SANTA CLARA, Calif., Oct. 12, 2021 /PRNewswire/ — Ordr, the leader in agentless security for all connected devices, today announced the appointment of René Bonvanie as Executive Chairman to the company’s board of directors. A 35-year executive leader, René brings a wealth of operational and go-to-market experience, providing strategic counsel and guidance to Ordr’s leadership team. He currently serves as an Executive in Residence at Battery Ventures and previously worked for over ten years as Chief Marketing Officer of Palo Alto Networks. Dominic Orr, Ordr’s Executive Chairman of the Board since 2019, will remain on the company’s Board of Directors and continue working closely with the senior management team.

“René’s deep expertise in the cybersecurity market, his intimate familiarity with customer needs, and his understanding of Ordr through his work with Battery Ventures are an ideal fit as we continue to grow rapidly,” said Greg Murphy, CEO of Ordr. “We are delighted to have a world-class executive of René’s caliber joining the Board and working closely with our leadership team to deliver the greatest possible value to our customers.”

As CMO of Palo Alto Networks, René grew the company from startup through an initial public offering, and then scaled it to become one of the leading cybersecurity vendors in the world with nearly $3 billion in annual revenue. He also served in senior executive roles at a variety of companies including Ingres, Oracle, Business Objects, SAP, and Salesforce.

The Executive Chairman appointment follows a record-breaking quarter for Ordr, with 125%+ year over year growth in new annual recurring revenue (ARR) and record total bookings. The accelerating growth was fueled by market demand for connected device security across verticals, including healthcare and industrial.

“René joins us at a pivotal point in Ordr’s journey and in the industry. With the alarming increase in cybercrime, organizations are looking not only for visibility and insights on connected devices, but a complete set of security features to protect and respond to cyberattacks. Ordr is well positioned to meet these needs, and René’s experience will be invaluable in accelerating our growth,” said Pandian Gnanaprakasam, founder and Chief Product Officer at Ordr.

“I’ve been working with Ordr over the last year and have been impressed by the team, the technology, and their customer traction.  Ordr is redefining the connected device security market with an innovative product that addresses a variety of visibility and security use cases,” said Bonvanie, “I’m thrilled to take on the Executive Chairman role and look forward to working even more closely with Greg, Pandian and the executive team, building on Ordr’s record-breaking growth and seizing the opportunities ahead of us.”

This announcement comes on the heels of Ordr’s Rise of the Machines 2021 report, which analyzed connected devices across healthcare, life sciences, retail, and manufacturing verticals, uncovering a shocking number of vulnerabilities and risks. Download the full report for additional findings and details, “Rise of the Machines 2021: State of Connected devices — IT, IoT, IoMT and OT” .

Ariana Grande and Nicki Minaj performing “side to side” is one thing, but unusual network traffic moving side to side (internal lateral movement), now that’s a whole different story. An in a healthcare environment where sensitive customer information is stored and lifesaving equipment is connected, it can be downright dangerous. In part 3 of 6 in our series on Control, we dive deeper into Network Control and the concept of traffic control of internal lateral movement to help you maintain order in your healthcare facility.

Trouble in Louisiana

Remember when Louisiana’s governor issued a state of emergency in response to a rash of malware infections that hit the public schools? In the northern part of the state, the ransomware attacks crippled these schools when malware was embedded and allowed to spread quickly throughout the campus. Sorely needed files were encrypted and criminals demanded payment in exchange for the decryption key.  How did this happen? Clearly someone with a lot of resources found and exposed a vulnerable spot in the network.

What Perimeter?

Firewalls are one thing but people and devices move around constantly. What is the purpose of a stationary perimeter if there is constant movement in the network? Consider, for example, a hard-working healthcare worker (Bob) at a regional hospital who goes home late at night and connects to the web and accidentally clicks on a few bad URLs here and there. Without his knowledge, he has just downloaded malware onto his trusty laptop. The next day when a connection is made to the hospital network, this is when the malware does its thing, performing reconnaissance to understand the devices near its proximity so it can spread. This side to side movement is what you need to stop and contain right away.

Know What You Have

Adding anti-virus software is one thing but consider many medical devices that can’t be patched in the first place or think of the headache of keeping a log to make sure all devices are patched. Most often, we find that many hospitals don’t know what’s exactly in their network in the first place. Assuming you’ve taken the necessary steps to add full visibility, the next necessary step is to implement network control specifically network traffic control.

The Traffic Tower

If and when a breach occurs, the quick remedial action to take is to ensure that the malware does not spread. Ordr’s traffic control can ensure that the damage is restricted to a small contained area and the whole hospital network does not go down. When routers, switches, gateways, and firewalls all have flow-based whitelisting enabled, a bad packet from Bob’s laptop computer will be stopped and it will never make its way to a camera or a medical device in a different part of the network.

We can take it further with rule-based automation. For example, if we find that a camera is trying to have dataflow to a particular VLAN that it shouldn’t and the flow looks unusual, we can shut it down right there and then. It starts with total visibility and having the smarts to see all the internal traffic movements, up and down and side to side. Worried about MAC/IP spoofing? We take care of that too.

Much Happening Behind the Scenes

Network control is also about who gets in and out of your network. The point of entry can be wired or wireless, it can be serial or VPN. Doctors, nurses, visitors connect all the time to the healthcare network. It’s important to have the smarts to know what’s happening with the traffic flows, all the stream of information moving north and south and also side to side. And just like Ariana Grande and Nicki Minaj, we’re good friends with Infoblox and we play nice with Cisco ISE. Go ahead, do a little dance, Ordr has you covered.

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.

Peter Drucker may have directed his famous adage, “you can’t manage what you can’t measure,” to business managers, but these words ring just as true for network and security managers. Technology leaders constantly measure and manage risk, performance, capacity, and numerous other metrics.

However, there’s an important corollary: You can’t measure what you can’t see. Without visibility, measurement and management become almost impossible.

Nowhere is this more true than with enterprise networks. They are complex, constantly evolving, and continually connecting more and more devices. Comprehensive visibility into the traffic, devices, behaviors, and risks allows network and security managers to take the key measurements needed to make smart decisions. However, hooking a multitude of “monitoring solutions” to a network can create problems with performance, SPAN/Tap availability, and complexity.

This is where Gigamon and Ordr work together to provide a comprehensive infrastructure for network and device visibility.

The Gigamon Visibility and Analytics Fabric collects full-fidelity information from your physical, virtual, and cloud network infrastructures, optimizes the traffic via de-duplication and advanced filtering, and creates a consistent and centralized interface for viewing all data in motion. This can particularly benefit complex or distributed organizations, allowing centralized monitoring of east-west (internal) traffic as well as north-south (datacenter-to-internet) traffic. Enterprises benefit from full visibility into network traffic, regardless of its origin or destination.

Ordr SCE leverages the Gigamon Visibility and Analytics Fabric to passively inventory and classify every device on a network, from traditional IT devices such as workstations, printers and servers, to IoT devices such as medical devices, building automation, and security cameras, to operational technology (OT) such as manufacturing tools, sensors, and PLCs. Ordr then takes this visibility to the next level: not just identifying network devices, but identifying their behavior, their communication patterns, and their risks.

Gigamon and Ordr joint solution

When deployed onto the Gigamon infrastructure, Ordr can be deployed more quickly, with less (or less expensive) hardware, and with less contention for SPAN or TAP ports on network switches. Additionally, Gigamon’s ability to centralize traffic often means a more comprehensive inventory of devices that are connected to complex, highly distributed networks. More visibility means better management of risks.

Interestingly, encryption adds another twist to the visibility story. While internal use of TLS improves security in many ways, it can also blind network analysis tools to the data needed to identify security breaches like advanced persistent threats (APTs), remote access trojans (RATs) and crypto mining. Gigamon Visibility and Analytics Fabric addresses this challenge too. Its TLS decryption support offers a secure window into encrypted traffic, giving Ordr complete visibility into encrypted inbound, outbound, and internal networks.

Together, Gigamon and Ordr give network, security, and business-aligned technical groups (such as clinical engineering) unparalleled visibility into enterprise networks, devices, behaviors and risks. Gigamon customers seeking to identify and protect IT, IoT, IoMT, and OT devices should schedule a free demo of Ordr SCE to see how it can quickly and easily offer new levels of visibility and security for the devices in your network. Ordr customers who wish to optimize their network visibility infrastructure can reach out to Gigamon for a demo or free trial as well.

Full visibility into network flows, devices, and network behaviors with Gigamon and Ordr makes measuring and managing your risk a straightforward task. Peter Drucker would be proud.

For more information on Gigamon and Ordr, check out our solutions brief here, and watch our See, Segment, Secure webinar here:

Bryan Gillson

Bryan joined Ordr in November 2019 after spending six years as VP Strategic Alliances at Ionic Security. At Ionic, Bryan initiated and managed business relationships with system integrators such as Accenture, Deloitte, and PwC, and closed OEM partnerships with vendors in the CASB, virtualization, and data protection sectors. Previously, Bryan led product management and business operations for Symantec’s encryption products and information protection groups after integrating the acquisitions of both PGP Corporation and GuardianEdge. Prior to Symantec, Bryan led the business development team at PGP Corp. and was a VP in Merrill Lynch’s Technology Investment Banking group.

• Huawei Technologies Co.
• ZTE Corp.
• Hytera Communications Corp.
• Hangzhou Hikvision Digital Technology Co.
• Dahua Technology Co.

Compliance Made Easy with Ordr

Awareness and concern over security implications associated with the flood of connected devices hitting the market is growing worldwide, and governments are taking notice. Here in the U.S., it started after it was discovered that internet-connected security cameras made in China, and in common use at Department of Defense facilities, were sending data back to their manufacturers. That prompted Congress to take targeted action prohibiting the purchase of communications gear made in China. The Secure Equipment Act of 2021 was signed into law on November 11, 2021.

But unsecure IoT and Internet-connected devices aren’t a problem limited to products made overseas. The journal EE Times recently reported that the security of connected devices is a major concern, and that manufacturers of such products are not reporting known issues and vulnerabilities with their goods.

New UK Bill Aims to Protect Consumers

Now, a new law being considered in the UK seems intended to protect consumers from the threats associated with unsecure connected devices.  The Product Security and Telecommunications Infrastructure (PSTI) Bill is expected to become law sometime in 2022 and would establish new rules for Internet-connected devices made and marketed to consumers. PSTI would prohibit universal default passwords, ensure transparency related to known security flaws and what actions are being taken to mitigate them, and require the creation of better public reporting systems for discovered vulnerabilities.

Industry research, current events, and laws like PSTI show that personal and enterprise security have never been more vulnerable and intertwined. Vulnerabilities in Internet-connected devices don’t just put consumer data at risk, but also put corporate and government enterprise integrity in jeopardy. While PSTI is focused on the consumer-grade IoT market, we know many such devices make their way onto corporate and government networks.

Consumer Devices are Connecting to Commercial, Government Networks

Ordr’s own research has found devices like Pelotons, Sonos and Alexas, Kegerators, and many more unmanaged, consumer devices connected to corporate networks and healthcare environments—often for legitimate purposes and operations. Alexa devices, for instance, are being used as substitutes for the nurse call button, turning on lights and TVs with a voice command. Pelotons are being adopted for physical therapy. Imagine if those devices were to become compromised after connecting to a hospital’s IT infrastructure.

In Ordr’s view, legislation like PTSI should be expanded to cover an even broader array of devices, including those designed specifically for the enterprise as well as the consumer. Enterprise devices, and even medical devices, share many of the same vulnerabilities. Instead of merely requiring transparency, PTSI should mandate designing security into IoT products, ensuring secure protocols and technologies are used for key functions.

More Awareness, Security Needed

PTSI will help make consumer devices safer, but beyond safer passwords and vulnerability management, organizations still need to consider additional security best practices, such as:

• Maintaining a real-time inventory of devices: You can’t protect what you don’t know about. Security starts with real-time visibility of exactly what you have in your network and how those components are communicating in the network.
• Monitoring device behaviors for suspicious communications: Devices have deterministic functions. By using machine learning to baseline what behaviors are normal, you can then identify abnormal device behavior that may be an early indication of an attack.
• Tracking who is using your devices: By tracking and associating devices to users, you can identify compromised devices and also potential account misuse.
• Implementing Zero Trust segmentation for vulnerable devices that cannot be patched: Zero Trust segmentation policies can keep these devices in operations by allowing “normal communications” required for its function, while limiting exposure.

We believe PSTI is a good start, but much more remains to be done to make all internet-connected devices, and the people and organizations that use and rely on them, safe.

Danelle Au

Danelle Au has more than 20 years of experience bringing new technologies to market. Prior to Ordr, she was CMO at Blue Hexagon, a deep learning for malware protection company, and CMO at SafeBreach where she helped build the marketing organization and and define the Breach and Attack Simulation category. Previously, she led strategy and marketing at Adallom, a cloud security company acquired by Microsoft. She was also Director, Security Solutions at Palo Alto Networks, driving growth in critical IT initiatives like virtualization, network segmentation and mobility. Danelle was co-founder of a high-speed networking chipset startup, co-author of an IP Communications Book and holds 2 U.S. Patents. She has an MSEE from UC Berkeley

Santa Clara, CA – January 11, 2023 – Ordr, the leader in connected device security, today announced that it is collaborating with GE HealthCare to offer customers a solution leveraging Ordr’s market-leading platform for health systems.

The solution addresses critical patient care challenges across three key stakeholder groups: biomedical and healthcare technology management (HTM) teams, giving them the granular visibility as well as performance and utilization insights they need to improve medical device management; IT teams, helping them to monitor network connectivity and performance, while mapping device communications flows; and security teams, helping them to identify, prioritize, and self-manage responses to vulnerabilities, threats, or anomalies.

Healthcare providers rely on a wide range of network-connected devices to improve patient care and enhance clinician productivity. As the care environment becomes more complex, health systems are struggling with:

• Lack of visibility into device status, such as determining which devices are in-use, identifying new devices, or devices not yet registered in their asset inventory database;
• Monitoring and troubleshooting devices impacted by communications or performance issues;
• Lack of accurate device data (OS, software version, etc.,) to assess risks, manage vulnerabilities, and implement mitigations; and,
• Locating mobile and portable devices, with many organizations spending almost an hour per person per shift searching for equipment in need of a service action

To help ensure continuity of service for these devices, continuous monitoring of network performance and security is essential. Incorporating Ordr’s solutions will enable GE HealthCare to provide continuous network performance and security monitoring of all clinical assets connected to the CARESCAPE network. The proven, market-leading capabilities of the Ordr platform will help enable broad visibility, performance monitoring, security, and governance of all clinical assets on the CARESCAPE network, providing customers with enhanced self-management capabilities for their critical patient care devices.

“Empowering biomedical technicians, clinical engineers, and hospital IT with easy-to-use tools aimed at improving self-managed network security, productivity, and equipment uptime is key to enhancing critical patient care,” said Alla K. Woodson, GE HealthCare’s Global GM, Patient Care Solutions – Services & Consumables. “This network performance and security solution brings together the technology and scale of our two organizations to help ensure that our customers have visibility and access to actionable insights.”

“Hospitals and healthcare facilities rely on GE HealthCare’s CARESCAPE networks to host critical patient care devices. It is of the utmost importance that these networks—and everything connected to them—remain secure and operating at peak efficiency,” added Jim Hyman, CEO of Ordr. “The deep integration of the Ordr platform with the GE HealthCare CARESCAPE network will help give healthcare organizations comprehensive clinical asset visibility, security and performance capabilities they need to optimize and protect their environment of care.”

With this new service offering, healthcare organizations will be able to:

• Gain Granular Visibility to All Devices in the GE CARESCAPE network – Gain real-time visibility and automate inventories of all assets on the CARESCAPE Network, with device data that can be integrated with existing computerized maintenance management systems (CMMS). Access granular details on GE HealthCare clinical assets, such as hard-to-track patient data modules and which bedside monitors they are connected to.
• Enable Improved Device Performance and Help Reduce Downtime – Enable application-level performance monitoring of GE HealthCare Patient Care devices. Monitor HL7 application flows with actionable alerting that can speed troubleshooting and help reduce the impact of downtime.
• Monitor your Entire CARESCAPE Ecosystem – Provide a bird’s-eye view monitoring of the entire CARESCAPE ecosystem to help catch performance and availability issues with switches & UPS power supplies in near real time to help enhance uptime.
• Enable Preventative Maintenance Efficiencies via near Real-Time Data for HTMs – Eliminate the manual effort and time needed to locate networked devices and identify whether they are in use, based on near real-time network and physical data to complete Preventative Maintenance.
• Mitigate Risk and Help Improve Device Security – Full-lifecycle vulnerability management enables users to identify and focus on specific vulnerabilities affecting clinical assets under their management, prioritize vulnerabilities with Clinical Risk Scores, and self-manage the remediation process with simplified workflows and custom tags.
• Enable Optimal Device Utilization and Operational Efficiency – Understand how GE HealthCare Patient Care devices are being used, enabling teams to optimize performance and support future purchasing decisions.

Contact our team to get more information about how Ordr and GE HealthCare can help protect and optimize clinical assets on your GE CARESCAPE Patient Monitoring network.

Santa Clara, CA – July 18, 2023 – Ordr, the leader in connected device security, today announced that KLAS Research has recognized the company as a top performer in its recent report entitled “Healthcare IoT Security 2023: An Update on Vendor Performance and Deep Adopter Utilization.” This is the fourth year that Ordr has been recognized as a top performer in this report by KLAS Research.

The report provides insights into the competitive healthcare IoT security market by looking at vendor performance amid recent mergers and acquisitions, as well as early insights into how vendors meet the needs of deep adopters.

Ordr received top rankings from customers in the KLAS report, with customer feedback praising the following:

• Continually improving the user interface to simplify access to key device insights.
• Strong integration with devices and security systems, and new integration capabilities that are continually added to the road map.
• “Persona” feature that enables collaboration with multiple teams and stakeholders, including security and clinical engineering/HTM, for a “whole hospital” security.
• Automated segmentation capabilities to mitigate risks, stop lateral movement, and keep devices with outdated operating systems in operation.

“We work with the world’s largest and top ranked healthcare organizations, and are dedicated to delivering the industry’s most powerful medical device security platform to protect their patients and patient data,” said Jim Hyman, CEO at Ordr. “All the effort and expertise we put into building a platform with the intelligence and automation necessary to achieve ‘whole hospital’ security is equally focused on meeting our customers’ high expectations. As shared in the KLAS report, it is rewarding to see that customers are delighted with our ability to bring HTM and cybersecurity teams together to sustain more efficient HTM operations, address Zero Trust initiatives, and protect against advanced threats.”

When asked about Ordr, a customer CIO shared that:

“Meeting our IoT security needs is a pretty big thing, but the Ordr Platform helps us manage our other security as well as validation with our other security systems. When we find some sort of vulnerability, Ordr comes up with a solution for monitoring that type of traffic on top of our other security. They are a great partner in layered security. Recently, Ordr integrated their system with one of our partners’ systems, and that integration allows us to do segmentation in a much more automated fashion than we would have been able to do in the past. While that is a requirement for more than just IoT security, it is a value add that was a panacea for a long time and is now a reality. Without Ordr’s Platform, we would have had a huge gap in our visibility. It has been a great product for us.”

Because all connected devices in a medical facility are critical, a “whole hospital approach” to security is necessary in order to fully understand and protect the ever-expanding attack surface. Ordr empowers HTM and security teams with the insight, context, and tools needed to protect all IoT, IoMT, operational technology (OT), and traditional IT systems. Ordr helps medical facilities protect against ransomware and zero-day attacks by baselining device behavior and identifying any devices that are behaving anomalously. Incident response efforts are accelerated by immediately identifying compromised devices and dynamically creating and applying security policies. In addition, the platform supports Zero Trust segmentation efforts by enabling only required device communications from those devices already or likely to be impacted

Learn how your organization can improve connected medical device and equipment visibility and security with Ordr.

Last year, when Verizon issued its 2023 Data Breach Investigations Report, we observed “Connected Devices Conspicuously Absent” and wondered why they were not mentioned despite playing a critical role in establishing an organization’s risk profile and affecting an approach to cyber asset attack surface management (CAASM). Vulnerabilities in cyber assets can give threat actors a means of entry into a network, and unprotected/unsegmented assets can make it easier for threat actors to move laterally across a network to get to their target destination.

“Even if IoT, IoMT, and OT are not the initial vector of attack, such systems may be the target of an attack, or used as a path of attack as threat actors, once inside a network, move laterally to their intended destination,” we wrote at the time.

We Wondered Where They Were

We also wondered if identifying connected assets by increasingly granular categories was simply too much for the report, which has tended to keep the focus at a higher level. Understandable, if so. But given the increasing scrutiny given to cyber assets by technology analyst groups like Gartner and Forrester, regulatory attention by the FDA and other agencies, and threat reports from CISA, NIST and independent threat laboratories, it was worth asking the question and, hopefully, starting that conversation.

When the 2024 Verizon DBIR came out recently, my first thought was, “It’s good to know that people pay attention when you take the time to express an opinion.”

There They Are!

Whereas assets and connected devices were absent in 2023, they feature fairly prominently in the 2024 report, including a list and definition of asset categories that contains (lightly edited by me):

• Server: a device that performs functions of some sort supporting the organization, commonly without end-user interaction. Servers are common targets in almost all attack patterns.
• User Device: devices used by Persons to perform their work; usually laptops, desktops, mobile phones, and tablets. Common target in the System Intrusion attack pattern.
• Person: people in the organization. Different types of Persons will be members of different departments and will have associated permissions and access in the organization stemming from this role. Person is a common target in the Social Engineering attack pattern.
• Network: actual network computing devices such as routers, telephone and broadband equipment, and some of the traditional in-line network security devices, such as firewalls and intrusion detection systems.
• Media: mostly portable storage media like thumb drives, but including things like disk drives (and non-connected physical media like printed documents).

Ordr would add things like applications, business services, cloud services and workloads, and just about anything that connects to, communicates over, and shares/collects data from the network.

But… Incomplete Context

While the 2024 DBIR does give attention to connected assets and devices, the report’s emphasis seems to be on physical security and preventing certain assets (like smartphones, tablets, and laptops) from being lost or stolen. In the industry-by-industry breakdowns, we note that assets are called out for their role in phishing attacks and credential/privilege misuse. But even here, the report appears to be more concerned with the security of data contained on the various asset types, and not the role connected assets play in expanding the attack surface, introducing vulnerabilities, and affording threat actors a way of accessing and traversing the network itself.

In our view, that undervalues the risk that connected assets play in keeping networks and data safe. And it doesn’t accurately portray the importance of a Zero Trust posture that requires complete asset visibility, demands real-time asset status and rich insights to ensure an accurate risk assessment and good decision-making, the ability to segment assets to protect high-risk systems and ensure operational resilience, and minimize an attack’s “blast radius.”

Ordr Can Fill in the Gaps

To do that, you must have the ability to See, Know, and Secure every asset on the network in real-time, dynamically update risk assessments and associated security policies, effect segmentation/microsegmentation policies, and respond quickly when anomalous activities or conditions that equate to indicators of compromise are reported. That is what OrdrAI and the Ordr CAASM+ platforms enable. If you want to know more, and learn how Ordr can help your organization reduce your cyber risk and better manage your cyber attack surface, schedule a personalized demo today.

Srinivas Loke

Srinivas Loke is Vice President of Product Management at Ordr. Srinivas has a passion for cybersecurity with a deep understanding of network, end point, cloud and IoT security. Prior to Ordr, he led product teams at Aruba, Pulse Secure, FireEye and McAfee. He loves taking 1.0 products to the market and furthering cutting edge technologies that are solving customer problems.