Deliver healthcare apps with the same policy on every session

All right, everybody, please come and join us. We're just going to talk a little bit today about how we are delivering applications for healthcare across any platform. So we're really going to talk about also the concept of an enterprise browser and how it works in conjunction with AWS. So, really, what this comes down to is understanding what is the most used application delivery platform in the world, and very simply, that is the web browser. There's 5 billion of them deployed. Everybody knows how to use them. Nobody writes the front end to software anymore. They write the back end. They make it web accessible, and they go to work. Everybody knows how to use it. as simple as can be. But the reality is, is that the web browser is not designed for healthcare. The web browser is designed to serve ads and generate revenue for the people that build the browser.

So really what you end up with then is essentially fundamentally untrusted freeware. Running your most critical clinical and financial applications. So you've got freeware now. that's accessing all of your data, all of your systems, all of your people. And not only that, but they're tracking everything that they're doing. Not ideal. Let's just call it that. And then we have the fun of extensions. So the modern browser is very extensible. It's very modular, and users can install extensions themselves. Extensions are great. They can help you out. They can provide better security. They can help you with your grammar when you're writing. That's wonderful. But they can also access all of your data, exfiltrate all of your data, and do so legally. So it's really important to understand how your browsers are actually set up. And then, of course, these extensions also provide another avenue for vulnerability, which we all had had to experience around Christmas time.

And so as these extensions get updated, you need to be able to control, identify what is the risk of this extension in my environment and control that? So this is really key, especially since, how do you install an extension? Somebody down the hall says, you gotta try this thing. It's great. And you plug it in and it says, hey, you need these rights. And they go, okay, they don't they don't know what that means. They don't care what that means. That's not their job, especially in healthcare. I've spent 20 years doing cybersecurity and healthcare and my entire goal is to make clinicians not have to care about cybersecurity. I want them taking care of our parents and our children. I don't want them having to think about cyber security. So let's help them by putting technical controls around all of these things that they're doing. Now, unfortunately, because in general, we don't control the actual application platform. We put all of this network security in place.

And I spent a lot of time as a network engineer, so I've deployed all of these. Problem is every time you add security to a network connection, you're doing things like break and inspect, you are adding latency, you are slowing down and degrading the user performance. And then you hit things like certificate pinning where applications won't work if you do break and inspect. In that scenario, the very 1st thing that happens is you bypass all of the security and completely lose all visibility and control over anything that the system is doing over any of the data that's being transferred. So what we've ended up with is stifling security. It gets in the way. It creates horrible user experience. You know, I work with a group of radiologists who pipe all of their traffic into their from their homes, into their local hospital system, across the hospital system, and then through a direct route up to AWS. Like, so they've got the pieces in place.

They've got people working from home. They've got high-end gear. They can do the job great. They're sourcing their their data out of AWS, so they're supporting the cloud and they can be accessed from anywhere, but they still use this ancient technology of routing VPN traffic all the way through the network in order to do that. So with this complex security, it essentially creates a scenario where you cannot deliver applications in a, in a, an advanced fashion, in an easy to use and consistent fashion. I don't know about the rest of you, but healthcare is not exactly always at the bleeding edge of technology. So, you know, we run a lot of ancient tech. We run a lot of old systems, and we try to make it work because we don't have budgets to do all of the fancy stuff. So this is why all these things get built. It's not because the practitioners, the technical practitioners don't know what they're doing. It's because this is what the tools they've got to work with. So let's change the tools in the toolbox.

So really, what we're looking here is a way to address this through, we call the Enterprise Browser. The Enterprise Browser is an actual browser. Replacing your chrome, your edge, your Firefox, et cetera, on the user endpoints. And you use this for a variety of access. Now, you may be thinking right off the bat. Oh, web browser. Okay, you're talking about web apps. We've got all these ancient apps. They're not web accessible. I'm getting there, trust me. So the way we've designed this is across these 3 pillars. Advanced cybersecurity, advanced data controls that can essentially make the web browser the new VDI, where you, so you serve applications up through VDI because you want to control where that data can go. So let's build a fully secure browser. And I'll talk a little bit about how that works as we go that now gives you complete visibility.

So remember we talk about breaking inspect and certificate pinning, and now you've lost all of your visibility. Well, the browser is the natural point of that SSL termination. So now you've got complete visibility over all the traffic without having to do break and inspect. So it's faster, it's cleaner, and now you've got complete visibility. Also running right at the endpoint, it gives you the ability to apply business rules to your technical applications. You can do things like jump into a patient record and have the system automatically scrape all of their demographic data, and then you jump over to an insurance portal, and it automatically pastes in all of their demographic data. No typing, no back and forth cut and pasting, eliminating human error, and greatly accelerating that process. So for the individual lines of business, whether they're clinical, financial, ancillary, whatever, you are now looking at a better use case for them.

And then the end users. What is the one thing that we would ask for for our end users across, whatever they're doing and wherever they're doing it.

Consistency. Again, we're dealing with clinicians. We want them to have a consistent, clean experience. So whether they're working from their laptop, they're working from a clinical workstation, an iPad, they're at home, they're at their office, they're on a device that you don't own or manage, you want them to have that same experience, where while you put that cybersecurity in place, you put those data controls in, no matter where they are. So, We build all of that together with AWS and Island runs in AWS, so I am from Ireland. So, but the whole concept is all of our back end is in AWS. Your data is in AWS. You're working with Amazon workspaces, working with app streaming. Let's talk about how we create that consistent experience. Most people, when they're doing VDI or app streaming, they or workspaces, they give you a whole desktop.

So now the user logs in. They know what their desktop looks like. And then they log into another desktop. And so, you know, already, you know, we've got latency, we've got issues with that. And now they have an inconsistent experience. So let's pull all of that back right to the local machine. They run all of their web-based applications directly. And then we stream those applications from workspace so that to the user, it's just another icon. They just click on it. It launches the application, they see it the way they expect to, but they see it in their own space. They see it in what they, they are used to using inside that browser. And again, everybody knows how to use a browser so it makes it really easy for them to understand, oh, this is how I copy and paste. This is how I move around. So by doing that combination of AWS plus island, you can actually move even your most hideous legacy applications into a space where they can be accessed securely, safely and consistently by the users.

So, talking critical healthcare use cases. VDI reduction sits at the top of the list. VDI is very expensive. It's complex to run. It creates latency, it creates issues. Mostly what VDI is, is a 20 year old operational technology that we've repurposed for security. And it's brilliant. The reason that there are so many players and they're huge players in the VDI space is because it is a brilliant solution. But let's use it as a solution to an operational problem, not a security problem. So anything, again, anything that's web-based, you bring to the browser anything that cannot be served locally or run as a locally installed app, you keep that in AWS workspace and serve it as an application. So now you've significantly shrunk the spend, especially if you're moving from an on-prem VDI infrastructure. You've significantly shrunk your spend in infrastructure, management, licensing, all of those things while cleaning up and accelerating your user's experience.

We've also got, you know, of course, we already talked about all of the web apps, obviously. You're going to serve all your web apps that way. And we're going to look at things like, like data controls and, eliminating the capability for users to intentionally or accidentally, take sensitive data, and put it somewhere where it does not belong. So, one of the, One of the most interesting questions I ask healthcare organizations is, all right, I'm going to show you a patient record. Point out the PHI.

Generally, the response I get is that. Right? I mean, there's no way to identify PHI via regular expression. You just can't do it. So we've spent a lot of years doing DLP. I deployed DLP for one of the largest hospital systems in the country. 180,000 users across 24 states. I hired 5 people to handle email. But not even what was on their desktop, not even what was in the in the network shares, just what data was being sent by email. So we've all put in DLP. We all love it. It's our favorite thing ever, but it doesn't work. So what we want to do is identify these critical apps, the clinical apps, the financial apps. These are the things that are the lifeblood of your organizations. And then we put data boundaries around them. So we call this last mile controls. Honestly, every last mile controls is maybe overused. Let's call them the last inch.

And the reason for that is because when you live at the browser, when you live at the user device, you are their interface, you are that last inch of glass in the monitor, and now I can control, cut, copy, paste, print, save file uploads, file downloads. I realized that was opposite directions there. I can control screenshots, screen shares, anything you want to do. You're like, you're working long. You, you've got a vendor on Zoom or teams or whatever with you, and you jump into a patient record, and you say, oh, I'm in prod, not in test. Oh my god, I just shared all this information. The vendor on the Zoom session saw nothing. Because you can't screen share from your prod system only from your test system, your dev system. So that's the kind of controls I'm talking about. I'm talking about building a dedicated data boundary around your applications that says data can move freely between them.

Take like the example I used earlier. I'm going to go into the clinical system. I'm going to pull patient demographics. I'm going to go into the billing system, and those patient demographics are going to appear for me. That's awesome. But if I didn't go into my web mail and I try to paste that same data, let's make sure that data doesn't go to their web mail. Let's make sure it can't be downloaded to their local machine unless they're on a device that you manage and control. Let's make sure they can't drop that into notepad. Let's not allow them to steal or accidentally disclose PHI, PCI, or really any kind of personal data. So that, those data controls, that's how you manage your mission critical applications. This is also how you get users on unmanaged devices. So everybody's got clinicians that don't use your own computers, right? They use the, from their practice, they use their personal iPad, whatever it is, they want to do it, and you can't stop them.

You need them as much as they need you. So, let's put these data controls in place so that when they're accessing your systems through their machines. They are, they get that consistent experience we talked about and they're unable to take data and put it locally.

AI governance. AI is a bit of a hot topic this year. So, Let's control which AI you're allowing your users to use. Let's control what data they can put in that AI. Let's prevent, you remember that data boundary? A data boundary can exist inside the browser, too. So here's my clinical app. Here's my financial app. That's great. I'm going to go over here to DeepSeek. I'm going to go to ChatGPT. I'm going to go to wherever. And I'm going to try and take this data in there. Nope. You're still inside the browser, but now I know you are in an AI site or your personal web mail or whatever it may be. You're not inside the data boundary, so you can't put that data into the AI system. What about all the other AI systems? Well, let's lock those out. Let's make sure your users are only using the AI that you want them to use. Let's force them to log in with organizational credentials.

So I actually did this for a customer. They're using ChatGPT. You can go to ChatGPT site, and you can just ask a question right from there. don't have to have an account. So anytime their users go to that site, It bypasses that page, goes straight to the login. Then they say, yeah, okay, I'm going to log in. It goes straight into their, their IDP login does not give them the opportunity to put in their personal email address, log in with a different account. So you've got those kinds of controls when you run the browser. When you know who is logged into the browser, what type of device they're on, where they are in the world, you can now control everything you need to.

Secure access recovery. This is, this is a, This is a tough one. We are under attack constantly. And, you know, my, I've had my friends, my former colleagues spend weeks crawling under desks trying to find computers that have been hit by ransomware, shutting down servers, shipping patients to other hospitals. Bad things happen in our world. We need to be able to get people and systems back to work in a secure fashion. So, because you can tie directly into your identity provider or any identity provider, this is something we've actually done with a very large healthcare organization that had a very bad situation for a long time. They came to us and they said, can you get us back up? We had 10,000 users back up and running the next day because they just said, grab a computer from anywhere.

You've got a laptop that you own. You don't have one, go to Best Buy and buy one. And then log in with this new account, and now we've provisioned your applications too. You directly through the browser, get back to work. So now, even though their domains compromised, their machines are compromised, we can get them up and running on a clean device, clean account instantly. This can make the difference in both patient care and lost revenue. We've already talked enough about BYOD, I think. I love clinicians but they want to use whatever they want to use, right? So, simple use cases. What we're looking at here is simply, you can see kind of all of the things that we've been talking about, but over on the right hand side there is a box that I want to highlight. because it's funny because I work with a bunch of different industries and they all seem to have the same problem.

In order to access something, they've got to go through a, you know, a complex process. And so what we want to do is we want to simplify that. And so in this particular example here, we had a 15 minute process to log into ERP. And why is that? How can that possibly be? Well, it's because the users are remote. So they log into VPN. So 1st off, they need to know to log into VPN. Then they've got to launch their VDI instance. Log into that and wait for that to load. Then they launch their web-based ERP. And now they wait for that to load and stream the pixels down to their local machine and now they can go to work. So with Island, we've built in the concept of zero trust network access that allows those users to now fire up the browser on their machine, no matter where they are, on their iPad, on their phone, whatever. Click the icon that says go to the ERP, we safely and securely route the traffic to their internal network, and now they're logged into their ERP and they're going to work.

So that is a legitimate thing, this reduction of all of this complexity and time to get logged in, can really, really help with efficiency and effectiveness within the organizations.

So, we've talked a lot about these use cases already. And the thing about this is these are use cases that are critical to AWS as they are to us. So we're working in lockstep with them. Building this out and making these solutions. How can I say it? I hate to use terms like cost neutral and things like that. But the reality is, is that most times, when you are building out a new solution with something like Island plus AWS, you are going to significantly reduce the costs of your existing infrastructure. So we go in, we talk to organizations all the time. And they say, well, we don't have any budget. Our budgets are flat this year. We don't have any projects. We don't have an enterprise browser project. But we do have a massive VDI project. Or we've got a data governance project or we, you know, all these things. And so the way I usually look at it is when I talk to people, it's the security teams that want island.

And it's the operational teams that end up having the budget to pay for it because we're able to reduce that dependence on those local operational tools. And to a point where, I mean, we're saving financial organizations hundreds of millions of dollars. And so it makes it real easy to buy us. So that's what we look for. It's not a matter of, do you have a project for this thing? It's a matter of, hey, talk to us about what the projects you do have are, and then we'll help you get to that, to that next level. So thank you.