Latest / Tech Talks With Kinsoft / Icon Cancer Centre - A Fax-to-Email Gateway, a Dark Web Sales Post, and the Supplier Nobody Named

Transcript

Icon Cancer Centre - A Fax-to-Email Gateway, a Dark Web Sales Post, and the Supplier Nobody Named · Tech Talks With Kinsoft

• 0:00
  Imagine a multi -million dollar cancer treatment
• 0:03
  center. Okay. We are talking, you know, state
• 0:06
  -of -the -art radiation lasers, AI -assisted
• 0:09
  diagnostic tools, mapping out cellular structures.
• 0:12
  Right. The cutting edge of medicine. Exactly.
• 0:14
  And like biometric security protecting the physical
• 0:17
  servers. You assume the data infrastructure holding
• 0:20
  all of this together is just an absolute impenetrable
• 0:24
  digital fortress. You would hope so. Yeah. But
• 0:26
  then you peek behind the curtain. And you realize
• 0:30
  this pristine fortress is quietly being propped
• 0:32
  up and potentially compromised by technology
• 0:35
  from the 1980s. Oh, wow. A fax machine. It is
• 0:39
  wild when you actually say it out loud. It really
• 0:42
  is. So welcome to this deep dive. Today, we are
• 0:45
  unpacking an incredibly revealing tech update
• 0:47
  published by Kinsoft. This came out on October
• 0:50
  21st, 2026. Right. It details a major data incident
• 0:54
  at one of Australia's largest cancer care providers,
• 0:57
  the Icon Oncology Group. But the actual story
• 1:01
  here isn't just about one breached hospital.
• 1:03
  No, not at all. For you listening, whether you
• 1:07
  run a business and you're auditing your own company's
• 1:09
  software stack, or you're just someone who assumes
• 1:12
  their medical records are totally locked down
• 1:14
  after you hand them to a receptionist, this is
• 1:17
  a masterclass in how modern digital supply chains
• 1:20
  actually break. Yeah, the structural blind spots
• 1:23
  are really what make this Kinsoft update so fascinating.
• 1:26
  Definitely. Because like you said, we naturally
• 1:28
  project the physical sophistication of modern
• 1:31
  medicine onto the digital infrastructure running
• 1:33
  the admin side. Right. You see a giant MRI machine
• 1:36
  and you just assume the data storage must be
• 1:39
  equally advanced. Exactly. But the ICON incident
• 1:42
  just shatters that assumption completely. I mean,
• 1:45
  Icon Cancer Center operates more than 40 locations
• 1:47
  across Australia. That is massive. That is a
• 1:50
  massive, highly resourced entity. And on the
• 1:53
  12th of October, 2026, they issued a breach notification.
• 1:57
  And then they updated it a few days later on
• 1:59
  the 15th. And look, a major health care provider
• 2:02
  announcing a breach is sadly almost Tuesday news
• 2:06
  at this point. Yeah, unfortunately. But the mechanism
• 2:08
  of the breach is what really stopped me in my
• 2:11
  tracks. When I was reviewing the source notes,
• 2:13
  I realized the hackers didn't actually penetrate
• 2:16
  ICON's core clinical systems. Right. Like they
• 2:18
  didn't crack the main internal servers where
• 2:20
  the heavily encrypted patient care files are
• 2:23
  kept. Instead, they compromised an externally
• 2:25
  hosted third -party managed system. And all this
• 2:28
  system does is convert incoming faxes into emails.
• 2:32
  Yeah. And that specific architecture is really
• 2:35
  the soft underbelly of so many modern enterprises.
• 2:38
  How so? Well, in a sophisticated network, attacking
• 2:41
  the main firewall head -on is incredibly difficult.
• 2:44
  It's expensive for a threat actor, so they don't
• 2:46
  do it. They look for the side door. And the side
• 2:49
  door here is a fax machine. Basically, yeah.
• 2:52
  It's a legacy communications protocol wrapped
• 2:55
  in a modern cloud service. It's just crazy to
• 2:57
  me. Why on earth is a cutting edge medical network
• 3:00
  in 2026 still relying on a fax machine? It's
• 3:03
  a great question. Healthcare still leans heavily
• 3:05
  on fax because it traditionally operates point
• 3:08
  to point over telephone lines. Okay. And that
• 3:10
  gives this false sense of a closed private loop.
• 3:14
  Plus, universal secure messaging platforms simply
• 3:17
  haven't achieved total market saturation. Oh,
• 3:19
  I see. So everyone is using something different.
• 3:22
  Exactly. You have specialists, rural clinics
• 3:25
  and major pathology labs all running completely
• 3:28
  different, incompatible software. So the fax
• 3:31
  protocol acts as the lowest common denominator.
• 3:33
  It's the universal translator. Right. The universal
• 3:35
  translator every single office relies on to just
• 3:38
  communicate. But dealing with like thousands
• 3:40
  of physical paper faxes in a sprawling 40 location
• 3:43
  network, that has to be logistically impossible.
• 3:46
  Oh, totally impossible. So a massive provider
• 3:49
  like ICON. isn't keeping a wall of buzzing plastic
• 3:52
  machines in a back room. They outsource that
• 3:55
  bottleneck to a cloud service. Right. A third
• 3:57
  -party vendor essentially intercepts the incoming
• 3:59
  analog signal, digitizes it into a PDF, and then
• 4:03
  routes it through the hospital's firewall via
• 4:05
  an API or sometimes just an automated email.
• 4:09
  And the hospital's security system just lets
• 4:11
  it right in. Yeah, because it views that specific
• 4:14
  vendor as a trusted source. So the hospital has
• 4:17
  essentially contracted out its digital mailroom.
• 4:20
  That is exactly what they did. And the real vulnerability
• 4:23
  stems from the concentration of data. Right,
• 4:26
  because of the volume. Yes, the volume, but also
• 4:29
  the extreme sensitivity of the information flowing
• 4:31
  through a medical fax line. Oh, absolutely. I
• 4:33
  mean, you have referral letters detailing psychological
• 4:36
  assessments. You have complex pathology reports,
• 4:39
  oncology diagnoses, Medicare details. Just a
• 4:42
  goldmine for hackers. Exactly. And all of this
• 4:46
  highly concentrated, incredibly sensitive data
• 4:48
  is temporarily pooled on an external server managed
• 4:52
  by a completely different company. Sitting entirely
• 4:55
  outside the provider's primary security scrutiny.
• 4:58
  Right. I mean, it is genuinely like building
• 5:01
  a state of the art laser guarded bank vault.
• 5:03
  You've got armed patrols everywhere. But the
• 5:06
  security guard out front is just writing down
• 5:08
  everyone's vault combinations on sticky notes
• 5:10
  and leaving them on a desk in the lobby. That
• 5:13
  is a perfect analogy. The fortress is secure,
• 5:16
  but the intake process is totally exposed. Which
• 5:19
  brings up the terrifying reality of what was
• 5:21
  actually exposed when that lobby desk got robbed.
• 5:24
  Because looking at the source material, there
• 5:27
  is a massive, almost absurd contradiction between
• 5:30
  what the corporation is admitting and what the
• 5:33
  hackers are loudly bragging about online. Yeah,
• 5:36
  the fog of cyber war is incredibly dense in the
• 5:39
  first few days of an incident. Oh, for sure.
• 5:41
  And the Kinsoft update captures this tension
• 5:43
  perfectly. ICON's public response has been highly
• 5:47
  sanitized. It's legally precise. They state that
• 5:50
  the compromise records are, quote, discrete pieces
• 5:53
  of business correspondence. Right. And they explicitly
• 5:57
  emphasize that full patient care files were not
• 5:59
  breached. They've deployed forensic advisors,
• 6:02
  reset access and notified the Australian federal
• 6:05
  police, along with relevant regulators. Yeah.
• 6:08
  But. discrete pieces of business correspondence.
• 6:12
  I mean, that phrasing feels like it was put through
• 6:15
  a centrifuge by a team of risk management lawyers.
• 6:17
  Oh, absolutely. It technically covers everything
• 6:20
  from like a cafeteria catering invoice to a literal
• 6:24
  diagnostic lab result, all without giving an
• 6:26
  inch of panic. Well, the corporate incentive
• 6:28
  right now is strict containment. However, the
• 6:31
  reporting from CyberDaily and Databreaches .net
• 6:34
  paints a very different picture over on the dark
• 6:36
  web. Right. The hackers claims. Yeah. Around
• 6:39
  October 10th, and crucially, this is a couple
• 6:42
  of days before ICON's initial public notification,
• 6:45
  a threat actor known as 2019 posted on a prominent
• 6:49
  hacking forum. And they claim to possess over
• 6:52
  31 ,000 documents available for a one -off sale
• 6:55
  in cryptocurrency. 31 ,000 documents. Right.
• 6:58
  And according to this actor, the payload isn't
• 7:01
  just catering invoices. They claim these documents
• 7:03
  contain names, addresses, specific medical diagnoses,
• 7:08
  and Medicare details. Wait. If an attacker genuinely
• 7:11
  has 31 ,000 documents containing actual oncology
• 7:15
  diagnoses and government ID numbers, how can
• 7:18
  ICON just brush this off as business correspondence?
• 7:21
  That borders on corporate negligence. It sounds
• 7:24
  like it, but you have to know how dark web economies
• 7:26
  function. What do you mean? Well, this hacker
• 7:29
  is basically playing a game of marketing. They
• 7:32
  are running an illegal e -commerce storefront.
• 7:35
  They need buyers. Oh, I see. So they are highly
• 7:38
  incentivized to act like, you know, a sleazy
• 7:40
  used car salesman. They're slapping the roof
• 7:42
  of a stolen database and exaggerating the quality
• 7:44
  of the data to drive up the cryptocurrency asking
• 7:47
  price. So you're saying 2019 could easily be
• 7:50
  hyping up 30 ,000 blank cover sheets and appointment
• 7:53
  reminders as some premium medical dossier. Exactly.
• 7:57
  The underground economy absolutely runs on that
• 7:59
  kind of inflated marketing. Cyber criminals are
• 8:01
  notorious for overstating their halls just to
• 8:04
  create urgency and bidding wars. OK, that makes
• 8:06
  sense. But the Kinsoft update provides a crucial
• 8:09
  counterbalance to that skepticism, too. While
• 8:12
  criminals do exaggerate, they also frequently
• 8:14
  understate their access. Really? Why would they
• 8:17
  do that? Or they drip feed the most damaging
• 8:19
  information over time to maintain leverage for
• 8:22
  extortion. So the source advises holding the
• 8:25
  hackers' claims very loosely. They are an entirely
• 8:27
  unreliable narrator. Motivated purely by profit.
• 8:31
  Purely. But to be fair, ICON isn't exactly laying
• 8:35
  all their cards on the table either. No, not
• 8:37
  at all. The source highlights a pretty glaring
• 8:39
  list of omissions in their public statements.
• 8:42
  Like, they haven't confirmed the exact number
• 8:45
  of people affected. They haven't detailed the
• 8:47
  specific categories of stolen information. Right.
• 8:50
  We don't have a timeline of how long the hackers
• 8:52
  were actually inside the gateway. And most noticeably,
• 8:55
  ICON refuses to name the specific third -party
• 8:58
  supplier that got breached. Well, withholding
• 9:01
  the supplier's name is standard protocol during
• 9:03
  an active investigation. Is it? To protect the
• 9:06
  vendor? Partly, but primarily to prevent other
• 9:09
  threat actors from dogpiling the exact same vulnerability
• 9:12
  before it can be patched. Oh, wow. Yeah, that
• 9:15
  makes a lot of sense. From an external perspective...
• 9:18
  You know, ICON's vague public stance is super
• 9:20
  frustrating. But from an incident response standpoint,
• 9:23
  it is really the only logical place for a corporation
• 9:26
  to be just days into a forensic deep dive. Right.
• 9:29
  Because if you speak too soon. Exactly. Making
• 9:32
  a definitive public declaration about numbers
• 9:34
  or impact only to have to double those numbers
• 9:37
  a week later when new server logs are decoded,
• 9:40
  that destroys institutional trust entirely. You
• 9:44
  have to lock down the forensic reality before
• 9:46
  you make public promises. Which means both sides,
• 9:49
  the hospital and the hacker, are just spinning
• 9:52
  a narrative right now. Pretty much. But underneath
• 9:55
  all that noise, the core revelation of this Kinsoft
• 9:58
  update is what the author terms the supplier
• 10:03
  risk story. Yes. This is the big takeaway. Because
• 10:07
  you could spend $10 million building an impenetrable
• 10:10
  internal security perimeter. You could mandate
• 10:12
  hardware keys, zero trust architecture for all
• 10:15
  your internal employees. Yep. But your actual
• 10:18
  existential risk might sit with a cloud vendor
• 10:22
  you signed a contract with five years ago and
• 10:25
  literally haven't thought about since. The shadow
• 10:27
  supply chain. The shadow supply chain. In this
• 10:31
  specific configuration, a breach at the third
• 10:33
  -party fax gateway exposes sensitive information
• 10:35
  about patients who never even interacted with
• 10:38
  that supplier. Which is wild to think about.
• 10:40
  Right. A patient walks into an ICON clinic, hands
• 10:44
  over their referral, and assumes they are trusting
• 10:46
  ICON with their data. They have absolutely no
• 10:49
  idea that ICON is silently passing that data
• 10:52
  to an invisible subcontractor to be digitized.
• 10:55
  As a patient, honestly, even just as a consumer
• 10:58
  of any digital service, that realization feels
• 11:02
  paralyzing. It does. If I do my due diligence,
• 11:05
  right? I hand my data to a trusted doctor, a
• 11:07
  trusted entity. but then they route it through
• 11:10
  an invisible network of external APIs and legacy
• 11:12
  gateways. How is anyone supposed to maintain
• 11:15
  agency over their personal information? You really
• 11:18
  can't, not on your own. We have zero visibility
• 11:21
  into the subcontractors our doctors are using.
• 11:24
  I imagine this is exactly why the regulatory
• 11:26
  environment has to step in. If health data is
• 11:29
  involved, there has to be a legal mechanism forcing
• 11:32
  these companies to disclose what happens in the
• 11:34
  shadows. And there is. The legal framework is
• 11:37
  designed precisely to manage this kind of opaque
• 11:39
  risk. Okay. The source details the Notifiable
• 11:42
  Data Breaches Scheme, which falls under the Australian
• 11:45
  Privacy Act. Right, because this happened in
• 11:47
  Australia. Yes. And health information is legally
• 11:50
  classified as sensitive information, so it's
• 11:53
  given the absolute highest tier of regulatory
• 11:54
  protection. The moment an organization covered
• 11:57
  by the act has reasonable grounds to suspect
• 12:00
  an eligible data breach has occurred, a very
• 12:02
  strict legal countdown begins. So ICON can't
• 12:06
  just conduct some endless internal investigation
• 12:08
  to save face. They have a mandated window. Exactly.
• 12:12
  Given how carefully workshopped that business
• 12:14
  correspondence statement was, I deduce they are
• 12:17
  right in the middle of a ticking legal clock
• 12:19
  trying to figure out if they cross the threshold
• 12:22
  that forces them to go public to the government.
• 12:24
  30 days. They have exactly 30 days to assess
• 12:26
  the breach. Wow. 30 days. And the critical legal
• 12:30
  threshold they are evaluating right now is whether
• 12:32
  the compromised data is likely to result in serious
• 12:35
  harm to the individuals involved. Serious harm.
• 12:39
  How is that defined? Well, serious harm in this
• 12:42
  context isn't just financial. It includes psychological
• 12:45
  harm, reputational damage, and of course, the
• 12:48
  risk of identity theft. Because ICON is a health
• 12:51
  service provider, they fall under the Privacy
• 12:54
  Act regardless of their corporate structure.
• 12:56
  That perfectly explains the line in their press
• 12:58
  release about notifying relevant regulators without
• 13:01
  actually naming them. They are doing the forensic
• 13:04
  math. Yes, they are. If they determine that those
• 13:07
  31 ,000 documents do in fact contain Medicare
• 13:09
  numbers and oncology diagnoses, that easily clears
• 13:13
  the bar for serious harm. Oh, without a doubt.
• 13:16
  And at that point, they are legally compelled
• 13:18
  to notify the Office of the Australian Information
• 13:20
  Commissioner, the OAIC, and directly contact
• 13:23
  every single affected patient. Right. But the
• 13:26
  assessment phase is highly complex because they
• 13:29
  have to cross -reference the logs of the third
• 13:31
  -party fax gateway against their own internal
• 13:33
  patient databases just to figure out whose files
• 13:36
  were in transit at the exact moment the hackers
• 13:38
  were inside the system. That sounds like a nightmare.
• 13:42
  It is literal digital archaeology. Hearing all
• 13:45
  this, you know, if I'm managing a medical clinic
• 13:47
  right now or a law firm or even a real estate
• 13:49
  agency, I'm probably sweating. You should be.
• 13:53
  I might not even know if my IT department set
• 13:55
  up one of these shadow vendors three years ago
• 13:57
  to handle our document flow. The sheer scale
• 14:00
  of the invisible supply chain just feels completely
• 14:02
  unmanageable. It can feel overwhelming, yeah.
• 14:05
  But the brilliance of this Kinsoft update is
• 14:07
  that it doesn't just leave us staring into the
• 14:09
  abyss of cyber threats. It actually provides
• 14:11
  a highly specific, actionable playbook for navigating
• 14:14
  this exact architectural flaw. Yes, the corporate
• 14:17
  checklist outlined in the source is a really
• 14:19
  pragmatic blueprint for regaining control over
• 14:21
  shadow IT. Let's walk through it. Okay, so the
• 14:25
  very first step is foundational. Map your environment.
• 14:28
  Makes sense. A business cannot protect an asset
• 14:30
  it doesn't even know exists. This requires a
• 14:32
  literal comprehensive audit of every single third
• 14:36
  party service that touches your operational documents.
• 14:39
  So we're talking fax to email gateways, cloud
• 14:41
  -based e -signature platforms, external transcription
• 14:44
  tools. remote scanning services, and even third
• 14:47
  -party billing processors, every single one.
• 14:49
  Right. Like, look at your own office right now,
• 14:52
  if you're listening. You probably have an automated
• 14:54
  PDF converter or some web -based dictation software
• 14:57
  running in the background. Every single one of
• 15:00
  those is a potential backdoor that bypasses your
• 15:03
  main firewall. Exactly. But once you actually
• 15:05
  list them all out, how do you evaluate the risk?
• 15:08
  Well, the source provides four critical interrogation
• 15:11
  questions for your suppliers. Okay. What are
• 15:14
  they? First, Where is the data physically and
• 15:16
  digitally stored? Because data sovereignty matters
• 15:19
  deeply in a breach. Right. Second, how long is
• 15:23
  the data kept on their external servers? Third,
• 15:26
  if they suffer a security incident, what is their
• 15:28
  guaranteed timeline for notifying you? And the
• 15:31
  fourth? And fourth, and this is really the inception
• 15:34
  level question, who are their suppliers? Oh,
• 15:37
  wow. Finding out if your third -party vendor
• 15:40
  relies on another third -party vendor to host
• 15:42
  their cloud infrastructure. Yep. It's vendors
• 15:45
  all the way down. The chain of custody is terrifyingly
• 15:49
  long. It is. It requires extremely aggressive
• 15:52
  vendor management. But step three of the playbook
• 15:55
  is something every organization can implement
• 15:57
  internally today. Which is? Retiring or drastically
• 16:00
  shortening your data retention policies. Oh,
• 16:03
  I latched on to this point immediately when reading
• 16:05
  the source. The concept of a medical gateway
• 16:08
  storing years of incoming faxes is just a massive
• 16:12
  self -inflicted liability. It really is. It's
• 16:15
  the digital equivalent of keeping a decade's
• 16:17
  worth of your physical tax returns, complete
• 16:19
  with your social security numbers and bank details,
• 16:21
  just sitting in a cardboard box on your front
• 16:23
  porch. That is exactly what it is. You leave
• 16:26
  it there just in case you might need to quickly
• 16:27
  check a deduction from 2019. We hoard digital
• 16:32
  data because cloud storage is incredibly cheap,
• 16:34
  but we completely ignore the astronomical risk
• 16:37
  cost of a concentrated breach. Right. The blast
• 16:41
  radius is entirely defined by the retention policy.
• 16:44
  Let's break that down. Well, if an organization
• 16:46
  only allows the external fax gateway to store
• 16:49
  files for 30 days before automatically deleting
• 16:51
  them, then a hacker who breaches that system
• 16:54
  can only ever steal 30 days worth of data. Which
• 16:56
  is still bad, but contained. Exactly. But by
• 17:00
  hoarding years of transitional data on an external
• 17:02
  platform, a company turns a minor communications
• 17:05
  gateway into a highly lucrative target for a
• 17:08
  threat actor. Right. It makes the jackpot way
• 17:10
  bigger. Exactly. And the final step for businesses
• 17:13
  is to rigorously enforce breach notification
• 17:16
  timelines in their vendor contracts. If your
• 17:18
  external PDF converter gets hacked, but their
• 17:21
  contract gives them two weeks to inform you,
• 17:23
  you lose the critical window to warn your own
• 17:26
  clients. Yeah, that makes perfect sense. So that
• 17:28
  covers the corporate defense strategy, but we
• 17:31
  also have to look at the human cost here. Absolutely.
• 17:34
  If you are a patient sitting at home and you
• 17:37
  know you've had a referral sent to an ICON facility
• 17:39
  recently, you are essentially caught in the crossfire
• 17:43
  between a silent corporation and a screaming
• 17:47
  dark web hacker. Yeah, it's a terrible position
• 17:49
  to be in. What is the actual recourse for the
• 17:53
  individual whose data was in that mailroom? Well,
• 17:57
  the patient playbook detailed by the source requires
• 17:59
  really high vigilance right now. The primary
• 18:02
  instruction is to just wait for official contact
• 18:05
  via verified channels. Okay. However, the immediate
• 18:09
  secondary risk here is the secondary scam economy.
• 18:12
  Oh, right. The moment a major breach hits the
• 18:14
  public news cycle, opportunistic scammers mobilize.
• 18:17
  They will begin calling or texting individuals,
• 18:20
  posing as representatives from Icon Oncology,
• 18:23
  or even government cyber agencies. Building a
• 18:26
  social engineering scam on top of a legitimate
• 18:29
  hack. Exactly. They prey on the anxiety generated
• 18:32
  by the news story. Like, hello, we are calling
• 18:34
  from ICON to secure your account. We just need
• 18:37
  to verify your Medicare number. It is a highly
• 18:40
  effective tactic because the victim is already
• 18:42
  expecting contact. So the defensive posture here
• 18:46
  must be absolute skepticism. Trust nothing. Right.
• 18:49
  Never trust cold calls or unexpected text messages
• 18:52
  regarding a data breach. Always navigate independently
• 18:54
  to the organization's verified official website
• 18:58
  to read their security updates. Good advice.
• 19:00
  And if you do eventually receive a legitimate,
• 19:03
  verifiable notice that your personal data was
• 19:06
  compromised in this specific gateway breach,
• 19:08
  the source strongly recommends utilizing ID care.
• 19:12
  ID care. What is that? It is Australia's national
• 19:15
  identity and cyber support service. They provide
• 19:18
  free expert case management to help individuals
• 19:21
  navigate the complex fallout of having sensitive
• 19:24
  medical or financial identity markers exposed.
• 19:26
  That is an amazing resource to have. Let's pull
• 19:29
  all these threads together for everyone listening.
• 19:32
  Sounds good. We started with the assumption of
• 19:34
  a modern digital fortress, the Icon Oncology
• 19:37
  Group, operating with immense resources. But
• 19:41
  we uncovered that the vulnerability didn't actually
• 19:43
  require a sophisticated assault on their main
• 19:45
  servers. No, it didn't. A threat actor simply
• 19:47
  slipped through the side door by exploiting an
• 19:50
  externally hosted third -party fax -to -email
• 19:53
  gateway, basically a legacy protocol wrapped
• 19:56
  in a cloud service. Right. And we observed the
• 19:58
  stark contrast in crisis communication as a result.
• 20:02
  Definitely. You know, the corporate entity is
• 20:04
  aggressively managing the legal and public narrative,
• 20:06
  minimizing the event to discrete business correspondence,
• 20:10
  while they race against that 30 -day regulatory
• 20:13
  clock mandated by the Privacy Act. While simultaneously...
• 20:17
  Right. Simultaneously, a dark web actor is running
• 20:19
  an illegal marketing campaign claiming to possess
• 20:22
  31 ,000 highly sensitive documents just to drive
• 20:25
  up their cryptocurrency payout. The ultimate
• 20:28
  takeaway from this Kinsoft update... isn't about
• 20:30
  predicting the exact outcome of the ICON investigation.
• 20:33
  We don't know the final document count. We don't
• 20:36
  know the name of the supplier yet. And the exact
• 20:39
  nature of the stolen data remains locked in forensics.
• 20:41
  But the defensive lesson is urgent and universally
• 20:45
  applicable right now. Supplier risk is your risk.
• 20:49
  Understanding the invisible architecture of digital
• 20:51
  supply chains fundamentally changes how you interact
• 20:54
  with technology. It really does. It changes everything.
• 20:56
  It changes how you evaluate the software your
• 20:59
  business uses, and it changes your awareness
• 21:01
  of what happens when you sign a form at a clinic.
• 21:03
  Your personal or corporate perimeter is genuinely
• 21:06
  only as resilient as the least secure forgotten
• 21:10
  vendor in your supply chain. So true. So those
• 21:13
  actionable steps, mapping those hidden vendors,
• 21:15
  interrogating their security, and ruthlessly
• 21:18
  purging old data, those are vital hygiene practices
• 21:21
  for any organization today. It really recontextualizes
• 21:24
  the entire digital world around us. And, you
• 21:27
  know, that leaves me with a lingering, almost
• 21:29
  haunting thought to chew on. What's that? We
• 21:32
  walk through our days assuming modern society
• 21:35
  is running on modern architecture. But if a massive,
• 21:38
  highly funded medical network is relying on an
• 21:41
  obscure third party fax to email gateway that
• 21:44
  holds this much concentrated sensitive data.
• 21:47
  Yeah. What other forgotten legacy technologies
• 21:50
  from the 1990s or 2000s are silently propping
• 21:54
  up the crucial infrastructure we rely on every
• 21:56
  single day? What other digital sticky notes are
• 22:00
  sitting unguarded in the lobby, completely invisible
• 22:02
  to us, just waiting in the shadows until they
• 22:05
  inevitably break?