Latest / The Identity Blueprint / Day One of an M&A. Okta and Ping, Bloodhounds Sniffing Out Hidden Risk.

Transcript

Day One of an M&A. Okta and Ping, Bloodhounds Sniffing Out Hidden Risk. · The Identity Blueprint

0:00
SPEAKER_00: Welcome back to the Identity Blueprint Beyond the Domain.
0:03
SPEAKER_00: I'm Ernie with Jose.
0:06
SPEAKER_00: Last episode was the mechanics of getting day one access working on Okta and Ping.
0:12
SPEAKER_00: This one is about what you inherit once it's working.
0:15
SPEAKER_00: We trace how a routine access review turns into rubber stamping when a manager is asked to certify people they've never met.
0:23
SPEAKER_00: How a shadow octa or ping tenant someone spun up with a corporate credit card becomes a lateral movement backdoor nobody can see.
0:31
SPEAKER_00: And how a 10-minute phone call to the help desk is sometimes all it takes to reset someone else's MFA token.
0:39
SPEAKER_00: If you're the one securing this integration, not just building it, this episode is for you.
0:44
SPEAKER_00: Let's get into it.
0:47
SPEAKER_01: So back in 2016, Marriott spent, I think it was about$13.6 billion to acquire Starwood Hotels.
0:54
SPEAKER_00: Right.
0:55
SPEAKER_00: Massive deal.
0:56
SPEAKER_01: Yeah, totally massive.
0:57
SPEAKER_01: And on paper, it was this, you know, absolute master stroke of hospitality consolidation.
1:02
SPEAKER_00: Oh, absolutely.
1:02
SPEAKER_01: But the thing is, what Marriott didn't know, what their entire due diligence team completely missed, was that they had just purchased a network that Chinese state-sponsored hackers had been living inside for like over two years.
1:16
SPEAKER_00: Yeah.
1:16
SPEAKER_00: A complete nightmare.
1:17
SPEAKER_01: Aaron Powell Literally.
1:18
SPEAKER_01: Welcome to the deep dive.
1:20
SPEAKER_01: Today we are looking at the hidden digital landmines in MA.
1:24
SPEAKER_01: Specifically, if you're navigating the complexities of corporate mergers, you know identity is the new perimeter.
1:29
SPEAKER_01: So we're doing a highly technical masterclass in governance and inherited risk during merger and acquisition identity integration.
1:35
SPEAKER_00: Right.
1:35
SPEAKER_00: Now we're going deep into Okta and Ping identity today.
1:38
SPEAKER_01: Aaron Ross Powell Exactly.
1:39
SPEAKER_01: We are unpacking identity management blueprints, architecture comparisons for distributed enterprises, and, well, some massive cybersecurity breach post-mortems, including Marriott and that Oracle Cerner incident.
1:51
SPEAKER_01: Okay, let's unpack this.
1:52
SPEAKER_01: Why start with Marriott?
1:53
SPEAKER_00: Aaron Powell Well, the Marriott case is just the perfect lens for this because you know we are looking at the vendor neutral equivalent to the Microsoft-centric integration challenges we've analyzed before.
2:05
SPEAKER_00: Our mission today is to really understand the actual mechanics of access controls in a freshly merged environment.
2:12
SPEAKER_00: We're going to break down the hidden lateral movement dangers of shadow identity organizations and lay out why the ultimate risk narrative of an acquisition applies identically across all platforms.
2:25
SPEAKER_01: I mean, if I'm an IT director or a CISO looking at an acquisition, the very first thing I'm worrying about on day one is simply how to govern access when two separate companies suddenly share a digital roof.
2:35
SPEAKER_00: Exactly.
2:35
SPEAKER_01: You have company A, the parent company acquiring company B, the ink dries on the contract, and immediately you have thousands of employees in company B who need to touch company A's systems to just, you know, do their jobs.
2:48
SPEAKER_00: And that day one reality is really where the theory of identity governance collides with the friction of human organization.
2:54
SPEAKER_00: It gets messy fast.
2:55
SPEAKER_01: Oh, I'm sure.
2:55
SPEAKER_00: To understand how organizations handle this, we have to look mechanically at how platforms like Okta identity governance and ping data governance function the moment those environments are federated.
3:06
SPEAKER_01: Aaron Powell Right.
3:07
SPEAKER_01: And we aren't going to dwell on the underlying federation mechanics today, like tying the directories together.
3:11
SPEAKER_00: Aaron Powell No, no.
3:12
SPEAKER_00: Because the real danger lies in the application of the governance controls over that newly federated system.
3:18
SPEAKER_01: Aaron Powell Okay.
3:19
SPEAKER_01: So I'm looking at Okta's approach in these blueprints, and it centers really heavily on entitlement management.
3:24
SPEAKER_01: I want to understand how this actually changes the workflow for a newly acquired employee.
3:29
SPEAKER_01: Sure.
3:30
SPEAKER_01: Like if I'm a financial analyst from Company B and I need access to Company A's forecasting tools, I'm assuming I don't just email the IT help desk and ask for 20 different applications one by one.
3:40
SPEAKER_00: Aaron Powell You don't.
3:41
SPEAKER_00: I mean, manual provisioning is just impossible to scale.
3:43
SPEAKER_00: And more importantly, it's impossible to audit safely during an acquisition.
3:47
SPEAKER_00: Aaron Powell Right.
3:47
SPEAKER_01: It would just be chaos.
3:48
SPEAKER_00: Trevor Burrus, Jr.: Total chaos.
3:50
SPEAKER_00: So Okta's entitlement management allows the parent company to bundle resources into requestable access packages.
3:56
SPEAKER_00: Aaron Powell Okay.
3:57
SPEAKER_01: Access packages.
3:58
SPEAKER_00: Aaron Powell Yeah.
3:59
SPEAKER_00: Instead of individual permissions, an administrator creates a package that contains the specific Sauce apps, the necessary Okta groups, and the sensitive SharePoint sites required for that specific financial analyst role.
4:12
SPEAKER_01: Aaron Powell So the employee just clicks a button and requests the financial analyst access package and all the provisioning just happens downstream.
4:18
SPEAKER_00: Aaron Powell Exactly, it's bundled.
4:19
SPEAKER_01: Aaron Powell That makes total sense for standard Sauce applications.
4:24
SPEAKER_01: But if I'm listening to this and my company operates in a highly regulated space, say healthcare or defense contracting, bundling a bunch of apps together doesn't really solve my compliance problem.
4:34
SPEAKER_00: No, it doesn't.
4:35
SPEAKER_01: Because I don't just care if they can open the app.
4:36
SPEAKER_01: I care about what data they can see once they are actually inside it.
4:39
SPEAKER_01: Trevor Burrus, Jr.
4:40
SPEAKER_00: Right, which is where ping data governance provides a completely different architectural approach.
4:45
SPEAKER_00: Ping leans heavily into centralized, fine-grained control down to the individual attribute level.
4:51
SPEAKER_01: Attribute level.
4:52
SPEAKER_00: Yeah.
4:52
SPEAKER_00: Rather than just governing the front door of the application, ping is governing the data exposure itself.
4:57
SPEAKER_01: Aaron Powell Okay.
4:58
SPEAKER_01: Walk me through the mechanics of that.
5:00
SPEAKER_01: How does that policy engine actually evaluate a user in real time?
5:03
SPEAKER_00: Aaron Powell Let's use your financial analyst example again.
5:06
SPEAKER_00: The analyst logs in, ping data governance intercepts the request right at the data layer.
5:12
SPEAKER_01: Okay.
5:12
SPEAKER_00: It evaluates the user's attributes.
5:14
SPEAKER_00: So things like their geographic location, their department code, their security clearance level, and the risk context of their current session.
5:23
SPEAKER_01: Aaron Powell So it's looking at everything about them in that moment.
5:26
SPEAKER_00: Right.
5:26
SPEAKER_00: So if the analyst is accessing a global revenue dashboard, the policy engine dynamically filters the data in that dashboard.
5:33
SPEAKER_01: Aaron Powell Wait, dynamically filters?
5:35
SPEAKER_00: Yes.
5:36
SPEAKER_00: In real time.
5:37
SPEAKER_00: The analyst might only see revenue figures for the North American division while the European figures are completely redacted or masked.
5:43
SPEAKER_01: Oh wow.
5:44
SPEAKER_01: So the application itself doesn't have to manage that masking logic?
5:47
SPEAKER_00: No, not at all.
5:48
SPEAKER_01: The identity platform is doing it based on the federated directory attributes.
5:53
SPEAKER_00: Correct.
5:54
SPEAKER_00: The data governance layer basically acts as a proxy.
5:56
SPEAKER_00: And this is absolutely critical for managing complex compliance mandates post-merger.
6:01
SPEAKER_00: I can imagine Yeah, I mean if you acquire a company operating in a different regulatory jurisdiction, you can't just grant their employees blanket access to your databases.
6:10
SPEAKER_00: Ping allows you to enforce data residency and privacy rules dynamically.
6:15
SPEAKER_01: Right.
6:15
SPEAKER_01: Ensuring the acquired workforce only sees the specific data fields they're legally permitted to view.
6:21
SPEAKER_00: Exactly.
6:22
SPEAKER_01: Okay, so Okta gives us efficient access bundling, and ping gives us surgical precision on the data attributes.
6:28
SPEAKER_01: But looking through the sources, both of these platforms run into this massive edge case during integration.
6:34
SPEAKER_00: The certification campaigns.
6:35
SPEAKER_01: Yes, the collision of certification campaigns.
6:38
SPEAKER_00: This is a huge one.
6:39
SPEAKER_00: The certification campaign is really the backbone of identity compliance.
6:43
SPEAKER_00: It's the formal process where managers review and approve the access rights of their direct reports.
6:49
SPEAKER_00: Right.
6:50
SPEAKER_00: But in a post-merger environment, reconciling two disparate sets of certification campaigns, two different sets of policies, and two entirely different sets of reviewers creates an absolute organizational nightmare.
7:02
SPEAKER_01: Let's break down the exact workflow of this edge case because the documentation shows this is where the security posture of the parent company just completely unravels.
7:11
SPEAKER_00: It really is.
7:12
SPEAKER_01: So let's say Company A has federated their environment with Company B.
7:16
SPEAKER_01: Company B's employees have requested, and they've been granted, access to Company A's sensitive financial systems to start consolidating the books.
7:26
SPEAKER_00: Okay, so Company A's governance policies dictate that access to those financial systems must be reviewed quarterly.
7:33
SPEAKER_00: So the Okta or Ping governance engine fires off a certification campaign.
7:37
SPEAKER_01: Makes sense.
7:38
SPEAKER_00: And the system does exactly what it is programmed to do.
7:40
SPEAKER_00: It routes the access review to the designated resource owner or the assigned manager in company A.
7:47
SPEAKER_01: But the employee whose access is being reviewed works for company B.
7:50
SPEAKER_00: Yes.
7:51
SPEAKER_01: Which means a manager in parent company is suddenly staring at a dashboard assigned as a reviewer to certify access for people they have literally never met.
7:59
SPEAKER_00: Never met, and who operate in a completely different organizational structure.
8:04
SPEAKER_00: The reviewers looking at a list of names they don't recognize from a division they don't understand, asking to maintain access to critical financial systems.
8:13
SPEAKER_01: So the technology is functioning perfectly, but the human element is completely broken.
8:18
SPEAKER_00: Exactly.
8:18
SPEAKER_00: The human context is missing.
8:20
SPEAKER_01: You know, here's where it gets really interesting.
8:22
SPEAKER_01: It's almost like moving in with a new roommate and suddenly trying to merge your streaming accounts.
8:27
SPEAKER_00: Oh, that's a good way to put it.
8:28
SPEAKER_01: Right.
8:29
SPEAKER_01: You are asked to sign off on their viewing habits, but you don't even know what shows they watch or who they even are.
8:35
SPEAKER_01: How do you run a secure access review when the reviewer is completely blind to the user's actual job function?
8:42
SPEAKER_00: In practice, they don't run a secure review.
8:45
SPEAKER_00: What happens is this really dangerous phenomenon known as rubber stamping.
8:49
SPEAKER_01: Rubber stamping, just approving everything.
8:52
SPEAKER_00: Yeah.
8:52
SPEAKER_00: The parent company managers are completely overwhelmed by the integration.
8:57
SPEAKER_00: They are terrified of breaking critical business operations by revoking access by mistake.
9:03
SPEAKER_01: Right.
9:03
SPEAKER_01: They don't want to be the reason a payroll gets delayed.
9:06
SPEAKER_00: Exactly.
9:07
SPEAKER_00: And they simply do not have the time to track down the legacy organizational charts of the acquired company to verify every single request.
9:16
SPEAKER_01: They just highlight the whole list and hit approve.
9:18
SPEAKER_00: They rubber stamp the approvals out of pure confusion and alert fatigue.
9:22
SPEAKER_01: Yeah.
9:23
SPEAKER_00: And the mechanical consequence of that action is immediate, dangerous overprovisioning in the newly federated environment.
9:30
SPEAKER_01: So the principle of least privilege is just destroyed.
9:33
SPEAKER_00: Completely destroyed.
9:34
SPEAKER_00: Users retain access they no longer need, and because the reviewers lack the context to challenge that access, the excessive privileges just persist indefinitely.
9:43
SPEAKER_01: It's a massive blind spot.
9:44
SPEAKER_01: I mean, you have an enterprise-grade identity platform asking a human to make a critical security decision, but the human is flying completely blind.
9:52
SPEAKER_00: And this is exactly why the identity fabric becomes a severe liability if organizations fail to standardize policies before the access campaigns ever launch.
10:00
SPEAKER_01: Right.
10:01
SPEAKER_00: You cannot just flip the switch on federated single sign-on, launch a certification campaign, and assume the business will just sort it out.
10:08
SPEAKER_01: So if I'm running this integration, what is the actual sequence of events I need to follow to prevent that rubber stamping?
10:16
SPEAKER_01: How do I actually map the human context into the identity platform?
10:21
SPEAKER_00: Organizations must map roles and entitlements across both divisions meticulously before bridging the environments.
10:27
SPEAKER_01: Okay, before bridging.
10:28
SPEAKER_00: Yes.
10:29
SPEAKER_00: You have to translate Company B's legacy job titles and functions into Company A's governance framework.
10:36
SPEAKER_00: This involves identifying and removing redundant privileges in the acquired environment first.
10:41
SPEAKER_01: So clean house first.
10:42
SPEAKER_00: Right.
10:43
SPEAKER_00: You have to remap the manager attributes in the directory so that when a company B employee requests access, the Okta or Ping workflow routes that request to a reviewer who actually understands their daily function.
10:55
SPEAKER_01: Like maybe an integration lead or a legacy manager from Company B who's been onboarded into the new structure.
11:00
SPEAKER_00: Precisely.
11:01
SPEAKER_00: Only when the reviewer has the context to make a valid security decision is it actually safe to initiate a certification campaign.
11:08
SPEAKER_01: Wow.
11:08
SPEAKER_01: Okay, so that covers the friction of governing the users and the applications that the IT department actually knows about.
11:14
SPEAKER_00: Yes, the known environment.
11:16
SPEAKER_01: But reading through these due diligence reports, there is a concept that completely flips the risk model of an acquisition.
11:23
SPEAKER_01: Because if governing the known environment is that difficult, what happens when you inherit identity infrastructure that the acquired company didn't even know it had?
11:32
SPEAKER_00: Uh, yes.
11:34
SPEAKER_00: We are crossing from formal governance into the threat landscape of unmanaged identity.
11:39
SPEAKER_01: Shadow IT.
11:40
SPEAKER_00: Specifically, the massive risk of shadow octa or ping organizations.
11:44
SPEAKER_01: Aaron Powell The numbers in the corporate monitoring data are wild.
11:47
SPEAKER_01: Like most modern firms run hundreds of Sauce applications, but central IT only formally manages a fraction of them.
11:54
SPEAKER_00: Aaron Powell A tiny fraction, yeah.
11:56
SPEAKER_01: And when we talk about shadow IT, we usually think of, I don't know, a rogue marketing team using an unapproved project management app or something.
12:03
SPEAKER_01: Aaron Powell Right.
12:04
SPEAKER_00: It's like a random trellaboard.
12:05
SPEAKER_01: Exactly.
12:06
SPEAKER_01: But the sources here are talking about entirely unmanaged, fully functional identity environments.
12:11
SPEAKER_00: Aaron Powell It is remarkably common.
12:13
SPEAKER_00: Think about it.
12:14
SPEAKER_00: An engineering team gets frustrated by the bureaucracy of the central IT department.
12:18
SPEAKER_00: Right.
12:18
SPEAKER_00: They need to spin up an environment to manage access for a specific development project or to onboard a set of third-party contractors quickly.
12:26
SPEAKER_00: So a mid-level manager just goes to the Okta or Ping website, uses their corporate credit card, and spins up a dedicated tenant.
12:34
SPEAKER_01: Aaron Powell Just bypassing the central IT governance framework completely.
12:38
SPEAKER_00: Completely.
12:39
SPEAKER_01: Okay.
12:39
SPEAKER_01: If I'm playing devil's advocate here, I might ask, you know, if they are just managing their own isolated development project, what is the actual threat to the parent company?
12:49
SPEAKER_01: They are just out in their own sandbox.
12:50
SPEAKER_00: Aaron Powell The threat is that the sandbox is never truly isolated.
12:54
SPEAKER_00: Shadow organizations bypass core enterprise security controls.
12:58
SPEAKER_00: Because the Central Security Operations Center doesn't know the tenant exists, they cannot enforce corporate standards.
13:05
SPEAKER_01: They can't secure what they can't see.
13:06
SPEAKER_00: Aaron Powell Right.
13:06
SPEAKER_00: The shadow orgs typically bypass strict multi-factor authentication requirements.
13:11
SPEAKER_00: They don't utilize adaptive access policies based on device posture or geographic location.
13:17
SPEAKER_01: They're just totally exposed.
13:18
SPEAKER_00: And critically, they bypass centralized audit logging.
13:23
SPEAKER_00: If an attacker is brute forcing accounts in that shadow tenant, the corporate CM, the security information and event management system sees absolutely nothing.
13:33
SPEAKER_01: Aaron Powell The Shadow Org is completely invisible to the SEM.
13:37
SPEAKER_01: But how does an attacker compromising a rogue developer tenant actually pivot to hurt the main corporate network?
13:44
SPEAKER_01: Like, how do they cross the gap?
13:46
SPEAKER_00: Aaron Powell They cross the gap through the underlying connections that inevitably form over time.
13:51
SPEAKER_00: For example, an employee in that shadow org might use their corporate email address to provision an administrative account.
13:57
SPEAKER_01: Okay.
13:58
SPEAKER_00: But because it isn't integrated with corporate SSO, they use a weak reuse password.
14:03
SPEAKER_00: Or the engineering team sets up a loose federation tie, like a SAML assertion, between the shadow tenant and a minor corporate application just to share some data.
14:11
SPEAKER_01: Aaron Powell And then they just forget to tear it down when the project ends.
14:14
SPEAKER_00: Exactly.
14:14
SPEAKER_00: Or they share billing infrastructure or overlapping DNS subdomains.
14:18
SPEAKER_01: Wow.
14:19
SPEAKER_01: So if an attacker compromises that shadow org, maybe by finding, you know, unused active API tokens that were never revoked, they use those loose connections as a lateral movement backdoor.
14:31
SPEAKER_00: Aaron Powell That is exactly what happens.
14:33
SPEAKER_00: They pivot from the unmonitored shadow tenant straight into the main network.
14:38
SPEAKER_01: If I'm listening to this, I'm thinking about the mechanics of lateral movement.
14:41
SPEAKER_01: It's not the old cliche of buying a house with a broken deadbolt.
14:46
SPEAKER_01: It's more like connecting the HVAC systems of two adjacent office buildings.
14:50
SPEAKER_00: Aaron Powell Oh, that's a great analogy.
14:52
SPEAKER_01: Aaron Powell Right.
14:52
SPEAKER_01: It doesn't matter how secure the lobby of building A is.
14:55
SPEAKER_01: If you connect its air ducts to building B and building B has black mold in the vents, you've just poisoned both buildings from the inside.
15:02
SPEAKER_00: The shadow organization is the toxic mold in the ductric.
15:06
SPEAKER_00: And during an acquisition, you are bolting your pristine ductwork directly onto a system that hasn't been inspected in years.
15:12
SPEAKER_01: Which brings up, honestly, the most fascinating edge case in the post-acquisition due diligence reports.
15:18
SPEAKER_01: How does a security team actually discover a shadow Okta or pinning organization?
15:23
SPEAKER_01: Because by definition, the acquired company's IT team doesn't even know it exists, so you can't just ask them for a list.
15:29
SPEAKER_00: No, you can't.
15:30
SPEAKER_00: You have to assume the acquired IT department is entirely blind.
15:34
SPEAKER_00: Discovering these environments requires a highly aggressive, multi-layered, forensic approach known as shadow consolidation.
15:41
SPEAKER_01: Shadow consolidation.
15:42
SPEAKER_01: Yeah.
15:43
SPEAKER_00: You have to look at the exhaust fumes of the organization to find the hidden engines.
15:46
SPEAKER_01: Let's dissect the mechanics of that.
15:48
SPEAKER_01: I'm the acquiring CISO.
15:50
SPEAKER_01: My first instinct is to just run a broad network scan across the acquired IP ranges.
15:56
SPEAKER_01: But I'm guessing it's not that easy because these shadow SAWS instances don't sit on the local network, they sit in the cloud.
16:02
SPEAKER_00: Right.
16:02
SPEAKER_00: A local network scan won't find a cloud-hosted tenant.
16:05
SPEAKER_00: You have to start at the absolute foundation, which is financial forensics.
16:09
SPEAKER_01: Financial forensics.
16:11
SPEAKER_00: Yes.
16:11
SPEAKER_00: The due diligence team aggregates expense reports, procurement databases, and vendor usage data.
16:19
SPEAKER_00: They are mapping general ledger codes to look for rogue departments expensing unapproved SAS identity tools.
16:25
SPEAKER_01: Wait, are you telling me that during a multi-billion dollar acquisition, the highly paid incident response team is literally digging through expense reports for random$500 monthly credit card charges to ping or Okta?
16:39
SPEAKER_00: Aaron Powell Following the money is the most reliable way to find unauthorized technology.
16:43
SPEAKER_00: A manager expensing an Okta developer tenant or a pignon trial every month is a massive red flag.
16:49
SPEAKER_01: That is wild.
16:50
SPEAKER_00: It is.
16:50
SPEAKER_00: But the financial audit gives you the initial thread to pull.
16:53
SPEAKER_00: But you know, the financial data is often obfuscated or buried in generic software budgets.
16:58
SPEAKER_00: So that brings us to the second layer of forensics, which is network telemetry.
17:02
SPEAKER_01: Okay, let's get into the technical weeds of the telemetry.
17:04
SPEAKER_01: If the shadow tenant is in the cloud, what exactly is the security team looking for on the network to prove it exists?
17:10
SPEAKER_00: They are analyzing outbound traffic patterns, using secure web gateways and deep packet inspection.
17:16
SPEAKER_00: Specifically, they are using TLS fingerprinting and analyzing DNS query logs.
17:21
SPEAKER_01: TLS fingerprinting.
17:22
SPEAKER_00: Yeah.
17:23
SPEAKER_00: When a user in the acquired company's network connects to a shadow identity provider, the cryptographic parameters they offer during the TLS handshake, specifically the client hello message, form a unique signature.
17:35
SPEAKER_01: So the security team actually has a database of known signatures for Okta and Ping services.
17:40
SPEAKER_00: Yes.
17:40
SPEAKER_00: They look for TLS signatures that match identity providers but originate from subnets or departments that shouldn't be authenticating directly to those endpoints.
17:49
SPEAKER_00: Furthermore, if a whole marketing department is logging into a shadow ping org every morning at 900 M, that generates a massive anomalous spike in DNS queries to a specific unmanaged ping URL.
18:02
SPEAKER_00: The network traffic volume basically betrays the existence of the shadow environment.
18:06
SPEAKER_01: That's brilliant.
18:07
SPEAKER_01: And the sources also mention looking for legacy authentication protocols in this traffic as well.
18:12
SPEAKER_01: Why is that relevant to finding a shadow identity org?
18:15
SPEAKER_00: Because modern managed identity environments heavily restrict legacy protocols like basic authentication.
18:22
SPEAKER_01: Right.
18:22
SPEAKER_00: Basic auth relies on transmitting the username and password encoded in base 64 right in the HTTP header.
18:29
SPEAKER_01: There's no interactive challenge, no push notification to a phone.
18:32
SPEAKER_01: It's just sitting right there in the header.
18:35
SPEAKER_00: Exactly.
18:35
SPEAKER_00: Which means a man-in-the-middle attack or a compromise router can easily intercept those credentials.
18:40
SPEAKER_00: Managed platforms block this by default.
18:43
SPEAKER_01: But the shadow orgs don't.
18:45
SPEAKER_00: Right.
18:45
SPEAKER_00: Shadow orgs, which are usually spun up quickly for legacy app testing or third-party integration, they often leave basic auth enabled.
18:52
SPEAKER_00: When the network telemetry filters for those specific HTTP headers hitting SAS endpoints and finds a high volume of basic auth traffic bypassing modern security brokers, it is a glaring indicator of an unmanaged, poorly secured identity store.
19:07
SPEAKER_01: Okay, so we have the credit card receipts and we have the TLS and DNS traffic anomalies.
19:12
SPEAKER_01: But there is a third layer to shadow consolidation the blueprints highlight, which is cross-referencing.
19:16
SPEAKER_01: How do you tie the financial and network data back to actual human identities?
19:20
SPEAKER_00: This is the reconciliation phase.
19:22
SPEAKER_00: The security team cross-references the active directory extracts from the acquired company against the SAM authentication logs over a defined window, which is typically 90 days.
19:32
SPEAKER_01: Walk me through the query logic of that cross-reference.
19:35
SPEAKER_01: What is the delta they are actually looking for?
19:37
SPEAKER_00: You take the full extract of every known officially provisioned identity in the corporate directory.
19:43
SPEAKER_00: Then you pull the logs from the CIM showing every active login event across the network over the last three months.
19:49
SPEAKER_00: Okay.
19:50
SPEAKER_00: You run a diff against those two data sets.
19:53
SPEAKER_00: You are hunting for anomalies, specifically dormant or orphaned accounts tied to the network traffic we identified earlier.
20:00
SPEAKER_01: So if the SIM shows authentication activity routing toward an Okta endpoint, but the account generating that activity does not exist in the formal corporate directory.
20:09
SPEAKER_00: You have just found a ghost identity.
20:11
SPEAKER_01: A ghost identity.
20:12
SPEAKER_00: Yes.
20:13
SPEAKER_00: You have proven that an unmanaged user is operating inside a shadow environment that is connected to the corporate network.
20:19
SPEAKER_00: Shadow consolidation is really this forensic triad.
20:23
SPEAKER_00: Following the financial breadcrumbs, analyzing the raw network handshakes, and diffing the active logs against the official directory to isolate those ghosts.
20:32
SPEAKER_01: And the entire purpose of this exhaustive forensic hunt is just to close those lateral movement pathways before an attacker can use the shadow org to pivot into the newly merged parent environment.
20:43
SPEAKER_00: It is a complete race against time.
20:45
SPEAKER_00: Because once you step back from the specific mechanics of Okta entitlement management or the forensic hunt for ping network signatures, a really stark pattern emerges from the macro data in these sources.
20:56
SPEAKER_00: Yeah.
20:56
SPEAKER_00: Whether the acquired company runs on Okta, Ping, or Microsoft, the foundational risks of MA identity integration remain exactly the same.
21:04
SPEAKER_01: Aaron Powell The risk narrative is entirely vendor agnostic.
21:07
SPEAKER_01: I mean, when we look at the failure rates of corporate mergers, the statistics are just staggering.
21:11
SPEAKER_01: Identity integration failures are cited as a primary factor in more than forty percent of all MA failures.
21:26
SPEAKER_00: The failure rate is that high because the underlying vulnerabilities are universal and they are incredibly difficult to mitigate.
21:34
SPEAKER_00: Over 80% of all data breaches trace back to weak, stolen, or default passwords.
21:40
SPEAKER_00: And seventy-four percent of breaches involve the human element.
21:43
SPEAKER_00: Actions like social engineering, alert fatigue, or the misuse of privileges that we discussed earlier with the rubber stamping of access reviews.
21:51
SPEAKER_01: If I'm on the acquiring board of directors, I don't really care if the target company uses Okta or Ping.
21:56
SPEAKER_01: I care about the universal risks.
21:58
SPEAKER_01: Inheriting an undetected breach.
22:00
SPEAKER_01: Exposing data during the migration process and the strict transfer of regulatory liability.
22:04
SPEAKER_01: The vendor logo on the software doesn't change the blast radius.
22:08
SPEAKER_00: No, it doesn't.
22:09
SPEAKER_00: And the Marriott Starwood breach is really the canonical case study for inherited MA cyber risk, and it perfectly illustrates the irrelevance of the underlying platform when the fundamental security architecture is compromised.
22:20
SPEAKER_01: Let's spend some time dissecting the mechanics of what actually happened with Marriott because the timeline here is terrifying.
22:27
SPEAKER_01: Marriott closed its$13.6 billion acquisition of Starwood in September of 2016.
22:34
SPEAKER_01: But the breach didn't start in 2016.
22:37
SPEAKER_00: No, it didn't.
22:38
SPEAKER_00: Chinese state-sponsored attackers had actually compromised the Starwood network in 2014, two full years prior to the acquisition.
22:46
SPEAKER_00: Wow.
22:47
SPEAKER_00: Yeah.
22:47
SPEAKER_00: They installed web shells on the Starwood reservation system, moved laterally into the Active Directory, and just began harvesting credentials.
22:55
SPEAKER_01: So when Marriott's due diligence team was auditing Starwood's financials and technical infrastructure in 2015 and 2016, the attackers were already deeply embedded in the environment, holding administrative privileges.
23:07
SPEAKER_01: Marriott literally bought a compromise network.
23:10
SPEAKER_00: They bought the network, and because they failed to execute the aggressive shadow consolidation and directory reconciliation we just discussed, they completely failed to detect the dormant malware.
23:19
SPEAKER_00: But the real tragedy of the Marriott case is what happened during the integration phase.
23:23
SPEAKER_00: When Marriott began bridging the Starwood systems into their own identity fabric, the integration was flawed.
23:29
SPEAKER_00: They didn't isolate the acquired environment.
23:31
SPEAKER_01: They connected the toxic HVAC ducts directly into their pristine building.
23:36
SPEAKER_00: Precisely.
23:36
SPEAKER_00: And because of that flawed integration, those state-sponsored attackers operated for two more years inside Marriott's infrastructure post-merger.
23:46
SPEAKER_01: Two more years.
23:59
SPEAKER_00: It was.
24:00
SPEAKER_00: It cost Marriott$170 million in direct expenses.
24:04
SPEAKER_00: The attackers exfiltrated the records of 344 million guests, including millions of unencrypted passport numbers.
24:11
SPEAKER_01: Millions of passports.
24:12
SPEAKER_00: And the regulatory hammer was unprecedented.
24:15
SPEAKER_00: Marriott was subjected to a 20-year FTC consent order, extending their compliance and auditing obligations all the way through the year 2044.
24:22
SPEAKER_01: That is the ultimate realization of inherited risk.
24:25
SPEAKER_01: The regulatory liability transferred entirely to Marriott the second the acquisition closed.
24:30
SPEAKER_01: And the sources point to another massive case study that highlights a different but equally universal MA vulnerability, which is the Oracle Cerner acquisition.
24:39
SPEAKER_00: Right.
24:40
SPEAKER_00: Oracle acquired the healthcare IT company Cerner for$28 billion.
24:45
SPEAKER_00: The vulnerability in this case wasn't necessarily a long-term, dormant, persistent threat like Marriott.
24:51
SPEAKER_00: The breach occurred in the legacy data migration servers.
24:54
SPEAKER_01: Which proves a really vital point about the mechanics of integration.
24:58
SPEAKER_01: When you are moving massive amounts of highly regulated patient health data between two disparate identity ecosystems, you have to spin up temporary infrastructure.
25:07
SPEAKER_01: You need migration servers, staging databases, API bridges to translate data formates, all of that.
25:13
SPEAKER_00: And those temporary migration environments are frequently the weakest link in the entire MA process.
25:18
SPEAKER_00: They are often spun up incredibly quickly by integration teams facing massive deadline pressure.
25:23
SPEAKER_01: So they cut corners.
25:24
SPEAKER_00: They lack the baseline hardening of the source or destination environments.
25:28
SPEAKER_00: They might have misconfigured ports exposed to the internet, or they might lack mature endpoint detection and response agents simply because they are considered temporary.
25:37
SPEAKER_01: An attacker isn't going to try and break through the heavily fortified front door of Oracle's primary cloud infrastructure if they can just compromise the poorly secured temporary server sitting in the middle, actively pulling patient records from Cerner.
25:52
SPEAKER_00: Exactly.
25:52
SPEAKER_01: A vulnerable migration server is vulnerable regardless of whether it connects back to an Okta tenant, a ping directory, or a Microsoft environment.
26:00
SPEAKER_00: The mechanics of the exploitation remain exactly the same.
26:03
SPEAKER_00: Threat actors are always looking for the path of least resistance.
26:07
SPEAKER_00: And the sources specifically highlight groups like Scattered Spider to illustrate this vendor agnostic threat.
26:14
SPEAKER_01: Scattered Spider's methodology relies entirely on the human element, completely bypassing technical controls.
26:20
SPEAKER_01: Let's break down how their fishing, their voice fishing campaigns, actually operate against a newly merged organization.
26:26
SPEAKER_00: They identify an employee at the acquired company.
26:29
SPEAKER_00: Perhaps someone who recently updated their LinkedIn profile with their new job title post-merger.
26:35
SPEAKER_01: Because everyone updates their LinkedIn after an acquisition.
26:38
SPEAKER_00: Exactly.
26:39
SPEAKER_00: The attackers gather their personal details.
26:42
SPEAKER_00: Then they call the parent company's IT help desk.
26:45
SPEAKER_01: They impersonate the acquired employee.
26:48
SPEAKER_01: They claim they are locked out of the new system or they lost their phone during a business trip, and they urgently need a reset of their multi-factor authentication token.
26:57
SPEAKER_00: Right.
26:58
SPEAKER_00: And the help desk technician is dealing with hundreds of integration-related tickets.
27:02
SPEAKER_00: They are primed to be helpful.
27:04
SPEAKER_00: They don't have a strong visual or organizational familiarity with the acquired employee.
27:09
SPEAKER_01: They just want to close the ticket.
27:10
SPEAKER_00: The attackers use high-pressure tactics, and the sources note these calls often take just 10 minutes.
27:16
SPEAKER_01: Ten minutes.
27:16
SPEAKER_00: 10 minutes on the phone.
27:18
SPEAKER_00: And the attacker convinces the help desk to issue a new MFA token or reset the password.
27:23
SPEAKER_01: They gain administrator privileges through a 10-minute phone call.
27:26
SPEAKER_01: And that human vulnerability, the technician wanting to close a ticket and help a frustrated user, that exists regardless of whether the help desk is resetting an Okta token or a ping credential.
27:38
SPEAKER_01: A vulnerable human is vulnerable everywhere.
27:40
SPEAKER_00: So if the foundational risks, the inherited breaches, the vulnerable migration servers, the social engineering of the help desk, if all of that is identical across all platforms, we have to look at what actually changes for the security teams tasked with securing the integration.
27:55
SPEAKER_01: Right.
27:56
SPEAKER_01: The threat is the same, but the tools and the architecture you use to defend the perimeter look and act very differently.
28:02
SPEAKER_01: How does the day-to-day reality of the MA integration team change when the target company runs on Okto versus Ping?
28:09
SPEAKER_00: The primary differences lie in the administrative interfaces, the architectural philosophies, and the policy engines.
28:15
SPEAKER_00: Let's start with Okta.
28:16
SPEAKER_00: Okta's architecture is fundamentally cloud native.
28:19
SPEAKER_00: It was built from the ground up as an integration first platform.
28:23
SPEAKER_01: They rely on a massive catalog of pre-built connectors.
28:26
SPEAKER_01: I think the sources cite over 7,000 integrations.
28:29
SPEAKER_00: Yes.
28:30
SPEAKER_00: They utilize a unified cloud policy engine.
28:33
SPEAKER_00: For an MA integration team, if the acquiring company operates entirely in the cloud and utilizes standard SaaS applications like Salesforce, Workday, Google Workspace, integrating an acquired Okta environment can be highly streamlined.
28:47
SPEAKER_01: Because the administrative interface is designed for speed.
28:50
SPEAKER_01: You can plug the acquired company's applications into the parent company's identity fabric relatively quickly because the APIs are standardized and the connectors are already built.
28:59
SPEAKER_00: Rapid onboarding is Okta strength.
29:02
SPEAKER_00: But Ping Identity presents a different architectural reality.
29:06
SPEAKER_00: Ping leans heavily into complex hybrid scale.
29:09
SPEAKER_00: While they certainly have robust cloud offerings, their architectural DNA is deeply rooted in deep protocol customization and bridging legacy on-premises systems.
29:18
SPEAKER_01: Right.
29:18
SPEAKER_01: They utilize components like Ping Federate and Ping Directory, which we know from previous analyses require significant engineering overhead.
29:25
SPEAKER_01: How does that hybrid focus change the dynamic for the integration team?
29:29
SPEAKER_00: It becomes vital when you are acquiring a company that refuses to fit into a neat cloud native box.
29:35
SPEAKER_00: Imagine acquiring a legacy manufacturing firm, a regional bank, or an older healthcare provider.
29:42
SPEAKER_01: Organizations with decades of technical debt.
29:44
SPEAKER_00: Exactly.
29:45
SPEAKER_00: They're running on-premises applications, custom-built Oracle databases, and proprietary authentication protocols that were written 15 years ago.
29:53
SPEAKER_01: A cloud native platform might really struggle to connect to those legacy systems natively without heavy custom middleware.
30:00
SPEAKER_00: Ping is specifically designed to bridge those legacy on-premise applications into a modern identity framework.
30:06
SPEAKER_00: The administrative interface is far more complex than Okta's.
30:10
SPEAKER_00: The engineering required to map the custom protocols is deeper, but it provides the architectural flexibility to govern environments that have massive on-premises footprints.
30:20
SPEAKER_01: The integration team has to adapt their strategy based entirely on the architectural reality of the acquired company.
30:26
SPEAKER_01: If you are buying a modern soft startup running Okta, your integration strategy is focused on managing cloud policies and streamlining the pre-built connectors.
30:35
SPEAKER_00: And if you are acquiring a legacy enterprise running ping, your integration strategy is focused on navigating deep protocol customization, deploying on-premises identity bridges, and managing hybrid directory structures.
30:48
SPEAKER_01: The engineering tasks change completely, but returning to our core thesis, the underlying risk does not.
30:54
SPEAKER_01: Pre-acquisition due diligence, based solely on a target company's self-disclosure, cannot find breaches that the target itself doesn't know about.
31:02
SPEAKER_01: If Starwood didn't know the state-sponsored attackers were in their network, they couldn't disclose it to Marriott on a due diligence checklist.
31:09
SPEAKER_00: This is why the identity architecture and the aggressive consolidation and governance of that architecture is the ultimate MA battleground.
31:17
SPEAKER_00: You have to assume the acquired environment is compromised, and you have to govern the access and hunt for the shadow organizations accordingly, regardless of the logo on the software.
31:25
SPEAKER_01: To recap, identity integration during MA requires reconciling disparate access review campaigns and actively hunting for shadow identity organizations to prevent lateral movement.
31:36
SPEAKER_01: Furthermore, the core risks of inherited breaches, vulnerable migration servers, and regulatory liability remain identical regardless of whether the underlying platform is Okta, Ping, or Microsoft.
31:46
SPEAKER_00: That's a wrap on day one of an MA, Okta and Ping, Bloodhounds sniffing out hidden risk.
31:53
SPEAKER_00: We closed on the thesis that ties this whole three-part arc together.
31:58
SPEAKER_00: The risk doesn't care what platform's logo is on the login page.
32:01
SPEAKER_00: Inherited breaches, vulnerable migration servers, and rubber stamped access reviews show up on Entra, Okta, and Ping alike.
32:11
SPEAKER_00: Next episode, we leave MA behind and go after a different kind of standing risk securing your infrastructure without service accounts.
32:20
SPEAKER_00: Connect with Ernie on LinkedIn.
32:22
SPEAKER_00: The links in the episode description.
32:24
SPEAKER_00: Subscribe if this is useful.
32:26
SPEAKER_00: Until next time.