Latest / Identity at the Center / #293 - Passkey Insights and Challenges with Martin Sandren of IKEA

Transcript

#293 - Passkey Insights and Challenges with Martin Sandren of IKEA · Identity at the Center

0:00
There is a bit of urgency because it's clear that the
0:04
right now the attackers have gotten a bit of the upper hand.
0:07
They there's a lot of technology advancement that helps the
0:11
attacker to bypass the, the, the fishing filters.
0:16
The AI is happily helping the attackers to, to craft beautiful
0:20
letters, fishing emails. So there is a need to kind of
0:25
continuing the improvement journey and continuing the
0:28
resilience and this is a quite good tool in your toolbox.
0:39
This is identity at the center. If it has anything to do with
0:44
IAM, this is the go to podcast now your hosts Jim McDonald and
0:51
Jeff Stedman. Welcome to the Identity at the
1:00
Center podcast. I'm Jeff, and there's no gym
1:02
today. He is on assignment.
1:04
I've given him a vacation. He's in lovely Chicago,
1:07
hopefully getting some Portillo's, maybe some shaku,
1:11
but you've got just me today. But I'm not alone.
1:13
I've got my friend Martin. He's going to join us here in a
1:15
second. But before I do that, want to
1:17
again, thank everybody for reaching out over the last week
1:20
or so since we put out our fifth year anniversary episode.
1:23
It's been very great and very humbling to read.
1:26
A lot of the comments have been out there, so definitely
1:28
appreciate that. And we're going to just keep the
1:29
train rolling. So before we get too far along,
1:33
do want to mention that we are partnered up with the Identity
1:35
Week conference that's happening later this year.
1:37
So we have America, which is September 11th and 12th, that's
1:42
in DC. Jim and I are both going to be
1:43
at that and hopefully people can attend and come see us.
1:47
I'm going to be doing some sort of panel TV determined.
1:50
We'll figure that out and we'll probably be doing podcast
1:52
things. And then there's also the one in
1:54
Asia in Singapore, which is October 22nd, 23rd.
1:57
We've got discount codes for that.
1:59
IDAC 30 gets you 30% off of your registration.
2:03
So hopefully people could take advantage of that and come out
2:05
and see us at one of those. We'll also beat Authenticate in
2:08
October, still working on the discount code for that and get
2:11
that published as soon as we've got it.
2:13
But lots of opportunities to come see us and let's see what
2:15
else. There's also some regional
2:17
events taking place for Identiverse in November, I
2:20
believe in both New York City and Chicago.
2:23
I may or may not be attending one or both of those.
2:26
We'll see how things go, but want to make people aware of
2:28
that. I did go to the one last year in
2:30
New York City and I thought it was great.
2:31
I think it was the first time they had done that.
2:33
So kudos to Cyber Risk Alliance and you know, putting that kind
2:37
of stuff out there. I think it's great when we get
2:38
like identity meetups happening. So I'm talking to my own minute.
2:42
So let's get right into it as we introduce our guest today.
2:45
His name is Martin Sandron. He's the I am product lead for
2:48
IKEA. Welcome to the show, Martin.
2:51
Thank you very much. I'm one of your listeners.
2:53
I'm very happy to be on the actual show.
2:58
Well, I, I understand this is probably a career highlight from
3:01
you and, and being on the podcast and you're joining us
3:04
from the Netherlands and, and Amsterdam, I believe is what we
3:07
had established and you're 7 hours ahead.
3:09
So you're coming to us from the future, so to speak.
3:12
Tell us a little bit about Martin.
3:15
How did you get into the world of identity and access
3:17
management? Yeah, so I actually landed in
3:21
this because when I was at university, so I'm originally
3:24
from Sweden. So I went to university in
3:26
Sweden and I started working as a System Administrator in the
3:32
labs and I was supposed to be a chemical engineering major.
3:36
But then I found computers more fun than still in towers.
3:40
So I switched over to computer science.
3:43
And then when I did my, my thesis work, I was looking at
3:47
the integrating ERP systems with elder authentication,
3:50
externalized authentication. And then I kind of landed into
3:54
the, the world of security and ERP systems and then let took a
4:00
job in Germany. And then I went into to
4:05
consulting in the IM space back in 2005 and started doing
4:13
implementation of Tor accelerate, which a little bit
4:18
later became who I am. And then I got stuck.
4:23
You got stuck, but now and now you're with IKEA working on I Am
4:26
stuff there. How long total have you been in
4:29
the identity space? Super a little bit how we count,
4:32
but about 15 to 20 years if you count when I did a bit of other
4:36
things than just I am as well quite a long time now.
4:40
Is there anything from your chemical engineering background
4:43
that you think has translated to the identity space?
4:47
Well, it's interesting because some of the stuff that you do
4:50
in, in AI, for example, how you use machine learning and, and
4:55
peer, it's actually stuff that was kind of invented for how to
5:01
optimize chemical, chemical engineering filler tower, for
5:07
example, back in the late 19th century.
5:10
But when you don't really have a clue of how anything works, you
5:13
can use these data points and pair pair pairing to figure out
5:19
how to get some form of a control of a, a sample and
5:23
outcomes. So it's a little bit useful,
5:27
although not very useful. Useful for other things maybe,
5:31
but I think some of the lessons probably hopefully will apply
5:33
essentially about the AI parallel that you're drawing.
5:36
I know we're going to talk about passkeys and we didn't really
5:38
kind of talk about this ahead of time, but give me your thoughts
5:41
real quickly on AI in the identity space.
5:45
Where do you see things currently and where do you think
5:48
they go? Or where do you want them to go?
5:50
Maybe from an IAI perspective? Well, I think you have the the
5:54
kind of the, the cop and the consiguere concept.
5:58
So we want to use the AI to, to focus limited resources and the
6:06
right things. So for example, you can use that
6:10
to to focus in on the right to certifications that are out of
6:14
band or it can help in IPDR like cases where you really want that
6:20
your, your limited SoC resources focus on the most interesting
6:25
cases. There's also the, the, the use
6:30
cases where you see, for example, generating descriptions
6:34
of groups and similar things. So I do think that there's some
6:37
quite interesting parts, but it's also a little bit like, you
6:40
know, a couple of years ago everything was zero trust.
6:45
So it, it does right now, it kind of more helps the attackers
6:50
in some ways. For example, with AI you can
6:54
write beautiful, really nice phishing matters and also in
6:59
languages that didn't exist before some, some Icelandic
7:04
banks that discovered that suddenly was financially
7:07
feasible to write fishing letters and Icelandic AI
7:10
translations. So it's going to be very
7:13
interesting to see how it's going to help the the council as
7:17
well. Yeah, I think there's a there's
7:19
a lot of runway in the book is just starting to get, you know,
7:23
written on this topic. So I'm always curious when I
7:25
talk with others in this space of, you know, where they think
7:28
things are going or what they what they're kind of seeing in
7:30
the real world. I do want to talk about pass
7:32
keys, though, because I think that's really kind of be the
7:34
main thrust of our conversation. And you presented at EIC just
7:40
last month around this topic. I guess let's let's start with
7:43
your general thoughts around pass keys.
7:46
You know, is it hype? Is it real?
7:48
Where do you stand right now? So, so again, I think it's a
7:52
quite wide kind of topic and it's it's still very, very early
7:56
game and with real implementations.
8:00
If you look at what, what we have been using it for, it's
8:03
primarily in kind of a concept approach to see can it be used
8:09
to provide more efficient resistance for the high and
8:12
highest admins. So of course you have a
8:16
situation where you know, MFA has become ubiquitous like
8:21
everyone, like you can't have a Pam system where you don't have
8:25
a payout indication today. It's not, you know, it won't
8:27
really be a serious system, but the interesting part there is of
8:32
course that some of the technologies that I think at
8:36
least me, I thought that the, the, the push technology was
8:41
really strong. Why would you do anything more?
8:43
But what we are seeing is that the SMS has been defeated.
8:48
There's just a lot of different attacks and and you can Add all
8:52
operational problems. You can get the SMS.
8:55
If you look at push, there's a number of ways that you can
8:58
overwhelm a person or an admin. So the phishing resistance of
9:05
push technologies with the apps or similarities limited.
9:09
So then you of course start looking at alternatives and
9:13
there you have things like hardware keys, which are great,
9:16
but of course very expensive and not only because they cost some
9:20
money to actually purchase, but primarily because they are
9:24
expensive to distribute. And it's a little bit of, I
9:28
remember like 15 years ago when everyone had the, the little
9:34
generators from RSA and similar and you spent a lot of your,
9:37
your time on kind of distributing those across global
9:41
companies. It's a nightmare for me that I
9:43
re relive trying to distribute RSA tokens to people and seed
9:48
files and what happens when you need to replace it just yeah,
9:51
it's it's a problem. Yeah.
9:54
And it's of course when they're a global company, then you kind
9:57
of need to to figure out the way to support is global.
10:00
And of course there are companies that can help you with
10:02
this as well. But it's it's quite large
10:04
investment. And then you always have the
10:05
discussion especially everyone is trying to make sure to
10:10
control costs and adding a quite expensive technology.
10:15
It's something that people are really reluctant to do, of
10:19
course. So with the pass keys and of
10:24
course there's lots of different use cases for it.
10:25
But what we looked at was basically to see, can we use
10:29
this as a way to provide better, stronger phishing resistant
10:33
compared to what you have from a authentication app at the still
10:38
a more quite a low cost compared to rolling out hardware keys.
10:47
And that's been quite an interesting journey.
10:50
Of course, some of it, it's just become generally available.
10:57
And when we did the piloting, one thing we saw is that you
11:03
require quite new mobile phones. So the OS needs to be very kind
11:08
of fresh. And of course, that's an
11:10
important lessons learned because if you have this in your
11:12
plan, one of the things you should look for is to see, you
11:16
know, how much of the phones that your company gives out
11:19
connected support is. And if that percentage is
11:23
allowed to be low, then either wait a little while or start
11:27
notifying your your mobile phone department that you don't have
11:30
to do some refresh and get people some newer phones.
11:33
And usually, especially if you kind of target the higher,
11:37
higher, higher highest, it's usually quite limited amount of
11:41
people and perhaps they're quite happy about the cost of getting
11:44
a new phone. So it'll be nice for your poor
11:47
users once. You know, I'm, I want to touch
11:49
on that factor real quick because I'm always curious how
11:52
phones make it into the corporate or business world for
11:58
other regions. I'll give you my perspective.
12:00
In the US, this is something that I hear a lot when I'm
12:02
working with clients and stuff like that is, well, this idea
12:06
that if the company is going to make me use my phone for
12:10
something, then they should pay for it, whether it's the phone
12:14
itself or the service. And I found that that has
12:17
stopped quite a few companies from rolling out, you know, push
12:20
notification for MFA via an app or even pass keys and kind of
12:24
things like that where it's just this, it's just a sentiment in
12:27
the US, it seems where there are a certain part of the population
12:30
that has that feeling that, well, if the company's making me
12:34
do this, then they should pay for that.
12:36
Is that a similar thing that you experience in in your region or
12:39
is it a little bit different? It it's definitely and of
12:44
course, if you're in a unionized country, either if you're a
12:47
unionist shop in the US or if you're in, in, for example, in
12:52
certain markets like Germany where there's very strong
12:55
unions, unless the company pays for the phone, there's no
13:00
ability to you would you always have to provide an alternative
13:04
for your employees or new contractors to the the phone.
13:09
And that is, I would say if the the biggest challenge, one of
13:13
the biggest challenge that you have when you try to roll out
13:15
MFA in a global company. And then you also have the fact
13:19
that in in certain regions, smartphones aren't the standard
13:22
yet. There are certain regions where
13:25
that where SMS is OK. But if you say that you need to
13:28
have a smartphone and they go like, yeah, but people don't
13:31
have that yet. And so it's, it's important to
13:38
go out and and ask around your different areas to see, you
13:42
know, in the Middle East or in China just what is really
13:46
acceptable to your population. And I think that's something
13:50
that probably people should be thinking about here is passkeys
13:52
are not a binary thing, right? It's another option for an
13:56
organization to leverage to provide to their users or
14:00
customers or whatever It may be that I don't think we're at the
14:04
point yet where only passkeys is the solution that is actually
14:08
viable in the real world. No, the what we, our experience
14:13
was that about if you look at our population of mobile phones,
14:17
only about 30% of them actually supported passkeys.
14:20
Now of course that is improving month by month as we roll in
14:24
newer and newer phones. And again, people can probably
14:29
survive that they get a bit newer phones as long as you have
14:32
the the financial planning for it.
14:36
But today I would say that's definitely a big challenge if
14:40
you would start rolling it out on on broad front.
14:43
Yeah. I mean, that's a big expense to
14:45
put out there. I mean it went from, you know,
14:47
typically like a 30 to maybe $60.00 RSA token depending on
14:52
your bulk pricing to a what, 700 plus, maybe 500 plus, you know,
14:58
bare minimum smartphone. That's a pretty big difference
15:01
in pricing that if you're required to provide that to, you
15:05
know, your workers, I can see how that might be a roadblock.
15:09
Yeah. And the the total cost of
15:12
providing a mobile phone can easily be $50, perhaps $700.00
15:16
if you're right. Take the entire cost.
15:18
So of course you're talking about the broad, broad rollout.
15:22
That is a lot of money for a big company.
15:25
Yes, that's a pretty big bet to place on passkeys.
15:28
I'm wondering, you know, what are some of the other
15:31
challenges? I think the phone typically is
15:33
the first one that comes up. Maybe there's other things like
15:36
applications or remote desktop scenarios, things like that,
15:39
that maybe you've seen some some issues around.
15:41
One thing we saw was, and this is seems to be quite random
15:45
depending on how the application is packaged.
15:48
We have seen running into problems with teams specifically
15:51
which just seems to be a packaging question.
15:54
So an important lesson learned there is just to do a pilot and
15:58
roll it out to the kind of a representative population that
16:01
you want to have it down and see what kind of problems they run
16:04
into and let them run for a few weeks And see, the other thing
16:09
we saw was that, and this is of course a classical problem that
16:14
when we talked about anything that has to do with remote
16:16
desktop, that's always been a challenge for for past keys or
16:21
you know, physical keys or anything.
16:24
And of course, that is done very important because of course,
16:28
what if you want to use this for a higher highest, they usually
16:32
do form of remote desktop. And if that doesn't work, then
16:37
it's not very useful. We also saw that the the IT
16:43
still seems that the the kind of the usability is slightly better
16:48
for the hardware keys. So it's another factor.
16:54
There is also a little bit of of challenge.
16:56
You have to write good manuals because it's sometimes I think
17:01
we concluded that you have still have the authenticator there as
17:04
a backup. Otherwise bad things started
17:06
happening. So I think the main thing if
17:10
you're interested in this, start with a pilot, investigate how
17:15
many people's whose phones is actually working with.
17:20
And then also make sure that you try out all of your the more
17:24
important applications to see that they actually work.
17:29
You mentioned the usability component, and this is something
17:32
that, you know, I, I work in identity and I struggle with
17:35
this sometimes is I have multiple passkeys for my Google
17:39
account, for example, based on whatever device I happen to
17:42
create them. It might be on my MacBook, it
17:44
might be on my phone, it might be in my, you know, password
17:48
wallet, you know, whatever it may be.
17:50
And I can see that being very confusing for people where it's
17:53
like, OK, well, where did I store my passkey?
17:56
And it seems to me like that's off an awful lot of like, OK,
17:58
well, that's another password somewhere.
18:01
Maybe it's not a string that you have to remember, but it's like
18:03
you have to remember where you put it and you know what device
18:05
you used. You run into that scenario.
18:08
Yes, and also that if you look at it, the there's a lot of
18:13
people who wants to be the the single thing that rules them
18:16
all. So if you have some form of a
18:19
password wall like application, many of them are also targeting
18:23
of being working in different ways at the pass keys.
18:27
And then you, you kind of have an explosion in complexity, an
18:30
explosion in, in kind of how do I explain this?
18:34
And especially if you're many global companies like us, we
18:39
have five major help desks. So you have to make sure that
18:44
all everyone is informed about this because of course it
18:47
doesn't take many, especially if we're talking about an admin,
18:50
that tail deployment for example, because the person
18:53
couldn't get in, that becomes a big issue quite quickly.
18:58
Yeah. I thought about this before.
18:59
And I remember thinking back to an early consumer identity
19:03
conference, I think by Cooper and Nicole several years back.
19:07
And somebody came up to me from like a password vault vendor and
19:12
asked me what I thought about that.
19:14
And this was probably four or five years ago.
19:17
And I said, and I, you know, I felt I feel bad about this
19:19
answer. So I'm, I'm putting out there
19:21
and I think I've said it before is like, I just don't know how a
19:23
password vault survives if we are in this world where there's
19:26
no passwords. And now that we're here five
19:30
years later, now I see, oh, well, wait a second.
19:32
We need something to synchronize passkeys between devices.
19:37
And I think that's an area where a vendor neutral platform like a
19:40
password vault can be handy for people to say, OK, you know,
19:43
here's a standardized way that, you know, maybe if I'm rolling
19:46
out to this company and I want everybody to use LastPass or
19:51
Bitwarden or, you know, name your password vault of choice.
19:55
If they support pass keys, does it make it easier to say, hey,
19:59
here's the process. Store your pass keys here.
20:02
They work across devices and try to avoid some of the confusion
20:07
that goes along with, well, is this in my iCloud Keychain or is
20:11
this in my Windows TPM chip? Is this in you know in the
20:14
Android? You know, store or whatever it
20:16
might be. I'm curious what your thoughts
20:18
are on that. Yeah.
20:20
So it's, well yet another case where something has kind of
20:23
reinvented themselves. And of course, this is an
20:26
important part of your security standards as well.
20:29
So if you're using this for the high and highest, then perhaps
20:34
device bound is the right way to go.
20:37
That of course also then means that the question comes in in,
20:42
you know, once we have this in place, is the attack path that
20:47
is going to come in now? Is it the going to be the bind
20:51
and re bind of of passkeys and and application devices to the
20:56
user? So they the and that then
20:59
highlights the need for the service desk and how do they
21:03
authenticate user. Of course, now that we're kind
21:06
of past COVID, people can come into the office and then they
21:09
can show a physical idea. So that'll become a little bit
21:14
better. But there's still a lot of
21:15
people who might be working quite far away from the closest
21:19
physical help desk. And then you have to figure out
21:22
a way to do remote communication.
21:25
Of course, in, in Europe, every, all the light is coming towards
21:30
the, the, the wallet. So perhaps that is the solution
21:33
to that specific problem, you know?
21:38
Yeah, I guess it's, it's an interesting evolution maybe of
21:43
that solution and that technology.
21:46
What are we, we, I feel like this has been a negative
21:49
conversation only from the fact of like we've talked about the
21:52
challenges, right? Like this thing is not easy yet
21:55
it's if there's many things still to overcome that are
21:58
absolutely real, real world problems that we need to solve
22:01
for. But let's talk some of the
22:03
benefits. You know, what do you see as
22:05
some of the things that maybe you know, your users or you've
22:09
seen out in, you know, in in your world that have benefited
22:13
people to say, Oh yeah, this past few thing is great, you
22:16
know, and here's the benefit it provided.
22:19
So I think from our perspective, it's mostly it's, it's a
22:23
financially viable alternative to hardware keys for admins and
22:29
to get the phishing resistant solution in place.
22:33
And I definitely think this is something that there's the in,
22:37
in many cases we are very close to.
22:41
If you look at the the challenges that they are
22:43
becoming smaller and smaller per month.
22:46
So come, come fall, we're probably going to see, you know,
22:49
50% of the phones being able to support it of course depends on
22:54
how quickly you have your turnovers that's run.
22:57
So at that point, this is a really good idea compared to
23:02
continue using, you know, SMS or authentication apps or
23:07
equivalent, at least for some of the the really high admins.
23:13
And provided that that your applications connect to
23:15
supported them. And perhaps you don't do it on
23:19
your, your in many cases you want to do a separation anyway
23:25
between your, your personal account that you do all your,
23:29
you know, e-mail reading and web browsing and stuff and your
23:32
admin account. And then your admin account.
23:35
You might not be using that many applications that you know,
23:38
you're, if you're a, a primarily a Nash or Andra admin, that is
23:43
what you primarily do or you run into your Pam solution.
23:45
That's the only thing you do with that account.
23:47
So being able to lift the cost efficient manner, the security
23:52
of for that those kind of logins that making it really a lot more
23:55
fishery system, that is a huge boon.
23:57
And especially in you know, tough times and budgets might
24:01
not be as easy to get to not having to to make a large
24:05
investment in hardware keys and getting all the logistics
24:08
working that's it's a a significant improvement at the
24:13
relatively small investment. If I never have to send a
24:16
hardware token again out in the real world, I would be very
24:19
happy about that. That's a a pain and suffering I
24:21
don't wish on any of my fellow ID administrators of and they're
24:25
having to do that today. What about some other things?
24:28
So you mentioned kind of like the, the administrative use
24:30
case. Is there a customer thing here
24:34
that you know, it's, it's going to be easier maybe for customers
24:38
to come in 'cause I think about it from two different lenses.
24:41
One is, you know, the internal workforce, whether that's
24:44
employees, contractors or any partners and things like that.
24:47
And anything about this as a consumer and say, OK, well, you
24:50
know, I have a password wallet that has thousands of user
24:54
accounts in there, and I'm constantly being asked to rotate
24:57
passwords and things like that. Do you see an opportunity maybe
25:01
for, you know, the consumer side of the world to adopt this maybe
25:05
and help with that messaging so that it becomes more well known
25:10
and it becomes a thing that's like, Oh yeah, remember this,
25:12
You know, this thing that was kind of new, everybody's doing
25:15
it kind of like a Face ID or a Touch ID or other biometric
25:17
approaches. So I definitely think so if you
25:21
look at of course the little bit, the challenge here is that
25:24
you see, I think it's still see a quite kind of divergent in
25:28
different worlds that you have an Apple world and the Microsoft
25:33
world etcetera. They I think that part is going
25:37
to be kind of first coming to more advanced users.
25:41
And of course it depends a little bit of what kind of
25:43
consumers you have. If you have a high security
25:46
solution like financial services recall and then you're probably
25:50
going to have this earlier then you might already have a
25:54
standardized solution for it that's more secure.
25:59
It's definitely something I would expect coming in as a
26:02
standard part of, of CM solutions again, probably from,
26:07
from the fall or from next year and that people start kind of
26:11
using it. And in that setup, there's this
26:18
assuming that you're, you have a model CM solution that supports,
26:21
there's not a huge lot of downside of supporting it next
26:24
to the passwords. So of course, it's just a little
26:28
bit more straightforward and you, you eliminate the risk of
26:32
credential stuffing. Of course, you could say, OK,
26:36
what's different if I have, I generate a strong password and
26:39
my my password manager in my in my browser anyway, is there a
26:45
huge difference? And that's of course debatable,
26:49
but there is definitely a consumer, you know customer use
26:54
kit as well. So I want to I want to have you
26:58
put on your future prediction hat and tell me when do you
27:02
think we'll see, you know, something that's like AI related
27:06
to past keys we talked about earlier.
27:09
I was like, well, you know, everything's AI and it was zero
27:11
trust was a couple years ago. Like do you see an opportunity
27:14
for AI to help in any way with some of the passkey deployment?
27:18
And I think we can. Anything is on the table as far
27:20
as I'm concerned. Yes, so, so I think what we
27:23
usually look at when we think about this, you know, again, the
27:26
cop and cosiguere. So I definitely think that the
27:29
the cosiguere will keep track of all of the passkeys and make
27:32
sure that you, you know, where did I, which, where did I put
27:36
this, this passkey that I was supposed to find and figure that
27:39
part out. So I I do think that there is
27:44
some some AI parsh this as well. I'm waiting for like the the
27:49
logo on somebody's product that says, you know, such and such
27:52
authentication now with 50% more AI, right?
27:56
Or something like that that's trying to get on the hype train
27:59
for this type of thing. One other thing that I think I
28:03
want to get into is around, you know, you, you've, so you're
28:06
doing this in the real world. You're testing this out.
28:09
Is there anything that's surprising that you've come up
28:11
with? It's like, oh, I wasn't
28:13
expecting that when you started on this journey of fast
28:16
wordless. So, so I think one thing that
28:19
surprised me was that, that, that you required such a new OS
28:23
like the fact that my, my phone, my private phone, that is only
28:27
like 6 months, it's not supporting it yet.
28:30
That was not something I had expected to run in as a major
28:33
challenge. And it's a little bit, well, at
28:38
least to me, it was surprising that you needed to have a really
28:40
new OS to be able to run it in Android, for example.
28:43
And basically, at least when we looked at this three months ago,
28:47
it was almost like it was only the Google post that had it
28:51
supported on a broad front. That was one surprise.
28:55
I was also surprised about the fact that the the the
28:59
application packaging system matter.
29:01
That is not something I would have expected.
29:04
Yeah. Talk to me about the application
29:05
packaging. You mentioned it before and I
29:07
think give me, can you talk a bit more specifically about what
29:11
is the challenge there that that we need to overcome still as an
29:13
industry? So and I have to admit that we
29:17
didn't really figure out exactly why this run the problem.
29:20
It seems that so of course like most enterprises we need package
29:25
applications before we push them out to to our users.
29:28
And it seemed that certain ways of when we packaged up certain
29:32
applications was not was not compatible with the the pass
29:37
keys, which is not something I would have expected.
29:41
So that was a surprise to me at least.
29:44
Do you think that's something that's like OS specific or app
29:48
specific? Or maybe we just don't know yet.
29:49
Maybe it's both. It's a little bit unclear, but
29:52
it seems that if you also how it's installed, if it's
29:55
installed as admin requires, then it works.
29:59
Or I have to admit we've never figured out why it didn't work
30:02
because control that didn't work.
30:03
And that's the next phase is to sit down and see if we can get
30:09
these a few remaining applications.
30:12
But again, I think for at least initial years, it's mostly about
30:18
the Pam and there were they the the high and high and highest
30:22
admin and there it's mostly about how you handle remote
30:26
workstations. That is a a big problem for us
30:30
at least. Well, we've got a lot of
30:33
listeners all around the world, so maybe we can Crowdsource this
30:35
and, you know, we'll have a, a link to your, your LinkedIn
30:38
profile at our show notes. Maybe if there's advice at the
30:41
risk of killing Martin's inbox, you know, if there's ideas,
30:45
maybe they can reach out with, you know, potential solutions.
30:49
Sounds like a great idea. All right, so you've, you've
30:53
taken this journey on, you're just kind of getting started.
30:56
What's a piece of advice that you would give to people out
30:59
there who are in your shoes and they're like, OK, this paske
31:03
thing sounds interesting. What's something that I should
31:06
be thinking about? So the first part is to see if
31:10
if you have a, a, some form of a CMDB or management of, of mobile
31:15
phones, see how many of the mobile phones that was given out
31:18
by your company or actually supporting it.
31:23
That's a good starting point. The second thing is to kind of
31:27
perhaps put out some messages in the Slack channels, whatever you
31:30
use for and then suddenly people come bouncing up and says that
31:34
they will depart of the the pilot.
31:36
And that's a good way to get that an enthusiastic testing
31:42
force and then just try it out. Also, one thing, one eternal
31:49
challenge in an enterprise is it's how do you handle service
31:52
accounts? That's another interesting part
31:56
for perhaps this perhaps is a part of the solution to the
31:59
problem as well. It's a problem that you need,
32:03
you know, five 10/15/20 solutions because there's no
32:06
feel a bullet that solves all the application teams need for
32:10
having some form of a workable solution that's both secure and
32:14
works in their environment with the the specific setup they
32:18
have. So it's not an important thing.
32:21
And then try it out and be ready to kind of roll it back if it
32:24
turns out that it doesn't work for the the pilot force that you
32:27
have. Yeah, make sure you can recover
32:30
if you need you, right? Don't delete that password just
32:33
yet. We're not quite there yet.
32:34
You need somewhere to recover to go through that process.
32:37
All right, so those are things that people should be thinking
32:39
about. Let me put you on the spot here.
32:42
What's something that people should absolutely not be doing?
32:45
Like is there something that's like, Oh yeah, we tried that and
32:47
my experience that is not a good idea.
32:49
Or maybe just a general rule of thumb is, you know, definitely.
32:52
Don't do it. I just say definitely don't just
32:55
kind of say, well, today, now we have passkeys, their entire
33:00
company. Please stop using them.
33:04
Then you're gonna get a lot of people.
33:05
It's gonna go back. But my phone doesn't support
33:07
this and the the usability of these, this kind of close and
33:15
journeys is not really where they should be.
33:17
So you kind of need to have users that are very forgiving
33:21
for for problems to do this. So I would not roll it out on
33:27
the broad front just yet. Probably takes a bit more, bit
33:32
more versions before that is clear.
33:34
Yeah. Toe in the water a little bit,
33:36
maybe not Jump full full sleeve. Yeah.
33:39
But I do think it's a good idea to start trying this because it
33:43
it it does improve your your fishing resistance quite a lot
33:49
at the cost that is carryable by the company.
33:53
And that's a that's a great goal to strive for.
33:54
I think, you know, the more we're fishing resistant methods
33:57
we have out there, they think the better for everybody.
33:59
Yeah, obviously helps the user from their account security,
34:01
helps support desks and trying to reclaim those and obviously
34:05
the cost of study with organizations and, you know,
34:07
data and stuff like that. So definitely supportive of
34:10
that, yeah. And I think that's that's an
34:13
important part if you look at how you combat the attackers, a
34:19
lot of it is just trying to start walking towards both
34:23
increasing your Fisher resistance and stop putting
34:26
little speed bumps in front of the attacker that you will not
34:30
today you will not be able to kind of build the perfect kind
34:34
of castle that no one will break into.
34:35
But if you do, for example, you know, look at at your Active
34:41
Directory, I'll say, OK, how do I manage my entitlements?
34:46
Could it be that I could move from my kind of organic
34:49
entitlement model where you kind of giving out entitlements a
34:53
little bit, you know, piece by piece to a more structured model
34:58
where you go towards least privilege, at least vaguely
35:02
reasonable privileges most of the time.
35:06
And that you cannot do things like separating your normal
35:09
accounts from your admin account.
35:12
Those things thus make it much harder for attacker.
35:16
It means that they have to spend more time trying to crack the
35:19
next layer. And also that means that they
35:23
they take them more time and you generate more signal that gives
35:26
the the cybersecurity teams a lot more chances to to pick up
35:30
on the attack. Yeah, I feel like this is an
35:34
area where the, and I'm going to ask you if this is something
35:39
that makes sense in in your region is what we say sometimes
35:42
in the US is you don't want to be faster.
35:44
You don't have to outrun the bear.
35:46
You just have to be faster than your friends.
35:50
To a a large degree that's very true also here in Europe and I
35:55
think globally and also just trying to continuously kind of
36:00
move, move forward and, and it will, you know, 1000 small steps
36:06
get you. It's more of the the the
36:09
torturous probably beats the hair in this case.
36:13
That's a good analogy. I mentioned early on that you
36:17
had presented on this topic at the European end conference for
36:21
by the Martin Cooper puts out for Cooper Cole.
36:25
Did we is there anything that we missed from this conversation
36:27
that you think is worth like people understanding and kind of
36:29
getting out there and and part sharing your wisdom on us?
36:34
No, it was a quite interesting was a very full room.
36:37
So it's nice and I got E Mahler was doing the was the moderator,
36:42
which also was nice. That's great.
36:46
Yeah, yes. And I think this is a very
36:51
interesting topic that is going to really kind of become real.
36:56
And then we're going to see more and more implementations during
36:59
the next 6 to 12 months. And there is a bit of urgency
37:06
because it's clear that the right now the attackers have
37:10
gotten a bit of the upper hand. There's a lot of technology
37:14
advancement that helps the attacker to bypass the, the, the
37:19
fishing filters. The AI is happily helping the
37:23
attackers to craft beautiful letters, fishing emails.
37:27
So if there is a a need to kind of continuing the improvement
37:31
journey and continuing the resilience and this is a quite
37:36
good tool in your toolbox. Yeah, I mean, this is an area
37:40
that I think is really just starting to kind of explode.
37:44
And I'm sure we'll hear more about it at the Fido
37:46
Authenticate conference later this year.
37:48
You know, hats off to them for getting Microsoft, Google and
37:51
Apple all on the same table to kind of figure this out.
37:53
I think for a longest time, yeah, that was that was a
37:55
struggle. But we're finally coming
37:57
together right as a group to try and make this better for
38:00
everybody, both from a security but also from a usability
38:02
standpoint. I want to close the conversation
38:05
out with something that you told me right before we hit record.
38:10
You know, we end on a show on a wider note.
38:11
And you mentioned a moose tower and I was like, all right, we
38:15
have to talk about that on on the show.
38:18
Tell me about your moose tower. So I'm already from Sweden and
38:23
in in Sweden there's a lot of of woods and not very many people.
38:28
And if you're from the more rural parts of Sweden, there is
38:30
something called the moose hunting season.
38:33
So it's one week and it's different weeks in different
38:35
parts of Sweden. And basically a large part of
38:39
the rural population, they don't sit for a week with a
38:42
high-powered rifle and looks for moose.
38:46
And then you sit in one of these towers.
38:48
And a few years ago my, my son wanted a, a swing and I could of
38:54
course, my backyard and I live in Amsterdam, so my back is
38:57
very, very small. And I was thinking I could go
39:01
and buy a swing thought. But hey, I found this nice
39:06
blueprints from for how to build a moose hunting tower.
39:09
Is that in the there's a Swedish organization that tries to
39:13
promote building with lumber. So they have all of these
39:16
treated drawings and everything. And I, my, I managed to convince
39:20
my wife that I was allowed to build Musharking towers.
39:23
It was during COVID. So I started happily building
39:25
it. And she was probably thinking
39:27
that it will never be able to do it.
39:29
But now it's there. So it's, and it's about two
39:34
meters high and say 4 square meters or so.
39:41
And it's now been promoted from being a swing set, still a swing
39:44
set on the bus tower. And then it's also been it's
39:48
just now as I I strawberry and and potato growing towers have a
39:54
vertical farming. It's important when you have a
39:59
very small backyard that my my wife is American and she has her
40:03
small patch of grass that she can enjoy her suburbia and that
40:07
high am I potato and the and the.
40:11
Strawberry growing moose hunting tower.
40:14
And you got this in the in your backyard in the Amsterdam area.
40:17
And I guess for I'm trying to think of the conversion.
40:19
So 2 meters is about like what, 6 1/2 feet or so for the people
40:22
who are in the US on the. Six feet, yeah.
40:25
Yeah, it's like that. So that's pretty high off the
40:27
ground. Yeah, so it's probably not.
40:32
I managed. I I asked the neighbor if I was
40:34
allowed to build and I said yes, but they didn't probably
40:36
understand what the moose hunting tower was so they didn't
40:38
say anything about it. They probably look like what,
40:41
Moose. There's no moose around here.
40:43
Yes, so so it's a little bit that you walk around in this
40:46
moose hunting tower when you water your potatoes and you can
40:48
can look in on all of neighbors. But of course when you live in
40:54
the the the houses are quite high, you know the Dutch style
40:58
high house so everyone can look in everyone backyards anyway,
41:02
so. How long did it take you to
41:04
build it? So it turned out that the
41:07
hardest part was the fact that my house is about 1m below sea
41:13
level and it's built on sand. So the, the, the groundwater is
41:18
very high. So it took me two weekends to
41:21
build it, one weekend to, to do the, the piling.
41:23
So there's the the the 2m high tower also goes about 1 1/2
41:28
meter down into the ground. And that's any and did you do
41:33
this by yourself? Did you have friends help?
41:35
I dropped. My, my, I drafted my wife to do
41:39
a bit of it, but it was mostly about driving the, you put the,
41:44
you take the, the, the 2 1/2 meter long big pieces of wood
41:48
and then you put a half meter of a steel foot onto it and then
41:52
you start digging it out first and then you drive it down.
41:56
It stood now for four years. So it's a very stable loosening
41:59
hour. Interesting.
42:01
So if you were in Sweden, is this pretty similar to what you
42:04
see there? It would it be more like it
42:06
would be taller, It would be bigger.
42:07
Like talk to me about like the Swedish version of it, I guess
42:11
not Swedish, but you know, if it was in Sweden.
42:14
So it it's built actually from the standard pattern for
42:17
building these towers. It's, it's probably built a
42:19
little bit more robust than normally because normally you
42:22
build this with kind of leftover Lamber you happen to have
42:26
hanging around. So, but otherwise it's very
42:29
similar. It's, it's also about, so of
42:31
course one part of having a moose hunting tower so we can
42:33
see the moose, but the other part is that when you hunt
42:36
moose, they are very large. They, they weigh in like a full
42:40
bore. A full grown bull might weigh in
42:43
at like 1200 lbs or so. So you need a very high-powered
42:46
rifle with dumb, dumb bullets to actually stop them.
42:51
And if you don't, if you sit in a tower, you have a downward
42:55
directory of the bullet, which is very good because if you
42:58
would be sitting and and shooting normal, they could the
43:01
bullet could go like a kilometer after the bus and that could be
43:06
potentially very bad for anything else that happens
43:08
against. By putting the the shooters a
43:12
bit up than this hitting not through the dirt behind the bus,
43:16
they miss it. I think another value add that
43:19
you've got now that you start to think about is, you know, you've
43:21
got almost, it sounds like the beginnings of a perfect zombie
43:25
apocalypse like retreat where you know, you've got the high
43:30
ground and you've got and maybe you can expand your moose tower.
43:33
They have like, you know, some more rooms to it.
43:37
Yeah, I was, I'm trying to convince my wife that I'm
43:40
allowed to build a, a, a missile highlight that can dig
43:43
downwards. That's not a thing people do in
43:46
the center of Amsterdam. They you can't really build
43:49
anything up above ground. So just like in center of of of
43:54
London, there's a lot of people who dig deep downwards to get
43:58
more volume. Yeah, sometimes you hear these
44:00
stories of like, tunnels being done underneath the city.
44:04
And I mean, I can't imagine, you know, the effort that it takes
44:08
to do that. And then, I don't know, the
44:11
danger. I guess I'd be afraid, like
44:12
something would collapse on top of me or, you know, instability
44:16
in the buildings ahead of, you know, above me or whatever it
44:18
might be. I'll stick to my, you know, I I
44:21
I like the first floor. I'm good with that.
44:24
Maybe I'll get in the second or third and, you know, be fine
44:27
with that. But when we start talking about
44:29
going underground, that's not an area that I'm that I'm super
44:32
interested in. A little bit more dangerous.
44:38
Well, you're braver than I am and thank you so much for taking
44:40
the time to to share your wisdom with us on this.
44:43
I'm really excited to see kind of where passkeys end up.
44:47
I feel like it's been hyped now for a couple years, but we're
44:50
now starting to see it hit sort of the real world.
44:52
And, you know, real people in the real world are starting to,
44:56
you know, look at it, use it to play it, kick the tires and find
44:59
the issues because we have to find those issues to fix them.
45:03
And so I'm, I'm really excited that you're able to take some
45:05
time with us. And I know that it's, you're 7
45:07
hours ahead. So you're approaching, let's see
45:10
about 10:30 PM roughly. So it's quite late I would
45:13
imagine for you and want to make sure you get out on time.
45:18
Yeah, that's great. Well, thank you very much for
45:20
having me and thank you very much for all your hard work with
45:23
keeping this podcast on air. Well, thank you so much for
45:27
listening and thank you to everyone else that listens as
45:29
well. Hit that like and subscribe
45:31
button. That's the best way I can help
45:32
the show. We're on the web, IDC
45:34
podcast.com. We're on Twitter or X, whatever
45:37
it's called by the time you listen to this or watch it, IDC
45:40
podcast. Let's see, we're on YouTube and
45:44
I'm in the process of trying to set up some DNS entries.
45:47
So I think I've got IDC podcast.tv.
45:50
We'll take you right to our our YouTube channel to try and make
45:53
it easier for people to find. And of course, connect with Jim
45:55
and I on LinkedIn. You know, he had the day off
45:57
today. He's off in Chicago, hopefully
45:59
getting some Portillo's chocolate cake, enjoying that
46:03
while he's there. And he'll be back for a future
46:05
episode. We'll record it next week.
46:07
So with that, we'll go ahead and leave it.
46:10
Thanks everybody for watching and or listening and we'll talk
46:13
with you all in the next one. You've been listening to
46:17
Identity at the Center. We hope you've enjoyed the show.
46:21
Make sure to like, rate and review, and we'll be back soon.
46:26
But in the meantime, hit the website at
46:28
identity@thecenter.com. See you next time on Identity at
46:34
the Center.