Shut The Backdoor
Welcome to Shut the Backdoor, brought to you by Redox. Shut The Backdoor is a healthcare security podcast dedicated to keeping health data safe, one episode at a time. Hosted by Jody Maberry and Meghan Mcleod and featuring special guests to discuss the most critical topics for healthcare security.
info_outline
The Lost and Found Files - Data Loss Prevention
04/22/2025
The Lost and Found Files - Data Loss Prevention
"DLP is not just a tool that we have. It's also the ongoing education that we have for our employees to further minimize the occurrences of data mismanagement." Having strong Data Loss Protection (DLP) systems stops bad actors while also protecting employees from making accidental mistakes too. Every day, we put trust in the secure flow of health data. However, no matter what safeguards are in place, human error is one of the most common causes of data loss in companies. Security engineer, Zak Cowan, joins to share why data loss protection, or data leak protection, is paramount for a company like Redox. The everyday person may think about DLP as a way of securing photos and contacts. However, there is a lot more data that comes in and out of a corporate system. To those companies, data loss protection, or DLP, covers critical information such as social security numbers, bank account numbers, and particularly for a company in our space, health information. DLP protects companies from this sensitive information making its way out of their secure ecosystem and into potentially harmful hands. DLP is much more than stopping cybercriminals; it’s about creating guardrails for our whole team, preventing unintentional mistakes that can expose sensitive info, especially as so many of us work remotely or on the go. It’s not just the big bad outsiders we have to watch for. The majority of data leaks happen because of honest errors by well-meaning team members. That’s where DLP tools shine. By monitoring endpoints and cloud apps, we add invisible safety nets without grinding productivity to a halt. Education is equally critical. The best DLP solution works hand-in-hand with ongoing security training, offering helpful nudges right when someone needs them. As technology races ahead, especially with the rise of AI, our strategies can’t remain static. Zak urges us to stay curious and agile, integrating DLP solutions that evolve as new threats, tools, and workflows emerge. AI brings both risk and opportunity, so our policies and education need to keep pace, making sure every Redoxer knows what’s ok (and what’s not) when it comes to handling data. Protecting sensitive information is like having a dedication to locking the digital doors while also making sure we haven’t accidentally left a window open. At Redox, keeping health data secure is a team sport. By blending the right tools, targeted education, and a healthy dose of vigilance, we’re collectively shutting the back door one proactive step at a time. 00:52 Corporate Data Loss Protection 03:24 Remote Work DLP Challenges 07:18 Security Education Needs Technical Support 11:12 Alert System Enhances User Awareness 14:35 AI's Impact on Data Security 17:31 Unexpected Innovations Challenge Policy Adaptation Resources Have feedback or a topic suggestion? Submit it using . Matt Mock Meghan McLeod
/episode/index/show/d2d95129-fec8-41ca-b2a0-9866278572f6/id/36254165
info_outline
A Phishing Trip - The Constant Evolution of Social Engineering Attacks
03/25/2025
A Phishing Trip - The Constant Evolution of Social Engineering Attacks
"That's when it starts getting really scary. This is no longer just an email trying to get some gift cards. This stuff can lead to the bigger attacks that then can directly impact patient care." Notable Moments 01:02 Phishing: Persistent Cybersecurity Threat 03:27 Cybersecurity’s Evolving Threats 09:15 Phishing Scams: Calls and Video 10:23 Rise of Deepfake Scams and Counterfeit Reality Attacks 15:43 Vulnerability in Healthcare as Cybersecurity Threats Escalate 21:49 MFA and Password Management Trends 24:39 Stopping Phishing with Email Security 28:24 Advanced Phishing Training Strategies 32:05 Effective Phishing Training Strategies 34:07 Ineffective Automated Training Solutions Episode Resources CrowdStrike 2025 Global
Threat Report Gartner Article Resources Have feedback or a topic suggestion? Submit it using . Matt Mock Meghan McLeod Receiving a suspicious email, a text message claiming a lottery win, or an urgent request from a "bank" are instances of a cyber menace many know as phishing. While the term might initially bring the mental image of casting a line into a tranquil lake, this type of phishing is anything but relaxing. It’s a threat lurking in our inboxes and beyond, which is why it is important to stay vigilant with the ever-evolving social engineering attacks. Phishing has been a thorn in the side of cybersecurity for ages. The goal is to secure sensitive data like passwords or financial information or to install malicious software on a device, all under the guise of legitimate communication. The attackers attempt to capitalize on human error, exploiting the trust between people and technology. Phishing remains a top method for hackers due to its low cost and unfortunate high success rate. As Matt Mock highlights, phishing's simplicity is what makes it so dangerous. Grammatical errors or suspicious links used to make phishing attempts easy to spot. Now AI advancements have made attacks more sophisticated by creating convincing emails clear of grammar errors. They are using voice calls, video messages, and text messages with deceptive stories that sound real while demanding quick action. Home networks have brought on new challenges as remote work blurs the lines between home and professional security. The valuable data in healthcare makes them an irresistible target for cybercriminals. Healthcare data is rich with information that commands a high price in the black market. Attacks that compromise healthcare data can have serious repercussions, affecting both privacy and the quality of care. The need to protect healthcare data has never been more pressing. Preparation is paramount. Improve defenses by emphasizing advanced security measures like multifactor authentication (MFA), engaging training programs, and regular phishing tests. As cybersecurity professionals at Redox, we have the tools and responsibility to educate and protect against these persistent threats. Stay vigilant so you can help others anticipate the next wave of phishing schemes. Remember, it’s not just about locking the back door; it’s about securing all entry points.
/episode/index/show/d2d95129-fec8-41ca-b2a0-9866278572f6/id/35852435
info_outline
A Hacker's Welcome - Benefiting From the Bug Bounty
03/04/2025
A Hacker's Welcome - Benefiting From the Bug Bounty
"Putting this effort into the bug bounty helps us identify any sort of gaps that we might be missing, plug holes as fast as we can, and reward the researchers for all the efforts that they spend with us." Being asked to embrace hackers may sound counterintuitive. However, in today's fast-paced world of healthcare security it's a strategy worth exploring. Brent Ufkes is a staff security engineer at Redox, joins for a conversation about bug bounty programs. He shares how these programs can become a game-changer for organizations like ours. This episode explores: Understanding Bug Bounty Programs: Brent breaks down the essentials of a bug bounty program, how it contrasts with traditional penetration testing, and the ongoing collaboration it fosters between organizations and ethical hackers. Benefits Beyond Security Companies: There are a number of people that can benefit from bug bounty programs. Brent shares insights that it’s not just for security companies; any organization that offers a solution can find value in welcoming ethical hackers. Healthcare’s Unique Security Challenges: With considerations to compliance and patient safety, the conversation delves into why healthcare organizations, in particular, should consider bug bounty programs to safeguard against an evolving threat landscape. Embracing bug bounty programs is a way to preemptively uncover vulnerabilities and enhance security postures, especially in the healthcare sector. Are you curious about how a bug bounty program could be implemented in your organization? Tune in to "Shut the Back Door" to better understand how this proactive approach to security can transform your stance in the digital realm. Resources Have feedback or a topic suggestion? Submit it using . Matt Mock Meghan McLeod
/episode/index/show/d2d95129-fec8-41ca-b2a0-9866278572f6/id/35517555
info_outline
The Final Logoff - Streamlining Secure Departures
02/22/2025
The Final Logoff - Streamlining Secure Departures
"Everyone who's part of a health care organization or health care tech has access to really private information. And getting that access removed from somebody who's leaving the organization is key." Key Moments 02:23 Streamlining Through Automation 05:55 Streamlining Tool Access and Security 08:54 Centralize Identity with Single Sign-On 11:41 Automated Offboarding: Quick and Secure 13:25 Automating Environment-Specific Challenges 17:10 Streamline Access to Protect Data 19:51 Streamlined Process vs. Disorganization Streamlining secure departures is not just an operational necessity; it’s a pivotal component of our organization's security framework. During our latest discussion, we explore how automating the final logoff process can transform the way we handle employee departures. Bill Easton, a skilled staff security engineer at Redox, joins to highlight practices that can enhance our security posture. The overarching theme is that automation is king. Bill emphasizes that efficient offboarding begins with a central access system integrated with our HR information system. By automating access removal, we significantly reduce the chances of oversight and enhance security resilience. A streamlined, repeatable process ensures no system is left vulnerable due to manual mishaps. Meghan McLeod highlights the importance of role-based access rather than one-off permissions. This approach not only simplifies automation but also ensures that access can be efficiently managed across various roles within the company. Bill shared his experience at Redox, where continuous improvement in automation is a priority. Even though achieving full automation is a journey, each step forward makes a difference. We’re currently at an 80:20 ratio, and the push for seamless automation continues. To further safeguard our operations, Bill advises centralizing identity management through single sign-on (SSO). This strategy not only enhances user experience but also fortifies security by consolidating access control. As we steadily build this framework, let’s ensure our team is aligned with these processes and ready to tackle future security challenges with precision and efficiency. As always, it’s about locking the back door to safeguard our most sensitive information. Resources Have feedback or a topic suggestion? Submit it using . Matt Mock Meghan McLeod
/episode/index/show/d2d95129-fec8-41ca-b2a0-9866278572f6/id/35385010
info_outline
A Trojan Horse - Hiring Malicious Actors
02/22/2025
A Trojan Horse - Hiring Malicious Actors
"Everybody in the hiring pipeline should really be looking out for this. Every person that touches a candidate has a chance to pick this up before someone gets hired." Key Moments 00:42 Insider Threats for Financial Gain 06:10 High-Profile Cybersecurity Incident Reporting 09:16 Healthcare Data Extortion Risks 10:40 Spotting Red Flags in Hiring 14:14 Security and HR Collaboration in Hiring 17:23 Identifying Security Red Flags 19:51 Verifying Candidate Authenticity Steps 23:34 On-Camera Hiring Best Practices There is a new security concern that is catching many off guard: hiring malicious actors. Matt Mock, our CISO, shares that instances of fake candidates, particularly those backed by entities from countries like North Korea, are no longer a rarity. These actors typically have financial motives as their primary aim and have a surprising sophistication. They employ stolen identities and may even be working with domestic associates to get their foot in the door. As Meghan McLeod points out, these aren't mere hypotheticals. Even companies like KnowBe4 have reported encounters, underscoring that no organization is too small to be targeted. It is important to be vigilant in the hiring process. There are a number of red flags during remote interviews that are worth being aware of such as inconsistencies in a candidate's story, reluctance to appear on video, or unusual locations to send equipment. But it's not just about catching these actors during interviews. Some of these actors may be hired before they start to show subtle but suspicious activities. Accessing systems from unexpected locations or changing device settings to a foreign language can reveal their true intentions. Resources Have feedback or a topic suggestion? Submit it using . Matt Mock Meghan McLeod
/episode/index/show/d2d95129-fec8-41ca-b2a0-9866278572f6/id/35384915
info_outline
Introduction to Shut The Backdoor
02/18/2025
Introduction to Shut The Backdoor
Welcome to the debut episode of Shut the Back Door, a healthcare security podcast by Redox, hosted by Jody Mayberry alongside Redox’s own Matt Mock, CISO, and Meghan McLeod, Security Engineer. This podcast is dedicated to protecting healthcare data one episode at a time. In this introduction, Meghan and Matt explain Redox's mission as a leader in healthcare interoperability, enabling providers, payers, and health tech organizations to power better care through accelerated, real-time data solutions. The podcast aims to bring Redox’s behind-the-scenes data security expertise to the forefront. As security is a shared responsibility within healthcare, Meghan and Matt emphasize the goal of fostering collaboration and sharing knowledge with the broader healthcare community, ensuring everyone benefits from improved security practices. Listeners can expect monthly episodes featuring Meghan, Matt, and expert guests discussing real-world healthcare security challenges and practical solutions. Resources Have feedback or a topic suggestion? Submit it using . Matt Mock Meghan McLeod
/episode/index/show/d2d95129-fec8-41ca-b2a0-9866278572f6/id/35335685