Latest / Identity at the Center / #360 - Sponsor Spotlight - Trusona

Transcript

#360 - Sponsor Spotlight - Trusona · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad herself. I'm doing great.
0:17
I'm so excited about today's episode.
0:19
Every once in a while you get a founder who really takes
0:23
technology and solves a real world problem.
0:26
I mean, you and I have been doing identity strategy for a
0:29
long time. And one of the things we always
0:32
say, how do you know who's calling the help desk actually
0:36
is who they say they are, right. And like, it's how often do we
0:40
get a good answer? Hardly ever.
0:43
I think we'll talk about technology today that, you know,
0:47
could turn that on his head. Yeah, exactly.
0:50
And I think this is a, a question that typically comes up
0:52
is it's, it's, I've asked it so many times in our, you know,
0:56
client engagement, things like that and has never really been a
0:58
good answer, but. This is a.
1:00
A a sponsored episode that I am actually very happy about
1:03
because not that I'm not happy about the other ones, but this
1:06
is one that solves a real world problem that I have seen come up
1:09
multiple times. How do you know someone is
1:12
calling the help desk? And so to that end, we do have a
1:15
sponsored episode today. It is with Trusona.
1:18
It is with the founder and CEO of Trusona, Ori Eisen.
1:21
So welcome back to the show, Ori, because this is actually
1:24
your second time being with us. Thank you for having me again.
1:27
I'm super honored and excited to be here.
1:30
Yeah. So we're excited to have you
1:31
here, trusona.com/IDAC. We're going to have some content
1:35
there that we're going to kind of talk about through this.
1:37
You were kind enough to give us a demo, So we might refer to
1:39
that as we go through the conversation here and it's
1:42
recorded there. So we have kind of our own
1:44
little IDAC spin on that into into the demo world that people
1:48
will be able to visit there. But I'm not going to ask you how
1:50
you got into identity because we already asked you that question
1:53
back in 2023, believe it or not. So about a year and a half,
1:56
maybe almost two years ago, we were at the Authenticate
1:58
conference and he came in and sat down with us.
2:01
So what I want to find out is what's been happening since
2:05
2023. Tell us a little about Trusona
2:07
and then we're going to definitely we're going to get
2:09
into ATL Protect here in a minute.
2:12
What happened is after eight years of developing the no
2:15
passwords solution, as you can see, even my shirt is still
2:19
saying that many customers asked a simple question.
2:24
What happens when someone calls in and says I lost my hardware
2:28
key, I lost my MFAI don't have a device with the password list?
2:36
Let me in, hear me out. Even if you take every single
2:40
employee in a company and you completely retrofit them with
2:44
password less authentication, which I think is an amazing
2:47
idea. The problem that still exists is
2:50
when hackers call in and say I don't have that thing you want
2:53
me to have. Now what?
2:56
So by talking to customers, we realize at your Sona that the
3:00
last hole, the last gaping hole in the hole password less
3:05
strategy is I don't have it. Help me.
3:10
And you can see that the call quickly turns to an identity
3:14
verification effort as opposed to authentication to be crisp
3:20
about that. If MFA works perfectly, you
3:23
don't need what I'm we're about to talk about because people get
3:27
in and out of systems all day long.
3:29
But if you're on vacation and your phone falls in the ocean,
3:33
you just go to, let's just say, the Apple Store and you get a
3:36
new iPhone. You now need to get back to your
3:39
business. However, you don't have that
3:42
thing that you need in order to get back in there.
3:45
Why would they give you access? How would you prove to them that
3:48
it is you, Jeff or Jim or one of our listeners here on the other
3:52
end? And when you add to it, what
3:55
happened two years ago that we have to insert into this
3:59
conversation is the word Jen AI. When we sat at authenticate 2
4:04
years ago, I guess ChatGPT just started and people kind of
4:08
thought about it as a textual tool.
4:11
If you look at what Scattered Spider doing as we speak here,
4:14
as we're recording this episode, simply are calling your IT help
4:18
desk, claiming to be the CSO even with your voice or your CEO
4:22
with their own voice that they have sampled.
4:25
And good luck to the IT help desk agent to know is this the
4:28
CEO berating to reset their password or not?
4:32
That is what's new and different.
4:35
Well, as someone who's been on that call where, you know,
4:37
you've got people calling and it's like, OK, read it.
4:39
You're, you're trying to authenticate callers, etcetera.
4:42
I remember when you showed this to me and, and this is something
4:44
you've actually been working on for I think maybe a year and a
4:46
half or, or something like that. But I was kind of like, oh, this
4:50
is kind of cool. So tell me a little bit about
4:53
what it is about Ato Protect. And when we say Ato, we're
4:56
talking about account takeover. And so the goal here is to yeah,
4:59
know that it is Jim calling me and not someone to pretend to be
5:02
Jim, etcetera. So my, my, my, my jaded See, so
5:07
hat tells me I've got so many security tools out there.
5:10
Cool Ori, like, why do I need another tool in my stack?
5:14
So tell me a little bit about more about Ato Protect
5:16
specifically and what do you think makes it different from
5:19
other solutions that are, you know, kind of trying to do the
5:21
same thing? Yeah, I, I love this and I love
5:24
this conversation as a practitioners talk, because you
5:27
should ask me and everybody else who come on the show, do I
5:30
really need another tool? I mean, we have a toolarama
5:33
everywhere you go with so many beeps and bops and reports, it's
5:37
actually becoming harder to know what's going on because of all
5:40
the chaff, right, As opposed to the signal.
5:43
To answer your question, I'll say this.
5:46
Identity and authentication have been close Friends, enemies,
5:50
frenemies, cousins. They were never thought of as
5:54
the same thing. Let me prove it to you.
5:57
You can sign up for a Gmail account today without them
6:01
really knowing if it's you or Jim.
6:03
They they just don't care to know.
6:04
As long as you have a unique handle, you can stay anonymous.
6:09
There's zero identity proofing or identity verification in
6:13
those kind of processes. Think about your net Netflix
6:16
account. If you paid with a credit card
6:18
that was prepaid and was anonymous, they would also not
6:21
know who you are. However, when you call an IT
6:25
help desk or we'll talk about other use cases that a company
6:28
could have. For example, you're interviewing
6:30
somebody to come work for you. You want to make sure they are
6:32
who they say they are when a vendor calls your accounts
6:37
payable and say we changed the bank account, so send us the
6:40
next invoice to this new bank. Now it's not about
6:43
authentication, it's about, wait, who is telling me to do
6:46
this? Who is the true identity on the
6:49
other side? So the reason you might need
6:52
another tool is if we'll focus on the IT helpdesk, even though
6:57
you can see that there's other things around it.
7:00
When someone calls and they cannot authenticate perfectly,
7:04
you are turning the problem from, do you have the
7:08
credentials I gave you to? I need to know who you are
7:11
before I do anything. Anything could be reset that
7:14
password, reset your MFA, give you privilege access, or do
7:19
anything that is seriously risky because I can't really tell
7:24
who's calling me. We have in our industry all
7:30
kinds of tools for account verification for our customers.
7:34
For example, if you're a bank and you open credit card
7:37
accounts or a DDA account, yeah, you scan documents and you do
7:42
checks and liveness that you do all those things when you open a
7:45
consumer account. I doubt that you do the same
7:48
things today with your employees, and I doubt that you
7:52
do the same thing when an employee comes in without MFA.
7:55
Yeah, it feels like I'm so interested to get your take on
8:01
this, but it feels like when Jeff and I would ask this
8:04
question 10 years ago in that workforce identity situation, it
8:09
was something like, OK, how are you verifying people?
8:13
And it'd be like, well, we asked them their badge number and then
8:18
who did they sit next to? Like, like knowledge base.
8:21
So we say, OK, well, that's a big Rev X.
8:23
That's not good. But then you see organizations
8:27
that, well, we text them a special number, then ask them to
8:32
read it off to us, or we e-mail that code to the e-mail address
8:37
we have on file in their HR system.
8:40
And so you say, OK, that's out of band.
8:43
It couldn't be broken probably. But you know, you'd have to be a
8:50
super hacker today. I'm not Even so sure that that's
8:54
true. Like give us give us your
8:57
perspective on that e-mail to or SMS kind of scenario.
9:02
Is that good enough? Well, let's do this.
9:07
Anybody who listens to this podcast, I assume reads the news
9:10
from the security world. If you don't just open your
9:14
favorite search engine, put in these two words Scattered Spider
9:18
together to name off a Cybergang.
9:21
Pick up any article and go read their MO, their modus operandi,
9:26
and the answer will be there. Let me tell you what they're
9:29
doing and why the answer is absolutely not Jim.
9:33
Their favorite tactic is what's called SIM swap.
9:36
And what that means is they would call your telephone
9:40
company and and again, if there's no hackers in the
9:42
audience, you can derive who my telephone company is by the 1st
9:46
6 digits of my phone. It's not a secret.
9:49
You can tell if I'm with Verizon or AT&T, Not a problem.
9:53
You would call my telephone company as a precursor to the
9:57
attack and basically tell them that you are me and you got a
10:01
new phone and you want to port the scene, you want to SIM swap
10:06
the phone. And what happens if they fall
10:10
for this? And let me explain to you why
10:11
they do all the time. All the text messages you're
10:14
about to send me, Jim will actually go to the bad guy, not
10:17
to me anymore. Let's take it slow.
10:21
The first step is to snip out the real customer from the
10:25
traffic so they're not even aware that the OTP, the one time
10:30
passcode you just sent me did not reach them.
10:33
Now I'm going to take a step backward.
10:35
This is not, you know, don't try this at home, kids.
10:37
I'm not teaching you how to hack, but I just want you to
10:39
know why this happens and why you have 0 control over it.
10:43
If you're a CSO listening, you can't control AT and TS
10:47
processes. You can't control Verizon.
10:50
They will do whatever their script says in the call center
10:54
and unfortunately they might ask me things like my mother's
10:58
maiden name and my last four of my social and my date of birth
11:02
to prove to them that I am Ori the telephone owner before they
11:06
SIM swap me. So good luck with that.
11:09
This is step one in how Scattered Spider get you to
11:14
operate as if you are sending it to the real employee.
11:18
But you if you're not checking first.
11:20
Is this phone recently SIM swapped?
11:23
You're duped. You're none the wiser.
11:24
You're now sending all the stuff directly to the bad guy.
11:28
I'll pause here. No, it's that's exactly.
11:32
And to think that that is that uncommon, I mean, when you hear
11:37
about these scattered spudger attacks, that's the exact
11:41
pattern that's used. And at least there's some really
11:46
catastrophic data breaches and and beyond data breaches where
11:51
you get to the point where you can really have an operational
11:55
impact on a company. You know this, you know, given
12:01
that given that that kind of backdrop, because I'm not a true
12:05
believer, this is not something that is some kind of far out,
12:10
yeah, that's never going to happen to me kind of scenario.
12:13
It very well could if you don't have the right projections.
12:16
And look, I don't want to say company names, but some of the
12:19
the household name breaches that you've heard of, they started
12:23
very much in that way. Exactly.
12:26
I guess we have what I really want to ask you Ori is like how
12:31
does your Ato product, Ato protect product prevent that?
12:36
I mean, what can what can you guys do?
12:38
Let let me just go back a second to answer your question about
12:41
e-mail. I just want to see what is the
12:43
pre step there. I already explained in the phone
12:45
world, you do a SIM swap in the e-mail.
12:48
There's an easier path. If I imagine a bank that has
12:51
40,000 employees, I call one of them and say, hey, I'm calling
12:55
you from the IT department at the bank, I need to install
12:58
something so we can help you next time.
13:01
Now how will the employee ever know if I'm really working at
13:04
the bank or not? So unfortunately, some people
13:08
take the lure, allow me to get complete access to their
13:11
computer and now I can get their emails.
13:14
So if you sent me the e-mail in the chain we talked about
13:18
before, I'm now getting that as well.
13:19
I just want you to know how it's done, Yes.
13:22
Am I foreshadowing what the Ato Protect does?
13:25
Yes. But I want you to understand the
13:27
why because we've spoken to enough Csos and enough customers
13:31
that told us all the different ways they were taken down.
13:35
And we've done a thing that is a little bit to our detriment.
13:40
So I want to be very upfront about that.
13:42
When I speak to some of the analysts in our field, without
13:46
mentioning company names, they basically said you've created
13:50
something that is a Franken solution in the sense that it is
13:54
not focused in any specific domain or expertise.
13:58
It is by taking five different domains and putting them
14:01
together that we are not really a fit to any Magic Quadrant, if
14:06
you want to think about it that way, because we're not like this
14:08
one thing. So I'll go, I'll explain how we
14:11
do what we do, but the key is that we did not start with like,
14:15
what are we good at? And let's try to convince you to
14:17
buy that, which is unfortunately how our world is.
14:21
It is taking 2 steps back. It was about 18 months ago.
14:24
Jim, listen to all the MOS, all the attack vectors that are
14:28
happening after The MGM breach and say if you were to sell the
14:33
solution to the Cecil, not a point of I can do this or that,
14:37
What would that look like? It forced us to be good at
14:40
document scanning telcos, DMVS, different data brokers,
14:46
realizing that there was a man in the middle attack perpetrated
14:49
a second ago. All these things together.
14:52
Plus, did somebody call your employee without you even
14:55
knowing right? Have amalgam into this Ato
14:59
protect because it really protects from AT OS in the
15:02
different permutations they can take.
15:05
So I'll let you ask the next question, but the key is that if
15:10
Trusona started its journey by saying we need to go password
15:13
less, and I still think the world should, and at the end of
15:17
that journey realized, Oh my God, if everybody had password
15:19
less, but the bad guy just needs to say it.
15:21
Well, I don't have the password less.
15:23
Let me in. We are now solving that issue.
15:26
But I want you to realize that it's not a single disciplined
15:30
area to focus because scattered Spider and the calm and black
15:34
Cat are so well organized. I don't want to say
15:37
sophisticated because deep, deep down, everybody who listens to
15:41
this call can commit these crimes.
15:43
It's not like you need to be a rocket scientist.
15:45
You just need to have your moral compass at the set wrong because
15:50
they can come to you at all these different angles.
15:52
We have to be good at all these different angles to protect.
15:56
I'll pause here. So I think that idea of the man
16:00
and middle attack is sort of how things kind of get started.
16:03
I don't want to get too far along here because I don't know
16:06
if we have really talked about how this works.
16:09
So I'm curious or if you could just take me step by step if, if
16:12
someone's, if I'm a security analyst, a help desk person,
16:16
whatever it is. And I might be responsible for
16:17
taking a phone call. And we'll just pick on Jim here.
16:19
So Jim calls me, but it's not really Jim, right?
16:22
It's bizarro Jim. We'll call him.
16:26
How does Ato protect work? So I, I go to the website and
16:30
then what? Take me step by step because I
16:32
think that'll help maybe make it a little bit clearer as to what
16:34
we're going to get into next. Cool.
16:37
I'll, I'll start by saying for those of you who will stick
16:39
around until the end of this episode, there is a page that
16:43
the Jeff and Jim were very kind to record me show how this
16:46
works. So if it interests you after
16:48
you're done with your job, there is a video that you can go watch
16:52
all this. I'll try to describe it
16:54
verbally. Let's call the actors by their
16:58
name. Jeff, you would be the agent
17:00
like the IT help desk agent and Jim will be the caller.
17:04
And of course you can replace IT help desk with HR department,
17:07
finance department, whoever gets the call.
17:11
The way it works is this. There are two modalities.
17:13
One of them when there is a human taking call, that is the
17:16
most common thing we do. The other modality is when
17:19
there's self-service. You call an IVR or you go to a
17:21
web page and you say I need to change my password.
17:24
We can do exactly the same thing without a call.
17:28
When I call or Jim calls you rather, Jeff, you will tell them
17:34
first, please get your ID ready, literally just like if you were
17:38
stopped by a policeman and say, OK, show me your driver license
17:41
and you know, insurance. We believe that in most
17:45
countries that need to do this, you have access to your ID even
17:49
though you might not carry it like in the United States, but
17:51
you have access to it when you need to do something risky or if
17:55
you're traveling, you should have your passport or something
17:58
else. You've shown the border control,
18:00
so you should have something like that.
18:03
The second thing is you would tell the caller that none of
18:06
this data will be stored. Pretty important because we
18:09
don't want to become part of the problem.
18:12
And the third thing is you'll ask the caller how would you
18:14
like to get this URL? That will help you with your
18:17
mobile browser begin the journey.
18:20
You can ask why. Why reduce it all to a URL?
18:23
I'll go back to what I said 5 minutes ago.
18:26
If you're on a vacation somewhere in the world and your
18:29
phone drowned in the ocean, what we can expect you to have is a
18:33
new phone out-of-the-box with Wi-Fi connected to it.
18:37
And if you can get an e-mail to it or a URL to it, you should be
18:42
able to do this. It is specifically designed to
18:46
have the minimum viable technical know how or ability
18:50
because if I'll require you to log into our network to do this,
18:54
it's a catch 22. You don't have the very thing
18:56
you need to get it and that is what causes the issue to begin
18:58
with. So you would ask me, do I want
19:01
to get an SMS, an e-mail or literally just like in a video
19:05
call like this? You can paste the link into chat
19:09
or if there is a video call you can show me AQR code that I will
19:12
scan with any camera and essentially bring the caller,
19:16
Jim in this example to a page that will allow him to
19:19
self-service himself. Scan the document.
19:23
What your Sona will do there is verify, for example, if you sent
19:26
him a text that the phone has not recently since swapped.
19:30
If you sent him a text that he is really the owner of this
19:33
number and not just lying to you about it.
19:35
When they scanned their document, we would go to
19:38
numerous authoritative databases such as in the United States.
19:42
We can ping the DMVS to ask did you issue this document as
19:47
opposed to is the font looking good or is the template correct?
19:52
I'll state the obvious. I'm sorry for everybody who
19:54
might get hurt, but Jenny I deepfake have robbed us as an
19:59
industry from the ability to look at documents and say oh
20:03
this looks fishy now. When I used to be the head of
20:06
Frisk in the large credit card company, I relied on this tool.
20:10
But that was a world before chat GPD and before mid journey.
20:16
Today I can mimic your voice, your video image to that effect
20:20
that unfortunately it is not simple for AI to detect it and
20:25
definitely not for the human eye.
20:27
That was Orion, just so you know, I'm starting to get the
20:29
hang of this. So all this to say, Jeff and
20:33
Jim, when a call comes in, you ask the person to get ready to
20:38
identify themselves and you simply share with them a URL.
20:43
And from there on, the tool does what it does, including checking
20:48
if the link has been forwarded. But I'll pause here.
20:50
We'll get into that later on because that's another MO of the
20:53
bad guy, which is man in the middle attacks.
20:56
So when I log into this thing, I, I have two options, right?
21:00
Or a couple options I could say. So I can send it, SMSI can send
21:03
an e-mail, I can send a link. What are the IDs that work?
21:05
Because I see options here for driver's license and for
21:08
passport. So I think that covers most
21:11
government documents. And then what you're doing
21:13
behind the scenes, as I understand, is you're querying
21:15
DMVS in the United States or other, you know, I guess
21:19
registries of that sort of data around the world.
21:22
What are the limitations when it comes to driver's license and
21:24
passport? Like where?
21:26
What doesn't work? Yes.
21:28
So if after this podcast you will take our challenge which
21:33
again we will unveil at the end of going to try that trusona.com
21:37
or trusona.com/identity at the center IDAC, we will invite you
21:44
to play with the demo. The demo has the following
21:46
options. A driver license in the US and
21:48
Canada, a passport from any country in the world.
21:52
So that covers every country. And then a few documents from
21:55
India, that is what we give people to play with for free
21:58
because those are the most common in the UK.
22:00
Driver license we have that. We have 2500 additional
22:04
documents from many different countries.
22:06
So Philippines, China, Costa Rica.
22:09
We just don't put it in the default demo because then the
22:13
combo box will just be, you know, endless.
22:15
We have customers who are using up to 20 countries at the same
22:18
time. The question is, Jeff, not where
22:22
we can scan a document that we can do in any country because
22:25
passwords by design are in any country.
22:27
The question is, where can you verify that this is legit?
22:31
So I'll go slow. Let's take the United States,
22:35
which is the best country to do this in.
22:37
It is still not perfect. Why?
22:41
For all kinds of reasons, states like California and New York
22:44
have decided not to allow vendors like Trisona to ping
22:49
them and verify identities. They allow the Social Security
22:54
Administration to do it. So the data is there, but they
22:57
don't allow it for commercial use.
22:59
So in the United States, we can verify literally with the, with
23:03
the authoritative data sources, about 80% of the population.
23:07
Pretty good what we do for the other 20.
23:11
So if you do come to us with a driver license from California,
23:15
we triangulate it differently. We still scan the document
23:18
because it's hard to mimic the PDF 417.
23:23
And for the uninitiated it is the 2D barcode on the back of
23:27
your driver license that has a machine readable payload.
23:31
And instead of asking the California DMV, hey did you
23:35
issue this? Is this real?
23:37
We would ask you for your mobile number and then ask the
23:39
telephone company. Is this identity of Jim Stedman
23:43
with this date of birth and address matching whoever owns
23:47
this phone? So we're replacing the
23:50
authoritative source with the next best thing.
23:53
In India or the UK. We replace the DMV with
23:57
LexisNexis with one of our data providers.
24:00
And of course, we can add more. In India, you can go to some
24:03
government databases. In Costa Rica you can query the
24:06
voter ID database. There are different
24:08
configurations. The key is that you will not be
24:13
blind. Meaning what?
24:14
When Jim calls you today before you have Ato protect, he can
24:18
just social engineer you and tell you I am who I say I am
24:22
because you have no semblance of control as to is he telling me
24:26
the truth. But when you start scanning
24:29
documents and you have the triangulation and then we have
24:32
the device information telling us what time zone this device is
24:36
configured in, and I can ask Jim to click on a button we added
24:39
that gives his GPS location with permission.
24:42
All these pixels create a picture of is it likely to be
24:47
Jim at his house begging me to get him in, or it's somebody all
24:51
over the world who's just trying to masquerade who they really
24:55
are. So I see as an admin or whoever
24:57
logged into this, I see a bunch of these pieces of information.
25:00
The goal here is to give me enough pieces of information to
25:03
say, do I think this is really Ori or Jim calling versus maybe
25:08
someone else? And so as I have these
25:10
combinations of pieces of data, right?
25:12
So I'm looking at the screen right now and it's, you know,
25:14
the IP address, the country, the IP region, you know, the
25:18
browser. But in addition to that, I see
25:20
literally a map that shows me where things are coming from.
25:24
And then I see, you know, different parts of the data that
25:28
you've checked from either DMV or LexisNexis or even the MVO,
25:33
the mobile network operator, right, MMVO.
25:36
So all of this combined kind of gives me a picture to say, oh,
25:39
OK, I have pretty reasonable assurance based on this that I
25:44
have the right person on the phone that I'm transacting in a
25:48
relatively secure way. The man in the middle, if I was
25:52
outside of that. So let's say I, you know, did
25:55
something and I am got two people on the phone.
25:58
We're going to try and trick Ori out of his money.
26:00
You know, I call Ori up and I say, hey, I'm the help desk.
26:02
And then maybe Jim's got something else on the line and
26:06
I'm just like, give me the code, right?
26:08
That I'm going to send you 'cause this is the common way
26:09
they do it is they say I'm going to send you a code and then you
26:12
read the code. And then despite every single
26:15
SMS and vendor out there saying we will never ask if your code,
26:18
what do people do? They read the code to the person
26:21
that's going to, you know, take their money.
26:23
So when I read that code in now, it's coming in from a different
26:27
IP source, right? Or a different Geo location.
26:30
And so I see this on the map and this is something again,
26:33
trisona.com/idac, go watch the demo there that I see that
26:37
information and now I can start to raise some reasonable doubt
26:41
around whether this is legitimate or not.
26:44
Is that a fairway to put this? It's absolutely a fairway.
26:47
I'll give you 2 more anecdotes. 1 is iPhones use what's called
26:52
private relay. It's a type of AVPN.
26:55
And even though Jim called you and say, hey, I'm at my house,
26:58
his phone will tell you he's not at his house.
27:01
So for cases like that, even though the IP, you know, a la
27:05
carte would not reveal the truth, you can ask Jim to click
27:09
on this extra button with permission to say, hey, tell me
27:11
where your phone really is. And then if that is within 100
27:15
feet of where the driver license of your home address is, let me
27:18
tell you, Jeff, he is at his house because you can't be
27:21
elsewhere doing this. The second is the man in the
27:26
middle works when people get the payload, let's just say from the
27:30
bank and they cannot respond to it because they're not the real
27:33
customer. Now, they put the bank on hold.
27:36
Let me give you the most common. I use that in the demo.
27:39
The most common excuses we hear on calls.
27:42
My baby is crying. I, I, I, I'll be back.
27:44
My dog is barking like always play something else.
27:47
And the latest one is Amazon is knocking at my door.
27:50
I'll be right back. But all these are just excuses
27:53
to put the call on mute so the bank or the IT help desk doesn't
27:58
hear that you are now puppeteering someone else.
28:01
And you basically call the victim and say hi, I'm calling
28:04
you from the bank. We think there's fraud in your
28:06
account. I'm going to forward you this
28:08
link that you got. It's just that you can't act on
28:11
it. Could you please load it in your
28:13
browser and scan your ID? Because then I will know it's
28:16
you and Wilkin and the people are freaking out.
28:19
The bank is calling them. Sounds really serious.
28:22
You don't even know you're being puppeteered.
28:24
So what our tool does based on knowing how the bad guys operate
28:28
is it takes a fingerprint every time the link is loaded.
28:32
And then you, even though you're on mute because the person gave
28:36
you and you see on the map all these different houses, holds
28:39
and devices pop up. You say, OK, I know one thing
28:42
for sure. I'm not talking to Jim McDonald
28:44
on his own. There's he, he is not in five
28:47
different location. There is quantum stuff happening
28:50
in entanglement, but this ain't it.
28:54
Not yet anyway. And and so this is the part that
28:58
kind of really kind of sold it for me as I kind of looked at it
29:01
was, OK, I'm looking and this is not this is naughty, you know,
29:05
very hard thing to do for me as an admin.
29:08
I see it as very easy. It's showing me literally a map.
29:10
And when we tested this out the other day, you know, we had your
29:14
information and you were kind enough to kind of go through US
29:15
with us. And that's where that demo is,
29:17
is we see your information. And then we had OK, well, Jim,
29:21
go ahead and click, you know the link again.
29:22
And all of a sudden across the world, right, the map zooms out
29:25
and says, OK, well, wait a second.
29:27
Why is why did we start in Arizona and then end up in South
29:30
Dakota? Well, that's, that's a flag
29:32
right there. And so I think this kind of
29:34
brings home a little bit some of that man in the middle because
29:36
we thought of ways. OK, well, and, and, or you were
29:39
very gracious, like try and break it.
29:40
Like, OK, well, let me think of ways to do it.
29:42
Now, I'm not a professional penetration tester.
29:44
So that's where we'll talk about maybe later.
29:46
People can kind of, you know, help with that.
29:49
But the first thing I thought it was, OK, well, what happens if I
29:52
intercept the man in the middle type of thing, right?
29:54
E-mail, text, whatever may be another one was OK, well, the
29:58
whole liveness check, right? There's been, well, I can just
30:01
hold my picture to my camera, right?
30:02
And it will do that. Well, if you blink, that must be
30:05
enough liveness. OK, well, that's not, you know,
30:07
good enough. And so now we're saying, OK,
30:09
you're scanning the document. You're saying, OK, you're
30:12
checking it against known sources of good information.
30:14
You're combining pieces of information from multiple
30:17
sources. So if I were to tamper with one,
30:21
the odds of being able to do both become less and less.
30:24
Now they're never 0, right? And without being suspected as
30:28
SIM swapping, yes, let me reverse it and tell you, here's
30:32
how you can beat it. Like, let me give all the
30:35
listeners the recipe just so you understand what your task is.
30:38
And then you'll see how monumental it is.
30:41
You'll hear at the end of this podcast that we're going to give
30:43
you a challenge hack the box. And it's a very simple ask.
30:48
You need to log into our tool, play with it.
30:52
And if the tool will say that it is me, meaning you can scan a
30:55
document that would pass all the checks with the DMV to say,
30:58
yeah, yeah, this is Ori's real driver license and you will not
31:02
trip a we just SIM swapped his phone and my telephone company
31:06
will say that this if it all matches and there is no SIM swap
31:10
and no man in the middle, you have beaten it.
31:13
OK. And we can talk about how to
31:15
claim your prize. What you can't do easily, Jeff
31:19
and Jim, is plant records in official databases.
31:23
You can clone my ID. You can do that if you know what
31:26
to do because my record is there.
31:29
Who have to be able to do it in a way that is not caught.
31:33
This is really the hurdle. The next level is exactly what
31:37
you said is how do I do it without SIM swapping or man in
31:39
the middle, which really are trying to puppeteer somebody
31:42
with social engineering to do it for me.
31:45
And the last leg of the stool is this.
31:48
There is 5% of the listeners who at this point are thinking a
31:52
thought. So let me just tell you what
31:54
they're thinking. Wait a second.
31:55
I know how to break this. Didn't you say that you need to
31:59
send the link and then I will see that multiple people.
32:01
Yeah, I'm. I'm revealing to you a method.
32:04
But here's what I'm not going to reveal.
32:05
Just so you know, we thought about it.
32:07
And you will only learn about this if you're a customer in our
32:09
training. What happens if the bad guy
32:11
doesn't click the link and only send it to you?
32:15
I just say the words. So you know, we thought about
32:17
it. Yo did you did not find the
32:19
gaping hole? Not yet.
32:22
But that we only train customers because we do want to stay in
32:24
business. Or you can just tell Jeff and I
32:26
that way we can go ahead and steal your idea.
32:30
And I mean, I think this is a genius because I think the
32:35
industry's answer for identity verification is the document
32:41
verification, the liveness testing.
32:44
And I mean, that's built into your product, but it's more than
32:49
that, right? Just stay in the geolocation
32:52
angle as well. So there's two forms of
32:55
assurance that go into kind of this risk modelling.
32:59
Yeah, we, we think about it as 5 disparate sets of signals.
33:05
Some of them come from the device itself, Jim.
33:09
So your browser can tell me what language it's configured in.
33:11
And if it says Russian, you can tell me all day long that you
33:14
live not there, right? So that's one set of signals.
33:18
The second is, as you said, from the scan of the document itself.
33:22
The third is from the data verifiers.
33:24
So even if you fake the document pretty good visually, the
33:28
verifier will say, well, I don't have this document in my records
33:32
because it's a synthetic identity.
33:34
The third will be all the man in the middle detection to know,
33:37
did you forward something else? And the 5th, I know we didn't
33:42
talk about it much, but it's what we said before.
33:44
How would you know if somebody's calling your employee and tell
33:47
them, hey, I'm calling you from ITI need you to do something.
33:50
So that is again another module in the Ato Protect suite that
33:55
companies can advertise either to their customers or to their
33:59
employees on an intranet and say, if ever you get a call from
34:03
us, this is how you would know it's really coming from the
34:07
company as opposed to believing somebody who's done social
34:09
engineering. I'll talk us through that
34:11
because that's actually something that was on my mind.
34:14
I had my bank, I know we're talking about the workforce
34:18
example, but I had my bank call me the other day and they kind
34:21
of wanted to jump right into the details of them.
34:25
I. I believe it was them because I
34:27
was just interacting with them, right?
34:30
But the scenario was they called me, so it could have been
34:34
anybody calling me. Imagine if someone calls you Ori
34:38
and says, you know, I'm calling from the help desk and you're
34:41
like, OK, that that is my company's help desk now.
34:45
And they start asking you for information.
34:49
I mean, how can you how how as the person who received that
34:54
call use your product to verify that you know this legit?
35:01
Yep. I'll, I'll take a second to give
35:03
some kudos to our we call them the ninjas at Trusonas.
35:07
Those are the engineers that sit with me and the product
35:10
management team and say, listen, the problem is thus how do you
35:14
solve it? I'll be honest with you.
35:16
I've been in this industry for 24 years.
35:19
I did not think there's a solution to this.
35:21
I honestly did not. Actually, I didn't even spend
35:23
time figuring this out because it seems so well, how could you?
35:27
Thank God we thought of something.
35:29
It's now patent pending, so I can talk about it freely.
35:32
If you'll have time to see the demo, we're demonstrating it
35:35
there. But it works like this, Jim, if
35:39
you went to the trusona.com website right now and scrolled
35:42
all the way to the bottom of it, on the right hand side, there's
35:45
a link called Agent Verify. And we would recommend companies
35:49
that have consumers and employees have a similar link on
35:53
their homepage so everybody knows it's there, both the bad
35:56
guys and the good guys. And the law or the rule would be
36:00
simple. If you get a phone call that
36:02
claims to be from the company, whether you're working here or
36:05
you're a customer, go there, click it and ask the person on
36:09
the phone for a simple thing. Give me your agent verify code.
36:13
If truly they are calling you from the company, our tool will
36:16
give him a six digit code that is a one time thing.
36:19
And then they can see I am talking to Jeff.
36:23
And after that this code will not work again.
36:26
And it's the first time that we can give a simple instruction
36:30
without any technical know how or buying something for the
36:34
consumer to do that. You have a tool to fight this.
36:38
And unfortunately this is the only thing we know of.
36:40
Everybody else who buys this and understand how it works knows
36:45
that my employee can forget to do it.
36:47
I, I will tell you that as well. My mom may not remember to go do
36:51
it. I get that.
36:52
But at least now you have a way to prove to somebody that you're
36:57
calling them, especially if you have a personal banker that
37:01
wants to help you with a wire and they are calling to help
37:03
you, but at the same time, they need to identify themselves.
37:08
If IT wants to call you and help you while you're stuck, you want
37:12
to get that help, but you also want to make sure that it is
37:14
really them calling you. So this will be the way to prove
37:18
to both sides that you're talking to the right person with
37:21
this feature that is included in the umbrella of Ato Protect.
37:26
Oh, it's really great actually how to quit.
37:30
You brought up that topic and I did have a follow up there, but
37:35
you when you're talking earlier about the geolocation, I wanted
37:39
to get this question in. So if somebody is say the
37:43
hacker, the man in the middle is using VPN software, do you
37:48
accommodate for that? Yeah, I, I mean, Ori, what I
37:51
think is cool was like coming into this session, you said
37:58
throw away the script, go ahead and like try to stump me.
38:02
This is my attempt, you know now like I I'm not based on my I
38:09
could be calling you from Russia using AVPN voice over IP.
38:15
How did your software stop that? Great.
38:17
So you can't stop somebody from using AVPN, but we do help you
38:24
uncover it and solve it two ways.
38:25
One of them, we have a list of VPNs, either they're, they're
38:29
beautiful ones from Apple. There's AIP range that you can
38:32
say, OK, you're using iCloud relay and that's just a toggle.
38:36
If it's one of your employees and you really wanted to know
38:39
where they are, you just tell them, hey, can I give you
38:40
instructions of how to turn it off momentarily because I want
38:43
to make and no employee should argue about that because they
38:47
really want to make sure the company's safe.
38:49
The other one is AVPN, like a Nord VPN that you can come from
38:52
any country in the world. But hear me out, Jim, if you
38:56
wanted to get privileged access and you called in and says, hey,
39:00
I'm working from our whatever office or from my home, once you
39:06
scan your driver license, it has your home address.
39:09
So if I now ask you to click on a reveal your GPS location and
39:12
that is like 20 miles from that address, there's a problem.
39:16
Our tool can show you those, the driver license address and the
39:20
GPS within 100 feet of each other.
39:23
And you have every reason to think that the person is there.
39:27
I'll give you one more thing that we do.
39:29
And again, not revealing any methods that will help the bad
39:32
guys. Some companies are so large that
39:35
they have 5 different IT help desks in different countries.
39:39
So what do you do then? We allow them to associate the C
39:44
blocks of those different areas so that you can tell, hey, this
39:48
person was asking for help is coming from an internal IP
39:51
address of the company, which again, would lower the guard,
39:55
not completely, but give you reason to think that you're not
39:58
talking to somebody who's just talking to you out of the blue.
40:01
And lastly, if somebody at the company does use VPN because
40:05
they want to stream some stuff, hey, we all do it, it's fine.
40:08
You can simply tell them for this call, I'm asking to turn it
40:11
off. And if they give you any
40:13
resistance, that is immediate reason for you to pause and say,
40:16
OK, I need to use more security on this call versus less.
40:21
Because if somebody really works here and they don't want to
40:24
masquerade at somebody else, there's no reason for them to
40:27
not listen to your asks so that you can give them service.
40:32
I think it's such a fascinating approach to this is you're
40:36
collecting all these signals, you know, from all these
40:37
different areas and kind of combining to it.
40:40
You know, Jim and I have been consulting now together for 10
40:42
years, him him much longer in his advanced age.
40:45
But this is a question that, you know, has constantly come up is
40:48
how do you validate people calling the help desk?
40:51
And, you know, for the last eight years or so, there hasn't
40:55
been really the last 10 years, there hasn't really been an
40:57
answer. I remember being on these calls
40:58
before as a help desk agent doing password resets and this
41:03
is a very interesting solution. So I would definitely encourage
41:05
people go check it out. trusoda.com/IDAC.
41:08
There's a whole demo there. And you know, we're, we're, most
41:11
of our listeners are listeners, right?
41:12
They're, they're not seeing things happening and stuff like
41:14
that. So we're trying to describe it
41:16
as we go along, but it, it is a very, very cool solution.
41:20
I want to kind of take us into the future here a little bit
41:23
with a little bit of time that you've got left.
41:24
What do you think is the next battleground when it comes to
41:29
this type of thing? Right?
41:30
Is it's it's really identity verification.
41:32
It's how do I make sure this is really Ori and not, you know,
41:36
the the Google VO2 or the meta. What do they call it?
41:40
Emu model, right? Whatever AVAI thing that I can
41:44
create that would say Oh yeah, that sure looks and sounds like
41:48
Ori. Let me go ahead and do it for
41:49
him and take care of his his account for him.
41:52
What like what do you see as next?
41:53
So. Jeff and Jim, I, I told you that
41:56
I brought my special effects here just in case the
42:00
opportunity will arise. So it is you just ask the
42:02
question that merits this. So I'm going to have a
42:05
contrarian view. It's, it's not fun news, but I
42:08
will share it with your audience of what I think comes next.
42:11
So unfortunately, it will begin with this sound.
42:17
I'm happy that I'm at the end of my security career.
42:20
That's the beginning of the answer.
42:23
I have a son who's 22 years old, just finished computer science
42:27
and forensic accounting. He's just getting into this
42:29
world and I tell him I don't know how your generation will
42:34
handle what comes next. And next is not 20 years.
42:37
Next is 2 years, five years. Here's what I think would happen
42:43
next. Video Gen.
42:48
AI will become so good that for most people it will be
42:54
indistinguishable from live video.
42:58
That includes sound, which is very important for this topic
43:02
today. Without mentioning company
43:05
names, I can tell you I've listened to recordings of CEOs
43:09
of company because they were interviewed on the TV being
43:13
voice modulated. And now you can have this voice
43:16
say anything you want, berating the IT help desk to reset the
43:20
password. That will only get better with
43:23
time, not worse. So you won't be able to trust
43:27
your ears. You won't be able to trust your
43:29
eyes, you won't be able to trust images that I show you because
43:36
who knows? So it will again rob us as an
43:40
industry from all those senses, if you want to think about it,
43:44
that we had for so, so long. And the next thing again that
43:51
that could come, I hope it won't is any breach of the
43:54
authoritative data sources. So if you told me today, all the
43:57
DM VS data has been spilled out. We are now going to be in a
44:02
period of time of just not knowing blind, leave it leading
44:06
the blind until it would be so bad that governments will say,
44:09
OK, now we need the self sovereign identity and all the
44:13
things that we're talking about in futuristic world.
44:17
I believe we're not there for a simple reason.
44:19
We did not experience enough pain as a society to say enough
44:23
with this, we're doing it. Heck, 50 states in the United
44:26
States cannot agree on what's secure between them.
44:29
So what? What do you want the world to
44:31
do? Right?
44:33
I think we still have more time. We can still do some work, but
44:37
AI will be the breaking weapon of the bad guys if they use it
44:44
well, including writing emails and persuading people with, you
44:48
know, agents that know how to do that, man, they will have the
44:52
upper hand. It's just nature of the beast.
44:54
I don't like saying it. I know people don't like hearing
44:56
it. But as a defender, as a
44:59
practitioner, I'm happy that I'm towards the end of my career
45:02
because I I have no idea what comes next and how we will solve
45:05
it. Because things that we held near
45:08
and dear as sacred will not be with us as the gold standard
45:12
anymore. Well, that's a very positive way
45:14
to to end the conversation. But I think this is the
45:17
realistic way, right Is this is has always been a cat and mouse
45:22
game with attacker versus defender and trying to figure
45:25
out how can we stop one or the other.
45:28
And it happens on both sides. So it's as hard as we are trying
45:31
to defend the other side, just as much is trying to poke holes
45:36
into that. And there will be new creative
45:39
ways to do it. AI is just the latest version of
45:41
it. I mean, we did an entire episode
45:43
that was all AI like for us on April 1st.
45:46
And, you know, it was fine. It sounded OK.
45:50
And that's me as an amateur spending a little bit of time,
45:53
you know, training models on my voice and Jim's voice and, and
45:56
me telling Jim, no, you got to do it more demonstrably, right?
45:59
If I have motivation, the tools are absolutely there.
46:03
The accessibility to be able to do Gen.
46:06
AI to create video, audio images is, is so good right now.
46:12
And it's absolutely scary because what does this lead back
46:15
to? It's social engineering again.
46:17
The unhappy path, as we've called it for a long time, is
46:21
that's what people are going to take advantage of.
46:22
It's usually the way that people get breached or popped or
46:26
whatever word you want to use to say that bad things have
46:28
happened. And these are just tools that
46:30
people are going to use to do that.
46:31
And so another arrow in that quiver might be something like
46:35
this is how do you stop account takeovers as well?
46:38
Take a look at something like Trisona's ATL protect.
46:40
So I'm a big fan of it. I remember when you, when you
46:43
called me or I think you shot me a LinkedIn message like a year
46:45
and a half ago, it was like, oh, this is kind of cool.
46:47
Like what is this thing? And to see it evolve over the
46:50
last, like I said, year and a half and see the value of it has
46:53
been really interesting. So like typical cap to you, Sir.
46:57
Thank you. I appreciate it.
46:58
But as I asked you and Jim, I want today to be all about
47:03
trying to break this because I feel for everybody who listens
47:06
to this podcast on the defender side.
47:09
I would not want to be doing this job today because it's we
47:13
don't get paid enough for doing it.
47:15
But I do have a positive endnote if you don't mind, and I'll use
47:18
my slide whistle in the in the fun way just to say this.
47:25
I believe that some of us will try to fight AI with AII,
47:29
already see startups trying to do that.
47:31
I personally don't believe that that will be the solution
47:34
because of the cat and mouse issue. 25 years ago when you
47:38
bought Norton Virus, you were defended from what he knew
47:41
about, but not from the next thing, right?
47:43
So unfortunately, it is a way to give you some cover from what's
47:48
known. But in this world of AI
47:50
deepfakes, you just don't know what's coming tomorrow.
47:52
So I just don't know that overall that's the strategy.
47:56
A way to finish this episode is to think about what we described
48:00
today and what this tool does as a sort of a Turing test.
48:05
Hear me out. If we try to fight AI with AI,
48:09
we're now just fighting CPU with CPU and capacity with capacity.
48:12
And unfortunately, the bad guys have more money than most
48:15
companies to do this. What we're trying to do with
48:18
this tool is to take you out of your comfort zone, Mr. AI, and
48:21
have you hold the phone in the air and scan something.
48:24
In real life, no AI model can do that.
48:28
No AI model can generate the record for me in the phone
48:31
company. No AI model can do a lot of
48:33
things that we're testing for because it simply doesn't know.
48:37
It knows how to do a lot of things, but we're forcing it to
48:40
do things that human can do easily.
48:42
So here's the positive sound. But AI will fail miserably.
48:48
So I don't want people listening to this thinking, Oh my God,
48:51
we're doomed. AI will take over the world.
48:53
That is not what I'm saying. I'm saying if you put in front
48:56
of AI the things that it knows how to defend from, just with
48:59
more training, that is not a great strategy.
49:02
Force it to do the thing it cannot and now you have a leg to
49:06
stand on. OK, well you've been teasing us
49:09
the whole conversation and so let's talk about how do we break
49:13
this? And so you've you're issuing a
49:15
challenge to whoever is listening.
49:17
Tell us more about this hack the box.
49:19
What is it? How is it going to work?
49:21
And I guess just give the details on it.
49:24
So we will go to the website of Trusona forward slash idac at
49:30
empty at the center. There you will read a little bit
49:34
about this demo. You can see a video of it.
49:37
If you don't want to go do it yourself to hack the box, I'm
49:41
offering the following thing. Go to our demo and send us a
49:45
screenshot of the entire screen that it would also have a GUID
49:48
of the transaction you're on because we need to find it in
49:50
our systems to see that you did not manufacture one.
49:54
How's that for thinking like a hacker where the DMV and the
49:58
phone company and all those things do not suspect that it's
50:01
not my document. And again, I have one.
50:04
I'm not going to hold it too close to the camera.
50:07
I'm not going to do that, but I have one.
50:09
I've done this demo as you'll see there, but the net net of it
50:13
is if you can generate a screenshot from our tool that we
50:17
can verify was a real transaction on our end and it
50:20
will say, yeah, this is Ori Eisen, it was not me.
50:24
You get the prize now, Jeff, Jeff and Jim, you can help me
50:27
pick what the prize will be. I don't want it to be like a
50:30
gift card or something. Should be something cool.
50:33
So we will by the time this episode will pause post, we'll
50:36
decide what the prizes. I think it's such a cool thing
50:40
and, you know, being able and open to be able to say, hey,
50:43
let's figure out better ways to poke a hole in this is great.
50:45
And I guess be prepared because I think, you know, hopefully
50:49
people will check this out and really want to try to figure out
50:52
how it gets. I will let me say it again.
50:55
I'm not afraid. Most vendors are afraid to be.
50:58
It's OK if you ever listen to Karen and Lazari's Ted talk that
51:02
hackers are the immune system of the Internet.
51:04
I believe in that. So if you're listening to this
51:06
podcast, I'm not afraid. I want you to show me where the
51:10
holes are because I'd rather fix them if there are and protect
51:14
the world then not allowing you to test it.
51:16
I mean, that is not security. There's no security and
51:19
obscurity. Sorry.
51:20
I'm asking you help us see how it can be broken.
51:24
And if you can't break it, at least be like Jeff and Jim, they
51:26
were very honorable and say, hey, we couldn't break it
51:29
easily. Let us at least share it with
51:31
more people because if this can help the companies to not be
51:34
broken into, so be it. I think the other cool thing is,
51:38
well, first of all, famous last words, I'm not afraid so I'm not
51:42
that. I'm not that courageous, so I
51:45
will not say that myself. But the other thing I think
51:47
people should know is if they go to trusoda.com and they click on
51:50
the try now you actually get what, six of these?
51:52
I think 3 per month. Per month?
51:54
Yep. And so people can actually try
51:56
this, try that in an environment, see how it.
51:58
Works on their own ideas. You can just see what it would
52:00
do for you. Literally it's like a Gray box
52:03
as opposed to a black box. You can see what would happen,
52:06
but to break it, you need to be me with a real transaction.
52:11
Then we can chat about the prize so far.
52:14
Just so you know, no one has been successful trying to do
52:16
this. OK, the challenge has been
52:18
tossed out there. The gulp has been tossed down.
52:21
Whatever analogy you want to use, Ori, I'm I'm a big fan of
52:25
what you've built here. Very impressed to see how it
52:27
goes out there. Definitely encourage people
52:30
visit trisona.com/idac and we'll have links in our show notes for
52:34
people to find that easily, as well as a LinkedIn link for you
52:38
as well or for people to reach out and maybe send those
52:41
screenshots or whatever it may be to say, hey, I got you.
52:44
But hopefully not. So with that, we'll go ahead and
52:47
leave it for this week. Ori, thank you so much for your
52:49
time. Really appreciate you being a
52:50
supporter of the podcast and encourage people to visit the
52:53
website, visit us on the web, idscpodcast.com, do all those
52:57
fun, cool things like and subscribe, share those with
52:58
people. And yeah, we appreciate it.
53:01
So we'll go ahead and leave it there for this week.
53:03
Thanks everyone for watching and or listening and we'll talk with
53:06
you all in the next one. You've been listening to
53:10
Identity at the Center. We hope you've enjoyed the show.
53:15
Make sure to like, rate and review, and we'll be back soon.
53:19
But in the meantime, hit the website at
53:21
identity@thecenter.com. See you next time on Identity at
53:28
the Center.