Healthcare Company Thwarts Thousands of Cyberattacks

Thank you both for joining us. If you wouldn't mind, take a minute to introduce yourselves and  your role and what your organization does.

Yeah, I'm Quynn Kars. I'm the network security architect. We work for a medical organization. And then I'm Evan Martinez. I work really closely with Quynn as our network security engineer. So in charge of rolling out products like this.

How did your relationship with Akamai start and what products are you adopting today inside the organization?

We are an Akamai Guardicore Segmentation customer primarily. We were in the market for a microsegmentation or east-west firewalling solution. We didn't really have our idea too squared at the time, and we were at an actual vendor event with one of our partners we work really closely with, and I just happened to be lucky enough to meet someone from the Akamai sales team and, you know, kind of have a good conversation about what I thought our needs were at our organization. And, you know, the way I saw the industry trends going, what could benefit us. And we were able to get Akamai Segmentation on our radar pretty quickly. And then through some demos and PoCs, we were able to get on the right track and become a customer.

Looking back at the organization and adoption of Guardicore, how have you felt that's kind of been able to transform your organization from a deployment and the improvements that it's brought to the organization?

When we were doing that project, we were looking at the traditional firewalling setups that you'd seen throughout the environments traditionally for years, and we wanted to take a different approach that required less manpower but also accomplish the same goals. And so when doing that, Guardicore provided all of those things. It gave us that agent-based solution. It gave us something that we could drop in day one and get a deep level of visibility and control over that traffic without having to do large infrastructure changes throughout our environment. 

What are you seeing from an AI-assisted policy enforcement and policy recommendations? Like, how is that kind of, you know, landed in the organization from an organizational improvement?

The GPE has been an extreme procedure improvement for us, especially on the network security team, as far as how fast we can tackle the application rollout into enforcement mode. So that benefits not only the application owners getting their completed and functional ringfencing deployed quicker, but for us on the actual engineering side and the lift of actually deploying that, that has cut our time significantly. And just the amount of man-hours needed to get a really good firewalling set of everything the applications in our environment need. That's definitely been the biggest lift for us.

What's your impression been so far, you know, of the deployment of Guardicore Segmentation and relationship with Akamai so far?

It's been really good. Guardicore has basically hit the checkbox for every single item we were looking for. We wanted visibility, we wanted easy control, we wanted granularity, and all of those things were addressed day one for us. The rollout's been easy. The trust level building with the product has been really easy. It's, it's hit the box everywhere we needed it to so far.

How do you feel that the, you know, the AI policy engine, you know, compares to any existing segmentation solutions prior to adopting the beta program of the policy generation? Like, how was that from a before and an after state from a deployment standpoint?

From my point of view, and then also working with Quynn so closely, I would say I can recall multiple hour-long blocks of working sessions that I would sit in and reverse engineer traffic logs of core services. And, you know, just the man-hours that go into it. But not only that, the traffic needs to be there, right? The application needs to have generated that traffic. So not only did we have those hour-long blocks, but we had multiple of those spread out throughout the week for more traffic to roll in. Right? And, and with the GPE engine, it's not just taking that real-time data like we were in our role there. It's looking back on the ingested logs over the past 30 days. So it's catching something that I may not have seen since the last time I cleared the hit counts on the, the alert policy there. So it's just got a much bigger picture than I was able to capture without just investing more and more of my own time.

What do you feel from your perspective and role that the AI policy engine has kind of taken off your team's plate? It's taken off the discovery piece of it, right?

Going into this project, our app owners didn't really necessarily always have the best idea of what their app was doing, what it was talking to, all that stuff. And so having the policy engine has allowed us to bring to that conversation a mapped out look of what their app's doing and what we expect to put in place from a rule perspective. And so with that, we can show our app owners this information and say, hey, based on the past 30 days of traffic, this is what we're expecting to see from like what what needs to be blocked, what needs to be allowed, and they can just provide a validation step. It makes the process so much simpler, so much easier, and so much more fluent  for us from an end-to-end state. And it's been really great.

How do you feel the importance of being able to simulate policies before actually going into enforcement is with the organization, whether it's a false positive or protecting from outages? How has that impacted the organization? The simulation via the alert rules for every policy ruleset has been an extreme benefit for me in gaining trust from my change board, right?

So every time I would go through and deploy enforcement mode into a, you know, even if it's tier 1, tier 2, tier 3, whatever it may be, you know, that needs to roll through the change board and I need to have my approvals. The ease of me gaining the trust and the comfort of those approvers has been, you know, tenfold since I was able to do this compared to, you know, traditional firewall that we might be trying to implement a new block rule on. So that has been great for those people in the management roles, but then also the app owners themselves, I'm able to show them and gain them some comfort that I'm not going to cause them a downtime on their day off or, you know, some call in the middle of the night because Guardicore had blocked some traffic that they didn't want it to. So it's just been huge on the trust factor within the organization.

How important do you feel, you know, with the adoption of AI across, you know, the ecosystem of tooling and protecting AI itself, like how important do you feel it is to have explainable AI with more evidence base saying this is  what we're seeing to enforce this policy to kind of give you not only the comfort across the organization, but then also remaining a human in the loop as that we can make all these policy recommendations, we can provide you the evidence, but to essentially have that human as the enforcement point so it's not in an automated fashion. How important is that to you?

It's interesting, right? Because it's really important. We don't want to build technical debt. With these AI policies, right? We want what is coming out of these systems to be something clean and something that actually provides value to the organization. So having explainable information around those rules that are coming out and the stuff that the AI is providing to the engineers or our teams is important. And it's something that we'll see, I'm sure, gain a lot of traction over the coming years as AI becomes more prevalent in the industry.

Evan, can you share an example of something, you know, that was suggested that helped improve, you know, the security, you know, posture of the organization? Do you have any examples to share for that?

Yeah, definitely. So an example tied to GPE here, I would say see application 1 to application 2 over, you know, 80, 443, whatever it may be. And then a second suggestion that would come in with just a single IP address doing the same exact thing. So to me, that's a red flag right away that we missed an agent in deployment or we missed an agent in the labeling application. So then there's some investigation that needs to happen to say, okay,  what is this endpoint that Guardicore isn't seeing a label or a managed asset under? And then I can go work with the application team, discover what that is, and assign the right tags to it so that way we actually have the visibility, but then also the enforcement tied to that. So there's no rogue workloads running around our environment.

Any measurable, you know, benefits that the tools have provided you, like, you know, anything on end user troubleshooting, time saved, anything, you know, you can think of there through the deployment that you've
experienced on the ops side?

Yeah, yeah, definitely. On the operations side, I'm kind of removed from the network security point of view of what we're doing here, I'll actually get brought in to troubleshooting sessions or downtimes, whatever it may be, for things that don't even relate to applications or systems I manage, just from the perspective that I have the visibility on to the process level of what's going on. So, you know, I can see, for example, if an application server has an SMTP relay  set up to a DNS record exists, but there's no server there, right? And then the other 10 servers in the farm all have it configured to something else that's responding, and that's like the proper configuration, right? So there's many  times where I'll get brought into just a troubleshooting session to kind of get down to the process level and kind of add that extra information for the app owners to consider.

How important do you feel, you know, based on your experience, it is to, you know, explain to your peers, you know, what Akamai has done differently with AI?

I think it's important, right? Because a lot of organizations are pumping AI into their systems and, you know, whether that's actually adding value to the end user experience or to the engineers' experience, is a debatable question. And I think the way that Akamai has approached that topic is one of the better methodologies. What they're doing is actually providing value. The GPE engine is not just something that's, you know, throwing out garbage. As easy as it is to say, the actual suggestions that are coming out of the engine are something that is useful. It's providing value to our organization and it's providing us actual time savings. And it's what I want to see more vendors do.

What do you feel across the platform has delivered the most value to your organization?

Yeah, I would definitely have to say the GPE engine has delivered the most value. So outside of just the segmentation needs that Guardicore has covered for our environment, as far as after that purchase had been made and we became a customer, you know, the value add was really the feature rollout of the GPE. So Quynn and I have both got, you know, multiple projects running at any given time. We're involved in troubleshooting meetings for new initiatives. And so to save a few of our power users a bit more time in the deployment phase has just been a really big benefit for us to free up and pay attention to other things that maybe aren't so efficiently done.

You know, so when you were looking at different segmentation solutions, how do you feel Guardicore has ultimately come down, you know, through from a segmentation vendor standpoint, have really reduced the time for ringfencing?

Has it, you know, expanded on the benefit value of it, you know, from a time to deployment estimations across the organization? How do you feel Akamai has really landed that, you know, with the org? 

You know, I think the best way to put that is the industry had a set way of doing, you know, segmentation east-west for a very long time. It was, get a traditional firewall, stick it in the network at the point of presence that you want, and put your firewall rules there, or, you know, do some ACLs on a switch. Having an agent that it's just a, you know, throw out a policy, get it installed on the machine, and you're off to the races has made that deployment a lot quicker. We, you know, originally were planning on doing a traditional approach, and it would have taken us months to be able to, you know, go through downtimes, go through maintenance windows, so on and so forth, to be able to  get to the point where we could even actually start seeing traffic to make decisions on. And instead, with Guardicore, it was, you know, a week to have the agent on all of our machines, go through a deployment process. And, you know, obviously we had to go through phases as everyone does, but the time to delivery of just that visibility piece was so much quicker. And then from there, you know, we can start rolling out policies and start making decisions. We can start actually doing something with that data and it's just readily available. So I think it's been very helpful and I think it's definitely probably the way the industry is going to trend.

How do you feel, you know, Akamai Guardicore has really stepped in to kind of enforce that Zero Trust model for the organization? Has it kind of opened your eyes, you know, operationally to what is possible to using Guardicore even beyond means of east-west firewalling? Have there been any other, you know, use cases and value that you've gotten out of the tool besides what you were initially looking for?

Yeah, definitely. So we obviously had our project plan for what the rollout would look like once we first became a customer and kind of understood what the product was capable of. And then as you're kind of alluding to there, over time it changed when we get more experience with the product, start to really understand what we can do with this here. So, you know, without getting too specific there, like some of the applications that we initially decided to ringfence and leave it at that, you know, then we go back through with a phase 2 of the deployment and kind of look at really sensitive systems, maybe you're kind of providing an alternate solution for a system that isn't receiving security updates anymore, you know, going a lot more strict with the process-based ruling. You know, the ringfence is brought in, it's much smaller. So instead of maybe say an application in an environment for your ringfence, you're going down to a single cluster of servers that you don't really want to be able to speak to your workstations or to your, you know, mail server or whatever it may be.

How many applications are you actually protecting today, roughly, as far as where you are in the deployment?

Yeah, I mean, we're sitting at a little over 100 applications and, you know, that number, that number continues to grow as the organization continues to expand. And it's definitely made that process very easy.

How long do you think it takes to kind of understand, you know, incident response and, you know, has it accelerated any of your MTTR? You know, in any of the investigation side from that for the organization?

Yeah, absolutely. You know, our SOC analysts and our incident response teams, you know, including Evan and I, you know, we're part of that team as well. It's allowed us to be able to really identify what is going on quickly, right? Having that process-level view, it's like, okay, XDR alert hits for a process. No, okay, now we're not only digging through those XDR logs and, you know, trying to piece all that together, but we can see like, hey, what has that machine talked to in the past 7 days? What exactly has it been doing? Has that process been doing any network traffic? And so it's really allowed us to get another level of visibility that, you know, an XDR tool may not be providing or isn't providing nearly as good as what Guardicore can.

What do you feel, you know, from a configuration side of deploying a microsegmentation solution with ringfencing, you know, how often do you find misconfigurations or perhaps any malicious type activity that you feel would have been missed if you didn't have Akamai Guardicore Segmentation?

So I would say almost every app or every other app we're finding, you know, not everything may be a security concern, but definitely misconfiguration. So I've seen both again very often, whether it's something as simple as requests going out on port 80 instead of 443 or, you know, FTP instead of SFTP jobs running from critical systems. You know, that visibility is very easy for us to find via the GPE or, even just the logs themselves, right down to the process level. And it provides us such an easy way to export those network logs, provide them to the application owner, and then assign a remediation task of, hey, we want to see this remediated within the next month or so. If that's not possible, you know, come back and talk to us and we'll try to find out what we can do here. But the visibility alone has provided a great amount of insight for us to be able to kind of remediate those tasks. I think that that's a wrap.

Thank you both very much for your time. We appreciate the partnership and the business, and thank you as well to the viewers at home.