that. And those are things you should be looking at so that you aren’t always the person that either has to evaluate yes or no.

You have avenues to be able to take, when somebody asks for something that’s now weird. So now in this world, lots of people want to build apps. Everybody wants to be able to do that and they want to deploy it. We have avenues, we have committees, we have groups that help take that responsibility and we can push them to those pathways versus being the entire gatekeeper.

Then our technical controls back us up on that.

Brooke Vixamar:
Totally. Back to that, it’s new technology, everything is faster, but the people processes technology that we already have in place, the things that have already been established, that’s the core, that’s how we get back to it.

Kristin Hoppe:
Yeah, that’s definitely not changing. I don’t see that. That might be moving quicker, but it is definitely not changing.

Brooke Vixamar:
Yep. Yep. Paul, did you have any kind of thoughts, final takeaways as we close out today?

Paul Dant:
Let’s see.

You know, I think the one thing that kind of stands out that I’ll throw out there is the assume compromise mantra that Zero Trust tells us that from everything from our proactive approach to securing identities, to building identity programs, as Kristin said, there are playbooks out there to proactively build these foundation the foundational programs that make this work.

And then the reactivity stuff is so much more effective when you have those foundations in place, because we are assuming that any one of our identities within our organization could be compromised at any time.

And that’s really the way that we should have been designing security from the start. We all know that.

But from identity program perspective, as you said, we have people process technology built in layers upon layers upon layers. And so much of that stuff is very difficult to rip out, like active directory.

It is the bane of existence for so many, but a required, we won’t necessarily say evil, but a required, not so fun to always work with platform.

The processes, the people around it are what’s made it work over all these decades. The same applies to everything that we’ve talked about today. Being proactive, assuming compromise is the key to understanding why these risks have appeared in our organizations in the first place and how we’re gonna tackle them.

Brooke Vixamar:
Well said. Kristin, any final words to your peers, fellow colleagues in the health care space challenged with these similar pain points that you have?

Kristin Hoppe:
I mean, it just it drives back to foundations and realizing that everybody is in the same boat. We are all dealing with that.

I mean, you know, you can come on to these things and you

Brooke Vixamar:
can talk about what your program looks like. And then when you…

Kristin Hoppe:
come down and say, you know, on an individual level and go, well, what is your program really?

Like, we have things we’re really good at. We have things we’re not really good at. We’re constantly reevaluating stuff. Like, there are things we’re always having to fix.

I mean, this is the thing. We don’t have, you know, like Genentech AI, we’re all figuring it out together. That’s all new. So it’s, I mean, if you hear somebody that sounds like they know exactly they’ve got it all figured out, everybody’s program is still developed or being developed.

Brooke Vixamar:
Totally. I appreciate so much, Kristin, you being here. I’ll I’ll say to the audience, this Kristin’s part of our customer advisory board, and so we get to get together with her in person twice a year when available. And at the last advisory board meeting that we had, Kristin and a number of our other healthcare organizational identity professionals that were in the room were organically collaborating with each other in such a beautiful way that they created your own breakout at the end of the day.

They came up to me said, can we adjust the agenda? We want to have our own breakout. And I was like, I will find a time and a space for that to happen, to have this idea sharing because it is such a she is so generous with her experience, her knowledge with others. And I think the health care industry in particular, and maybe it’s the identity space in health care, I’ve just seen just this really lovely sharing of identities, sharing of challenges and solutions, and let’s work on things and collaborate and figure out these things together.

So Kristin, thank you for being that part of our customer advisory board and then also sharing with this entire audience those insights and things that you’ve learned. We really appreciate it. This is a really valuable conversation. I personally have gotten a lot out of it.

So thank you for being here. Paul, always, thank you for your, storytelling and your experiences. This has been a great, a great webinar. I appreciate you both.

And thank you all, Candies, joining us. Have a great one.

Kristin Hoppe:
Thank you so much.

What It Actually Takes: Identity Management & Defense from a Healthcare Practitioner

Read the transcript

Resources