Dr Chase Cunningham: Good morning or afternoon or evening. my name's Chase Cunninghammer, Dr. Cunninghammer, or Doctor Zero Trust. If you're listening to the I don't know, shenanigans I do online. I'm here with Jim Leraux, which is a very fancy sounding name from Symphian. Jim, why don't you give a quick intro on who you are and what you do? And then we're gonna talk about printers, because nobody talks about printers even though they should.

Jim LaRoe Symphion Inc.: Exactly. thank you for having me, Chase. I appreciate it. I'm Jim Laroe. I'm CEO at Symphion Incorporated. We're a company based in Dallas, Texas, and we protect print fleets and other IoT connected endpoints that are on corporate networks throughout the United States. Largely focused on the healthcare IDNs. We're protecting print fleets from over thirty thousand printers in them to down to three hundred. And

Dr Chase Cunningham: So interesting. So let's talk on the printer side. Why should somebody care about printers? Like printers print. Isn't that it? They just print stuff.

Jim LaRoe Symphion Inc.: Well, y agreed. And our our biggest performance marketing is I don't care about printers. So centering on that. Well, because they're the numbers are there, right? they're endpoints on your network. They're they're advanced business machines, more like a server that belongs in the data center than than some appliance that was an analog device a few decades ago because all the manufacturers have competed by adding incredible features like giant hard drives and multiple servers and internal communications, things like that. So they're really more like something that you would see in a glass house rather than sitting out in the middle of a hospital or an office or data, distribution center or something like that. So th they usually account for about 20% of the endpoints on the network. So you could take the number of employees divided by five and that's typically how many printer endpoints are out there. And man, we could go in the rabbit hole here on this because it's they're they're out there, they're they come from a management where they're managed from an uptime and supplies and purchasing and and then there's a whole service industry that's about twenty billion dollars a year called Managed Print Services that that takes care of that, usually through procurement and supply chain. But they haven't done anything about security. The manufacturers have done a great job compete with each other with great features on the devices and including security configurability and can and security features that are available on the devices. But when they're set on the network, nine times out of ten, they're set at a factory default with all the ports and protocols open, you know, no certificates, the firmware's not patched, they're default passwords, r administrator password, really bad stuff that's sitting out there for 20% of the endpoints. And the customers are typically blind to those devices too. So it's not a it's it's almost like the ostrich, from the standpoint of the risk register. and it's largely because of the way they've grown up from being procured like like appliances out of the procurement group. So and and they're really not the IT folks really don't understand the printer nuances with IoT, differ disparate operating systems. They're mostly Linux-based operating systems. They don't they don't understand it. And information security folks are usually focused on more what do you say, sexy things like AI and you know, so all that combines to you've got this giant exposure on your network. That can be your edge, it can be your lateral movement pivot, it can be anything you want and the bad guys know it. And now the bad guys are AI. So, that's a mouthful, dude. I'm sorry.

Dr Chase Cunningham: No, that's those are really solid points because I I I I used to be a red teamer actually when I used to do cool stuff instead of just sitting around and podcasting and screaming into the ether. But when I was red teaming, I always loved printers because like you said, nobody cares about printers and they do have access to the network and they're a great foothold and usually they are default configuration. typically also for wireless collection, most people put printers sometime some For some reason, near Windows, and they broadcast their wireless stuff all over the place. Easy to get to. one thing that I did just to prepare for this thing, because we're talking AI and printers and whatever else, I went off and just ran a bunch of dorks. I don't know if you're familiar with Google Dorks, and maybe if you're listening to this, you are or not. But and I'm not telling anyone that listens this to do this, because you have to be very careful, you don't get yourself in trouble. Don't do what I do because I know how to do it without going to jail. But Just bouncing around and doing some basic looking on, Google dorking and things like that. I was immediately able to find Xerox Alta Link C eight one four five in the United States. One second, dogs. in the United States. one is in New York. One is in a town called Shirley. and interestingly enough, looking at both of them, I have I see their full configuration stuff. I see version history. I can also see IP addresses behind the firewall, which is not good. a little bit further kind of looking around and poking, printers, right? So everyone says medical's a big deal, HIPAA high trust, all that stuff. I found 15 printers at an organization that is calling itself, and I won't give the last name, but the first name is Watermark. and it looks like they're all in a town called East Point. every single one of them is running SMB version two, and all of them have authentication disabled. They're talking to the internet right now. So that's 15 points of access inside of a system that's probably medically related. just a couple more just to show like how bogus and super easy this stuff is. I found an electric cooperative that has eight printers exposed to the internet, all with non-standard ports, all of them with no authentication. So there's electric, there's your IT, and this is for a city. additionally, a university that has a research institute with all of its stuff misconfigured. And a dental care organization that is literally running Samba version two. with the old IPC dollar sign problem floating around on their printers. And that took me, maybe six minutes of finding all those. So I mean in six minutes, seven minutes, I have close to 40 access points available to me as a dude sitting at home drinking beer on a Friday, messing around and finding printers. And what's crazy to me is, like you're saying, people will spend all kinds of money on sexy, cool Falcon Crowd Strike da. No one looks at the printers.

Jim LaRoe Symphion Inc.: It's a stone age, Chase. It's absolutely the stone age. And I didn't I didn't say that. One of the one of our contacts in the print industry said that to me, Jim, because I went on a podcast last fall and I was talking about the complacency, you know, the the absolute complacency. And I'm I can get into that with you here in a minute, but the reasons why, but and how to fix it and everything. But really I was talking about the complacency. And he's like, Yeah, man, we're in the Stone Age. It's not the manufacturers with the configurability, you've got a disparate operating systems and everything. We saw that with the vendor agnostic software. Okay. But then you gotta have a program, you gotta have process, you gotta have people. all the things that you would do with any other endpoint need to be applied to this endpoint, but there's a some big impediments to that. It but that's the

Dr Chase Cunningham: What?

Jim LaRoe Symphion Inc.: reason it stayed in the stone age like that, man. And now you come to twenty twenty six, okay, and all the stuff that's happening now, man, like what you posted yesterday, you know, reverse offensive. I I think I read that right, you know, the the green light for that, man. I mean it's it is man, we had hacks in twenty fifteen, Chase, where hacktivists went out, they went on Shodan and they picked out like the first twenty thousand And printed stuff out on And it printed and then one dude who was really anti Semitic pup put some Nazi stuff out on on like a hundred fifty thousand printers coast to coast, mainly like the high end, high ed, you know, s places, you know, like Yale and Stanford and some of those out there. And it was like, you know, you can print on the device, you're on the network, right? So man, that was just and that's just the edge piece of it, not the lateral stuff because, the hackers are out there, the the guys like you, you know, used to be the pen testers and the red team guys, okay? You know, they're out there they're making money off printers because they can they can take that printer over and move laterally because it stores credentials, the big an MFP. It's got a big hard drive full of data, usually not encrypted even though you can to really tight standards, but it's got stored scan to email. It's got access administrator access lots of time to the email system, to the LDAP system to authenticate users, to the server system, to communicate with the scan it to file it. Man, it's just a it's a cornucopia of goodness for jackpot for the bad guys, right?

Dr Chase Cunningham: crazy easy and it's the the automation side. while we were chit chatting there and kinda looking, I went off and fired another little dork that I wrote and basically now I've got the admin login and default credentials for that printer. So I mean it took while we're on this call, I found forty access points I've got I could potentially log into and just start doing stuff and like you're saying, the I would bet my money that on the back end of getting through that that there is not segmentation and isolation and those things.

Jim LaRoe Symphion Inc.: No, no, and then and then you gotta identify all the cows that go in the corral for the segmentation, you've got to make sure that's not a one-time thing. It and sometimes they'll okay, so let me let me ex let me expose the dynamic that's going on here and why we're here, okay, because I think that's the money part to understand because that you understand why we're here and that helps you fix it for the future, right? So so the the printers have been purchased in supply chain and procurement in larger companies, just hey, let's get it and and and put it out on the network. And then there's this whole business that's come about called managed print services that is really about driving out cost in the operation of the print service inside the business, right? And and printers are not just in some places they're just office equipment. If it goes out, it's no big deal. In other places they're essential. in healthcare, they're in essential workflows like, when you get admitted, when you get discharged, your labs, your pharmacy, your ER, all that really doesn't move without the wristbands and labels and all the other stuff that's out there, you know, or a distribution center, bills of lading and invoices and things and manufacturing process. You know, it's a bottleneck if those devices go out. So they've got a you know, they're important devices. But there's still the IT group is focused on, Windows-based platform, operating the the data center servers, the network elements, all the all that have to do with the network. These have grown up where the the managed print service industry sells them and carries and feeds them at a cost with a cost filter. So adding security to that's only bogging them down, right? You know, we've

Dr Chase Cunningham: Yeah, yeah.

Jim LaRoe Symphion Inc.: had guys come in here in the office at Infion even. working on a on a on a printer and reset it back to factory after they're done. That's the don't click on the email member when we're all so paranoid about still about that. But it's like they reset the factory after they've done something on the device. Or they reset the the firmware if they do something like that it resets it to factory. or update it gets blanked out pretty easily and swaps and things like that. So It's grown up over there outside of IT, outside of information security, really, So in and and there's a cost factor to prohibit it from being adopted, So now we enter this situation where it's like, what are the levers that they've got? What can they do? what am I gonna do? Am I gonna try to get the managed print and I I've talked to so many CIOs, C I S O CTOs. large and small companies, they all think, man, it's managed. The endpoint is managed because it's managed for, uptime supplies, cost elimination, eliminate the print service and all that. But it's not for for cybersecurity. So we've got to have requirements that go beyond, it needs to have an owner. And it and the requirements have to go beyond just the one time set. the zero trust principles, you've got to have you've got to have proof, continuous proof, right? And in this situation here, is is not a r it's not a static situation. It's a very dynamic, they're very subject to change in the in the environment. So hope I'm not talking too much, man. I got a lot to say about it. It

Dr Chase Cunningham: No, it's it's interesting to hear from people that are doing the work and and stri I mean, is it in your experience at people that are like this is is there just an apathy to take care of this thing? 'Cause what's crazy in my opinion is, you know, I've I talk with CIOs and CISOs every day of the week, a whole bunch of different orgs and they're all worried about malware and all this, whatever else. But if I say something to them as simple as, Well, what about your printers? They look at me like I got a freaking dick run out of my forehead. Like it's

Jim LaRoe Symphion Inc.: Yeah, yeah. It's a pejorative for sure. it's not a

Dr Chase Cunningham: mean they're just like butt printers, like what?

Jim LaRoe Symphion Inc.: Well, some of that is come from the beginnings of the printer, right? the analog, no respect it's a Rodney Dangerfield endpoint, right? Nobody respects it. It's forgotten. It's been outside

Dr Chase Cunningham: Yeah, I get no respect, yeah.

Jim LaRoe Symphion Inc.: Yeah, no respect. It's been outside the the purview of IT. IT doesn't wanna do. They're busy, right? They've there's they're taxed and and this is complex endpoint because a typical f any kind of fleet is gonna have different brands, different models. and and different you know types and ages. The devices they they stop supporting them after about five years for a normal multifunction. They don't put any more firmware out even, you know, so it's like and it's complex and they break, you know, so it's like it they haven't done anything, you know, and then it's political too, man, because if the supply chain owns it, they've had it for a long time. They have a whole setup How to evaluate the vendors, not only from the device feature standpoint, but also the service standpoint, a cost factor on it. So they've got the procurement motion going like that, So we've seen a bunch of different approaches to it. Some are more successful than others, that that but that's how it's slipping through the cracks, it's slipping through because There, I'm I I don't want to say that an information security professional doesn't understand the risk. I believe that they all do. They they all have to know that that that endpoint is it is not only an edge risk, but a a t walk up may physical it's a 360-degree risk factor, and all it takes is one. it just takes one bad one that that they didn't track. And we go into these accounts, Chase, and they they don't have an inventory of the printers. Okay. It's it's or it's obsolete. Or we've got to build it from, some discovery tool or or that they've got that's incomplete or some record or the CMD is not accurate, So that's the core lifeblood of anything that you're managing from numerosity standpoint is what do you have and where is it and how are you using it? from a tiered application standpoint too. So it's like, man, we're having to fill all that in because it's not being done. it's not like People think, well, let's do an inventory, you go in the the pantry and count the the cans on the shelf, right? Man, these guys this this is like an amoeba inv inventory because they're constantly moving around and the edge is changing and and there's no visibility to it. So it's it's a constantly moving target. And they I think it's just daunting. I believe that they probably think it's gonna be like if I touch it and break it, I'm gonna get blame for it too, know.

Dr Chase Cunningham: Yeah. And printers are like you say, it's you don't think it's a critical service till you p fuck one up and then it all of a sudden becomes a critical service.

Jim LaRoe Symphion Inc.: Yeah. A hundred percent. It becomes I got that on me and I can't get it off and it's like so you have to have a program that mitigates that. You have to treat it like an endpoint, a mature endpoint that it is. Some of I think, think it's going away maybe, we're digitizing, but it to a certain extent

Dr Chase Cunningham: Still print stuff.

Jim LaRoe Symphion Inc.: well hey, to a certain extent that's that's true. But we're also seeing They w they're printing like it with the electronic medical records, we saw a lot more printing for some reason, know, in

Dr Chase Cunningham: Well, they're backing up now because they're worried about a ransomware hit and they have to have paper records.

Jim LaRoe Symphion Inc.: I guess, man. I guess. and then, your your piece on insurance I thought was great. we think maybe in the back of their mind they're saying, Hey, look, we've got insurance that's gonna bail us out on this. And it's like, you know, maybe not, you know, maybe

Dr Chase Cunningham: Probably not.

Jim LaRoe Symphion Inc.: maybe not. But I think it it comes with maturity too, because we're seeing we're seeing, you know, board positions with cybersecurity hat now. it in in all size companies. We're seeing the chief information security officer advent of that position, right? Or information security leader or something, some title for that in the business. And who are they reporting to? They're reporting to the CIO, CEO, CFO, some board member, there's different levels of importance and maturity that you can see from that. But man, this is I'm I spent the last year and a half, Chase talking about the risk factors. We said, man, let's just get it out there because we we partner with everybody in the print industry. Okay. That we don't need them to deliver. They resell us to customers. And we're like, we're thinking maybe customers, they're they're demanding this, but it gets blocked off over in what we call the print silo. And those guys, they want to, the OEMs want to sell the printers, and they don't want any jam up on that. And the managed prints, they want to sell the managed print. So, they're not necessarily wanting somebody to grade their paper, for security and configuration management and farmware patching and certificate lifecycle, all that stuff, So it's not it it it we've been out for the last year and a half talking about risk, We thought, well man, maybe they just don't understand the risk of this IoT endpoint and we do cameras too, stuff like that, the other IoT configurable endpoint. And it's like maybe they just don't understand the risk. And it's like, no, no, there's more to it. There's a motion that that they haven't done because of these reasons we just talked about, right? The the risk owner and they gotta fund it

Dr Chase Cunningham: Yeah, I mean

Jim LaRoe Symphion Inc.: too, they have to fund it. So we see some of them do we see some of them take a pen test, a vulnerability scanner. This is maybe our number one come to Symphion use case that we see where they've run a pen test on some of the printers, the ones that it won't blow up or or knock offline because it they don't have enough memory on But but they they'll do a pen test like a Rabbit Seven Aqualas or Tenable on on the the endpoint and say, look at all these C V E's and then they toss it over the wall to IT and say go fix it. You know, get rid of the C V E's, which is that's like centering on what the manufacturers chose to report not the holistic protection of the endpoint, from the three hundred and sixty degrees that you would have from any other endpoint like walk up access or hard drive protection or the stored credentials or internal that kind of stuff that that is really presented by the endpoint. So but that's that's something that we've seen do, It's

Dr Chase Cunningham: a a lot of times people probably wouldn't even if you see if you I bet I would guess if you put probably not enterprise because enterprise folks are a different breed, but if you put a hundred mid sized business people in a room and said how many of y'all understand the risk of a printer in your network, I would bet three out of a hundred would actually really understand the risk. The rest would be like, I yeah, it's a printer or whatever else. Or I mean think cameras probably are a little bit more you know interest for people because there's that creepy factor of someone can see what you're doing, But a printer and some of these other IoT, OT devices, what's now they have the the network road signs. I find those all the time poking around, that are up and talking stop light cameras and stuff like that. It's it's it's not difficult. and it these are access points. and yes, you might have your enterprise locked up, but if the printer or whatever stupid access point you have floating around there is mismanaged or misconfigured. And to your other point from earlier, I it is not beyond the pale to see these things that have been sitting there collecting dust printing for a decade without ever catching an update.

Jim LaRoe Symphion Inc.: Twenty years, twenty-five year old, it's sitting there. They don't even know they have it sometimes. it it's it's when you have a multinational a multi-site organization like we've got companies with they're in fifteen, twenty different states or three states, or they've got, sixty hospitals or something like that, man, you don't have that that fingerprint on that thumb on what's going on. the the CMDB ServiceNow just bought Aramis, right? That for almost eight billion dollars. And Aramis is a network packet reading discovery solution out of Israel, and those guys, they're trying to fill up that CMDV with the IoT devices, but that just tells you that tells you you've got it and and then that something's out there, maybe it's not set up. right from externally looking at it, not the internal capacity of the or settings of the device. And it really centers on the the fix centers on cybersecurity operations, continuous operations. So it's it really centers on a program oversight of the endpoint. You know, if the industry is not going to police itself, you've got to put oversight for continuous operations for cybersecurity operations to to make sure it's the state that you've chosen is implemented and maintained and proven, right? because it's it's one thing to say we're gonna do this or they're gonna do that or we're capable of doing this. And and it's another thing to make it actually happen. it's it's true protection. we're not security's not a hundred percent right. you guys smart

Dr Chase Cunningham: I mean, you're always gonna have something. There they're there you play the numbers. There the odds of you having something misconfigured or whatever, sure. But like it if I i it just seems like it's potentially egregious to me, especially if you're a hospital or something and you've got a a ten year old mismanaged, misconfigured, unpatched printer that's talking to the internet. Like that that to me is somebody should burn for that.

Jim LaRoe Symphion Inc.: Well they set them to phone home too sometimes. the print industry will have them communicating off network. And it it's we had we had one we had one case where in in the the manufacturers they make software to control the device, right? Each one of them is brand limited, you've got to learn it. It's it's API access to the device that's hard coded in, you know, and And but it's not always caught up to the features that they have. they may update a firmware. Say somebody's on them to update the firmware on the devices, right? And keep it not an N minus one, but a current, let's go zero day and pop it on there as soon as it comes out or something like that. And it's it's not necessarily a zero day patch, but that kind of urgency, right? And they put it on there and it introduces a whole new whole new UI, all new features, or wipe something out or something like that. And it's like, they can't see it with their device management software. So it's like, we've seen that happening too, even in the ones that are trying to do, configuration management, basic cyber hygiene on the endpoint. we see that we see that out there, but it and it and then they've got to have different they've got to have some of them have a straddle on different software to manage their devices or they're not covered, or you can't update firm or the It's it's a nightmare. So if you've got any more than fifty devices, the industry speaks to mixed fleets and homogeneous fleets. Man, it's a mixed fleet everywhere we go. it is just it's there's no such unless it's real small, really small, know, and you've

Dr Chase Cunningham: Yeah.

Jim LaRoe Symphion Inc.: got all the legacy stuff. Yeah, man, the the legacy stuff that you're talking about, right? it's it's twenty year old devices that are that you've gotta have you've gotta put you've gotta take measures if they're gonna hold on to that, you've got to take measures to address it, right? segmentation, maybe you've got to up even before we put certs on them, we've gotta upgrade the firmware, and things like that. we came out in January with a a closed loop certificate lifecycle deployment and management program because the last mile, there's a lot of C L software out there, but there the last mile doesn't authenticate or log into the printer to get the data off and see where it applies or update the firmware. you can't do that. That's a constant vigilance, especially with your machine identity if they're enforcing it and not writing the exceptions, you know, you've got you've got you know, that's our real big defense c for what's going on right now, man, is, you know, the the identity based networking component of it. machine identity and it's it's you you've gotta make sure it's applied in the right spots. And we built a closed loop to their CA and and validate and put it back, on there. And then you got the cert cycles are going down to month and a half, forty seven days or something like that. it takes a lot of effort. So you gotta get somebody who you said you Got a frowny face when they you talk about printers and they look like they smelled something and it's like, you gotta convince them that they've gotta get that protected to a certain level or their risk factor is there. And then they've gotta know how to make that happen in their business politically, financially, everything else.

Dr Chase Cunningham: So d tangenti, but I think it fits here is do you in your experience, do you think if I am an organization and I'm compliant, like I'm certified, I'm Gosslock two ISO, whatever else, and I've got a misconfigured dorked up printer on my infrastructure, am I compliant?

Jim LaRoe Symphion Inc.: Man, you know, Chase, I'm I'm a Texas trial lawyer, okay, and I blame people, made a lot of money doing that over the years, okay. So this would to me would be something that is really, really bad if you got caught. You know, I mean it's like if you're certifying compliance and one of the questions has the printers in scope, then you probably have some significant risk associated with that. we don't have a GDPR here in the United States, right? where the the the penalties are real thick. the this SEC's trying to tighten down on some of the public companies. HIPAA is really not it's not I mean, it's not enforced at that level, right? I mean, we started off centering on HIPAA compliant. You would think your question is totally relevant because we started off when we launched the the the program in twenty eighteen. We started off with our hospital customers saying, Hey, look, this help you keep in compliance with HIPAA, but the realistic factor is they've got thirty thousand complaints a year. They write about maybe one or two and they give all these chances. it's we did we had the f the head of the OCR, former head of the OCR on the call on a webinar we did with her and she's like, how do you do a comprehensive risk analysis if you're not including the printers in there. you've got to have an answer for that. You it's it's like your risk register, right? everybody talks about that. How am I gonna address what what deliberate decision have I made to address this endpoint or not address it, right? you've got to go in with your eyes open and say, hey, we're gonna we're gonna assume that risk and we're making a deliberate decision to assume it. And that's just how we're doing it at the corporate level. They're doing that now by default, right? But if they're certifying and there's some there's some penalties associated, whether they be civil or regulatory penalties, right? Whether they have those kind of downsides to it, you know, is is really what you're asking. Is is I you know, am I gonna get my wrist slapped or is it gonna cost me, you know, a whole bunch of money? You know. We did a we did a Some white papers. We call them this guy this guy over here in Dallas did a he set out a a financial model called a five factor sensitivity model for n failing to do something, you know, like choosing like I I I'm gonna see this risk and I'm gonna choose not to do it. What does it cost me if I'm wrong? Right? And that's business, right? We make decisions all the time. Maybe I leave my front door open at night or I don't lock my back door, I you know, Or, I choose not the word seatbelt, even though it's the law. Okay, right? those are all decisions that we make. But we saw the sensitivity to revenue lost. Okay. we we did revenue lost, operation cost increased, regulatory cost, you know, the data cost for the data like credit data or e fi or health data, the third party costs. And we did a sensitivity analysis. It's big deal, man. It's a lot. Even for a small departmental cost. and we we did it from the standpoint of say they're enforcing a machine, the identity on the network. Okay. The cert's gotta be valid to s to show up on the network, to to be on their network. They're enforcing the zero trust principle, okay, of that. And and I'm it's which I believe they need to do across the board, okay. But it's like they're the and they have an outage because it didn't valid one is n the whole whole group fell off. They didn't keep it tight, or they they invalidated or you have a an event that affects a certain thing like a data center or something like that. I mean a a distribution center or something like that or maybe a department in a hospital. It's a big number, man. It's a it's a big number to to do that you know, to have that happen and but It's like buying insurance, right? What are you gonna what are you gonna spend your money on to prevent the bad stuff from happening, right? we have

Dr Chase Cunningham: Mm-hmm.

Jim LaRoe Symphion Inc.: the law we don't have that law here in the United States, right? To make us do that, we get to choose what we're gonna do, They have that the public companies have to fill out a representation for I think it's I what's the name of it? one six or something like it's SEC certification they have to certify that they're protected, for the shareholders and it that's about as far as you're getting. So, the the risk with the civil lawsuit, if I if I certify compliance, the first thing in the plan floor in a class action or something like that, and there are lots of them popping up, they're gonna do is they're gonna say, what did you do here? you certified this. They're gonna get your attestations and records and your underwriting from your insurance, like you talked about in your podcast. you know, all the records and trappings of, you know, what it is that you represented that you're doing. You know, I mean it's it's it's okay to assume risk. You've got to just make a corporate level decision to do that, not one person blowing it off or because it's not politically, you know It's not gonna be sexy or something like that,

Dr Chase Cunningham: Yeah. Yeah, I think this is a topic that we I think we're gonna have to revisit in the f in the near future 'cause it there's there's more to uncover here, especially your kind of unique background on the legal side is is interesting too. So you know, one thing I I always when I'm talking to a guest that I like to try and do, and this one's been kind of fun for me 'cause you literally gave me a reason to go do some old red team and stuff. I I just this minute while you were talking took some of the results I had and went a little leaper and again, folks, I know how to do this without breaking the law, get myself in trouble. I know beyond a shadow of a doubt right now, I would stake my my firstborn child on it. There is a hospital system in New York, in Brooklyn, with a misconfigured printer talking to the internet that is part of the largest healthcare system in the state of New York right now, today. And it took me while Jim was talking, it took some clicks to fuck to get around. And by the way, the system tells me how long it's been up without being patched. It's almost five years straight. So, it tells me the number of seconds that it's been running unpatched. And I went through that into an AI and I said, Tell me how long this is in days and months and weeks. And it's four point six five years that this thing's been sitting there just like this, misconfigured, talking to the internet. And I will guarantee you that that hospital has got a HIPAA and a high trust certification.

Jim LaRoe Symphion Inc.: Imagine you got twenty thousand of those.

Dr Chase Cunningham: Yeah. And imagine I'm somebody that's not on your side, right?

Jim LaRoe Symphion Inc.: You don't know. You don't know what you don't know. And it's

Dr Chase Cunningham: That's that's it. You don't know what you don't know and the the lack of willingness to find out what you don't know is not an acceptable excuse.

Jim LaRoe Symphion Inc.: Yeah, it and it's it's not a we had we did a we did a seven thousand device sleet in about a month, a couple of months ago and and I had been talking to for quite a while, right? You know, the customer and and I'd been telling you know, with us and this is not I'm not selling here, but it's true, you don't really have to know the printer endpoint, okay? 'Cause that can be a hurdle You don't need to know printers and they were like, Yeah, Jim, you're right. You we didn't need to know the printers. we needed to we need to engage guys and and let you guys do this. And it's like, that was a pretty strong story, I thought, you know, maybe because they're they were centering on, you know, man, we don't know printers and and you know, those cycles on the the the managed print cycles, they do about five years every five years. So they got a new set of people coming in. They're They're pushing new devices to come in, right? So, or maybe not, or they're gonna manage the old stuff. And they're all doing it on the cheapest most of the cheapest that they can do. So it's like it's a cost it's a cost

Dr Chase Cunningham: Cost benefit risk, all that calculation.

Jim LaRoe Symphion Inc.: Yeah, yeah. And it's like, man, somebody's got so what we're saying is like Mr. Information Security Professional, we're right. the and and and here's another one. We seen we seen one that will remain nameless that's that had a huge big hack, okay, and hundreds of millions. And they had an a request for proposal. That's how they purchased the printers and the service. It's a it's a twenty billion dollar year industry, the managed print service industry in the US. And that's how they purchased it. And they lay out the requirements. You've got to do this stuff. And this one had, man, it was really good. It had a bunch of different controls set. They had really thought about it. and it was one of the more mature ones that we've seen. We can read the tea leaves and see how mature, because it's got that requirement has to go from information security GRC into the printer procurement process. And be a requirement for a company that really didn't do that. Okay. But it's in there to try to get them to pay for it as part of their service. But what was missing was the service levels. Man, it's like it's like you know, what's the what is the mean time to discover detect a a change? Okay, these guys reset the factory all the time, and it's like Or they swap it out or they change a motherboard, it drops off. the SNP scanners that they use to run the industry are just not real accurate and it it's not it doesn't manage when devices are off and come back on and networks change, businesses change, all that. It didn't have mean time to remediate. so if I've got to go set a project and I'm gonna clean it all up every quarter, you're the zero trust guy. What do you think about now and that you gotta clean it up every quarter with the AI, how

Dr Chase Cunningham: Yeah. Mm-hmm.

Jim LaRoe Symphion Inc.: is that gonna work? or we're gonna patch once a year, maybe, or we're not gonna we're gonna do cell sign certs, if any at all, And then

Dr Chase Cunningham: Yeah.

Jim LaRoe Symphion Inc.: then we've got the future coming where Microsoft is trying to lock down no drivers on the on the Windows eleven, so everybody's gonna communicate. directly to the printer with the IPP and it's gonna need a cert on it for IPPS. there's a whole lot to do with the care we're not printer company, we're endpoint security company. So it's we just happen to have the IoT endpoint because it's a where we're focused. But it's like, we're looking at the the endpoint. It's like, how are they gonna address that, man? What's the current feeding? It's a different skill set from, fixing a broken printer to making hypervigilance security, decisions or or even recommending a program, we build that into our program, recommendations, lessons learned, here's what you need to, what is your standard you've got to comply with, right? NIST, is it is you centering on diesel stig? Or what what are you centering on? what what zero trust principles do you want to establish for the endpoint and maintain? What we'll include those. how is that something that that you know, you're not doing for this endpoint? So it's like, you know, we're talking, you know, running around talking to guys like you and you know and and evangelizing the need to do this, you know, because it's not getting through you know, it's not getting through to the the the the the the motion from The information security, which I believe they understand the risk, man. I really do. I it it's it's really smart people in information security and GRC and all all sides of that, right? I mean, and IT is really smart too. I can't believe that they're not understanding that they need to do something. You know, I think it's just that they don't know what to do. Their politics with the procurement and ownership, an incredible silo that's been built around that printer input. and we came into that in twenty fifteen, from managed CMDB supporting outsourcers across all IT assets, service or the the the release level reports, so they could prove in the IT outsourcing what they're managing, right? You know, what the numbers and and and you know, we got into one of them OEMs called us up and said, hey. we bought this IT services company. Can you come help do your thing on that, as a additional service for their IT? Well, they were S and B, but we got involved in the the business. We saw, man, this it's an alternative universe of printer endpoint, and it and the printer is really the most configurable, most mature IoT device. Okay. And it's gonna be it's where the The cameras have gone. Okay, you got a lot of Chinese cameras. They're configurable too. They have admin passwords. They have firmware. They have S N P older versions, things like that. And like you said, the Beckers, the Beckers reporting group, the the hospital group, they said the number one and two hacked IoT in in healthcare are cameras and printers. So yeah.

Dr Chase Cunningham: But I that that that if there's a if there's a line to leave it with, there we are. So folks, when you're listening to this, I'm gonna have Jim back on because we could go through this and talk about more IoT stuff and he he didn't mean to, but he's given me a reason to do a little bit of red team and things, which is fun. Yeah. So Jim Leraux at Symphian S Y P H I O N Inc. He's in Dallas, Texas, you can tell 'cause we're both Texas people. He's got He's got the accent a little more than I do 'cause I got out of town when I was younger. But Jim, we'll bring you back on and we'll go through this again. I think this is one of the most interesting topics out there and anyone that doesn't consider their printers a risk, you should wake up.

Jim LaRoe Symphion Inc.: Thank you, Chase. I appreciate you having me on, man. It's been a blast.

Dr Chase Cunningham: Awesome.