Latest / Identity at the Center / #56 - What is FIDO with Andrew Shikiar

Transcript

#56 - What is FIDO with Andrew Shikiar · Identity at the Center

0:08
Identity and access management. Welcome to the identity of the
0:22
center podcast I'm Jeff and that's Jim.
0:24
Hey Jim hey Jeff. How's it going?
0:27
I'm pretty good. How about yourself?
0:28
Good. It sounds like you've got a new
0:32
microphone that really improves your data.
0:48
It's simple I think you should plug it, let everybody know
0:51
about it. So Chris today I basically
0:55
filters out your background noise or not a commercial.
0:58
I think it's, you know, it's freeware.
1:00
Or it's free to start with anyway, not free, but you get 2
1:05
hours a week. I think is what their, what they
1:08
start off with. But yeah, we don't, we don't
1:10
currently have sponsors or commercials or anything like
1:12
that. But yeah, like you said it's
1:14
it's a pretty cool little program.
1:16
Just runs a little app on Windows or Mac and seems to be
1:19
do a pretty good job of reducing background noise and things like
1:23
that. You never want to be that person
1:24
right on the on the zoom call, or teams or whatever it may be
1:27
where you can kind of hear everything, right?
1:29
In the background. So I thought was pretty cool.
1:31
So, glad you're getting some juices out of.
1:33
I've been that guy on our on our podcast for a long time.
1:37
Where, you know, we set up rules around me which is keep your
1:40
earpod case far away. So you can't click it and you
1:44
know, don't squeak in your chair.
1:46
And so now I've got a good microphone, I've got the noise
1:50
reduction software, I think I'm ready to go.
1:54
There's so many layers of noise reduction, not even Sheriff.
1:56
Pruitt, we're not even sure. Sometimes of like our voices
1:58
will come out. All right.
1:59
Exactly. So for today's topic we're going
2:03
to talk about Fido and for those who aren't familiar, that's fast
2:07
identity online, and there's no better person to talk about
2:10
that. Then and Russia are who is the
2:12
executive director and chief marketing officer of the Fido
2:15
Alliance. And we've got them today.
2:17
We're very fortunate with for that.
2:18
And thank you for joining. Welcome to the show.
2:20
Andrew, and thank you. Thanks for having me guys.
2:22
Really appreciate it. Great.
2:24
So, I know that Fido has really started to really kind of Of get
2:30
a foothold out there but before we get to that one of the things
2:33
that we like to start to talk about is when we have a guest on
2:36
is their background in it and identity and access management.
2:41
Can you tell us a bit about how you got into I am?
2:44
Yeah sure so I'm not a practitioner per se but I know
2:48
it was done a variety of kind of marketing and strategic
2:53
development type roles in emerging technology.
2:57
And so I got into identity, I think before identity was All
3:01
back in 2001. I went back to Sun Microsystems
3:05
were previously, worked to help them launch, something called
3:08
Liberty Alliance, and I'm sure many of your listeners are
3:11
familiar with Liberty. This was the kind of first
3:14
standards effort to standardize what became to be known as
3:19
Federated identity. So, a lot of the Liberty specs
3:22
during into stable to specs and it was really interesting time
3:26
to be in identity because frankly, it wasn't in the
3:31
mainstream whatsoever. I'm a lot of my job at that
3:34
point was to help me recruit the initial companies and Liberty
3:37
Alliance. And so I defy, you know, around
3:40
the world and talk to cxos and you my first part of the
3:45
conversation would be, you know, what is identity, what does that
3:47
end? I mean, to your business, which
3:49
side any means your employees, your customers, and is always
3:52
kind of thought, provoking discussion with people hadn't,
3:54
thought, about identity Beyond maybe for an identity.
3:58
So, it really fun. To be get into that space, I
4:02
subsequently then worked on Son's identity management,
4:08
product set and did a lot of go-to-market work there as well.
4:10
So yeah, that's how I first got an identity as out of the space
4:14
for a while, then I got back into it when I joined Fido lines
4:19
around five years ago. And one thing that's kind of fun
4:22
was to see that. A same concept, we're talking
4:25
about the enter are relevant today.
4:28
Be some of the standards actually, now being Used and
4:31
seeing a lot of the people who have worked with back then are
4:33
still in the space. In fact, a lot of them are
4:35
inside of Fido lines. So it's been nice to kind of
4:38
reunite and get deeper in the identity Marketplace.
4:45
That's great. Andrew.
4:46
One of the things I think kind of the starting point we ought
4:49
to start with, which is what is Fido, and why was it founded?
4:56
Yeah, so if I do, Alliance was founded to address.
5:00
The data breach plague. You know, data breaches continue
5:04
to grow and scale and a number of attackers are growing
5:09
sophistication and tools and and the vast majority of data
5:14
breaches are caused by passwords, right?
5:17
So you two patterns being compromised stolen, Cask,
5:21
passwords being stuffed, social engineering, taking password, go
5:24
to someone stands up, Sports cars, you know, over 80% of data
5:27
breaches on an annual basis. And so, you know, passwords are
5:32
very much acceptance of the spear to address.
5:35
The database problem which is why the title is focused on
5:38
that, right? So our mission is simply to
5:42
reduce industry relies on passwords in favor as vital
5:46
authentication. Fundamentally what Fido is doing
5:50
is trying to shift the market and shipped industry.
5:55
The way from being dependent on not as passwords.
5:58
It really all server-side shared secrets and server side
6:01
authentication in favor of an approach that leverages
6:03
public-key cryptography and takes advantage of devices that
6:06
are in use your scans every day, right.
6:09
So our tagline is simpler stronger authentication, so it's
6:12
stronger. Authentication using the public
6:13
key cryptography, but also simpler because any side
6:17
authentication activity is done with a single single gesture.
6:22
So whether that's touching my finger to a phone touching, a
6:26
security key in certain security key, using face, ID, or Windows,
6:30
hello. This is all just one gesture for
6:32
me to authenticate myself. And I think that's really
6:35
important because as we've all seen, If a second you know if if
6:41
security is too hard, will won't use it.
6:43
The option rates, go down especially with consumers.
6:47
Often rates for second Factor authentication, go down, the
6:50
more complex, it is. So we think that, you know,
6:53
decreasing friction while increasing security is the
6:57
approach. We need to take to get people,
6:58
to actually adopt stronger communication.
7:01
Now, one other note, I want to make As I said all shared
7:05
secrets on the sermon, right? So while any form of MFA or two,
7:11
if a any second factor for authentication, is better than
7:15
passwords loan and will protect people against scalable tax,
7:21
frankly. Anything on a server can will be
7:23
stolen, so that includes otps. Otps are still shared secret,
7:28
they're still on a server. I'll be it for a much shorter
7:30
period of time, but they can be manipulated through a man in the
7:33
middle attack. That replay attack and things
7:35
like that. You know, that's how you know, a
7:38
lot of spearfishing. It attacks are successful,
7:41
people think are protected, but they're really not.
7:43
So, you know, half those are good at their jobs which is why
7:48
over 40% of phishing attempts are successful.
7:51
So we need to put tools in the hands of users, that help
7:54
protect them from the bad guys and also from themselves because
7:57
it's very easy to get fished, frankly, there's no shame in it
8:00
because you're dealing with professionals.
8:02
So we need to Implement fight authentication to help people,
8:07
prevent prevent people from getting their cows, taking over
8:10
other nefarious, things happening.
8:14
What I'd like to add to that. I think you should only really
8:16
good point about phishing attacks.
8:18
As you know, we run into the phishing attack.
8:21
Where you think gosh person must be stupid to fall for those but
8:24
I've seen some, you know, especially videos and Conference
8:29
presentations from like black hat where these phishing attack,
8:34
some of them are extremely sophisticated.
8:36
They'll poses a site like Google have you log in and provide a
8:42
one-time. Word really?
8:44
They're taking that then and in the background authenticating
8:48
you and then, you know, changing your password while you're in
8:52
the site and it's like I can see how people can can get duped
8:57
into those. Now those are the more
8:58
sophisticated ones is not your everyday phishing attack but you
9:02
know when the risk is high it certainly there.
9:05
Yeah. I mean I just want to come back
9:07
the data point as a Google statistic 40% of well-designed
9:11
phishing attacks are successful. Arthur you had like you said,
9:14
we're not talking about a Nigerian prince, you know,
9:18
sloppy emails. But these are in a well-designed
9:20
phishing attacks of a 40% success rate.
9:22
Now, the click rate success rate, which is a staggering
9:25
number which you know, it shows that fishing pays it really
9:28
starts to outline the depth of this problem.
9:33
At 40% is an astronomical number considering that usually, that
9:38
kind of attack is, is talking about single digit success,
9:41
right? So if you can, I mean, that is
9:44
just crazy. How many people fall for it, and
9:47
sometimes it's, you know, obviously user education plays,
9:51
a big part in to it. But, you know, even the best can
9:54
get fooled. And, you know, we saw what
9:55
recently happened with Twitter, right, where they got socially
9:58
engineered and someone got in and you did some things.
10:02
I'm thankful. IE.
10:03
They only care about Bitcoin but they could have done a world of
10:05
damage like literally just based off of that that social
10:09
engineering attack and then getting access to the inside
10:11
tool. So I think it's important to
10:12
understand that even though you have education, you need to back
10:17
end it with good, strong methods to enforce and reinforce the
10:23
security message. You're putting out there which
10:24
is why MFA is so important. So I'm glad your em not to get
10:29
off track on the, on the, the direction I want to take this,
10:32
but I'm glad You raised Twitter because I think you know what
10:37
needs to be clear is that, that attack could not have happened.
10:40
If those administrators were using Fido Securities.
10:44
Grab the social engineering attack, could not have been
10:46
successful if those never gab menswear you who are obviously,
10:49
you know, smart top of users, if they were using fight a
10:53
Securities that that would not have been successful.
10:57
It's probably one of the bigger things you could do in an
10:59
organization. It still shocks me when when Jim
11:01
and I are working with folks out there that MFA is not kind of
11:04
standardized. I think, what's becoming more
11:07
prevalent? Is that MFA is put in place for
11:10
what they consider privileged access typically but they're
11:12
still not protecting normal users right from that kind of
11:15
thing. So, I think at this point, you
11:18
know, even Gartner think mentioned it.
11:20
I don't know if his last year year before that MFA is Baseline
11:23
at this point, password is not good enough and The easier you
11:27
can make MFA the better experience it is.
11:31
You know, the easier Spears is going to be for the user, which
11:33
means that your security increases and makes it a lot lot
11:37
better for everybody. So that's why I think that Fido
11:39
is is great because I can see the usability benefits of it.
11:44
And you know some of the challenges that it typically
11:46
solves around some of the more Legacy approaches to MFA.
11:51
Right things like tokens and you know, SMS which are easy to
11:56
Oops, relatively speaking, you know, from a security standpoint
11:59
you know e.l. one-time passwords like all use all the stuff that
12:02
you said around it being stored somewhere in a server, write
12:04
that kind of thing. But also just the usability
12:06
aspect of it is huge. Jeff.
12:09
I'd also add to that, you know, that is the other angle.
12:13
So when you think about the statement passwords are dead or
12:17
pastors should be dead, passwords are dinosaurs, it's
12:22
not just the security aspect. It's also the usability aspect
12:26
and for me, that's a big reason. Why Fido is so important and
12:31
room wondering, if you could kind of talk about the usability
12:35
angle and why that's so important?
12:38
Yeah, fully. So, you know, as I mentioned
12:41
before, you invited tagline is simpler stronger,
12:43
authentication. And I think their part and
12:45
parcel, you know, if it's not easy, people use it and it needs
12:49
to be easy for Mass adoption. So, if itís focused on a single
12:53
gesture strong user authentication.
12:58
So, let's take a different lean on this and look at traditional
13:02
means of an effect. All right, so that multi-factor
13:05
authentication is to a phase is not new.
13:09
But it's had some challenges, right?
13:10
And they have both security and usability challenges, all right.
13:13
So the traditional means, you know, what going way back is
13:16
having like a token dedicated token with totp on it but a
13:21
dedicated piece of hardware for Easter.
13:23
So say you have I also talked about that he's ability for a
13:26
second. One, is you have to know if
13:28
you're doing a lot of sensitive work, you have multiple tokens.
13:31
We have the token keychain problem to you need to literally
13:34
juggle, you know, devices to enter in the code.
13:38
Code to verify yourself with it with two new system.
13:44
Now compare that to find him, we're everything the tokens that
13:47
you have. So, you're using external
13:48
security key. But we call Roman authenticator,
13:51
you know, that can support multiple services.
13:53
And again, all you need to do is touch it or insert it is.
13:55
All you're doing is proving possession of the advice.
13:58
So there's a good example right there of how.
14:01
If I do provides a superior user experience over the traditional
14:06
token-based means the multi-factor Authentication.
14:08
Ocean. Additionally, if I do obviously
14:12
supports Biometrics, which brings the same benefits of
14:16
security and privacy at Fidos, public key cryptography,
14:20
underlying architecture but you can use biometric to prove
14:24
possession and to verify yourself also and that's even
14:27
easier, right? Where you just literally again
14:30
touching a device or you're looking at a camera, right?
14:32
So, Any of our users, any of your listeners who use Windows?
14:37
Hello. Are you seeing this every day?
14:39
But I logged into my PC looking at my camera I mean it doesn't
14:42
get much easier than that or by touching my personal favorite
14:46
are brain scanner or using a local pin.
14:48
Now the key thing is that all this is local on the device and
14:51
all very user-friendly single action to you know do things
14:56
that are traditionally associated with a locking
14:58
devices. Are now being used with Fido to
15:01
log me in, right? So that's kind of the smaller
15:04
Little League. We need people to take is that
15:06
unlock means login and the same easy mechanism you have for.
15:09
That is actually doing a highly secure authentication process
15:14
through the same exact action. I'm a big fan of Windows.
15:18
Hello. I have been for years and, you
15:21
know, I think Jim is mentioned before, but I'm kind of a tech
15:25
geek tech nerd, some kind of on The Cutting Edge of the
15:27
technology usually and you know, I saw Windows.
15:29
Hello several years back when it was first rolling out and I
15:33
couldn't wait for that Hardware to become more prevalent in the
15:37
Enterprise because typically Enterprise Hardware Cycles are
15:41
somewhere in the two to four year range.
15:43
You know if not longer and you know, it's going to be a couple
15:46
of years before. The fingerprint reader.
15:49
The, you know, the IR camera is standard Hardware right on most
15:52
Enterprise devices. So I'm excited to see that
15:54
becoming more of an option in the Enterprise and I'm really
15:58
excited to hear that Apple join the fight Alliance relative
16:01
recently. Think it was maybe a couple
16:03
months ago at this point and I'm hopeful that things like touch
16:06
ID and the rumored face ID on the Mac books.
16:09
For example, that might be coming out in the future, might
16:12
be taking advantage of that and I know that you've got a lot of
16:15
big Heavy Hitters in the industry.
16:17
Maybe In talk a little bit about folks like Microsoft and Apple
16:20
and other organizations Google that.
16:23
That might be part of the alliance and what that brings to
16:26
the table. Yeah, absolutely.
16:29
And so, Apple did join photos board of directors in January of
16:32
this year and it's been really great.
16:33
And I think once you have makes 50 unique and I've done a number
16:38
of Standards, I mentioned, Liberty Alliance, I've done.
16:40
Other kind of multi stakeholder organizations in my career.
16:44
What makes 50 unique is that there isn't really an
16:45
alternative standards Effort right.
16:48
There is no betamax our VHS not to date myself, but if you're
16:53
interested in standards based authentication, it's really
16:55
quite oh and apple joining at the beginning of year really
16:59
unified the industry around side of authentication.
17:04
So I think it's really important but amongst our members, we have
17:08
250 something members in the alliance include have board
17:13
around 40 companies. And I think, what's really cool
17:16
about our board of directors is a It has the right composition
17:19
accompany the right composition companies to address this
17:22
password problem. So first we have kind of loosely
17:29
described these companies as device manufacturers.
17:32
So people who are creating the devices and platforms that we
17:39
use everyday. So companies on a ship's outside
17:42
like Garnet Intel and Finney and groups like that but the
17:45
platform's right? So Microsoft Google Apple device
17:51
manufacturers like Samsung Lenovo right?
17:53
All these companies are involved with Fido making sure these
17:57
platforms and devices support fight authentication.
18:01
Secondly, we have experts in security and Biometrics so both
18:05
stalwarts long time stalwarts like RSA and groups like that
18:09
and once fan but also you know, emerging companies are really
18:12
driving a lot of innovation and the authentication space like
18:16
you would go and hyper. And Knock-Knock and groups like
18:18
that, what you're really getting a lot of traction.
18:21
And last but not least, we have the service providers, grab
18:24
these are the companies whose businesses are dependent upon
18:27
their ability to deliver High Assurance services to billions
18:31
of users worldwide on daily basis for estimating.
18:33
They are dependent on Fido being successful or else you have to
18:37
go in and on standards Direction.
18:40
And so these are the, you know, the big social networking
18:42
companies like Facebook and groups like that.
18:47
Converse companies, like Amazon payments, networks MasterCard,
18:51
Visa American Express big banks. These are the companies that are
18:55
helping steer Fido lines. So I think when you look at that
18:59
kind of breadth of membership that we have at the top, which
19:01
is also reflected throughout the rest of our membership, you
19:06
know, I think it gives us a really good starting point to
19:08
help us be successful. In doing the three things that
19:11
finalized does, which is a bill technical specifications based
19:16
on Market. He's be, we Grant a
19:19
certification programming building a really diverse
19:22
ecosystem of products that are quite a certified, which
19:26
companies can use to deploy fighter with indication the
19:29
last. But not least, you know, develop
19:32
best practices and help people be successful in understanding
19:35
and driving adoption if I do authentication.
19:38
So, yeah, cover the question starting with the Apple, but I
19:42
think it's really important to look at the full range of
19:45
members that we have. Driving 50 Ford.
19:50
Yeah, absolutely. I think that was a great
19:51
overview. You know, one thing that I
19:55
didn't really understand this until I started doing more
19:58
research is what is the difference between Fido and Fido
20:02
too? Yeah, well, so let's back up and
20:07
talk about photos specification than 50 architecture.
20:10
At a high level, but specifications.
20:12
So, as I mentioned previously, if I do authentication leverages
20:17
public key cryptography, user-friendly public key
20:19
cryptography, High vertical, be called pki evolved.
20:24
But the key thing that we're doing is introducing, the
20:26
concept of an authenticator. An authenticator is both a
20:31
saying, in a concept, its base Ali where the private key
20:36
stored. And so, instead of having being
20:39
dependent on passwords on a server and study using public
20:43
key cryptography, you have a unique key pair for each Fido
20:47
account. The private key saves the
20:49
authenticator secure on the user's device and a public key
20:53
sits on the server instead of a password as we all know public
20:56
Keys, have no material value, the can't be reused.
20:59
So when, if and when I do, you know, Happens.
21:05
One thing it's not stolen is password, right?
21:07
Which starts to break that credentials that cycle, which is
21:11
plaguing so many companies. But if I do specifications, So
21:18
the first intifada specifications are came out.
21:21
There are two. One is focused on a biometric
21:23
use case. I've just called 50 uaf out a
21:25
universal authentication framework.
21:27
And a second one was based on a second Factor, use case you to
21:31
F, which is popularized by gimmicky and all the other
21:34
companies. Now making biosecurity keys,
21:37
both of those have the same approach to underline with.
21:43
Again, if I do public key cryptography, underlying
21:46
architecture Supporting both to the differences.
21:49
With uaf is basically password replacement.
21:51
The biometric and u2f it was using activating the private Key
21:57
by verifying possession. That device Again by inserting
22:01
your touching and interactions with security key.
22:05
Whereas back in a second with uaf, use a biometric to verify
22:08
yourself so that the private key could be activated.
22:11
Those are the the first steps in spite of specifications.
22:15
We saw strong take up with both uaf and you.
22:17
Laughs, you two have had strong pickups a inside of Google and
22:22
is attached to Google services. It still supports Google
22:26
services uaf was underpinning. A lot of native apps for I said
22:33
to the average user uaf looks no different than if you have you a
22:36
UF app on your iPhone, it look no different than your usual
22:39
Touch ID experience but is using all the benefits of fight
22:42
authentication, rather than just doing a kind of a password cut
22:46
and paste, which is what the native.
22:47
Biometric would do typically with with Touch ID.
22:52
So even though we have good uptake with both both two of
22:54
those, what photo realizes up to gain scale, and to truly be in
23:00
position position to address. A password problem, we needed to
23:05
Target the platforms starting with the web, right?
23:08
So if I do was working on something called the phyto 2.0,
23:12
web, apis inside the alliance. We made a strategic decision to
23:17
Contribute. These to the w3c and that became
23:24
the web authentication working group The Wave off and working
23:27
group instead of w3c started in the beginning 2016 and that's
23:32
how, you know, 50 decided to Target the web.
23:35
Right. So in Coop and cooperation with
23:37
w3c and it'll often working group got a lot of stakeholders
23:40
and both Fido and w3c working on that.
23:43
That's part of the fight, a to specification.
23:47
The other part of the part of to specification was an extension
23:50
of u2f called CPAP clients authenticator protocol which you
23:55
stand in the you to Fu stays to do a couple of things.
23:58
One, it allows for pasture was Suffocation by enabling resident
24:04
credentials in a security key but secondly it also extends the
24:08
use case to allow devices to be authentic are so now your
24:12
handset could be a security key in addition to security key.
24:15
So that starts to broaden the address.
24:17
It'll basically users who can leverage provide authentication
24:21
on the client side. Those two things together, web
24:24
off then and CCAP comprised by De to.
24:27
So you see a lot of talk wife, I do too because that's where a
24:30
lot of Enterprises are starting to really move towards because
24:36
phyto to is supported in the windows environment and in a lot
24:39
of kind of Enterprise infrastructure.
24:42
So that's one reason why there's a lot more adoption.
24:44
I think an Enterprise with photo to then May have seen with just
24:48
u2f, but frankly, it's that kind of platform support and the web
24:52
support. That's really reassuring in a
24:57
huge wave of adoption for fight authentication.
25:00
So specifically, if I do to supporting in a couple important
25:04
platforms, one is the web graph so that benefit one of the
25:07
benefits of working in w3c is that as soon as we want families
25:11
done as part of the pilot to spec we had support out of the
25:15
box from leading web browsers. From Microsoft Mozilla and
25:20
Google and later on Apple has been supporting about, then in
25:25
Safari. So that's what that's a platform
25:27
and of itself separately as we talked about earlier Windows,
25:31
hello is if I do certified authenticator basically.
25:35
So Windows 10, is it supports phototube inherently?
25:39
So any built-in biometric on a Windows, 10 machine can be used
25:43
in lieu of a password for your login on sites, that Part.
25:48
Well I said well, identified Authentication.
25:51
So what some windows tenza is a fight, a certified environment.
25:54
Additionally, Android is if I do certified environment.
25:58
So any Android 7 or later, handset can support by do
26:01
authentication and likewise use the local biometric instead of a
26:06
password both for Native apps and for, for web based
26:10
authentication. All right, so good example.
26:12
This, for those of you who have an Android device, visit,
26:16
ebay.com, and go to login with your Android device, and it will
26:20
prompt you. To use your biometric instead of
26:24
using the password. And then most recently, Apple
26:28
announced support for Fido and their update to iOS and Mac OS
26:33
that will allow web Safari. Also explicitly, support, fight
26:40
authentication with Native Biometrics on iPhones, and
26:43
macros. So that really starts to extend
26:46
the addressable user base. So all told, you know, over the
26:48
past year and a half, is you seen this platform has a If I do
26:52
through phyto to you know there's billions of added
26:56
devices that can Now consume 500 authentication.
26:59
So I think that that expansion of the addressable Market by
27:03
default is one reason why we're seeing so many companies now,
27:06
ramp up their plans to support fighting.
27:09
So, yes, you know, that is going back to your question that is
27:11
Phi 2 on those platforms. But ultimately, to us, you know,
27:16
is I see it all as fight authentication because it all
27:19
has the same exact benefits as the initial.
27:21
So specifications brought to the table and, you know, but it's in
27:26
general, it's good to see this ground movement to support many.
27:30
What are some of the Fido or Fido to Enterprise?
27:34
Use cases that people should be thinking about if they're
27:37
sitting in AC so chair or maybe as a member of an I am program
27:42
or I am architect, because I know a lot of the, the focus is
27:45
typically paid on the end user experience.
27:48
What if I'm trying to implement something like this as, you
27:51
know, Just a normal corporate environment.
27:53
What are some of the things that you could offer to those types
27:55
of folks? Well, I think talk about a
27:59
couple of things. So, one, you know, you need to
28:01
think about your use case and your infrastructure.
28:03
I said, no environments, every environments, little different.
28:08
We talk about Microsoft support for Fido.
28:11
Right? So if your Microsoft shop moving
28:14
towards Fidos is somewhat straightforward.
28:17
All right? So, add your ID, for example,
28:18
has a lot of support for, for users and then, of course, the
28:25
desktops all support, Fido as well.
28:28
But also, you know, another thing, I think that a lot of
28:31
soot surgery are dealing with and security.
28:33
Folks are worried about are the new entirely remote Workforce.
28:38
You know, how these people accessing system resources?
28:41
We were talking about fishing before you Fishers and are
28:45
targeting new remote workers. And so you need to make sure
28:49
that they're accessing systems as as securely as easily as
28:53
possible. So we encourage Just doesn't
28:58
think about deploying security keys after the remote Workforce
29:01
and get them moving that direction soon as possible or
29:04
using other kind of device Biometrics either on device, or
29:10
using a phone as a log in to protect their Workforce as well.
29:14
So I think those are the key things to think about is what's
29:18
your use case, it was for a sexier look like and there
29:21
certainly are products that can be brought to bear to protect
29:26
you. The workers and system
29:27
resources, alike somehow that something else that Fido
29:32
Alliance is doing as a body. I mentioned before, you know, we
29:36
do three things, one of those being establishing best
29:38
practices, for implementations of fight authentication, we have
29:43
a working group Focus, only exclusively on Enterprise
29:47
deployment, use cases. So we just actually release the
29:51
white paper. Cxo considerations for moving to
29:56
a patroclus Enterprise. It's actually going to be the
29:58
first in a series of papers that get into more granular.
30:01
Death on exactly how to implement if I do decide
30:04
Enterprise. So I'd encourage people to check
30:08
it out. Won't include some links as part
30:10
of this podcast but can check out that serious.
30:13
You get more details on these best practice recommendations
30:16
which are being developed by actual Enterprise practitioners
30:20
inside if I do lines. So, Andrew, we talked a lot
30:23
about the security benefits, the usability benefits, there's
30:27
obvious benefits to the organization thinking of from
30:33
the standpoint of the, the money people, you know, moving the,
30:37
how does it? How does doing Fido move?
30:40
The needle mean, I can think from a cost perspective, you
30:44
know, there's avoidance of data breaches, but you know, can you
30:48
kind of address that we're within an organization?
30:51
And who cares? How do I get something like this
30:53
approved? And how do I show that?
30:56
I can get an Roi and move the needle for the organization?
31:02
Yeah. Yeah that's a great question and
31:04
it's interesting that I think opinions on this have shifted a
31:06
little better at least from gotten kind of broader.
31:11
So initially you know all the focus is on cost avoidance.
31:15
As you mentioned like avoiding a data breach like the cosmic data
31:17
breach, first of all that's actually enough avoiding data
31:20
breach from a cost standpoint. Point and a reputation
31:23
standpoint, and it should be a large enough imperative to move
31:26
away from passwords and towards something like photo, but with
31:29
other costs associated with in Enterprise associated, with not
31:35
using fighter, having complex authentication, right?
31:37
So password resets, you know, you see estimates for that
31:41
ranging from 100 to 1000 dollars per reset.
31:44
Once you factor in the cost of downtime and systems and things
31:48
like that. So, password resets are
31:50
expensive. Lost productivity, bad.
31:54
If someone can't get into a system or can access the system
31:57
because it's too complex or they forgot a password or whatever it
32:00
might be, you're losing that money being spent on employee.
32:04
Not actually working the other costs are four different
32:10
depending on token. So I so the actual hardware
32:12
cloth associated with the in deploying.
32:14
So many tokens, the more advanced tokens are very
32:16
expensive. So I think inside the Enterprise
32:19
if I do a prevent data breaches Has b gets rid of password,
32:24
resets and see makes it easier to log in Google did a case
32:27
study. Couple of years ago, which is we
32:32
site often because is you tens of thousand employees over a
32:37
multi-year study using u2f security Keys, what they found.
32:41
First of all, generally talk about the fact that the study
32:44
found that not one of them got fished right?
32:46
Which is super important and goes to the core security
32:49
message and the bottom line benefits associated with that.
32:53
But other part that study points to the fact that call center
32:58
support desk calls Way down and productivity went way up and the
33:04
also got some sentimental feedback from people that they
33:08
like that login experience better.
33:09
So we're talking about there is you know those are three cops
33:12
battery juice. Plus happy employees is
33:15
beneficial to the company as well.
33:16
So I think there's a lot of ways to look at how Fido creates cost
33:21
savings and those are just some of them.
33:25
Additionally, there's Top Line benefits.
33:28
So, for companies that are selling to Consumers, you know,
33:31
around fast of shopping, cart abandonment, sardu to password
33:36
issues, people can't log in. They can't do that impulse.
33:39
Buy they decide not to buy. That's a huge opportunity cost.
33:45
Additionally, we think that there's brand benefit associated
33:52
with the better login experience.
33:53
So we've recently actually introduced a consumer logo that
33:57
we anticipate service providers using or power bank account info
34:02
button that we anticipate service providers using to
34:06
express their consumers that they are providing a, you know,
34:09
a industry blast, safer Superior simpler logging experience, we
34:16
think there should be a halo effect associated with that, but
34:18
even without the Fido, No, do you know a better logging
34:23
experience is good for good, for one Springs.
34:26
Utah, so what are we saying before about?
34:27
How I think that opinions have evolved on this is that whereas,
34:30
initially, most of the focuses on cost avoidance, we're seeing
34:35
a lot of companies have focus on usability escort service, this
34:38
is better for my customers is making me have happier.
34:41
Customers stick your customers and things like that.
34:43
So a lot more Focus out from decision-makers on the top line
34:48
benefits. In addition, To the bottom line
34:51
across the widest. Yeah, I really like that idea.
34:54
So you have my stamp of approval on the powered by Fido logo or
34:59
bad, just kind of like the Intel inside, but I wanted to go back
35:04
to another point that you made, or maybe it was you agreeing
35:09
with my point around the data breaches.
35:12
Because I think when, you know, Jeff and I were talking about
35:17
data breaches, you know, five years ago It felt more to
35:22
Executives like we were spreading fear and uncertainty
35:25
and doubt and I just I feel like we've come a long way since then
35:30
anybody who thinks that is just you know, not tuned in I mean
35:36
the cost of a data breach, I think we saw a statistic
35:39
recently that the constitute a breach at least in the u.s. is
35:42
like over eight million dollars globally.
35:45
It's over 3 million dollars and that's made up Of, you know, a
35:51
lot of it is the companies have to run around and make good for
35:56
the fact that they fumbled people's data right in that they
36:01
now maybe the victims of identity fraud.
36:05
So it's not fear, uncertainty and doubt and those numbers I
36:08
threw out there. Those are averages, right?
36:10
That includes a lot of a smaller pieces and you get hit by a
36:13
really big breach, it can cost you much more in terms of
36:18
dollars as well. As what I think you pointed out
36:21
in terms of brand reputation, which is a little hard to
36:24
quantify. But it's not fear, uncertainty
36:26
and doubt, and hopefully that message is is getting out there.
36:32
No, it's quite real you know. And in this comes back to the
36:35
question you asked earlier in Wi-Fi, do what's your Wi-Fi to
36:39
exist? And this is what we're trying to
36:40
solve, right? So we were trying to solve
36:42
database problem. So, you know, we're often
36:44
Associated is rightly with the reducing Reliance on passwords.
36:48
But we're doing that to solve a data breach problem because that
36:51
is the, you know, those are expensive and problematic and it
36:55
really just erodes the Integrity of the network economy itself
36:59
and that's not good for anybody. Yeah, I think from a strategy
37:03
standpoint, if your insecurities the two vectors that I would pay
37:07
attention to and there are so many vectors right?
37:10
But the first one is the password and being able to get
37:14
rid of that and secure it in a better way, right?
37:16
Using Technologies like MFA which combined with Fido make it
37:19
easier to use and then being able to mitigate against
37:23
ransomware attacks and the news today is Canon, got hit by a
37:26
ransomware jacket. So, you know, and that's, that's
37:29
a pretty big one, right? And they're not sure if images.
37:32
Stolen. So that's adds another wrinkle
37:34
to it. So having the appropriate stance
37:39
toward security, not only making it available, making it easy to
37:42
use. I think is critically important
37:44
to the adoption and improving security as a whole because what
37:48
you don't want to have is and you spend a bunch of money on
37:51
and getting something in place. And if it's unusable, no one's
37:54
going to use it, you know, what's the point?
37:56
Yeah. Right.
37:57
They're just going to find ways around it so, so I think I love
38:00
what's happening. If I do Oh, and I hope and pray
38:04
that, you know, other organizations will start to kind
38:07
of see the light and consider security as a end-user
38:11
experience as much as possible. And by that, I mean taken to the
38:16
fact that usability of it. So I think it's I think it's
38:18
super important you know, on those lines.
38:21
But you know, I think the changing that, you know, with
38:24
with covid and everything. You know, this remote Workforce
38:29
Your employees are not your consumers to, right?
38:31
So you even an Enterprise, you think, what?
38:32
How are these employees going to log into systems securely and
38:35
and your people will find workarounds first person for
38:41
security, what when they can, you know, we're not everyone,
38:44
but a lot of employees will taste want to log in.
38:46
There is trying to do their job, you know?
38:47
So you need to think about usable secure methodologies for
38:54
granting. The remote access to systems and
38:55
that's where I think another area.
38:57
We're 50 does. Yeah, and this is and that and
39:01
that kind of stuff, right? Leads to things like, you know,
39:03
forwarding emails to a personal email address.
39:06
Well, I can't get to my baby, you know, regular work account
39:08
or it's too hard or whatever it is, right?
39:10
There's all kinds of excuses but it's, you know, it's they're
39:14
solving a usability issue around that, right?
39:16
If you make it easy for people to do their work and make it
39:19
secure, you start to eliminate some of those examples of
39:22
reasons why people would try to look for ways around the
39:26
security posture is it that people put in Place to make the
39:29
organization more secure, you know, is that I'm in favor of it
39:32
which is which is a great thing. And I know you mentioned that
39:34
white paper, we definitely will have a link to that in our show
39:37
notes I guess from a elevator pitch, right?
39:42
Why should someone read that white paper and what do you
39:44
think they'll take a take away out of it in 30 seconds or less?
39:48
Well, it's really this getting people started.
39:50
I'm focusing on the Enterprise benefits of moving towards
39:53
pastoralists authentication for users, right?
39:56
So it's squarely focused on that.
39:58
It's an Enterprise paper that, you know, from Cicero on down,
40:03
in that organization can look at it as succinctly.
40:06
Summarizes key considerations and the house and why why?
40:12
And how to be play Fido. And as I mentioned in the
40:14
beginning of a series that will get into more and more deaf, in
40:19
fact we'll have a blog post on this shortly.
40:21
Kind of starts to outline the series and of itself so people
40:24
can see the key steps associated with deploying fight, own
40:27
Enterprise One thing, this is a little inwardly focused I
40:32
suppose, but one thing we realized our goal is to get
40:37
people to move to Fido. All right, we're unique in the
40:41
sense that we're a nonprofit organization working, not
40:43
pitching products. We're just trying to get people
40:46
to use their application but we have a lot of good high level
40:50
information on our website and we have some a lot of specs, you
40:52
know, all the specs Europa and we have some very detailed white
40:55
paper. Is what we're trying to find The
40:56
Sweet Spot to make Final Act. Well for practitioners.
40:59
So I think this series of papers will really be helpful though.
41:03
I'll be around five pages. Each very actionable in lawsuit
41:07
formation so I think that's what this paper signals and is a good
41:11
starting points again so I'd like to beat a dead horse here
41:15
we because I think everybody probably agrees that the
41:18
passwords are not a good enough control but just as a
41:23
practitioner myself I think to myself I'm relying on passwords
41:27
that can be pretty. Be sure those passwords have
41:30
already been hacked for a large number of users.
41:33
I had to sign up for a little league website the other day and
41:37
create an account with a password.
41:39
I thought there's no way through enough technology on the back
41:43
end of this little league website to secure my password,
41:47
remove, picking on Little League.
41:49
I'm picking on all the hundreds of websites that we use every
41:53
couple of years to create accounts and whether or not, you
41:57
know, those of us The I am industry, use a password Locker,
42:01
that's fine. The average average Joe on the
42:03
street doesn't and that's why you can be pretty sure that if
42:08
you're, if you have a system that relies on, you know, email
42:12
address and password age, going to get compromised Yeah,
42:18
absolutely. Set up before password is not
42:22
modern authentication. So that's all you're offering
42:25
your way behind already. Okay.
42:29
So I think, you know, I'm looking forward to the next
42:31
series of the papers and we'll put a link to the final Alliance
42:33
website as part of the show notes Here.
42:36
I like that. The, the one you just put out it
42:38
is definitely an easy read and I think it's a good way for people
42:42
to start to think about how to position the cell within your
42:45
organization of why we should start to move towards that
42:48
direction. So, if You're interested in
42:51
getting started with Fido or learning more about.
42:53
I think that's I think you've hit it right on the nail and I
42:55
had with that with that paper so definitely check that out.
42:58
On the fight Owens website and also in the show notes that will
43:00
have here which will have a direct link to it.
43:04
Andrew certainly, appreciate your time and I know you're a
43:06
busy guy. Any last words of wisdom that
43:10
you want to throw out there for the folks who are listening?
43:13
I think we hit on all the key points, and I hope people, you
43:16
know, enjoy enjoy listening to us today and, and take something
43:20
away from this. Look for that paper.
43:22
One other thing that we're doing, we have an industry
43:27
conference that we were going to launch us here in person.
43:29
We're going to be virtually virtually instead called
43:31
authenticate. So this was going to be a
43:35
two-day conference focused on all the ins and outs of
43:38
authentication, not just Fido authentication best practices.
43:41
You know, we had maybe a dozen cases, Studies plans, some kind
43:45
of case study track its technical track, the standards
43:47
track, all that's being rolled up into a virtual event so you
43:52
can find information on that on our website, but also on
43:55
authenticate conduct Cam, that is going to be taking place in
44:00
the middle of November. I strongly encourage people to
44:03
sign up to attend that if they want to learn more as well and
44:05
that's going to be free free to attend.
44:09
Great content was submitted for this paper, just a little
44:12
anecdote on authenticate. Eight.
44:14
We thought we're gonna have a hard time pulling together.
44:16
The agenda we had around six times as many papers submitted
44:21
as we had agenda slots, which may be super exciting because
44:24
they help us put together awesome set of content.
44:27
But also it shows that this is really gaining Traction in the
44:30
marketplace. We had submissions from all
44:32
corners of the world talking about different implementations
44:35
applications of Fido. So all that's being brought
44:38
forward into this event. I strongly encourage people to
44:41
to make sure to sign up to attend.
44:43
That's great. Yeah, I'll definitely put a link
44:45
to that it's for the website its aesthetic aesthetic. 8 con.com
44:50
and I'll have a link in the show notes as well and I think that's
44:52
fantastic, isn't it, free? I think we saw a lot of good
44:54
uptake with identifiers, for example, which I believe wrapped
44:59
up last week or maybe it's wrapping up this week.
45:01
It's weird because it's stretched out over several
45:03
weeks, right? But yeah, I'm definitely going
45:06
to be registering for that and looking forward to it.
45:08
So so great deal Jim. Anything else that you want to
45:11
close out with before we answer Ergo.
45:13
No, I just wanted to sit and drove really appreciate your
45:16
time and knows the CEO of 500 that you are extremely busy
45:21
person and just appreciate you taking the time to educate our
45:26
listeners. Thank you for having me.
45:28
How many people you could be talking to you?
45:30
And I appreciate it and, you know, our goal is to get the
45:33
word out and get people engaged and thank you for this
45:37
opportunity. Great.
45:39
Preciate it Andrew. And with that we're going to go
45:42
ahead and close it out for this week.
45:44
Don't forget you can follow us on Twitter at idac podcasts and
45:48
you can check us out on the web at identity at the center.com.
45:52
We're in your favorite podcast app.
45:54
So feel free to subscribe. Follow like whatever the thing
45:57
is that your podcast app. Does that helps us immensely and
46:01
helps us get great guests like Andrew in the future.
46:03
So with that, we'll go ahead and close it out for this week and
46:07
we'll be talking with you all in the next one.
46:09
Thanks for listening. You've been listening to the
46:19
identity of the center podcast for more episodes of visit
46:23
identity at the center.com.