Rethinking Network Defense in Healthcare

Narrator: Welcome to the Cybersecurity at Vive series on the Beat podcast where we break down the fast moving world of cybersecurity and what it means for your healthcare business, your data and your everyday life. In this series we'll go beyond the headlines to explore real threats, real defenses and the people on the front lines keeping our digital world secure. And now your host, Sandy Vance.

Sandy Vance: Hey everybody. Welcome back to the Cybersecurity at uh, Vive series on the Beat. I'm your host Sandy Vance and today I'm here with Chris Boehm who's the field CTO for Xero Networks. Welcome to the show, Chris.

Chris Boehm: Hey, thank you, I appreciate it.

Sandy Vance: So for our audience, Xero Networks helps hospitals and health systems protect patient data critical systems and clinical operations by applying zero trust and automated micro segmentation with their platform. And, and we're going to talk today about how Zero Networks is helping healthcare organizations deal with legacy devices, third party access and generally meet the regulatory requirements around cybersecurity as well as an AI initiative that they are working on. But first, before we talk about Zero Networks, Chris, can you walk us through sort of your background in cybersecurity and the experiences that shaped how you think about cybersecurity for healthcare today?

Chris Boehm: I started in state and local government. From there I got into uh, I should say small enterprise space. Then I moved on after being one person of one team, just like in state local government to a slightly larger enterprise. I started working at Microsoft. Um, I started on the core operating system side. So I had to deal with everything when it comes to performance, operation, management of the OS itself. Think of anything you talk about on the operating system. I had to work on it. From there I started working on a lot of cybersecurity initiatives and signals that brought me into more, uh, new product lines, new features and capabilities that Microsoft was working on. And they acquired an Israeli company, uh, called Secure Islands. And the Secure Islands, their product line was to harden your email, harden your uh, documents. So if you ever had secure email, secure documents, that's actually something that I helped launch and work on at Microsoft and now it's part of Office. By the way, if you have the Office security subscription moving forward. I was there for about eight years, worked on multiple different products, worked on multiple different lines, mostly cloud based because that was the new thing, cloud and security. I was asked to join another company, they just hit ipo and that company name is Sentinel One. I was at uh, Sentinel One for about three years and now I'm at another company called Zero Networks now Zero Networks itself. Just a quick background. Is the person who was here just kind of tied all in? Uh, the CEO was on the Microsoft Defender for Endpoint team, the ATP team. He was, he's the CEO. So you can kind of see the bridging connection. I've worked on multiple new products and Israeli products. So the connection, uh, said I had people here that's been asking for me to join and here I am at Zero Networks.

Sandy Vance: Fantastic. So you've really spent years working with organizations on real world security challenges. That's so cool. What patterns, or I would say lessons learned have stood out to you that you think maybe you've seen in some of these other organizations earlier in your career, but they still influence your work?

Chris Boehm: The weird part, in this space there is a lot of patterns and consistencies across most customers. But, but no single customer is on the same journey. I've never met one that's like, hey, we're neck and neck and doing the exact same thing. But there is usually a consistent theme, I should say. So. For example, AI, uh, regulations are being brought up, or Zero Trust initiatives or hardening identity posture. Those may be the current trends that's happening right now. And that's how the cybersecurity market kind of shifts in the vendor space and even the customer space. Because now they have business level objectives and those business level objectives are getting forced down from the board to executive staff. And it's just shared across the whole market, which there's players like Gartner or Forrester and those kind of people who influence that market as well. So to kind of answer your question in a direct way is there's a lot of influence based on the high regulatory compliance or what's being pushed in the market. And then there's always those, hey, what is my actual business problem? And that problem might be different across every organization. There's some organizations I've worked with and I've worked with some of the top, top five biggest companies in the world. And it's, they literally have every problem, name it, they're working on it because they're acquiring new companies or uh, they have tiny products to the largest organizations of products that's been running for 50 years. Like they've had the starting of stuff and they've evolved it over time. So it's quite interesting to see how every company is transforming and the technical debt they have in place. But it is fascinating to see that the journey usually stays on modernized trends. And the modernized trend right now is, uh, business resilience is what I would say is today's thing.

Sandy Vance: So how do you sort of explain the core problem that Zero Networks solves in cybersecurity? And what makes the Zero Networks approach different from a traditional network security solution?

Chris Boehm: A, uh, traditional network security solution to hit on that first is typically done on a network layer or hardware layer. Think of uh, the Palo Altos, the fortnets, the I'm going to monitor your network traffic, or I'm going to monitor your network traffic locally and then I'm going to secure it. I could do packet sniffing, I could do multiple things. Zero Networks took a slightly different approach. We are focused on the network security, thus micro segmentation, network segmentation. But we started from an identity segmentation perspective. So we learn what Chris is doing in his environment, what machines he's talking to, how I'm communicating on a regular basis. And this works for service accounts, non human accounts. Same thing in a way to uh, privilege accounts. If I'm a global admin or I have access to. So it breaks it down in multiple tiers and then assesses that over time and then builds out a network path in your environment. That's identity, application, network. So we learn everything you're doing and then we harden it for you. And when I say harden, we block privileged ports. So what I mean is by blocking privileged ports is if an attacker decided, hey, I'm going to spread my ransomware, spread my whatever, I'm jumping around to learn what's happening to your environment, I automatically put the door in front of them right, right away and say, hey, are you really Chris? And can you prove it? I just need you to prove it real quick. And then we open up that temporarily for that single asset. That's how we can quickly drive a customer to a hundred percent segmentation across their environment because we, we know how attackers are getting in. It's a. We did our own statistics. 4 trillion signals just in the past year, and 70% of them are being utilized by four different ports, for example. So that's just something that we've been noticing as a trend and we just try to make that easier for customers. The hard part is learning, knowing what's going on and providing that segmentation as part of the product is what we're doing today. And we do all that more for you automatically.

Sandy Vance: Yeah. So, uh, can you break that down a little bit? I mean, I think a lot of companies sort of struggle with adopting Zero Trust because it does feel complex or maybe even disruptive to what they're currently, you know, how they're currently operating. So how does Zero Networks help security teams move towards that zero trust without breaking their existing environments?

Chris Boehm: The challenge you run into when you're implementing Zero trust is as you just mentioned, it's the fear of breaking business operations and business resilience and business uh, continuity. Those things are the main concern. You're like oh I have all the best products in the market.

Sandy Vance: Well, and health care doesn't need more friction, right? Like there's so many systems there's to

Chris Boehm: access so much friction. Yeah, exactly, exactly. So they, they don't lock it down, they uh, truly lock it down, isolate it, bubble it and like we are kind of segmented already. Okay, well that's, that's fair. But everything has a bridge of communication in some form or fashion. That's how your admins and that's how other people manage these environments. So if they're all intercommunicated in a way because you have to send it to your SaaS platforms, everything's cloud based infrastructure based in some form or fashion. So network paths still do exist. Then how do you learn what you're doing and then contain it appropriately while not hurting the business? And that's exactly what uh, is driving Zero Networks versus some of the legacy solutions out there. Uh, for example, let's just say, let's just go in a hospital as we're talking medical, of course you have a doctor that has not admin privileges, maybe local because he needs to do some things that he needs to do like connect uh, to certain applications or certain, the hospital bed has weird rights, you know, whatever is going on there. But let's just say he gets on that machine and he connects and all of a sudden it just doesn't work. Well we, as a product, this is how we naturally allow customers to move forward is if we notice the communication occurred, let's just say to that medical device that provides medicine for example to the hospital patient that's there and the chat. Like you had some friction that was happening. We would said hey, are you really Dr. Mr. Smith? Just prove it real quick, we'll open it up for you and you can gain access just in that hour, whatever window you want in place. So it keeps the business moving forward even with segmentation or hardening in place. So compared to old legacy solutions, you had to understand what that doctor's going to do, how they're going to talk, what that machine's going to talk to, what application is going to talk to. Most people say it's impossible or they've tried and it's just never ending. There's always something new, there's something different that uh, they just can't keep up with it. So most customers would claim that they have 20, and this is an evolved customer, 20% segmentation in their environment, where I have customers today that are 100% segmented because they can say it's contained and isolated across my whole entire environment, it's still working as designed. It's only when it's not normal, like Chris trying to reach out to a database or Chris reaching out to something, I have the rights and permissions, then I can open it up temporarily. So we keep the business moving forward while providing that hardening. So, uh, there is a slight level of friction that could occur only if it's abnormal. That's what I should be more clear. So if it's something that the doctor normally does and we learn that behavior, then it should just work. But if it's something that they've never done, for example, they're trying to reach to a customer database that for some reason the applications like I'm trying to do and they just don't have access to it because it's so weird, we can ask them, hey, are you really Mr. Smith? And we can give you access just temporarily. Uh, that's, that's how we keep the businesses going forward while staying secure.

Sandy Vance: What are the biggest mistakes you would say are the gotchas that organizations are still making from an internal network security perspective?

Chris Boehm: There's a few different flow conversations there. Sometimes it's being forced into an umbrella you're uncomfortable with. You're just sticking with the standard, I should say. Or you're, you're, you're part of a pricing umbrella package of saying this is everything under the moon and we provide it all to you. So you kind of force your conversation into that perspective as a business. I've been working with some leaders. They all have their own different opinions. Some leaders think the best of breed of utilizing products and modernization. Some leaders even believe they should focus 100% on AI solutions because that's where the future is. Just let AI do everything for you. Then there's the other ones that say, this is just so beyond me. And it could be a smaller hospital, for example. You know, you're just an independent one. You don't have the manpower, you don't have the heck I've worked. Here's another example. I worked with a university. Um, they went through 5,000 new nurses every two months. That's how much they're flowing in and out of nurses. I'm like, whoa, what are you doing? They're like, we're hiring. We bring in temporary staff. It's just a list across all the hospitals, 5,000 new nurses a month. I'm like, wow, that sucks. I'm sorry. That is a lot.

Sandy Vance: That is a lot.

Chris Boehm: But at the same time, like, they have to learn and adapt to everything because they're working with schools, they're working with their own hospital branches. It's just a big umbrella. So how do they solve that? Problem is they're leveraging smarter tools out there to help them with that. But then their budget is limited, as everyone's probably aware, to what can I be focused on? So I would say prioritize focus. Of course, compliance and regulations is a necessary must because you're needed for your own business. But consider, like, what is new and evolving out there, and that's hard. I've been in the practitioner space of sitting there, and I'm managing everything in my company. I'm reporting to the head of the IT department, and I'm just trying to keep up most of the time. So thinking about the next steps, it's usually a second priority. Usually a vendor or someone reaches out to me is like, hey, have you checked out this cool AI thing? Or, hey, have you checked out this new network, uh, security? Or I'm going in the process of buying a new product, so I'm going procurement, I'm going with a vendor or my partner, or, uh, provided me a solution. So I'd say be more, uh, conscious of not being stuck in a bubble. That's what I would say is it's easy to sit in a pattern. And years later being like, why did we just not look elsewhere?

Sandy Vance: So maybe just doing things the way they've always done them.

Chris Boehm: Right. Right. And a lot of businesses are that way. And it's kind of frustrating sometimes when you look at your like, wow, like, why, why are you still doing it this way? Well, that's how we've always done it.

Sandy Vance: You've mentioned AI a couple of times now, and obviously we're seeing, since the commercialization of ChatGPT, AI is just everywhere, and everyone's trying to capitalize on its capabilities. How is that impacting the work that you all are doing in the security space? And do you envision that this is going to have a, uh, drastic impact on how people approach their network security?

Chris Boehm: Very much so. I'll just answer that last question right away. The impact of AI is massive when it comes to network security. A few levels. So one of the main concerns is AI is permissive of what you give it to access to. For example, if I'm on my machine and I decide to have something smart and I say just access everything that I have access to and build this out, or read, uh, it and tell me what's going on. It's literally going to talk to anything Chris says an individual has access to on my network because I just told it to, it's going to do what it's told to do. So instead of being secure and being like, hey, line of sight, you should only access this one database. That's for medical records. And that's where we get the answer for like, when's the next time a patient needs to be called? No, it's going to search your history, your future, uh, applications, like, whatever. I have access to that because you've told it just spread around. So network security, all of a sudden you just don't know what it's talking to. So the lack of visibility with artificial intelligence, or I should say agentic AI or LLNs, micro LLNs, that's on your local machine, that's where the future is kind of going. Because every business is focused on it right now. How can I secure my AI? How can I make sure it's doing what it's supposed to be doing? Uh, is there any posture management to make sure it's not leaking my confidential information? Because all of a sudden now they're using these online models or whatever models they want to leverage and you don't have full control of what your whole company is doing.

Sandy Vance: Yeah, it's like shadow AI when we first started using APIs. Right. Like people just start letting data in. And now you've got departments standing up, these little individualized agents, and we don't really. It's like Pandora's box. You don't really know what's going on out there. So how are you guys helping your customers address this?

Chris Boehm: So I kind of mentioned we have to learn what me as a user does, what the machine is doing and what applications are doing for us to do our job. Because of that, we provide this beautiful map for you as a product and we say, hey, we can tell you what this machine is, what it's talking to, including shockingly of course, what artificial intelligence is talking to as well. So as an example, you can look at my machine. I'm playing Spotify on the backend. Well, Spotify is then reaching out to Gemini, and Gemini is making a call because it's making recommendations to my playlist. Well, I had no idea, I actually had no idea until I used my own product. And then I, I saw, oh, it's making AI calls all the damn time. So that's just a simple, simple example. And this is just a common app that a lot of people utilize. So how do you know other products are, are they authorized? Do you want to have containment? What else is it reaching out to? Is it actually doing what it's supposed to be doing? Because I'm assuming it's only reading the Spot. The Spotify application. That's it. But what if it accidentally reached out to a few other things that I didn't want to have access to? So, so that is exactly what we're providing all automatically. And then you can harden. Of course, like, you can say, no, I want to block everything in my environment. Most people just do that on the firewalls alone. But you could technically do it across every asset in your whole entire environment. With our product, you could just say, block port, block this. So the main thing is we're providing the visibility because that's what every customer is looking for. Like, can you. And what can you show us today when it comes to artificial intelligence in my environment, what if something is roguishly reaching out to everything in my environment? Could you see that and could you contain it? Well, yeah, we can block it, we can contain it and we can provide you full visibility of what it's doing. That's the joy of a product that learns. Because we learn what your business is doing in order to segment it, harden it. So this, that's a sad. And byproduct of what happens to learns. We've had customers launch us start learning because it takes about 30 days for an average business flow. It's what we recommend. And then all of a sudden they see, wait a minute, why, why is everyone talking to this machine over here like, like, I, I don't know why this. And, or, or like we don't know, we just, we just know everything communicates to it on a regular basis. And we recommend opening up this port so we don't hurt the flow of your business. And then they investigate and they find out that's not, that's not right. So there is that scenario that does happen from learning products and learning, uh, your environment. Because the main concentration for most customers today when it comes to network security is can they get in? Can they not get in? Not if they get in. What do they do after they get in? That's the shift right now is we're focusing on the shift of after you get into your environment, can you contain it? And most customers don't feel confident in that answer.

Sandy Vance: So do, uh, you think AI is sort of going to help that because of the detection you're able to do now within a network, is that the big evolution over the next few years is being able to more readily see the analytics of who's accessing what and why.

Chris Boehm: That's one portion of it. The other one that's very popular right now, uh, that's, I should say growing in popularity, is full control of what the person is saying in the prompt itself. So for example, if I put in proprietary customer information, there's a security layer in between that prevents it. Now we're not doing that. We are truly monitoring like, hey, your edge browser is reaching out to ChatGPT or OpenAI, blah, blah, blah, and we can see the full visibility or environment, who's accessing it and how often. Even like, like, oh, this one user, he's a power user. He, he talks to AI about 3 million times a day. Oh, okay, what is he doing that's making us into that many calls, for example? So there is multiple layers of security. I would say the more prompt one, people are more concerned about what I'm typing in and what I'm sharing. But the visibility control, that is something that most customers just, they assume that it can block out the firewall and that's it. The problem is, is what? How do you block your remote users? How do you block your, uh, other controls? So that's why ZTNA is saying like, they're gaining visibility and control, they can harden you there. It's a weird game right now because you're not just always at an office and contained in that fortress like you used to be. Now you have to support everyone, cloud environments, across your whole entire ecosystem. It's not hard for a developer to open up, um, an Azure or AWS tenant and start using an AI agent and just start communicating across your whole entire environment. We would see that visibility, we would provide that map and be like, hey, that you're talking a lot here, by the way. And sometimes reaching down to GitHub and whatnot. Like, is that what you're wanting to do? So we could provide that mind map for you as well. Uh, so I kind of see a few different evolutions for AI. The main one that's going to start factoring in and this will probably be some time, probably probably at least two to three years is when there's a firm Framework that AI regulatory like all of AI companies have to follow.

Sandy Vance: Right. Once we get a standard.

Chris Boehm: Yeah, yes. And it's not there yet. It's, I mean there's some, there's the EU on this, uh, there's the new Trump AI, uh, framework that they're working on. But I would say until that is truly set and you're like, hey, you have to be AI security, I mean, whatever they call it, probably AIs or something weird, then that certification from there will then push you into a certain standard saying, okay, are you that or not? Or I'm not going to use you. The other part is companies are starting to build their own. That's something that everyone's seen, uh, inspiration saying, why don't I just build my own AI or some fashion of it or smaller. Micro AI. And micro AI is popping up right now, uh, at Micro LLM. I should be more clear to be, uh, on that terminology. That way I can just run it to be a very specific task, smart enough for a user to understand and communicate to, and it just builds on top of itself. And that's where agentic AI is kind of coming in. So agentic AI's AI for those who don't, are not very aware if you haven't been following. This is where AI ends talking to itself and working on its own mission back and forth. For example, coding is the most popular one. I tell it to write a Python script. The Python script. The AI says, hey, uh, how should I write this Python script? It asks another AI agent. AI says, leisure, write it this way. This is the best way today. It goes back and says, okay, I'll write it this way. And it kind of just continuously goes back and forth and all of a sudden you have a Python script versus the simple question of just asking ChatGPT, I want a Python script. And it says, okay, well like, what do you want me to do? Uh, like there's more things it can do all automatically and a progressive timeline based on just some simple context in comparison to, I need AI to, uh, just solve this answer for me. The other problem is, and this is the problem we're running into today is coders and developers are using AI and it's doing the job, but it's insecure. So there's going to be this huge burst. It's not, it's already happening where things are just vulnerable. And that's why there's even that big, uh, product, uh, announcement that happened just in the past few weeks of like, hey, we can make products more secure. By default. So this is less of a problem. We'll see how that turns out. But there's a lot of evolution of how artificial intelligence is impacting coding specifically. And that's the main concern for a lot of businesses is like what if we're pushing out insecure code and we're just letting them in uh, versus uh, we were following a mandate or framework.

Sandy Vance: So what advice or parting thoughts do you have for our chief information security officers at healthcare organizations?

Chris Boehm: Obviously solve the problem you're working on. That's the main goal. I would always encourage that for anybody. Pay attention to the new regulatory requirements that's happening with hipaa. Uh, that is one reason why we have expanded in the space ourselves because the new regulations are pushing toward context, aware of what a user is doing and network hardening aspects itself, which is in turn micro segmentation. It's coming out. It hasn't been fully authorized and approved last I looked, but it is in the near future. So be prepared for that and start analyzing what do you have in place. Or consider looking at Zero Networks as a solution because when that happens you're going to be dealing with the problem of how do I map this out, understand it and visibility. Be a little more on top of it. That's my recommendation for you when it comes to the new HIPAA regulatory compliance measures that's happening in the near future. Micro um, segmentation is a multi year journey for most products. I have customers the size of some of the biggest airlines in the world for example have done it in a year. So think of it that way. Think of the speed and scale and when you need to solve this. And that's what I would advise you to consider going forward and stay on top of the AI stuff. Uh, the, it's a constantly changing market, it's. I uh, can't encourage more peer to peer conversations of how are you working on this and how are you solving this today? That's one of my highest recommendations for anybody in that space. Reach out to your peers, have an internal group even if you're not doing it already, just reach out and say hey, what are you guys working on? What's the latest? It goes far because everyone is working on the same damn thing to be clear.

Sandy Vance: Fantastic advice. So Chris, how can folks find the website to learn more about Zero Networks

Chris Boehm: www.zeronetworks.com and you're more than happy to check out our product or you can reach out to me, I'm on LinkedIn quite regularly if you want to uh, see us at a booth any cybersecurity event. We're trying to reach out to as many as possible, but we are growing. Uh, we are 200 and change. Uh, and we've uh, been making a big impact where I have over 400 customers. So I'd recommend reaching out to our customers. If you know any of them, they're on our website as well.

Sandy Vance: So. Awesome. We'll link to that in the show notes as well. Chris Boehm is the field CTO for Xero Networks. Thank you so much for your time today. It's great talking to you.

Chris Boehm: Oh, thank you.

Narrator: Hey, if you enjoy listening to this podcast, be sure to check out all the content around data innovation at 52026 by visiting health.com that's hlth.um com from there go to the Events tab and you will find recordings of nearly 100 case study presentations, podcasts like this and white papers presented by leading technology solution providers. Be sure to subscribe so that you don't miss the next Vive event presented by Health and Chime.