Latest / Identity at the Center / #154 - Customer MFA vs. Workforce MFA

Transcript

#154 - Customer MFA vs. Workforce MFA · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:26
sender podcast I'm Jeff and that's Jim.
0:28
Hey Jim hey Jeff, how are you? Oh, not so bad yourself doing
0:32
great man. And we might get some background
0:34
noise because we've decided to record on Wednesday this week.
0:39
The landscapers are here and they are mowing and I've heard
0:42
them a few times but we'll keep our fingers crossed sounds okay
0:47
to me but we'll see what it looks like in the
0:49
post-production world and of course you've got landscapers.
0:52
I actually have a guy in my yard with a chainsaw cutting down Ted
0:55
trees. So, hopefully that would impact
0:58
us too much but those are first world problems as far as I'm
1:00
concerned, right? Yeah.
1:02
And actually, for our banter this week, I wanted to bring up
1:05
a non first world problem. So I've been listening to course
1:09
the risky business podcast. I was to do it pretty much every
1:12
week and this week, they were talking about kind of
1:17
Microsoft's moves relative to the word Ukraine, which is that
1:22
they've taken the stance that they Are not going to issue
1:26
patches to their software for Russia and you know the debate
1:33
goes something like they think it's a really bad idea for a
1:36
couple of reasons. One is because there are a lot
1:38
of, you know, noncombatant organizations in Russia that
1:43
depend on their operating system for example, hospitals or
1:47
orphanages or whatever. And so if hackers are able to
1:52
break into the systems, they caused a lot of problems.
1:55
And you know nobody wants to see hospitals and orphanages or even
2:01
just you know innocent bystanders get hurt by this and
2:05
then issue. Number two is that they send the
2:08
signal out to the rest of the world.
2:11
That hey, if you're a company, if your country ends up on The
2:14
Blacklist, we're not going to patch your software and that's
2:19
going to make companies think twice about using their
2:21
software. What are your thoughts?
2:24
Yeah, I I feel like we talked about this a while back.
2:28
I just don't know how effective this sort of approach is because
2:32
how do I mean how they block it? Like, okay, if you're like, what
2:35
I have a Russian IP address. You just can't get patches.
2:37
Okay, well, I'll just go to a VPN and change my I can watch
2:41
Netflix anywhere I want in the world.
2:42
Like, how's that going to like actually work.
2:44
I think you're totally right. It's not a it's not a smart
2:47
munition. I think it's a shotgun approach
2:49
and you're hurting just as many people as you might be helping.
2:53
I get the intention behind it. Don't know how effective it is
2:57
but I'm not going to claim to be an expert on, you know the the
3:00
efficacy of patching and and things like that.
3:03
Just I'm skeptical of how effective it is but I did see I
3:07
think Ukraine awarded Microsoft some sort of like Freedom at all
3:10
or something like that. So yeah I support the intention.
3:13
I just don't know how effective it actually is in the real
3:15
world. Yeah I just it kind of feels
3:18
like it's not incredibly well thought out, you know, I think
3:22
that like you said, the Action is right, but I kind of fall in
3:27
the side of where the risky business guys.
3:29
Are you know relative to the potential downside of the
3:34
potential Fallout of such a move.
3:37
You know, it's just the The Squeeze won't be worth the
3:41
juice. Yeah, it's always that balance.
3:43
Right? Is that is the benefit worth it
3:45
or not. I mean, I'm not going to claim
3:48
to know everything, some guessing Microsoft thinks that
3:51
it is for some reason. Maybe it's Even the technical
3:55
reason, it could just be a PR reason.
3:56
I hate, I hate to be, you know, - down that route, but it could
4:00
just be a were, you know, throwing our support behind it
4:03
in the way that they think is the best way to do it.
4:05
I don't know. Not my jam, not my, not my pig,
4:09
not my farm about that. Yeah, I'm with you on that.
4:14
So what do you been up to this week moving?
4:18
So still getting set up finally have like my office or set up
4:22
some no longer and like a makeshift couch.
4:24
Got one of these fancy standing desk.
4:26
So we're trying this one standing up, which is kind of
4:27
cool and interesting, but yeah, things are going well, no bear.
4:31
Sightings this week not since the last one our first couple
4:34
days here. So, so far so good.
4:37
And like I said, I got a guy with the chainsaw side, cutting
4:39
down a cutting down trees. Yeah.
4:42
So this episode is going live on July 11th at which point I will
4:47
be unemployed. Mmm, we will be in between
4:51
physician. So I'm rain on the economy, a
4:55
drain on the economy. Well I you know I wouldn't go
4:57
that far but I will be leaving my current posts and coming to
5:03
work again with you and that going to get the party back
5:07
together. Very exciting.
5:09
I'm sure. We'll be talking about it more
5:10
in the future. Yes, the their relationship
5:14
continues as it's been successful for the last Almost
5:17
decade at this point and yeah, exciting things in store.
5:20
So super happy, super excited. That things are are working out
5:24
the way they way. They are so far, I don't want to
5:26
jinx anything. But yes, we'll have some some,
5:30
some new things coming up and the band is definitely sticking
5:33
together and I think we'll have some more opportunities and to
5:35
do some cool stuff, including potentially recording at Gartner
5:38
in a few weeks. So if you're going to be at
5:41
Gartner ping gym or I, the plan is for us to both be there, and
5:45
I think we're going to try to figure out, maybe how to do some
5:47
recordings on site, maybe get some guests, get some comments
5:52
feedback for maybe attendees things like that.
5:55
Haven't quite figured out all the logistics on it yet.
5:56
But that is certainly the intention so that'll be cool and
5:59
exciting because you and I were talking before we hit record
6:03
here. I can't read the last time I saw
6:04
you. I think it's been closed.
6:06
It's been at least three years, I think, maybe at this point
6:08
other than you being a window on the screen, I was going to say,
6:11
How do you know it's really me? How do you know?
6:12
It's not a deep fake of me. Somebody's don't get over my
6:16
identity and is projecting out as me.
6:19
They gave recently, I think it's pretty clear.
6:22
It is me is that you know who would come up with this kind of
6:26
content other than me your mind works in mysterious ways.
6:31
That is for sure. But yeah, I don't know.
6:33
For fact, but this is actually a should we just get into that
6:35
article? Because I think this, I think
6:37
you sent this to me and this is I'm glad that when you think of
6:40
deep fakes, you think of me Me, I don't know if I should be, you
6:44
know, honored or impressed or what about it, but there was an
6:48
article, I think it was from dark reading that talk through
6:52
basically criminals using deep fake videos to interview for
6:56
remote work. And this is something that you
6:58
and I talked about maybe a year at least more.
7:01
Go at this point where it was just first coming out and kind
7:05
of becoming easier for people to use.
7:07
And I'm curious when you read this article, what were your
7:11
what? Thoughts around it like initial
7:14
thought was oh Jeff is going to love this but correct thought.
7:18
Yes yeah so correct thought I guess my initial thought was you
7:24
know I look if you're going to kind of be cutting edge to use
7:32
technology like deep fake, why would you use it to get a job?
7:38
It seems to be like getting a job as his Probably not that
7:42
hard but I think that the, you know, we're using the Deep fake
7:48
would make the most sense has trying to be verified credential
7:54
system. So in other words trying to deep
7:57
fake and show a Passport and get access to somebody's identity
8:01
online to launch some kind of some kind of hack.
8:08
I guess I my my initial impact was I didn't see this as the use
8:13
case you'd want to really use the Deep fake for.
8:18
Ya know, I'm more about the memes and trying to get our guy
8:20
Fletcher into various compromising pitch situations of
8:25
not the real variety. But this is, this is actually
8:28
pretty close. So what I was thinking is sort
8:30
of like a threat is definitely the identity identity
8:32
verification component. Especially so there's a couple
8:37
things. Right?
8:37
So deep fakes and impressive technology.
8:40
We've seen it in movies, we've seen it in.
8:43
So you know, I'm sure people have scrolling through Instagram
8:45
and talking all their stuff. But the technology is at a point
8:50
now where it is relatively easy to use that.
8:56
Now it becomes to start to be a problem for identity
8:58
verification, especially in a remote Workforce environment
9:02
where I am looking at you on a screen right now in our
9:05
conferencing, you know, podcasting sort of Moment here.
9:08
I am assuming it's you I'm pretty confident that it is.
9:12
Am I 100% know 99% but as these Technologies become more
9:17
prevalent if you're sitting in an interview, for example, and I
9:21
know that this has been a challenge for certain areas of
9:23
the world, where, you know, the one person shows up for an
9:26
interview and is not the person that applied for the role and
9:30
sometimes it could be for, you know, a relative but nine
9:33
reason, it could be. The person is very skilled
9:35
technically but just has a hard time.
9:37
Interviewing for whatever reason and they hire somebody to
9:40
basically be their public face. But the real work is getting
9:43
done behind the scenes to someone, maybe isn't good on the
9:45
interviewing side. I think we've probably all heard
9:48
stories that are kind of similar to that.
9:50
Now I've got a situation where criminals might be leveraging it
9:52
for any number of reasons. You know, the lazy person to me
9:56
says okay well great, I'm going to get hired and you know, get
10:00
get get a job in a company and who knows?
10:02
They might give me access something.
10:03
They might pay me for two, three, four weeks and never
10:05
actually do any real work. And in the meantime, I wasn't
10:09
ever a kind of a real person anyway, so be may be tough to
10:11
track down. So I think there's a variety of
10:13
different options. None of them are good.
10:16
Unfortunately, in this case, but I hate to throw out the
10:21
technology because I do see the benefit for entertainment, you
10:26
know, even as a accessibility tool, maybe for some people who
10:31
who require those sorts of Technologies, but it is
10:35
certainly something to be aware of.
10:36
I think this is And also the we asked, I think I remember asking
10:40
Mike angle this of one Cosmos a while back is from this
10:44
identity, verification, a remote standpoint and things like
10:47
liveness checks, how do you know that's not a deep fake and yeah,
10:51
I think yeah, I do remember his exact answer it.
10:53
I think. I think they felt it was a they
10:55
had a pretty good solution in place, you know, for that I know
10:58
Adobe for example has spent time and money on kind of developing
11:02
tools to kind of help to detect that, but when you're doing
11:05
remote conversations like this, This you may not have the visual
11:09
Fidelity that you can rely on to really kind of inspect
11:13
pixel-by-pixel to see if Shadows are cast in the right way or you
11:17
know, whatever it may be. I think it's I think it's very
11:19
interesting, it's obviously something that that I find
11:21
personally, interesting as well. And I think of the bad things
11:24
can happen with it, but I'll hope to think that there will be
11:28
some good use cases out of it. To like I said, I gotta get, I
11:30
gotta get the memes going for my guy Fletcher, you know, I think
11:34
the the You know, thinking back to my Kangol conversation, my
11:39
takeaway was we just try and stay one step ahead of the bad
11:43
guys, right? I mean, that's probably all you
11:46
can do. I think if you take a historical
11:49
perspective, 120 years ago they invented the electric light
11:54
bulb, Tom says invented the electric light.
11:56
Bulb does not have 120 years ago, you know, a little more
12:00
than a lifetime ago. Now, look at things or even
12:05
typing, this deep fake conversation.
12:06
And so what can happen? 20, 40, 50 years down the road.
12:11
It's just like, I don't think we can even predict yeah.
12:16
Who knows? Maybe we'll become deep fake
12:18
individuals ourselves and instead of streaming our stupid
12:22
faces, maybe we just go to a fully cartoon format.
12:24
Yeah. And that becomes a Persona.
12:26
What's the band? Gorillaz?
12:28
I think was kind of revolutionary in that spot where
12:31
it's a real band, but there are public Persona was basically
12:35
cartoon monkey. Keys are gorillas.
12:38
And that was sort of like how they portrayed themselves, the
12:40
world, until they kind of came out later on and show their real
12:43
faces. But I thought that was
12:44
interesting instead of Buddy care about me, I like some of
12:49
their songs. The other thing I think to is
12:53
like what happens if someone does a deep fake of, you know, a
12:57
CEO and then calls into somebody and says, hey do this, and it's
13:02
convincing enough. Where somebody does it, right?
13:04
Which we have heard stories of people calling Again and doing
13:08
voice deep fakes and voicemails and things like that where
13:11
things have gone awry. But I think now as we get to
13:15
more of a distributed remote Workforce, you may not ever
13:18
actually see the person that you've been emailing and what
13:22
happens if you get socially engineer and all of a sudden,
13:24
you know, a deep fake person comes on tells you to do
13:28
something and you trust it. I think it opens up a lot of
13:30
avenues. You got to be careful from that
13:31
social engineering aspect because as you and I know,
13:35
social engineering continues to be the scourge of data breach
13:40
Guardians, all over the place. Yeah, that's a great point
13:42
though. Just one, one more thought on
13:44
the D fake is that makes identity and access management
13:49
verifying credentials although much more important that.
13:53
All right. Now I have a CEO in front of me
13:55
telling me to do something. Can I be sure that it's m as not
14:01
just that it looks like him. Sounds like him just like, I got
14:05
an email, looks like something he would have written.
14:08
It's got the letterhead must be from the CEO.
14:11
It goes back to the next thing that were leading into is just
14:15
social engineering and it's still one of the main ways that
14:21
Credentials are being stolen. Yep, I think you want to talk
14:26
about our data breach of the week?
14:29
Yeah, sure. So it's Marriott and I think
14:33
we'll have a link to an article in the show notes, if anybody
14:38
were to read up on it. But it was, I think, within the
14:42
past week, where an employee at the Baltimore Airport, Marriott
14:50
Hotel was Shuns you're into giving away their credentials.
14:53
Now the article is not clear on whether or not the employee had
14:57
the data on their on their device.
14:59
I'm assuming not assuming that they were connected back into
15:03
the network and that, you know, the hacker was able to leverage
15:08
some kind of pathway through that endpoint device back into
15:13
the network. The sounds like they got 20
15:16
Gigabytes worth of pii data now, I think Marriott saying that
15:22
hey, it wasn't that all that was reported by, you know, I think
15:27
the hackers leaked out that, hey, we got all this credit card
15:30
information, things like that, but according to the article
15:34
Marriott's, like, denying that it was, you know, that that
15:38
level of data, but is kind of concerning, because I think
15:41
they've kind of run into this scenario several times, where
15:45
it's like the social engineering, I think, you know,
15:48
My biggest takeaway or, you know, it's not even just to take
15:52
away is just kind of a, you know, confirming in my mind what
16:00
is often the case which is that the a lot of folks in the it
16:05
space think that okay, you know, you can't get through if we're
16:10
doing MFA and we're doing one credential per person, you log
16:14
in and assist employees and we have good deep furbishing
16:17
processes. We feel good to person.
16:21
Has gone through the right Jax. However, I think we're social
16:24
engineering, we had Roger Grimes on even with him if a you could
16:27
be social engineer to out of a multi-factor credential.
16:31
Now, once you get into the network, are your network
16:36
conditions designed in such a way, like, as your trust, kind
16:40
of way that you're going to be limited in terms of your
16:44
movement. In terms of, you know what you
16:47
can access. You can't change.
16:48
Credentials now that you're through the door and that you're
16:52
not depending on the fact that okay, people who are on this
16:56
side of the far, all we trust people on that side of the
16:59
firewall we don't trust. I think that's the you know at
17:03
the most basic level, what's your trust is all about
17:06
targeting which is that traditional mentality that we
17:10
have a firewall and inside the firewall.
17:14
It's a higher level of trust. Zero, trust says, it doesn't
17:17
matter inside. Her outside the firewall.
17:20
The trust level is Euro. We don't trust you because
17:23
you're on the inside, you need to be able to present the
17:26
credentials for the system. Now, the reason I bring all that
17:29
up, is that a front desk worker at one of the property
17:33
locations, their credentials should not be able to get 20
17:37
Gigabytes of data? So I'm assuming that unless the
17:40
system that had that data was extremely flawed that they
17:45
elevated to another credential that.
17:48
Also, cause for concern, but we don't know all that.
17:51
We're just, you know, there's obviously like an article
17:54
that's, you know, a couple paragraphs long, it doesn't give
17:57
all the the anatomy of the breach but you know, that's
18:01
that's what we kind of know at this point.
18:04
That's a little white on details but at the end of the day,
18:06
social engineering strikes, again the unhappy path, right?
18:10
I think of maybe people looking for access to things.
18:14
It sounds like, you know, you know, they had them if they
18:16
wouldn't matter in this case someone got tricked into doing
18:19
it. And I think this is where the
18:20
education component comes in. I think we still see reports.
18:24
So we said I've seen that still show that, you know, awareness
18:27
and and security education is still, you know, dollar for
18:30
dollar the best spend, especially for scenarios like
18:33
this. The challenge is, how do you
18:36
make sure that you're targeting the right people?
18:38
It's easy enough to say, okay, yeah, we'll never fall for
18:40
fishing. And then the one time that you
18:43
fall for it is the At time so you can continue we have to
18:46
reinforce and you know Rogers quoted on this in this article
18:49
from Silicon angle and we'll definitely link in the show
18:51
notes but he points out a good thing.
18:53
Here is the continual reinforcement of that message.
18:57
Always be alert for it. You start to develop sort of
18:59
that mindset and that and that awareness.
19:02
But yeah, as a Marriott bon voyage person, I find it
19:08
disappointing again, I think I saw an articles elsewhere that
19:12
this is the seventh time that They've had a date incident
19:15
since like 2010. So, you know, if you're
19:17
averaging one every other year, that's probably not a great
19:21
stat, that you're probably want to be proud of hopefully things
19:24
get better, but I would assume they're a pretty big Target,
19:27
right? I think one of the last acts
19:29
also had was linked back to China and some Espionage going
19:34
on there as well. So all the more reason to try
19:37
and close as many doors as you can and certainly start to look
19:42
at potential e zero trust. But also Save your analytics
19:44
right? 20, gigs of data, you know,
19:47
exiting your network should have trip, all kinds of alarms
19:50
accessing that number, you know, that that much data should also,
19:52
you know, trip up some things as well to try and be more
19:54
proactive about it. The subtly right?
19:58
Those are all great points. I think in their defenses,
20:01
they've got a global customer base.
20:06
They are the biggest hotel chain in the world, I love Marriott.
20:11
I mean, I went to to book. A hotel for an upcoming trip and
20:17
it was in San Francisco and like the number of boutique hotels
20:21
that came back that are now under the the Marriott umbrella
20:25
really impressive. But I think with having a global
20:30
customer base, you've got so many different challenges in
20:36
terms of the requirements for data privacy and really what
20:42
level Factor authentication is feasible.
20:46
I mean, the use cases that you pretty much anybody in the world
20:52
could become a member. They may have a smartphone, they
20:54
may not have a smartphone, you want them to become a member.
20:58
I mean that's that's your whole business, right?
21:00
Your you want everyone to be a customer at least, you know, I
21:04
think now we're thinking, like, B to C and that scenario for a
21:07
PHA, you know, how does that Maffei work differently between
21:11
b2c B2B bde. This is actually IE a
21:14
conversation that I started earlier today, with my new
21:17
friend, Nick, we're kind of talking about, you know, what's
21:21
the difference between customer MFA versus what, I'll call
21:24
Workforce MFA, and I'll lump be to be within that Workforce
21:28
environment as well because typically, they might be an
21:31
extension of your Workforce, or maybe like a supplier or
21:34
something like that, but it brought, it was interesting
21:36
conversation because I think that at face value, it's like,
21:40
oh, it's just MFA but as you and I know anybody probably Neck
21:44
deep in a sanitation, they are very different beasts and very
21:47
different use cases and very different user experiences that
21:50
come unto it. And I guess maybe this is world
21:53
will kind of take them in conversation for today is what
21:56
is the difference between customer MFA versus Workforce
21:59
MFA from your perspective? Which you think is harder to do?
22:08
You know, I think one of the hardest things to do is MFA is
22:12
to get the user experience, right?
22:14
And I kind of feel like the user experience on the customer side
22:21
is a little bit more difficult. You've got to get a more
22:24
tailored and what it ends up doing is requiring you to scale
22:29
back having a complex process. So you compromise strength for
22:34
usability On the employee side, I think it tends are the
22:39
workforce outages, a tends to be less that way.
22:42
So for example and I think this this conversation has so many
22:49
chemicals but from a technology perspective, most MFA technology
22:54
that works for the workforce will also work for the customer.
22:57
So one example is SMS, tax for one-time password, a time-based
23:03
one-time password, and you get Sent to your phone and you see
23:08
that in so many different customers scenarios because they
23:11
have the person's phone number on file and sending him.
23:15
A text is pretty much Universal, it's will work whether you have
23:19
a flip phone or you have a smartphone However, I think on
23:24
the employee side, having worked with so many customers, I rarely
23:28
see anybody depended on SMS time-based one-time password.
23:35
When you do see it, it's usually as an option, Bjorn option C.
23:40
And I will point out that hacking that that kind of
23:46
scenario is usually based on the unhappy path.
23:51
So it's oh my Other applications not working.
23:54
Okay, then we'll just send you an SMS.
23:56
Oh, I don't have that I just changed my phone number.
23:59
Okay well just log in with the secret questions and I was like
24:03
okay yeah I've got the secret questions because they got
24:06
dumped with you know this big data breach a happen somewhere
24:11
but yeah that's that. So what's harder to do?
24:17
I don't know that once necessarily harder than the
24:19
other except that I think that if you're saying which One's
24:23
hard to do in a very secure way. I think customers harder to do
24:27
in a very secure way. Yeah, I can see that.
24:31
I mean just the sheer footprint, right?
24:33
Number of clusters, you might have the variety of devices that
24:37
might be out there. And I think that's why we see
24:39
SMS continue to be leveraged, even though it's not, you know,
24:43
even recommended at this point keep using, it's still better
24:45
than nothing. So you see that as sort of like
24:47
the fallback plan, sometimes I only know the primary for, for
24:51
some organizations, I guess I see them as equally difficult,
24:56
but for different reasons the customer side, definitely the
24:59
user. Variants.
25:00
But I feel like for the customer side, you can narrow down the
25:03
paths. Pretty pretty specifically.
25:07
We're going to do SMS. We're going to do, email magic
25:09
link. We're going to do, only push
25:12
notification through our own branded app that you need to
25:15
download from the store, right? Something like that.
25:18
And I feel like still traditionally organizations are
25:22
willing to spend the money on customers on security, on
25:26
usability, on the user experience versus Is the
25:29
workforce where sometimes they'll put up with a less than
25:33
great experience because I well it's just our Workforce.
25:36
We don't really care. Yeah.
25:38
But their experience which I don't think is correct way to
25:42
approach it and I think on the workforce side you get into
25:45
really interesting and very specific use cases.
25:48
Where, how do you deliver MFA to a variety of personas on the
25:53
workforce side? Sure.
25:54
There's going to be your, you know, will come cut, your strip,
25:56
your typical office worker who might have a smartphone it.
25:59
Is it but what happens if you are working with somebody who
26:02
works in like a clean room environment or a shop floor or
26:05
someplace? Where they can't bring a
26:07
physical device in with them? What how are you going to
26:11
deliver to them a multi-factor? You know device.
26:14
They can't carry. Phone can't carry a token.
26:17
Is there a phone call that they get maybe?
26:19
And they have to do voice verification?
26:21
Is that a retina scan, a fingerprint?
26:23
You know. I think you get into some really
26:25
interesting use cases on the workforce side that you really
26:28
don't need to Account for is often on the customer side.
26:33
And so, I think it depends, which is a great Consulting
26:35
answer. Let's see.
26:37
Which one's harder, but I feel like work force can be harder
26:42
depending on how complex, your authentication scenarios look
26:45
like. Do you need to count for
26:46
something like that. If you have a pretty basic
26:49
Workforce, it's just hey, we're all logging into Microsoft and
26:53
we want to turn on, you know, MFA through Microsoft, that's
26:55
probably pretty easy. It's always the details and
26:58
those like Edge used Is that trip up a lot of organizations?
27:02
And then they start developing and itís like back doors, but
27:06
maybe back doors but alternative exception paths, that might be
27:10
easier to exploit than just having a standard process that
27:14
all of our users. Go through all of our customers
27:16
do this. Maybe not all your employees do.
27:21
I think if your paint with a broad brush to generally
27:26
speaking, the customer side scale is way greater than the
27:32
workforce. I'd say.
27:33
Alright, I mean there are certainly companies with
27:36
enormous workforces and there are certainly companies where
27:39
their customer footprint is relatively small.
27:42
But let's assume customers into millions Workforce in the
27:46
thousands It makes it very difficult to use.
27:52
Some of the stronger Technologies for MFA like
27:56
authenticator applications. You're one of those scenarios
27:58
where I run to personally a few times is where you change
28:02
devices. So even if you're going from one
28:06
iPhone to the next generation iPhone, you back up the iPhone
28:10
restored. The new iPhone, it doesn't bring
28:12
over the authenticator app information, you have to
28:15
re-register the but the device and if you do that before You do
28:20
that and you get rid of the old phone or yard, he wiped the old
28:23
phone, you go to access the applications.
28:25
Like oh so now what I do. Okay.
28:28
Maybe they have a backup path but if there isn't a backup
28:31
path, what do you do? I think from a customer, I am
28:34
perspective. You'd have to think through that
28:36
whole scenario. And do you want to put your
28:39
customers through the headache of having call Help Desk?
28:43
Well, if it's a banking scenario, or it, always comes
28:47
down to the risk. What your answer is going to be
28:50
And probably you have to ask yourself a question is like,
28:53
it's my customer going to go through this or they going to
28:56
abandon doing business with me. And so, if your level of
29:00
affiliation is not so strong, I think at the most that point you
29:06
can do is like an SMS or an email, so that the challenges
29:11
you might not be implementing the level of security that you
29:14
want to implement, because we already know there's a lot of
29:17
weaknesses in a lot of ways around.
29:19
And SMS and email, especially if you're dealing with people who'd
29:23
be like a Target like, you know, politicians or human rights
29:27
activists or celebrities things like that, they use their
29:32
customers of different places as well, right?
29:35
And people love to get their accounts, you know, thinking on
29:39
the employee side I think putting those strong controls in
29:42
is very reasonable and not even to say like we don't care about
29:46
the user experience, but if you get to the end and you go get
29:49
New device and you have to call the help desk because you didn't
29:53
do things in the order you should have done them or for
29:56
whatever reason. You're still talking thousands
30:00
instead of millions and it's more feasible and plus you're
30:04
paying those individuals. So there's some level of
30:07
expectation that either something that comes along with
30:10
that. Yeah.
30:15
I think about it from blast radius to if a customer account,
30:21
gets breached, what can they actually do with the customer
30:24
information? One person's, probably not going
30:27
to have a good time or maybe a family.
30:29
Right there might be associated with that.
30:31
If a employee account where to get breached, I think the blast
30:35
radius tends to be larger in that case.
30:38
The damage might be more significant relatively speaking.
30:42
Now, if it's the wrong person, the customer side that could
30:44
have. Traffic, you know, you know,
30:47
issues as well. But where is the most damage
30:50
going to get done? Is it because one customer
30:53
didn't set up MFA in their account or that one customer got
30:56
breached or because one employee got reached, I see the ladder
31:01
because we're seeing it on, you know, a customer counts or
31:05
employee counts, getting breached and then getting access
31:07
to other sorts of data within the environment and a locked, I
31:11
had struggled with it earlier this year with one of their
31:13
msps. No had yeah, they got octave
31:17
itself, didn't get breach but the MSP did.
31:20
Yeah, that bead. So the blast radius to me plays
31:22
a lot into this to say, okay. Well what's if the goal is to
31:26
provide security It's obviously important to make sure that the
31:30
customer data is safe. But if a customer gets breached,
31:33
its One customer. If the employee gets breached,
31:36
it could be multiple customers as we saw here.
31:38
Potentially with whatever happened with Marriott that's
31:42
why I think I lean towards they're probably the same from a
31:45
difficulty standpoint but for different reasons based on a
31:48
different types of complexity. If it's yeah it's a couple
31:51
hundred people on the Enterprise side, maybe in the workforce you
31:54
know. Maybe it is less of a concern or
31:56
maybe the type of business that you do just It's as much of a
31:59
target, maybe you're more The ransomware Target.
32:01
Just for, you know, getting a few bucks out of you versus
32:05
maybe something that's more, targeted Espionage or you know
32:09
in a case of War trying to bring down you know different services
32:12
or whatever. Maybe I think that blast radius
32:15
has to play into the decision as well.
32:19
Do you want to lose customers? No.
32:21
Do you want your company to go underground and lose everything?
32:25
Because the proper was security wasn't a place.
32:27
I think that's equally as important to maybe even more
32:29
important in some scenarios. Yeah.
32:31
Well I think that we're in a scenario where what's the
32:35
difference between the two? I think.
32:38
Technically speaking, the Technologies work.
32:42
The saying are the the same sets of Technologies can be used for
32:46
either scenario, but some of the masses, an SMS is an SMS or a
32:50
magic link is the same or a push notification.
32:52
They're all the same, they work the same, right?
32:56
And you know what I mean? Sometimes I really like the SMS.
33:01
You know. If it's something that you know
33:03
my LinkedIn account for example, I need to access it.
33:07
Do I think that SMS is the strongest form of MFA.
33:11
E naught, but I think that using SMS MFA is appropriate for the
33:19
level of risk involved with logging in to LinkedIn and
33:25
that's what I like. You're inviting people to try
33:27
and man-in-the-middle you and take over the Jimmy Mac.
33:31
I am LinkedIn profile. Maybe this is where defects get
33:35
started all of our millions of listeners who are out there.
33:39
Like oh yeah, you're gonna challenge me.
33:41
Yeah. Well you only need a small
33:43
percentage angry at you and then bad things happened.
33:46
That's true. That's true.
33:47
But, you know, one thing I feel like I need to bring this up but
33:52
it's so cool. Like how on iOS devices now when
33:57
you get an SMS one-time password whether you're in a native app
34:01
or in a browser-based application, if you have the
34:05
focus on the, you know, where you enter your SMS code kind, Of
34:11
pops up and you just push the button and you're you're right
34:14
in. I mean it's a great time saver.
34:17
Yeah, I'm happy Google and apple have figured that part out, I'll
34:20
be much happier when the Fido standards get put in place and
34:24
we start to see passkeys just live there and it just becomes,
34:28
you know, look at your phone to authenticate or press the finger
34:30
print button or whatever. Maybe even, that'll become a
34:33
whole lot easier. But, yeah.
34:35
So it's those little, it's those little Time Savers that make the
34:38
difference. I think, on the usability side,
34:41
there's nobody Likes having to put in a second password because
34:44
that's really what we're talking about is that SMS is just
34:46
another password. So the easier that you can get
34:50
it into the right field and make it secure the better.
34:54
You know I'm sure there are people figuring out you know how
34:57
to scrape that information from the message app on your phone
35:01
and do man in the middle I think especially on Google or Android
35:07
you know there's tons of messaging apps that's not the
35:09
same messaging app for everybody and Some of those you give
35:13
permissions that they can see your clipboard, they could see
35:15
everything you type. You know how secure is that?
35:18
I don't know. You really you're putting a lot
35:20
of trust into whatever messaging app you're using to not read
35:23
every single thing. You're typing into it and store
35:27
it somewhere. We're be able to capture it and
35:28
send it elsewhere, so think there's good and bad that comes
35:30
along with it. I like the idea of it.
35:33
I have a little more trust and Apple's implementation of it but
35:40
Yeah, it's everything has a risk and reward to it.
35:43
Well, you brought up there with the Fido possibility.
35:48
I wonder how that would work when switching an iOS device
35:51
because are those keys going to transfer when you get the new
35:55
one, or you're going to have to re register your device.
36:00
I'm assuming it's you, imagine high clouds can be a big part of
36:04
this because that's how iCloud the key chain works right now
36:07
between Mac OS, Mac OS, IOS and iPad OS.
36:12
The iCloud portion is really sinking things behind the scenes
36:15
and even if you use something like the Microsoft authenticator
36:17
on iOS, you can still back up your Microsoft, authenticator
36:22
keys to your iCloud account. You go to your new device log in
36:27
with your Microsoft account and then restore from iCloud your
36:31
keys. So I think, I think there's all
36:34
these. Are you sure that I don't quote
36:36
me but I feel ready. Sure.
36:38
Because I change devices all the I'm and I rarely have to
36:42
register new apps within my authenticator, so I don't use
36:46
Microsoft for everything. I use authy for some things as
36:49
well. So somewhere there is a sink and
36:52
a decryption is taking place that takes all of my you know
36:56
one time password generators through my through my
36:59
authenticator app and is putting them on my new device.
37:02
I'm not going out re-registering like 50 new apps, every time I
37:05
get a new phone, otherwise would stop getting new phones.
37:08
I don't want to do that. No, but I saw, I recently got a
37:11
new phone with my previous employer.
37:14
And there are Microsoft shop and install in tune to create like
37:20
a, you know, basically. Yeah, it is stalls and Emi in.
37:25
Tune, doesn't he definitely throws a wrench into it
37:27
sometimes. Yeah, yeah.
37:29
Somehow is creating some kind of encrypted package using the keys
37:32
on your phone. So if you have that, I think it
37:36
makes it much more difficult to kind of take your Rich tration
37:40
from before and uses some of the gifted just start over.
37:45
Yeah that's why I think the the workforce I could be more tricky
37:48
if I'm a consumer you generally don't see that problem as often
37:51
because they're allowing you to move those you know one time
37:54
password generator is between devices.
37:57
If you hassle I get in tune or an other MDM platform.
38:00
There's probably more controls around it by policy.
38:03
That is blocking you from doing that.
38:04
You need to put a new certificate on which invalidates
38:07
maybe, you know, the previous tokens that were Using you have
38:10
to set it up again. That is definitely something
38:12
that I have seen experience is painful when it happens, it's
38:15
always happens at the worst time but I can see that scenario and,
38:19
you know, maybe this, maybe this tips it for some people say
38:22
yeah, Workforce might be harder because of that type of
38:23
scenario, whereas on the consumer side, you maybe don't
38:26
have that level of control or the device.
38:31
So therefore you have to be a little bit more open with it and
38:33
just by that nature, makes it may be a little bit easier to
38:35
deploy. Yeah. well, I think the other
38:40
thought that crossed my mind as you're talking about different
38:43
scenarios with Workforce being more difficult is I think you're
38:48
going in posture of all of your security tools, how close you
38:52
are too, kind of a zero trust world because if somebody does
38:56
kind of slip through the cracks of MFA, you know, are they now
39:01
in they can just run wild or have you established kind of the
39:05
entry into the network that's going to Segment and limit their
39:09
access around the network. So I think there's that element
39:13
kind of plays into how much risk you're talking about.
39:17
Oh yeah. For sure.
39:18
I mean, how many times do we? You know, your people are
39:21
listening right? When they when they log on to
39:23
their company VPN. Can you get anywhere in the
39:25
network or basically, in any any rule from routing perspective or
39:29
are you limited, right? That's one of the first steps
39:31
from a zero trust perspective, is making sure that you can only
39:35
get to the resources you can and you know you and We need to see
39:38
lots of lots of companies. They have vpns that are wide
39:41
open. Hey, what's your IV p on your
39:42
trusted? You can go anywhere, do anything
39:44
you want. And think if you got a shot,
39:48
what you want to do, that's that's still so much the case.
39:51
I mean, I work with so many organizations and that's exactly
39:54
where they are. If you get on the VPN, you have
39:57
full access and it's hard. It's hard to do it.
40:01
Maybe you're basically how about Riri.
40:02
You know re-architecting your IP space within an organization.
40:06
If you're a small enough If maybe it's not as difficult, but
40:10
if you're a relative Argosy organization or you have a
40:13
pretty complex environment, maybe have to do segregation
40:15
between, I don't know, like, you know, manufacturing lines and
40:20
scada devices, or power company, or bank or whatever it may be.
40:24
And you haven't like figure that out or architected it in
40:27
advance. That's a lot of work.
40:31
You have a, it's we should be doing it, right?
40:35
I mean, think about it, like, all right, so I was on the
40:41
network engineering side early in my it career, and each office
40:47
had IP segments, you know, like this IP range for this office
40:53
and that IP range for that office and really, you should at
40:57
the most be able to access kind. The office that you go to but
41:01
really you should be accessing any endpoint devices or printing
41:05
to any printers when you could VPN.
41:07
Or if you do it should be kind of the exception case or maybe
41:12
basing it on DNS, rather than IP addresses, you should be
41:15
accessing applications that are in data centers.
41:19
Ideally you get to the point where you're saying, you can
41:23
only access these IP addresses in these ports.
41:27
Anything beyond that just seems like it's it's not good enough
41:32
and you see like in other areas of it where an information
41:37
security where we've made so much progress, but we still in
41:42
math. I say let me know if it's I'm
41:45
just over generalizing your but I see the lot where there's just
41:49
very little control when somebody's on the VPN they've
41:51
been authenticated. Might have good authentication
41:54
controls but once they're in, they're in, If I think I'm the
41:57
different least, I think that's the difference.
41:59
I think it is, I think local networks generally are in a
42:04
better shape, but when it came to VPN, it was just, hey, we
42:07
need to get access to everybody. And maybe the pandemic
42:10
accelerated that for people who weren't ready for it and they
42:13
had to put something in place and they didn't have the time to
42:16
architect, the VPN eyepiece, to make sure that they were the way
42:20
they were supposed to be. So, should they be doing it?
42:22
Yes, I Hope they've started. If they haven't already, you're
42:25
probably buying the This, but I think that's the difference,
42:28
right? Is the VPN angle of it is.
42:32
You're coming in, any any? And if that's what gets breach,
42:35
and now you have a remote laptop that's been lost or somehow
42:38
compromised. That's an endpoint that has any
42:41
any access to your network? That's bad times.
42:44
Totally agree. Well, Jeff, we can go on all day
42:48
with different topics, but I do have to kind of wrap your yep.
42:52
Let's go ahead and wrap it up here before we go.
42:55
Today is the 11th. It's national state.
42:58
Fair, food day. What's your poison?
43:01
I'm going to let you answer first because I think we're
43:04
going to answer the same thing and I've got a good, I've got a
43:07
good number of answers. I could feel with, I mean I'll
43:10
eat most things. I think you know the Irish you
43:13
haven't been to Exotic when it comes to state fairs.
43:15
Like I've never had a Fried Twinkie or a Snickers bar or
43:19
anything like that, but I do enjoy.
43:21
We're talked about this before, we started as a funnel cake.
43:24
I was like, yeah, that's that's that's my jam.
43:25
That's my wife's Jam to, we try to get at least one per year,
43:29
you know, in to us. But that's that's that's that's
43:33
where I'm going to go with. So it's a little cake.
43:35
Do you put it like dealing a lot of powdered sugar?
43:39
I like Define a lot because it's amount of the be covered.
43:43
No. It's like yeah, you should know.
43:46
It should be an appropriate amount of powder sugar.
43:50
It should not be a mountain that you can stick your finger
43:53
through and not hit any funnel cake if that makes sense.
43:57
Well, there's also like sometimes I've seen them where
44:01
people get the funnel cake powdered sugar and then like
44:04
chakra tell, what may be your something on it?
44:06
Yeah. Or caramel.
44:07
Yeah. What do you do?
44:10
I'm a plane. I like I like the funnel cake.
44:13
The the way it was meant to be just some powdered sugar.
44:17
But I you know certainly willing to allow others if they wanted
44:20
to desecrate their funnel cake with various sauces or dips.
44:24
Yeah. So I mean that is definitely
44:26
like funnel cake is If anybody's listening it happen, hasn't had
44:31
funnel cake. You need to try it unless you're
44:34
diabetic kidney to try it. It's wonderful.
44:38
I too, like, the fried Oreos and I will get them once in a while.
44:41
I'm not a junk food kind of sir, but they are pretty good, and
44:45
the front twinkies and fried Snickers bars.
44:49
I don't really hang out in the south of the u.s. now.
44:52
So, you know, you have to have to get your carnival on.
44:56
This will be and yet another excuse for my ever expanding
45:00
waistline. So all right we'll go ahead and
45:02
leave it there for this week. Appreciate everyone for
45:05
listening. You know.
45:08
One of the things that we like to do is you know, have
45:10
conversations like this. If you got topics that are out
45:12
there, feel free to hit us up on LinkedIn.
45:14
You're going to be a gardener hit us up on LinkedIn.
45:16
We'd love to this pump, you know.
45:18
Maybe figure out if there's something that we can, you know,
45:20
get guests on the show and kind of talked with that, I love
45:22
hearing stories from people are out in the field, so definitely
45:24
don't hesitate to Ping Jimmer eye on LinkedIn for that.
45:28
Sort of thing. You can catch Us online on the
45:31
web. I'd any of the center.com, we're
45:34
on Twitter and idac podcast, I'm finally getting my office back
45:38
in order and getting schedules you know back in order.
45:42
So I'm sure the live stream will come back at some point, but we
45:45
still have those out there on YouTube a tidy, a seedot As a
45:48
shortcut. So I'll hopefully people will
45:50
check those out and with that, we'll go ahead and leave it for
45:53
this week. Preciate everyone, Jim thanks
45:55
for your time. Thank you all for listening and
45:58
we'll talk with everyone in the next one.
46:03
Thanks for listening to the identity at the center podcast.
46:06
If you like what you heard, don't forget to subscribe and
46:09
visit us on the web and identity at the center.com.