Santa Clara, CA – November 7, 2023 – Ordr, the leader in connected device security, today announced the appointment of Kevin Arsenault as Chief Revenue Officer (CRO). Kevin comes to Ordr with more than twenty years of leadership experience building and managing high-performing sales teams for successful Software-as-a-Service (SaaS) cybersecurity companies. As CRO, he will be focused on driving growth and accelerating the significant market momentum of the company.

Most recently, Kevin served as Vice President of Sales, North America, for cybersecurity company CrowdStrike, where he proved to be a catalyst for strong revenue growth, helping grow and position the company for a 2019 initial public offering which saw share value double upon debut. Prior to that, he was Vice President, Worldwide Advanced Security and Information Governance Sales at cybersecurity company Proofpoint, building that company’s sales team and revenues in advance of a 2012 IPO that opened to a 30% share price increase.

“Kevin’s experience leading sales teams and driving profitability will play an immediate and essential role here at Ordr, as we solidify our position as the technology and market leader in connected device security,” said Jim Hyman, Ordr CEO. “As he has done before, Kevin will use his experience building high-performing sales organizations and his knowledge of the cybersecurity market to maximize our customer-facing efforts, helping to ensure that our solutions exceed all customer expectations.

Throughout his career, Kevin has maintained a maniacal focus on customer satisfaction, with an emphasis on helping customers solve their cybersecurity problems. A graduate of Boston College’s Carroll School of Management, early in his career he also led successful sales teams at Internet Security Systems (ISS), which was acquired by IBM

“Because of the constant expansion – and resulting complexity – of modern IT environments, it has become increasingly difficult for security teams to maintain true visibility into what assets they have, what they are doing, and the cyber risks they bring,” Arsenault said. “Ordr’s platform gives customers the ability to gain full asset inventory of what’s on their network, identify and address any vulnerabilities and threats, whether they’re caused by a failure to apply patches, software end-of-life, or a newly discovered zero day exploit, and secure these assets with automated policies.” 

Ordr delivers granular visibility for IT, Internet of Things (IoT), Operational Technology (OT) and Internet of Medical Things (IoMT) assets and a comprehensive view of an organization’s entire attack surface, including visibility into security gaps, potential risks, anomalous behavior, and active threats. Compromised assets are automatically identified, along with the added context of where they are located and details of their operations. Ordr uses insights on assets to manage cyber exposure, rapidly respond to a cyber incident, and mitigate potential issues. Zero Trust segmentation efforts are also accelerated by automating policies that restrict assets to only essential communications required for their functions. 

For more information on how Ordr can give your organization the cyber asset visibility and protection it needs, visit our OrdrAI Platform overview.

Last week, Ordr announced the expansion of our NIST FIPS 140-2 validated product offerings. As one of the only next-generation IoT vendors to support this, this announcement is both a reflection of our commitment to our Federal and public sector customers, as well as a testament to the continued speed of innovation by our engineering team.

There is sometimes confusion about what this certification means, so we thought we would address frequently asked questions about FIPS 140-2 in this blog

What is FIPS 140-2?

For those not familiar with the FIPS 140-2 certification, it is a cooperative effort between NIST (the U.S. National Institute of Standards and Technology) and their Canadian counterpart CSE (Communications Security Establishment). NIST and CSE both team up to staff the CMVP (Cryptographic Module Validation Program) and CAVP (Cryptographic Algorithm Validation Program), which work with independent third party testing labs to certify algorithms used in products.

Why is FIPS certification important?

Encryption is an important part of a security strategy to secure data. However, encryption algorithms can vary widely. Organizations in the private sector can use any encryption algorithm they prefer. The U.S. federal government however established FIPS as a standard for vendors and products. FIPS is a set of standards for encryption with the goal to ensure a minimum strength level for the cryptography is used in all Sensitive But Unclassified (SBU) federal operating environments.

FIPS 140-2 (the 2^nd generation standard) is an accreditation program that certifies that any hardware or software cryptographic module used in a product must meet well-defined security standards, and specifically must implement algorithms from an approved list.

Is FIPS certification important only to Federal agencies?

FIPS is mandatory for use in federal agencies. The Federal Information Security Management Act (FISMA) dictates that all government agencies use the FIPS 140-2 validated cryptography models. This requirement extends to U.S. government contractors and third-parties working for the federal government.

In addition, FIPS 140-2 is now popular outside of the federal government. The FIPS 140-3 certification has also been adopted as a standard by state and local governments, and regulated industries such as finance, healthcare, legal and utilities.

How did Ordr achieve our FIPS certification?

The Ordr validation was granted after an independent third-party lab testing of the software used on the Ordr platform. FIPS Certificate numbers 2888 for the Kernel Crypto module and 2962 for the OpenSSL modules were achieved with Ordr’s integration partner Ubuntu/.

Which Ordr products are FIPS 140-2 certified?

Ordr has FIPS certified our hardware platforms with the following hardware & software:

• Ubuntu 16.04 LTS 64-bit running on Supermicro SMX11SPL-F with PAA
• Ubuntu 16.04 LTS 64-bit running on Supermicro SMX11SPL-F without PAA (single-user mode)
• Ubuntu 16.04 LTS 64-bit running on Supermicro Supermicro A1SAi with PAA
• Ubuntu 16.04 LTS 64-bit running on Supermicro Supermicro A1SAi without PAA
• Ubuntu 16.04 LTS 64-bit running on Supermicro SYS-5018R-WR with PAA
• Ubuntu 16.04 LTS 64-bit running on Supermicro SYS-5018R-WR without PAA

Does Ordr need re-certification when there is a new software release?

FIPS 140-2 certification is not tied to any specific release. It is validation of the operating system and the hardware layer. Since our software uses the underlying Kernel and OpenSSL modules, no revalidation is needed based on the software level. In short, all Ordr customers will be able to operate with the most recent version of our product without any certification validation delay.

With the holiday season in full effect, retailers like Walmart and Amazon are rolling out the Deal of the Day. Well, with these deals, comes a great cost savings, but what we also need to take in to account are the risks of these devices. While it is probably fine (although not encouraged) if they are deployed at home, putting these devices on your organizations corporate network can be far more dangerous.

There has been a recent spike in these types of routers being plugged into corporate networks and most of the time by employees who want to either extend the ethernet ports or have their own private network. With the router acting as a gateway NAT-ing all the devices behind it, this becomes an untracked shadow network. Traditional endpoint detection tools cannot detect these types of devices and the potential dangers.

Take the example of the recent reports of the $30 Wi-Fi routers sold at retailers like Walmart and Amazon. Researchers found that these routers contained hidden backdoors and are being exploited by the Mirai botnet. The routers with the reported security hole are the Jetstream router that can be easily purchased, with no disclaimer. These critical vulnerabilities allow threat actors to remotely control the routers as well as any device connected to that network and monitor all the traffic coming through that router. This constant surveillance on the shadow network can critically endangers the whole network. Additionally, the Wavlink routers contain a script that lists nearby Wi-Fi networks and could connect to those networks with the factory passwords. This can have a cascading effect with the attacker slowly and patiently expanding the blast radius.

Ordr installed these two routers in our lab environment and almost instantly noticed port-443 connection communicating to known Chinese domains.

With Ordr, these devices can be easily identified, classified and added to the “Hi-risk Manufacturers” profile.

The next challenge is to physically locate these devices so that this can be investigated and removed. Ordr provides device location and also physical connectivity information so that this device can be tracked, and the appropriate workflow is supported.

Identifying these rogue devices is important in protecting your network infrastructure.  With Ordr’s ability to see all connected devices via DPI and support massive network infrastructures through AI/ML to classify these devices at scale, then automate policy generation, we can help our customers discover, baseline, and secure their environments.

For more information on how Ordr can help you identify and manage vulnerabilities for any connected device, please contact info@ordr.net.

Our journey with Ordr Core started some time ago as we met with many enterprise customers regarding their difficulty maintaining a safe and secure network. As we listened, it became apparent that many companies could not protect themselves from cyber attacks or other intrusions without fully understanding what devices are in their network, complete topological map of their pathways and how they are communicating. There are many methods of gaining this visibility. But, most technologies involve agents, expensive hardware, along with large network and security teams that can take months, if not years to get started. We decided to change all that.

Today, we are pleased to announce the commercial availability of the Ordr Core software and our new self-service IoT Discovery Program.  At its essence, Ordr Core is IoT Device Security Made Simple.  It’s foundational software that gives customers granular visibility into all IoT devices, identifying managed and unmanaged devices and any potential security risks—all within minutes. Those who want to move beyond visibility to proactively protect these devices by integrating fully with existing software and infrastructure can easily upgrade to Ordr Premium at any time.

To make it even simpler, as part of the IoT Discovery Program, qualified users get a free zero touch provisioning sensor and the Ordr Core software at no cost for 30 days. Sensor deployment is plug and play. As soon as a sensor is “connected”, it automatically calls home to our cloud dashboard, and Ordr automatically starts classifying all devices and identifying their risks.

Ever wonder how many legacy Windows XP machines are in your network? Are you concerned about which devices might be vulnerable to Ripple20 or Wannacry? Are you worried about which security cameras still have default passwords?  We show you in one elegantly designed user interface.  If there are external communications to malicious URLs or even unusual sites, we tell you right away. To top it off, we will send you an Executive Report at the end of the program with all our findings so that you can take proactive steps to protect your network.

At Ordr, our engineering culture is rooted in the belief in delighting our customers.  We embrace speed and agility, we encourage growth and learning, and working towards delivering the best features for our customers.  Our architecture was designed to scale up or down from the start. We can see everything in a network and provide the context of the various communication pathways between devices, be it internal lateral movement or connection to external web sites of poor reputation. In fact, in one partner forum, an Ordr user said this about our platform, “If Ordr does not profile it, it does not exist”. From details such as device icons in our GUI, to our constellation view and Ordr Flow Genome, we have worked very hard to make the complex elegantly simple.

Ordr Core delivers unparalleled profiling of behavior and risk.  Some of the leading enterprise companies already trust Ordr to tell them what’s on their networks.  Now we can bring this visibility to you in minutes, not weeks or months.  If you are in networking, security, or asset management, get started here.

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.

The “shared responsibility” philosophy for improving cybersecurity is becoming a worldwide phenomenon. It was woven throughout the U.S. National Cybersecurity Strategy issued by the White House in early March, and later that month the UK also announced its plan to improve cybersecurity for the country’s National Health Service (NHS).

On March 22, the UK government announced it will draft a six-year plan to “promote cyber resilience across the health and care sectors by 2030, protecting both services and patients.” That plan will build on five pillars for reducing the risk and impact of cyberattacks on healthcare organizations, while also improving recovery and resiliency should an attack succeed. Those pillars include:

• Identifying the areas of the sector where disruption would cause the greatest harm to patients, such as through sensitive information being leaked or critical services being unable to function.
• Uniting the sector so it can take advantage of its scale and benefit from national resources and expertise, enabling faster responses and minimizing disruption.
• Building on the current culture to ensure leaders are engaged and the cyber workforce is grown and recognized, and relevant cyber basics training is offered to the general workforce.
• Embedding security into the framework of emerging technology to better protect it against cyber threats.
• Supporting every health and care organization to minimize the impact and recovery time of a cyber incident.

Faster Response, Minimized Disruption

The second of the five pillars is notable to us because it calls for “uniting” the healthcare sector in an effort to combine resources and expertise to “enable faster responses and minimize disruption.” At a macro level that is a critical capability for hardening the networks of organizations connected through extensive digital supply chains. At the individual level it is vital for an NHS Trust to approach cybersecurity from a “whole hospital” perspective. Recognizing that, with IT systems operating on the same infrastructure as the operational technologies (OT) that run the hospital operations—and also alongside the sophisticated connected medical devices (Internet of Medical Things) integral to delivering a high quality of healthcare to patients—a vulnerability anywhere in the network puts the entire Trust at risk.

Protecting 1.7 Million Devices

The announcement points out that there are more than 1.7 million devices operating within NHS Trust networks, and that the strategy seeks to monitor each for suspicious activity that could indicate an attack or active threat. That’s wise, and an imminently achievable goal. In fact, many Trusts in the NHS system currently use the Ordr platform to discover, monitor, and protect the hundreds or thousands of Internet of Medical Things (IoMT) devices that populate their networks for the delivery of patient care.

When the full NHS cybersecurity strategy is published later this year, Ordr is confident that our customers will be prepared to meet whatever standards are set as they pertain to protecting connected devices. And as the CISOs and other leaders in those Trusts have already demonstrated a desire to work toward a Zero Trust security posture, there is no doubt they will establish themselves as cybersecurity exemplars for their peer Trusts.

Ordr is also actively working with NHS Trusts to comply with the NHS Data Security Protection Toolkit (DSPT) and  ensure the security and privacy of data shared within the NHS system. Contact us for more information about how we can protect the connected devices in your network.

Kieran Wood

Sales Director – EMEA

Kieran is a UK and EMEA focused sales leader with 20+ years of experience in enterprise infrastructure, storage, cloud services, and cyber security.

On Tuesday March 9th, Bloomberg reported that threat actors had breached security camera feeds by Verkada Inc, a Silicon Valley startup, gaining access to almost 150,000 video surveillance cameras inside hospitals, organizations, police departments, prisons and schools. This was an unsophisticated hack, i.e the threat actors found exposed credentials for an administrator’s account on the Internet.

While many security vendors are claiming that they could have detected the breach, note that in this specific case the credentials used were valid administrative credentials that provided access to multiple feeds from multiple customers in the Verkada cloud servers and not customer networks. Additionally, because of Verkada’s architecture, every feed from an organization’s cameras was encrypted and sent directly to the cloud. Therefore, any on-premises security solution would not have detected any anomalies from the cameras as they were simply streaming video to the centralized cloud server.

However, there are several security learnings from this incident:

• Real-time visibility is critical – Video surveillance cameras are pervasive, and just like many IoT devices, are not built with security in mind. Security starts with knowing what’s on your network. Our customers use our inventory dashboard to find devices like Verkada or any other video surveillance cameras in their network.

• Profile risks and behavior– It’s important to not only identify devices, but also understand the risks they bring and map how they communicate. In one Ordr deployment, we found that 60% of an organization’s cameras deployed in hundreds of facilities world-wide were using default passwords that were published on the Internet. And some of these cameras were running “non-production” software, calling home to their R&D center in China periodically. Once you understand risks and baseline normal communications, you can create segmentation policies to enable devices access required for its role while limiting exposure.
• Monitor admins, users and access – Always make sure that admin maintenance accounts are secured properly, and monitor users and access. As outlined in this blog, Ordr provides very robust tracking of users using AD/RADIUS and wireless integration, so you can monitor which user is accessing what devices at what time. We also monitor supervisory protocols SSH, Telnet, RDP, and can monitor access by corporate versus guest users.

Organizations must look at the rapid growth of connected devices (ie. digital transformation) as an opportunity to start maintaining a continuous and accurate inventory, a true understanding of how those devices communicate, automate alerts based on any device or group of devices that act outside of a set baseline, and automate proper segmentation of devices as to not let lateral movement inside your network via the device(s).

Listening to Part 1 of the Minnesota HIMSS webinar series Medical Device Security Overview for Healthcare Delivery Organizations with speakers Matt Dimino and Carrie Whysall from CynergisTek, I found the following to be useful information that you can apply to your organization’s security program development.

Medical Device Security Services

Medical devices have important functions and carry sensitive data, making them attractive cyber attack targets. As medical devices become increasingly connected to the internet they are becoming greater security risks. These devices are purchased and utilized by different departments within the organization and can lead to inaccurate asset inventories and unmanaged devices.

Attacks on medical devices can cause disruptions in patient care and possibly result in patient harm. Not only will this result in lower quality care for that patient, it will also affect organizations reputation, and bottom line.

IoT & IoMT Device Security Challenges

There are a variety of security challenges that come with securing medical devices, and each requires a different solution.

• Culture: There’s a disconnect between IT and Clinical Engineering teams. Each group has minimal experience and knowledge of the other’s work and capabilities.
• Legacy Systems: Many medical devices on networks today are running on outdated operating systems and are kept for long periods of time.
• Unable to Update: Medical devices are often difficult, if not impossible, to patch.
• Medical Device Ecosystem is Complex: The medical device ecosystem is very complex, with devices coming from multiple vendors and software platforms.
• Lack of Security Contracts: Many familiar IT security controls don’t apply to medical devices. Administrative and physical controls can be disruptive to patient care and operations.
• Lack of Tools: IT teams have limited tools that work well with medical devices and can scan inventories for vulnerabilities.
• Medical Devices are Proprietary: Medical devices are specialized; with different wireless requirements, hardware and software.
• Insufficient Visibility: Many medical device networks lack adequate visibility of their medical device inventory.
• Inventory Size: Hospital beds have about 10 to 15 connected medical devices per bed, and each device has an average of 6.2 vulnerabilities

Medical Device Security Components

Medical device security should be comprehensive, creating a security program in three stages ensures it will be implementable down the line.

• Risk Assessment: The first step in creating a program is assessing your current security practices. This includes reviewing the current security program practices, installing a passive network scanner, and creating a security risk classification guide. Organizations should also segment devices and decide what teams, whether it be IT or Clinical Engineering, will be remediating vulnerabilities and overseeing different devices.
• Program Development: Next, create a cybersecurity program through adding security practices to pre-existing device management practices. This includes continued surveillance over remediated devices and other assets, as well as standardized device assessment, configuration and incident procedures.
• Program Management: Sustained device management is necessary for medical organizations to stay secure. Assisting in medical device procurement and deployment, vulnerability reporting, and remediation planning should all be performed as part of program management.

How Ordr Can Help

Cynergistek highlighted a passive device scanner as a key tool to creating and automating a medical device security program. Ordr Systems Control Engine (SCE) is able to provide an accurate asset inventory, properly classify devices with granular detail needed for appropriate workflows, baseline and map device communications and enable micro-segmentation efforts.

The Ordr SCE gives organizations the power to enable visibility and security of their network-connected devices, with a simple and powerful solution to identify, classify, profile the behavior and risk and automate action for every network-connected device in the enterprise. To learn more about how Ordr can enable an effective IoT security strategy for your organization, request a free sensor.

Segmentation Done Right – Part 3 of 3

Segmentation is a good thing and we understand the benefits and we also know that segmentation needs to be done right. Doing it right means segmenting in a non-rigid manner and having a clear goal in mind before VLANs are deployed randomly or likeminded devices are just lumped together. In our concluding series, we discuss our take on flexible segmentation and how to generate policies using the observed behaviors of devices.

At Ordr we can granularly group devices by type or even group the same type of devices across an enterprise. For example, if you want to see all your cameras across your entire enterprise we can do that. Want to see cameras only used by the surveillance security department? Or cameras just in the manufacturing line? We can slice it or dice it any way you like in ways that fit your business requirements.

One popular starting point that we see with some customers is segmentation by vulnerabilities. This process entails segmenting by the most vulnerable devices in your network. For example, think about all the cameras that come with a default password which is oftentimes just “password”. We can help segment these vulnerable cameras from the rest of the network to reduce their attack surface if they get hacked. Later on, we can help a hospital segment another group of precious devices such as CT scanners and patient monitoring devices which are often vulnerable since they run older operating systems. Older operating systems can be an issue since they can be susceptible to malware attacks, oftentimes inadvertently introduced by a healthcare worker who worked remotely, visited a bad site, and then came back to the hospital.

With the Ordr system, you can work through the device population one group at a time, based on your specific business criticality requirements. This is a very granular configurable method vs the traditional way of segmenting …the all or nothing approach of traditional VLANs. Think of it rather as a personal VLAN per device. We can help security personnel maintain good network hygiene by segmenting rogue access points, preventing devices from guest networks accessing clinical resources, and even help identify and remove outlier devices from incorrect segments.

With our approach, there is no need to declare a zero-trust day plan, and then execute to that milestone only to realize that the business requirements have changed, the device population has increased, or the network footprint evolved. With Ordr, you can start the segmentation journey now with a logical device-centric approach vs. big rigid boxes of categories. Our micro-segmentation approach is easier to execute, flexible and changes as your business requirements change, equipment is moved around due to utilization adjustments, or whatever the case may be.

We add insights into understanding the behaviors of devices. Once Ordr has baselined all the traffic, the system can report any time a device attempts to communicate outside its defined network behavior. This will be alerted on the main dashboard and as a device security incident. We can further show you the flows of traffic per device and how it interacts with every other device in your network. We can tell you what’s “normal” as we have intelligently mapped and baselined the traffic. Our system can subsequently report any time a device attempts to communicate outside its defined network behavior. This deviation from a device’s normal behavior will be alerted on the main dashboard as a device security incident.

At Ordr, you can group and segment however you prefer, the choice is yours. Whether it is creating network segments for medical vs. facilities vs. a contractor vs. the emergency room, even subsegment the pharmacy if you like. And within each segment, you can selectively allow access by various groups. With granular flexible micro-segmentation from Ordr, you can contain any potential breaches and damage. Whitelist internal flows for your business needs flexibly. Blacklist with micro-segmentation, we do that too. We give you the tools to do segmentation right and we give you the smarts to take control.

Read Segmentation Done Right – Part 1: Great Idea and Segmentation Done Right – Part 2: Seeking A Better Way.

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.

IoT is changing the world as we know it, bringing new opportunities and innovation to almost every industry. We’ve seen this first hand at Ordr, where our customers in healthcare, manufacturing, retail and government are reaping the benefits and efficiencies of IoT.

Whatever the business outcome — from patient diagnostics to inventory management to building access – there is a sensor, system or device that delivers on that promise. The real challenge is ensuring the visibility and security of all these devices. With more than 25 billion IoT devices deployed in 2020, and 75 billion expected in 2025, the downside of playing fast and loose with IoT security can be devastating. As Zeus Kerravala, Principal Analyst at Zeus Research, said, “Every connected device is a potential attack vector, especially when deployed outside the purview of security and IT. In order to secure their devices, organizations must start with visibility into what is actually connected but most organizations don’t have the time or resources to do this manually, and have had to live with the risk of not knowing what’s lurking in the shadows.”

This is why we launched our new IoT Discovery Program – to shine a spotlight on what’s previously been in the shadows. The IoT Discovery Program includes a complete kit – Ordr Core and zero touch provisioning sensor– to discover and classify IoT (and shadow IoT) devices in the enterprise. The IoT Discovery Program is so simple and seamless, it removes resource or project barriers that prevent organizations from truly understanding what is in their network

We’re especially proud to have the IoT Discovery Program available through Ordr channel partners, including Cadre, Carousel Industries, GuidePoint Security, Logicalis, Novacoast, and The Teneo Group. We’ve been working with these strategic partners and their enterprise customers in early deployments of Ordr Core and the IoT Discovery program since the beginning of the year.

The feedback from the program has been overwhelmingly positive, and we hope you’ll give it a try. Our partners are standing by, ready to help you get started today.

• “I am a security researcher focused on all kinds of malware and I was surprised it found all of these issues quickly and the details are amazing” – Mike L., Software Company
• “Pretty amazed with what Ordr collects and the details of what it collects” – Ron B, Financial Services
• “Easy to use, plug and play, I got a lot of info quick.” – Chris L., Security Company

Greg Murphy

Greg joined Ordr as CEO in December 2018. Previously, he was VP Business Operations for the HPE Aruba Group, the 4,000 person networking and IoT business unit of Hewlett Packard Enterprise. In that role, Greg was responsible for leading the business integration of Aruba and HP Networking following HP’s $3 billion acquisition of Aruba Networks in 2015. Greg held multiple prior senior executive positions within Aruba, including SVP Business Operations, GM of network management software, GM of outdoor and mesh products and VP of Marketing. Greg joined Aruba in 2008 through its acquisition of AirWave Wireless, a network management software provider that Greg founded and led. Greg received his M.A. from Stanford University and his B.A. from Amherst College.