Shut The Backdoor

"Companies have been very quick to implement AI but not necessarily understand the true risks or the necessary guardrails that have to be in place." Episode Chapters [00:46] Understanding Mythos and Agentic Systems [02:18] A Double-Edged Sword for Vulnerability Management [03:44] The Death of the 7-Day Patch Cycle [05:58] Addressing the AI Governance Gap [07:07] Is the Sky Falling? How Organizatio...

"Security doesn't stop with one customer. You have to think about all of them."   [01:18] Responding to customer compromises with care and context [02:46] Protecting all customers when one is compromised [03:41] How organizations learn about breaches in real time [05:45] Containing risk by pausing and managing connections [08:23] Adjusting response based on severity of compromise [12:18] Safely re...

"If you're behind on updates, you're vulnerable." Episode Highlights [00:53] macOS security myths and built-in protection limits [01:40] How fake installers and malvertising trick users [02:39] Why trusted searches can still lead to malware [04:44] Adding proactive security beyond Apple defaults [06:06] Why personal devices create organizational risk Security engineer Zak Cowan joins the conversat...

"Communication is one of the biggest parts of making vulnerability management work." Episode Highlights [00:44] Start with understanding your environment and technology stack [01:21] Prioritizing vulnerabilities based on risk and business impact [03:16] Tracking vulnerabilities without overwhelming engineering teams [05:58] Communication and collaboration to ensure vulnerabilities get fixed [08:40...

"Security needs to continue to function regardless of that leader being there or not." Notable Moments [00:01] Leadership transitions in security are common [02:17] Preparing documentation and shared access early [04:53] Systems knowledge must outlive one person [07:17] New leadership brings fresh perspective [09:50] Build programs ready for eventual transition Leadership transitions in security a...

"Good security tools don't replace people. They help people focus on what actually matters." Notable Moments [02:22] AI as a Security Teammate [03:41] Cutting Through Alert Fatigue [07:16] Continuous Testing with AI Agents [11:33] Connecting the Dots Across Systems [16:51–20:36] Oversight, Governance, and the Human Role AI is often framed as a threat. This conversation flips that idea and explores...

"AI is making attacks faster, more efficient, and more convincing, and that's something everyone needs to be paying attention to." Notable Moments [01:27] AI accelerating attacks and phishing [02:34] Prompt injection and AI misuse [04:19] Shadow AI and visibility risks [04:55] Ransomware and extortion trends [06:35] Infrastructure and virtualization risks [07:30] Nation-state focus and hiring thre...

"The main reason people get into trouble is they don't deal with things when they're small." Episode Highlights [00:01:22] Why time management, empathy, and discipline are inseparable [00:02:04] The "layering effect" and how unresolved issues create anxiety [00:04:35] Why dealing with problems immediately reduces long-term stress [00:07:17] Daily planning, reflection, and anticipation as leadershi...

"Good security habits should reduce stress, not add to it." Notable Moments [0:00–2:17] Holiday phishing scams and why "too good to be true" usually is [2:33–3:53] AI voice cloning and the rise of deepfake phone scams [4:06–5:20] Personal vs. work data and accidental cloud uploads [5:35–7:05] Shoulder surfing risks and protecting your screen in public [7:23–9:26] Public Wi-Fi safety, fake networks...

"Third parties are a common entry point for cyber attac ks. T his is something you really want to make sure you have under control." Notable Moments [00:01:15] Third-party due diligence and security reviews. [00:03:25] How regulatory requirements like HIPAA, PCI DSS, GDPR shape due diligence. [00:05:28] Ongoing monitoring and review expectations. [00:06:19] Physical access risks: background checks...

"Cybersecurity is a shared responsibility. One organization's defense can strengthen an entire community." Notable Moments 00:01:00 – What an ISAC is and how it began 00:02:40 – How Health ISAC has grown globally 00:04:44 – Top threats facing healthcare today 00:09:25 – AI's role in both defense and attacks 00:13:45 – Impact of the Cybersecurity Information Sharing Act 00:18:03 – Why information s...

"We're not trying to avoid AI because of the scary security issues; we're trying to deploy it securely so we can unlock its true potential." Notable Moments 01:09 – Rene Brandel on why he began hacking Y Combinator AI agents to find security gaps. 02:30 – How quickly AI systems can be breached without strong security oversight. 03:51 – The risk of cross-user data access and violating HIPAA's minim...

"There aren't that many things that really are impossible. We just have to set aside boundaries and figure out how to make them real." Episode Highlights [02:53] Bob on managing creativity and building environments where big ideas thrive [05:27] Disney embedding safety and security into their culture [10:20] Brainstorming approach for tackling "impossible" challenges [17:03] Balancing creativity a...

"If we can scale AI for better use, it can make the world a better place rather than just your daily personal life." Notable Moments: [01:27] Marina explains her AI project with indigenous communities in New Zealand [03:26] Researching AI responses in abortion counseling [07:43] Ten weeks in Namibia studying environmental science and conservation [10:46] Using machine learning to study tree pod dy...

"DEF CON is one of those places where you walk in expecting to learn one thing and walk out realizing the possibilities are far greater than you imagined." Notable Moments [02:24] – Trevor explains what DEF CON is and why it's unique. [04:36] – The rise of inclusivity and community groups like WISP and Diana Initiative. [06:55] – Villages and Capture the Flag competitions explained. [09:22] – A bo...

"Hospitals don't just store data. They safeguard stories, care plans, and lives. When ransomware hits, it's not just a system crash, it's a trust collapse."  Notable Moments 00:01:10 – What ransomware is and how it's evolved 00:04:15 – How the Colonial Pipeline and Vegas attacks sparked Jeffrey's interest 00:07:10 – Why healthcare is a prime target 00:10:00 – How Jeffrey built a ransomware databas...

"Security isn't proprietary. Sharing what works makes us all safer." Notable Moments 01:29 – Rise in ransomware and the case for collaboration 03:41 – Why reinvention puts you at risk 05:12 – The danger of building relationships mid-crisis 08:10 – Balancing information sharing and confidentiality 09:26 – How groups like HISAC facilitate secure collaboration 12:24 – Learning from incidents you have...

"We have to make sure AI doesn't just automate what we've always done. It should elevate what's possible." Notable Moments 00:40 – What's pushing us to talk about AI now? 04:22 – A call for AI mission statements 08:18 – When tools lead before people: the risk of reactive adoption 11:05 – Defining AI boundaries: what it should never replace 15:33 – ChatGPT, Canva, Magic School: the tools already in...

"DLP is not just a tool that we have. It's also the ongoing education that we have for our employees to further minimize the occurrences of data mismanagement." Having strong Data Loss Protection (DLP) systems stops bad actors while also protecting employees from making accidental mistakes too. Every day, we put trust in the secure flow of health data. However, no matter what safeguards are in pla...

"That's when it starts getting really scary. This is no longer just an email trying to get some gift cards. This stuff can lead to the bigger attacks that then can directly impact patient care." Notable Moments 01:02 Phishing: Persistent Cybersecurity Threat 03:27 Cybersecurity's Evolving Threats 09:15 Phishing Scams: Calls and Video 10:23 Rise of Deepfake Scams and Counterfeit Reality Attacks 15:...

"Putting this effort into the bug bounty helps us identify any sort of gaps that we might be missing, plug holes as fast as we can, and reward the researchers for all the efforts that they spend with us." Being asked to embrace hackers may sound counterintuitive. However, in today's fast-paced world of healthcare security it's a strategy worth exploring. Brent Ufkes is a staff security engineer at...

"Everyone who's part of a health care organization or health care tech has access to really private information. And getting that access removed from somebody who's leaving the organization is key." Key Moments 02:23 Streamlining Through Automation 05:55 Streamlining Tool Access and Security 08:54 Centralize Identity with Single Sign-On 11:41 Automated Offboarding: Quick and Secure 13:25 Automatin...

"Everybody in the hiring pipeline should really be looking out for this. Every person that touches a candidate has a chance to pick this up before someone gets hired." Key Moments 00:42 Insider Threats for Financial Gain 06:10 High-Profile Cybersecurity Incident Reporting 09:16 Healthcare Data Extortion Risks 10:40 Spotting Red Flags in Hiring 14:14 Security and HR Collaboration in Hiring 17:23 Id...

Welcome to the debut episode of Shut the Back Door, a healthcare security podcast by Redox, hosted by Jody Mayberry alongside Redox's own Matt Mock, CISO, and Meghan McLeod, Security Engineer. This podcast is dedicated to protecting healthcare data one episode at a time. In this introduction, Meghan and Matt explain Redox's mission as a leader in healthcare interoperability, enabling providers, pa...