Latest / Identity at the Center / #173 - Managing Social Media Accounts with Kurt Greening

Transcript

#173 - Managing Social Media Accounts with Kurt Greening · Identity at the Center

0:09
You're listening to the identity of the center podcast, this is
0:13
the show that talks about identity and access management
0:15
and making sure you know who has access to what let's get
0:18
started. Welcome to the identity of the
0:25
center podcast. I'm Jeff.
0:26
And that's gem a gem. Hey Jeff, how are you?
0:29
Oh, not so bad yourself. I'm good, man.
0:31
Just hunkering down getting ready for the storm.
0:34
I live in Augusta. Georgia.
0:35
We are taking a direct hit and I but I think the news is here, is
0:40
that you now live in the south and are facing a direct hit from
0:44
a hurricane. And this got to be a first for
0:47
you. It absolutely is.
0:48
I we're talking about was it's hurricane Ian, I think is the
0:51
name but yes, you sent me a picture last night.
0:54
Like hey you know you're in you're like in the past like
0:56
Inland and Georgia. I'm like next in line.
1:00
After it's you yeah, never been through a hurricane before so
1:04
we'll see how that goes. I live on the side of a mountain
1:06
so I'm not necessarily worried about flooding more like storm
1:09
damage. Maybe if there's like high winds
1:11
and trees and stuff like that. So yeah, yeah, you're probably
1:13
going to few trees go down, you're probably get a lot of
1:16
rain, but it's one of those deals.
1:17
Like we've got a lot of nerve like, complaining about it
1:20
because maybe some of our grass will get washed out and other
1:23
people. Having their houses destroyed
1:25
but how dare it? Yeah.
1:27
Well you know the insolence of hurricane Ian yes for sure.
1:31
For sure. So I had another thought
1:34
recently so you and I have known each other for a long time.
1:37
In our Glory Days, we did strategic, I am advisory
1:42
together and I know you're familiar with the term, stump
1:46
the chump and I'm wondering, what does stump the chump mean
1:50
to you? Well, I mean it's, you're
1:52
basically asking hard questions trying.
1:54
Stump whoever is on the spot trying to answer those questions
1:57
could answer correct whatever reason it's almost like I don't
2:00
know I don't remember the name of the game was kind of like
2:02
you. You throw the football up in the
2:03
air and everyone tries to try to tackle that person whoever
2:06
catches it and that person tries to run away.
2:07
It's almost like tag but they safer version of that probably.
2:11
Yeah, and I'll wait but when you're in the moment if you
2:14
don't have a good answer, doesn't feel good.
2:16
But I'm wondering. Have you ever received the stump
2:18
the chump question? It goes something like this.
2:22
Privileged access management does It include social media
2:26
accounts. So this is one of my favorite
2:28
questions because I have advocated that it does for
2:31
years. Now I think, you know, if you
2:34
historically kind of look at the space of privileged access
2:36
management, it's been like oh yeah it's our server accounts or
2:39
it's like our database or whatever it may be and I've
2:43
argued I think for the last couple years I know you I know
2:45
you know this because you and I have been in the same room it
2:47
when we're talking with clients is like okay how about your
2:50
social media accounts? How are you managing Facebook
2:53
LinkedIn? Twitter?
2:54
You know, whatever The Tick-Tock, I guess that, the,
2:56
uh, now at this point you're probably would be, you know,
2:58
what are the major ones? How are you protecting those
3:01
accounts? Because those are absolutely
3:02
privileged and a lot of damage can be done, you know,
3:05
reputation wise, especially, you know, if you have the wrong
3:08
people posting, and I've worked for companies.
3:10
So it had that issue in the past and it is something that is
3:14
unfortunate. Truth of the real world.
3:16
Yeah, no, you're right. And I think that one thing that
3:22
my the maturation of my My thinking about social media
3:25
accounts of course they're they're important because look
3:29
at the results, when but something happens when they're
3:33
compromised but I also think within the scope of the social
3:37
media account is really like third-party applications.
3:41
So my experience like almost every organization has a ton of
3:46
third-party applications that they use and by convenience or
3:51
just because they don't have a better solution they end up.
3:54
Managing those passwords by sharing them, emailing them to
3:57
each other, things like that. And it's obviously then you have
4:01
all the same problems that you would run into from.
4:04
And I am perspective with every other type of privileged access,
4:09
you know, how do you, how do you change this?
4:12
So that the person who left can't use it anymore especially
4:15
if you have like those oauth tokens, right?
4:16
The you probably granted like 10 years ago to like services and
4:18
you just never cleared them out. I'm guilty of that, you know, as
4:22
my multiple Isis and me, testing out things all the time.
4:26
I'm constantly having to go into, you know, my identity
4:28
provider identity providers and clear out old devices,
4:31
Microsoft, Google, right stuff like that, Android phone o that
4:35
was last week, I'm on iPhone. Now on the next week, it'll be
4:38
different. So it's a similar, I think, you
4:42
know, problem is a lot of these services will give you that, you
4:45
know, that integration. And then you kind of forget
4:47
about it and it means something still has access to your
4:51
account. Got to be careful about Gru to
4:53
you, take. When you go from Android to
4:57
iPhone and back, do you take the same SIM card or SIM cards able
5:02
to go from phone to phone across platform?
5:05
Well, yes, you used to be able to do that.
5:09
You typically can take your salmon, just swap it into a new
5:11
phone and then you, you know, login with the credentials,
5:13
everything kind of comes, download from the cloud cloud,
5:15
which that's how I do it. I just do it.
5:17
So often the new iPhone though, has a nice M which means there's
5:20
no longer a physical send at least on US models.
5:23
So now everyone who's on the The new iPhone 14 is leveraging
5:26
Isom, which is probably the future.
5:28
I am a little concerned about me who I can to switch devices, so
5:32
I don't know what that means. I want to try out, you know, my
5:35
an Android phone here at some point if I want it.
5:37
I can't I can't just swap my SIM card into it, so that's
5:40
something I've got to kind of read up on, but it seems like
5:42
u.s. iPhone users. Who have the new 14 are going to
5:48
experience the joys of Isom of the diversity of.
5:52
Even though it's a standard that's been around ya next time.
5:54
Roger crimes on the show. We'll have to ask him about the
5:57
you sem and does this open up new opportunity for Sim swapping
6:02
attacks. It's supposed to reduce it to
6:05
some degree because I don't want to claim on that it reduces it
6:09
but I think it theoretically will help with it.
6:13
It's funny you mentioned since whopping because Cloud fair just
6:15
announced I think it's Cloud. Fair some service around East
6:19
him and being able to kind of track and help secure that from
6:23
way. An MDM perspective.
6:26
I don't know how good it is not definitely not a plug for them
6:28
but it just it happened to kind of come across my feet in the
6:31
last couple days, so it's kind of interesting.
6:32
Yeah. You always want to keep an eye
6:33
on that news coming across. I mean other Islands were on the
6:36
news. My birthday is October 4th.
6:39
You're celebrating my birthday by going to Austin and the South
6:43
Point navigate conference and leaving me behind you know I do
6:46
love a good Tex-Mex you know the food trucks.
6:52
That's like my thing. But I'm glad for you that you're
6:55
going. And honestly on my birthday are
6:58
probably actually would want to go on a business trip.
7:01
Yeah, you're probably right. So you're welcome.
7:02
I'll take the hit on that one. First time going to sell Point
7:04
navigate, so it'll be interesting.
7:06
I'm sure I'll see a bunch of, you know, familiar faces and
7:09
kind of connect with old identity friends and things like
7:12
that. But yeah, it'll be interesting.
7:14
So I'll be at, I'll be time. People are listening to this,
7:17
I'll be at in Austin at Southpoint, navigate that week
7:20
and then you and I are going to the authenticate 2022 conference
7:23
in Seattle. It'll put on by the Fido
7:25
Alliance. That's the week of October 17th
7:27
and we're hoping to put together some good content.
7:29
They're similar to what we did for Gartner, with recording,
7:32
with some guests and putting out a bunch of shows.
7:35
I'm not sure if we'll have two full weeks worth.
7:37
That was a lot, but we should have you no more than a handful
7:41
of episodes to put out in a timely manner.
7:43
Hopefully around. Yeah.
7:44
Good to be able to actually sit through some of the sessions
7:47
because they look really interesting and yeah, but I do
7:52
think we're going to wind up having quite a Episodes because
7:55
it's too good of an opportunity to connect with all those people
7:59
who are speaking. I guess last but not least,
8:02
we're going to Octane in San Francisco.
8:05
That's the week of November 7th. Again, we're hoping to get our
8:11
podcast on and meet with a bunch of people who are going to be at
8:14
the conference. That'll be my first octane to.
8:17
So it's a little bit different, kind of leading a practice doing
8:21
more of the business development, partnership stuff.
8:24
But I'm enjoying it. I think it's I think it's I
8:25
think it's a cool opportunity. So yeah, it's going to be fun
8:28
and it it's funny you bring up the ability to meet things.
8:31
So today we're going to, I guess, let's just pivot.
8:33
Right. Let's just get right into our
8:34
sort of topic du jour and we let off with the social media
8:38
conversation around accounts and kind of managing access.
8:40
And that's where we're going to talk about.
8:41
For the most part today is managing social media account
8:45
access right, shared accounts or maybe delegate Administration,
8:48
sort of things like that and one of the event.
8:50
And the individual we're going to have on here.
8:51
I was not able to meet at Gartner because you had me
8:53
stuck. In a sweet, sweet, as you like
8:56
to say Jim editing podcast, but you guys are able to connect
8:58
their. I'm hopeful that we'll connect
9:00
that at Octane but he is certainly an individual
9:03
passionate about shared passwords.
9:05
We've got curtain, reading with sir, be welcome to the show
9:07
Curt, thanks for the invite. Happy to be here.
9:10
Yeah, so we have tradition around here the first time,
9:13
anyone joins us for the first time, as we like to find a
9:16
little bit about their identity background or made their infosec
9:20
background. Really kind of find out.
9:22
How did you get into the space? Is something that you chose, or
9:26
did it choose you? That's a great question.
9:28
So I started by career trying to take a CD-ROM server and put it
9:33
on a network. So first, an oval that were
9:36
later, active directory after that I played around with
9:40
Microsoft Exchange and hated backup and recovery at Microsoft
9:45
Exchange. And so the desire to get
9:47
exchange online is really what, you know, migrating to Office
9:53
365. What got me really into
9:55
identity. So, I had to learn a little bit
9:57
about something called active directory Federation services at
10:02
first and later as or active directory premium.
10:05
So that's really what got me more into identity.
10:11
So you're from the Trent, you're From The Trenches I assume were
10:15
using from server. I mean, I got to know more about
10:18
the CD-ROM server late on us. Yeah.
10:21
So back in the day, Day. If you were a Supply Sergeant in
10:26
the military, one of the biggest use cases was you had from the
10:32
defense Logistics agency, National Stock numbers, and
10:37
everything that you ordered from Boots, the sleeping bags or in
10:40
this National staff member catalog, and so military, really
10:44
needed to have a new CD, ROM servers and the supply sergeants
10:49
wanted to start putting them on network.
10:51
So that's what that's what got me into.
10:54
No Val first and, and active directory happen and now your
10:57
with survi. I'll admit I'm not overly
11:00
familiar survey's when we first started to talk about this.
11:02
I was interesting because they thought okay, well here's here's
11:05
potentially something that might solve some problems for some
11:07
folks. I guess we don't want to turn
11:09
this into a commercial for Serbia, but give us the 32nd,
11:12
you know, maybe at most 60 second answer of what is Sir be
11:16
do. So what sir be does is solve the
11:21
challenge of applications that that can integrate with
11:26
corporate single sign-on typically that's because they
11:29
don't support identity standards.
11:31
I'm talking primarily about Samuel and skim and of course
11:37
you know challenges that we end up with is not knowing who has
11:41
access to what you know not having automated on-boarding and
11:45
off-boarding certainly that's a challenge and then who knows in
11:49
those environments it pass for best practices are being being
11:53
followed. So, Kurt the topic for today is
11:56
social media accounts and we all know, there were accusations
12:01
face the challenge of managing social media accounts.
12:04
And I think probably the biggest challenge is that there are
12:08
accessed by more than one person.
12:11
So, what's the right way to manage and secure those?
12:15
Yeah, I think it really depends on the size of your
12:17
organization. If you're a really small
12:21
organization and one or two, Two people are managing those.
12:26
I think that there are some best practices that can be followed.
12:31
Maybe using a password manager, my friend Mac Tod actually has a
12:37
social media checklist of things that you recommend people do.
12:41
So I mean, if you're small, you can absolutely follow those best
12:44
practices manually. If you start to get big and you
12:49
have a big brand or your advertising on social media,
12:54
That's where we invite one is. Start looking at.
12:57
Do you need some type of Automation and Central
13:00
management? Yeah.
13:01
You talk to us and we were getting ready for the podcast.
13:05
You talk to us a little bit about Matt and kind of is social
13:09
media checklist. So we'll make sure that we put
13:13
that link out to that in our in our show notes.
13:17
So people are interested in kind of taking a look, but you also
13:20
kind of talk to me about something that I wasn't really
13:23
aware. Are which is that other
13:25
different types of accounts when you look at this social media
13:29
landscape. So you got the type like
13:32
Twitter, which is essentially like a shared password then
13:35
you've got the Facebook's and login and Linkedin.
13:39
So the world where you've got kind of a corporate account and
13:43
people connect with their, I think it's like their personal
13:46
accounts and somehow are allowed to administer or switch context
13:50
into the corporate account, baby, talk to us a little bit.
13:54
About that. Yeah, they're so you're correct.
13:56
There are two access models that I primary see out there from
14:02
social media. So that's shared password,
14:04
Twitter is absolutely a great example of that.
14:08
And not only do you need to make sure that you understand what's
14:11
going on from the shared password.
14:13
But you know, how are you going to share the mechanisms for
14:17
multi-factor authentication and then with things like Facebook
14:22
and Linkedin, The main concern is, how do I map a personal
14:28
identity back to a corporate identity.
14:33
So that when, you know, Jeff for Jim Lee Morrison, how do we take
14:39
away their access to Facebook, business manager, and one, make
14:44
sure they don't do anything bad. But to take away the risk that
14:47
if their personal account gets hacked, some kind of fraud
14:50
happens with our ad, spend accounts, you've done it.
14:54
Good job. I think of not selling your own
14:57
book of business and I we do appreciate that, but I think
15:00
it's the same time. We do want to talk a little bit
15:03
about the technology solution. So if you are like a midsize to
15:08
a large Enterprise, and you've got maybe a couple of Twitter
15:13
accounts and maybe maybe you're a big Media company or a sports
15:17
league and you've got, you know, a couple of accounts or one main
15:21
account multiple, people have to be hitting it.
15:23
And have the ability to pose to that account, you know, talk to
15:29
me a little bit about what technologies out there to make
15:33
it so that I can manage that in a better way.
15:37
Treat that like the privileged access credentials that I think
15:40
Jeff and I agree that they are. Yeah, so I mean we're on it
15:43
identities. Yo.
15:45
I imagine that the people listening believe that single
15:49
sign-on is probably the best security investment that anybody
15:53
to bake. And so, firstly, my belief is
15:58
all of those applications that are in use on the corporate
16:02
Network even consumer-grade applications like social media
16:06
should be integrated with single sign up, but I think I mentioned
16:09
that the Challenger for why people aren't doing that today
16:13
is lack of Standards support us and would skin.
16:17
I know many big companies have tried to pressure, social media
16:21
companies, and to supporting these things.
16:23
And You know, I hear it's on the road map but I also hear it gets
16:27
delayed. So, how do you solve that
16:31
challenge? There's a couple of bright guys
16:37
that came up with an idea to use robotic process automation, to
16:43
create apis where apis don't exist, and then we're apis, do
16:50
exist to do things, like, rotate passwords.
16:55
Or remove access Etc. Certainly, we want to use those
17:01
apis. But in some cases, the really
17:03
the Big Challenge and why this has never been solved is not
17:08
having an API, and I think the best answer I've ever seen is to
17:14
use robotic process automation, to create those.
17:16
Yeah, that's really cool. It's, I wouldn't say that is the
17:20
answer that first came to mind, I mean, the RPA piece.
17:24
Is makes a lot of sense. So I've kind of also thinking of
17:28
more or less. The traditional I am tool so you
17:30
kind of mentioned single sign-on but we've also got you know
17:34
privileged access management IGA on wondering if like for the I
17:39
am practitioners out there who this isn't the main problem?
17:42
They're trying to solve but it's one of the use cases.
17:45
Can they leverage their investments in Pam SS oiga?
17:50
Or is this like a new problem that requires a new tool or is
17:54
this? It's somewhere in between.
17:56
Yeah, I mean, great question. And so yes, there are some
18:01
customers out there that happened, amusing, sir, be that
18:05
have decided that they don't want surgery, which is a
18:09
cloud-based platform to store the secrets and they want to
18:13
store the secrets someplace else.
18:15
So that could be a Pam solution that could be and 8wi says a
18:20
secret Spanish judgment solution and most People that we have
18:25
talked to, if they do have a Pam solution rolled out.
18:30
They at least go through the thought, process to evaluate,
18:34
should we be using Pam to manage social media?
18:37
But anybody who's actually tried that, they realized that the Pam
18:42
Solutions are missing a bunch of automations that are specific to
18:47
social media. So certainly, that's a
18:49
challenge. And then I don't know if you've
18:52
ever met anybody from marketing, They're not usually the most
18:56
technical so you know although Pam Suresh Solutions are
19:01
incredible for administrators. I don't recommend them for a
19:08
social media person. I think it's kind of almost like
19:10
the lowest common denominator that point if it's probably
19:14
better than nothing but the usability is probably suspect.
19:18
I think at best the way that I kind of think about it as if
19:21
you're using, if you are lucky enough, first of all They have a
19:24
dedicated Pam solution. Then most likely just a simple
19:29
password, vault is probably all you're going to really kind of
19:32
get to be able to get away with to store those credentials.
19:34
It's no different really than, you know, somebody having like a
19:37
shared password wallet like a LastPass or a bit word in or
19:41
anything like that. All you're really doing is kind
19:43
of storing the ID and password, one spot, but you can't really
19:46
do anything with it to head off potential concerns.
19:49
It almost becomes like a race where you know someone has
19:53
access to The social media credentials and they should no
19:57
longer have access to it. You need to beat them to the
20:00
punch to change the passwords and other sort of, you know,
20:03
claiming parameters around the account before, something bad
20:07
happens. So I can kind of see the
20:09
low-tech solution, you know, the lowest Tech is well, it's on a
20:12
sticky note and, you know, you just kind of pass it around the
20:14
office which not good. And then, you know, maybe you
20:17
digitize a sticky note and put it inside of a spreadsheet or,
20:21
you know, maybe in sort of a password Vault or something like
20:22
that. But I do think they are A angle
20:25
is interesting from a proactive measure, especially this idea of
20:29
creating sort of Leverage points, from an API perspective
20:33
to do some security which it's it's what piques my interest
20:37
when I started, you know. It's kind of read up and kind of
20:39
see how this thing works but I'm curious from your perspective,
20:43
you've got to have some you know horror stories around what some
20:47
people might have done with you know, breached or misused
20:52
credentials maybe and the social media.
20:54
World, I certainly have a couple from from prior engagements in
20:59
my life that that I probably am. Not at Liberty to talk about,
21:02
but the risk is real, and I'm curious if there's anything you
21:05
could share from, you know, what are some of those risks around
21:08
getting happy mentioned the reputation.
21:10
But certainly, there's other things that I'm not thinking of
21:13
off Hunter, I mean, Port Disney? They've been hacked.
21:18
I believe twice in the last 12 months.
21:22
One was Twitter, I think an Elon Musk impersonator took over
21:26
their Twitter. The other one was posting, you
21:31
know, racial and homophobic slurs.
21:34
So not that great for the old old image, right?
21:38
That's it. That's a negative one and brand
21:41
risk, you know, it's not easy to quantify exactly.
21:45
But the bigger, the brand, the bigger the risk, right?
21:49
But there are some things that are easy to quantify Fly like
21:53
adspend fraud. So I'll give you the Facebook
21:56
example. We have a customer that bought
22:00
sir be after they had an employee leave.
22:06
That employee still had access to Facebook and other business
22:10
managers either personal accounts that nobody took away
22:13
their access social media was hacked and a hundred million
22:18
dollars was spent frauding early on.
22:21
There's ads been accounts, so that's pretty easy to quantify.
22:26
So, one of the things I typically talk to see says about
22:31
or identity and access management, Professor
22:33
professionals are saying, I don't know if this really should
22:36
be in my domain. I usually say.
22:38
Well, have your GRC team just go ask and say, you know what, your
22:42
daily spend limit on your ad spend credit accounts, right?
22:47
And then I guess thirdly, the scary.
22:51
One that I've seen was a about three months ago, Brazilian
22:56
retailer, fat shop. There was a combination of a
23:00
ransomware attack and then taking over Twitter and
23:05
Publishing new customer data. I think our oblique until they
23:10
paid the ransom so that was a kind of a scary combo attack, I
23:14
guess. So for people who aren't
23:16
familiar, with this ad spend fraud, can you kind of give us
23:20
the 101 on? What that is for people who
23:22
maybe just haven't really had that exposure yet within the
23:25
social media world. Yeah, I mean, the idea of
23:30
marketing via social media, right?
23:32
I mean I think everybody, you know, as seen Brandon fluence
23:35
orders and that type of thing. If you've got kids, right,
23:38
everybody wants to be a YouTube Star, right?
23:41
Or Instagram or whatever, I guess, check out the leads
23:46
Tick-Tock. All right, but the idea of Acts
23:51
And is typically boosting maybe your influencers making, more
23:56
people see it. And so you know you have a
24:01
credit line pretty much like, yeah, I'm a credit card and back
24:05
to be used to promote your stuff or that can be used, you know,
24:10
waste your money. So if let's say my account does
24:13
get breached, what are some of the things that I can do to sort
24:17
of mitigate or I guess reduce You know, what are my next steps
24:22
essentially? I don't know if you have insight
24:24
into sort of like an incident management plan, you know,
24:27
obviously probably want to delete tweets that that that
24:30
probably shouldn't be there. But what are other things that I
24:33
can do sort of or start? Think about to manage that?
24:36
Yeah, I mean hopefully done a tabletop that precise on this
24:40
right? You have a plan in place but
24:43
yes, quickly deleting any of the comments is the best thing.
24:47
But we, we know today that first thing It's do is screenshot
24:53
things and take videos of anything that's up there.
24:56
So if it's, you know, up there for 10 seconds, chances are it's
25:00
replicated on 100 different social channels so that's it -
25:04
and you know if you have a big brand you better have a good PR
25:08
agency crisis management, you ready to reach out to all the
25:13
different news stations with you know an official statement you
25:18
know hopefully you can quickly talk about Out.
25:22
This is how it happened. You know, this is what we're
25:25
doing to be responsible, etc, etc.
25:28
Right. That you know, nobody wants to
25:30
buy from a company that they think.
25:31
Well, they didn't even try and they don't seem to care, right?
25:35
We don't condone blah, blah blah, we're taking steps to
25:38
secure right. I think if you've been in the
25:40
business, you've probably seen a number of these sort of, you
25:43
know, breach emails or what I was going to add to that.
25:46
Also, I think that, you know the Quick reaction might be all we
25:52
just we just need to go out and delete that tweet.
25:55
You know, Kurt I'm kind of wondering what your perspective
25:58
on that is like should you delete the Tweet with this slurs
26:03
or do you leave it there and post an apology or how?
26:08
How do you see that getting handled?
26:10
Yeah, I've never seen anybody leave it there.
26:13
But what I typically have seen is that there are screenshots
26:18
and particles and on the news. So that's Usually your chance to
26:22
comment on what was there but, you know, my personal not a PR
26:27
expert, a security guy but I would say delete it.
26:31
If you can as quickly as possible own it, I guess or the
26:34
other alternative. And I don't know many brands
26:36
that would survive owning control for Content like that.
26:40
One thing that I am always fascinated by is this concept of
26:43
deep, fakes, I love the idea for for the memes that I can
26:47
potentially generate, the animated gifts that I could
26:50
certainly get some Ends with. But I think this is also an area
26:53
where it is starting to sort of invade the internet at large and
26:58
becoming much easier for people to do.
27:00
I'm curious, if you've seen things around that space around
27:03
some of the more advanced maybe types of either attacks or the
27:09
results of some of the attacks were, maybe there's, you know, I
27:12
could think of, like, you know, the Deep fake of a CEO doing
27:15
things. They're not supposed to be
27:15
doing, right? And that gets posted.
27:17
I'm curious if you have any experience with that.
27:19
Well, I haven't actually seen That happened in a corporate
27:22
environment yet. But I am working with a big, New
27:26
York financial institution, and they have social media flagged
27:32
as a risk exception. And there have a goal by the end
27:36
of the year, to eliminate those risk exceptions.
27:39
And, you know, one of the risks that they certainly looked at is
27:43
the management of their CEOs account.
27:46
And if something like that was to be posted a deep bake or
27:49
something else. What they expect the in the
27:52
potential impact that meets their stock.
27:55
And so, you know, in the management of his account alone,
28:01
that's where they see enormous rest to people potentially
28:05
shorting the stock. If something was to happen, sir
28:08
Kirby, kind of, kicked off. And I threw this thought out
28:11
there, which was that social media accounts and third-party
28:15
accounts to Mir, They have a very similar use case and that
28:20
usually there's a small number of accounts, small number of
28:24
users and it's something that it departments traditionally said,
28:29
all right, we've got bigger fish to fry.
28:31
However some of these applications have a lot of risk
28:36
and the sharing of the password can actually multiply the number
28:40
of actual users. But you know, for whatever
28:43
reason, the business is said, we're just going to get one
28:46
account. Maybe it's because As a third
28:48
party vendor only allows you to have one account.
28:51
You know, the typical use case that I think of in this space
28:55
was I've run into it a lot. Myself is an accounting
28:58
department that has access to a bank account.
29:01
So maybe that bank accounts, a well known bank and you can only
29:04
open, you know, one user account to access that bank account and
29:10
so they share the password. Now, obviously I mean the risk
29:14
of that account, seems pretty obvious.
29:18
But because it's like, one account, usually IIT won't
29:21
manage it. I'm wondering, you know, do you
29:24
see this as well? Do you see this falling into
29:27
that same scope and do you have any similar examples?
29:31
Yeah. I mean I think it does Cam you
29:35
seem like the kind of guy that cleans your own carpets that
29:38
maybe maybe once or twice great. So you probably have been into a
29:43
store. I think you said it down the
29:44
South so maybe into a Public sir.
29:49
Yeah, what are the Albertson's Brands to rent a Rug Doctor but
29:55
you probably will be disappointed as an identity,
29:58
professional to find out that most stores.
30:01
Share one, password for The Rug Doctor rectal application,
30:05
amongst the whole store. So, that's how that happens.
30:09
So, that's one example. You also tend to think of, you
30:14
know, federal government, you know, they're pretty secure,
30:17
right? Right.
30:17
You know purveyors of zero trust and you know how do you do zero
30:23
trust will. Hopefully right.
30:25
You know who everybody is like that's like one of the first
30:28
steps and zero trust and what they have access to but you
30:31
might be surprised that some pretty critical financial
30:36
reporting, critical infrastructure reporting,
30:40
there's some shared passwords there and that's really to think
30:45
about is just like do My brain is running wild with all the
30:49
different scenarios. There's probably dozens or
30:52
hundreds of scenarios like this on a large corporation.
30:55
Yeah I mean I know at least 10 corporations that have more than
31:00
1000 of these issues. There's also the apps that kind
31:03
of sirloin so I was mentioning like accounts like bank
31:06
accounts, utilities things like that.
31:09
We know that we started off the conversation, talking about
31:12
social media and then there's kind of these intermediaries
31:15
like marketing Forms where again that risk kind of reaches back
31:21
to, you know, potential reputation risk where hey if
31:27
that's just some got compromised, forget the tweet
31:31
that someone can post and you know all the social media are
31:35
all the traditional media picks up on it, but you can delete
31:39
that what if you send out a million emails?
31:43
What if that person gets on sends out a million emails, full
31:46
of content that Don't want sent out to all of your customers.
31:50
So I think these third party platforms, I think as I am
31:55
practitioners, we need to have a shift in terms of not thinking
32:01
about their importance just in terms of, number of users.
32:05
But really also understanding what is the risk and including
32:09
that kind of reputational risk to to that big picture Jim.
32:13
What about that mailing application?
32:16
That you probably We integrated with your CRM system and so when
32:20
the male spanning system gets packed, it's got access to
32:25
everything in your CRM or maybe a lot in your CRM.
32:29
You know, I think about the cascading rest because all these
32:32
systems typically are great. So so is really the answer, then
32:36
that, you know, in terms of how you should manage this to
32:40
leverage your, I am platforms. Like your single sign-on MFA?
32:46
Your IGA Form or is there more to it than that?
32:50
Yeah, I think I said this before and I'll say it again.
32:54
My personal belief is any application that is in use for
33:01
corporate use. Even if it's a consumer-grade
33:03
application, in my opinion should be integrated with single
33:07
sign-on. That's, that's my very strongly
33:09
as all. I'll hit you with this one.
33:11
Last question. So, where does the buck stop?
33:14
Who's responsible for this? Is it No IIT information
33:18
security or is it the owners of the applications?
33:22
Yeah, it's an interesting question responsible, right?
33:25
I mean I guess right? The application are bears
33:30
responsibility but I guess I'll ask you Jim picked.
33:35
If there is a breach of credentials you typically gets
33:39
fired. Is that the application owner?
33:42
I don't think so. I mean in my experience, it's
33:45
the system so somebody Works for the city.
33:48
So ultimately the board holds them responsible for any type of
33:54
reach. So yeah, I guess, you know, in
33:58
my opinion, yes, you know, does the responsibility?
34:01
Really the application or yes, but I think in terms of who's
34:05
going to get no, no, I think I think that's a point.
34:09
Well, taken as interesting as you were saying that it my mind
34:13
immediately went to well, You know, we have to know that these
34:18
applications are in use there that we have these accounts.
34:21
Some of it though, is kind of obvious, right?
34:24
You should know the right questions to ask.
34:26
Do we have a Twitter? Do we have a Facebook?
34:28
Do we have a LinkedIn? Do we have marketing platforms?
34:32
There are all these things that we need to control, but then you
34:35
mentioned the Rug Doctor utilities and things like that.
34:39
So I know there are some technologies that can help you
34:44
discover what applications. Are being used.
34:47
I think you have to bake it into your policies that you know, if
34:51
there's your, you know, even if they're not it systems that we
34:56
control, but if they are accounts that belong to the
34:59
company that password sharing is prohibited.
35:04
If an exception needs to be granted, here's the exception
35:08
policy that exception policy will make us aware as
35:12
Information Security Professionals that there's this
35:15
Pastor sharing going on. Now it's the balls in our court,
35:19
right? We can either, you know, allow
35:21
the exception because we don't have the resources to address it
35:26
or we can address the Exception by managing that account.
35:31
But I think you're right, the buck stops on like you know, if
35:35
someone goes out to your Twitter account or your sins out,
35:38
there's million emails like who's going to be in trouble?
35:42
Ultimately is probably going to go back to your information
35:44
security lead. I think option A is certainly -
35:48
compensating controls and you can sit down and tell your
35:53
users. What that would look like.
35:55
Or you could say there is an automated way if you prefer we
35:59
can pursue both. I think there's two things that
36:01
really struck me about this last kind of back and forth.
36:03
Was the importance of an inventory of understanding?
36:07
What are all the thing assets that we need to protect?
36:09
And then to what is the role of the I am program or information?
36:16
Ready or whatever. The, you know, the, the, the
36:18
name of the department is that supposed to be in charge of,
36:22
maybe not necessarily securing it, but providing advice to the
36:26
organization and what they should be doing to be that, you
36:29
know, counselor, right to the internal side of things that
36:32
internal consultant that says, hey, you know, we may be, we
36:35
don't own them, the social media accounts.
36:37
But here are the things that you need to be thinking about as the
36:40
owner of those accounts and how you're going to protect the
36:43
company, you know, from a risk standpoint or whatever.
36:46
Maybe so I think, I think both of those things kind of
36:48
fundamentally strike to is what type of information, security
36:52
organization? Or I am program is in place.
36:54
Are you Consulting on it or, you know, are you kind of more
36:58
removed from it? I think that's important.
36:59
Yeah, I think the secure way needs to be the easiest way.
37:05
I think that's the job of Security Professionals share.
37:08
We can educate but people who are trying to make money in a
37:13
business are going to take the top Least resistance.
37:17
So we've got to be creative and make security easy.
37:22
I like that make it make security that the easier thing
37:24
is the better compliance. You'll have that certainly is is
37:27
definitely a winning strategy. Alright, we've wax poetic here
37:30
about sort of the importance of security and now it's time to
37:34
get. As I like to say I've started to
37:36
say is like it's time to get stupid towards the end and sort
37:39
of end on a lighter note and we usually have a couple different
37:42
things. We let our guest kind of choose.
37:46
We might go through a couple here, but here's my lighter note
37:49
for both of you because and I will say that this question
37:52
stems from a conversation that took place on one of my
37:56
favorites. I don't know it's really a radio
37:58
show at this point but that ington and SiriusXM a big fan of
38:02
those of that show and they were talking about the way that
38:07
people put on their socks and shoes.
38:09
And I was surprised to hear that there was that there was more
38:12
than one way to do this and say Here's my question for both of
38:15
you will start with Hurt and they'll go to gym is.
38:17
How do you put your socks and shoes on?
38:19
Is it sock, sock. And then shoo?
38:23
Shoo, or do you do sock shoe? Then the other sock and the
38:27
other shoe. Yeah, definitely both socks
38:30
first and then the shoes, I just feel more accomplished if I get,
38:34
you know, one thing Donald check it off.
38:36
Yeah, I mean I like yourself. I don't think I've ever gone.
38:40
Sock shoes, socks shoes though. I'm with Kurt on that.
38:43
But I will also tell you that I'm Just like everybody else
38:47
above my pants on one leg at a time but after I after my cats
38:52
are on, I make podcasts told my gold podcast, so I'm the same
38:57
way I would say I'm typically a sock sock shoo, shoo, but one of
39:02
the interesting wrinkles that I heard was athletes.
39:06
They tend to do sock shoe, then sock, and then shoe, because
39:11
they need the exact perfect sort of set up for either stability
39:15
or safety. Or just you know maybe it's just
39:17
part of their routine, right? Lock, whatever it may be and it
39:21
seemed to be like that was like the one thing that was kind of
39:23
out. There was if you're an athlete,
39:26
you tend to put your sock and shoe on on one side and then do
39:30
the other one. So I don't know, I guess the
39:34
next time you're putting your socks and shoes on, you're
39:36
probably gonna buy a be self-conscious about it.
39:38
Like what am I doing? Like because I think a lot of
39:40
people are just kind of on autopilot that point.
39:42
All right so that was one. Let's go to another one.
39:45
This is one that I've been trying to get in for the last
39:47
few weeks and this is a situation that is going to occur
39:50
to you for the rest of your life.
39:52
It's going to happen at random times, it may not be severe, it
39:55
might be annoying, but it is something that you can expect
39:59
will occur repeatedly over the rest of your life.
40:03
And that is one of these things is going to happen.
40:04
And you have to choose, you're going to randomly cough,
40:08
randomly, sneeze, or randomly have about of the hiccups Kurt.
40:12
What's your poison? I'm gonna have to go with the
40:16
coughing and maybe this will get a little bit too personal health
40:19
wise, but unfortunately, I already have a little bit of
40:23
that asthma and so that kind of is my life.
40:28
So I'm used to it and I'm still kicking, it's no big.
40:32
Well for you about you. Jim almost had to cancel
40:34
episodes of this podcast due to my hiccuping, right?
40:37
I've been waiting for you to use this question to you.
40:40
Is that one? I would never pick that one.
40:43
I would never. I'd rather, you know, randomly
40:46
faint, then have the hiccups all the time.
40:50
I do not like coughing. I've never enjoyed coughing, but
40:53
sometimes sneezing feels good to me.
40:56
I mean, I don't know, I'm a little weird, but I have what
41:00
they call a photosynthetic sneezing.
41:03
Like if you like, if I look up at the sun.
41:06
Oh yeah, you're like a light. I can make myself.
41:08
See, sometimes I just do it because I feel like sneezing.
41:11
So I choose me And I'm weird. Yeah, hiccups are painful.
41:16
At least they can be I don't know if I would want that.
41:19
I guess I would go with the cough because they feel like
41:20
that's probably something that's more easier to manage for some
41:24
reason. I don't know.
41:26
I mean, none of them sound great.
41:28
It's really not a way that you want to live but yeah, I guess
41:31
I'll go sir free though. So, yes, if they're sneezing.
41:34
I think I can manage it but it reminded me of when I was a kid
41:38
my dad would carry a handkerchief with some
41:41
everywhere and Nobody Does that anymore.
41:44
I don't think but I always thought it was very unsanitary,
41:49
but I think if I sneezed all the time I would probably do that
41:52
because you know, tissues where out but there's handkerchiefs
41:56
you can keep on using. Yeah.
41:59
Yeah Jim. Did you ever see your dad give a
42:02
crying woman, his handkerchief? I've seen that in the movies and
42:06
I've always wondered, why will this woman type?
42:09
Yeah, Steve has really grow some time.
42:11
No, never something I did do that.
42:13
What he would do is lick it. And then like wipe, like dried
42:17
ketchup off my face. If I got done eating a hot dog
42:20
or something, I was like, oh that's stop doing that, you
42:23
know, anyway, that was the trouble from my childhood, all
42:26
right, we don't want to relive that but yeah, I handkerchief
42:29
sounds gross especially if you know, when the last time was
42:31
clean. But yeah.
42:32
Wait at, let's way to end on a positive side, gross,
42:35
unsanitary. Handkerchiefs that's why people
42:37
listen to the identity of the sender.
42:38
Podcast is get that that hard-hitting content right
42:41
there. All right, we're going to wrap
42:43
it. It up for this week, but before
42:44
we go any final thoughts, Kurt that people should be taking
42:47
away from this conversation around, anything that we talked
42:50
about managing social media account, sort of the shared
42:53
account delegate account, type thing, or will they be checking
42:58
out how they're putting their socks and shoes on?
43:00
Yeah, I definitely people should be thinking about the socks and
43:03
shoes thing, but this is an identity podcast.
43:08
So I mean I think You know, we've got to take this
43:11
seriously, you know, we've got responsibilities as
43:15
Professionals for the organizations that work for and
43:20
you know, if there is a solution that I think, you know, we need
43:24
to be evaluating everything that's out there to make things.
43:28
Like I said, make it easy if the easy way since secure way then
43:32
it's going to be secure if you use all the tools in the
43:34
toolbox, General. Your so I did a webinar with
43:38
Mike angle from One Cosmos last week and we talked about
43:44
pastoralists and we talked about, you know, MFA being
43:48
hacked and we talked about what happened with Uber and twilio,
43:52
and today, we talked about a couple of like Disney and some
43:57
organizations. And I think, what I wanted to
44:00
point out was that we're not, you know, beating on those
44:05
companies, right? Nobody's intention is to beat on
44:08
this company's what we are. Doing to do is like what can we
44:12
learn from these situations so that we can be better as I am
44:17
practitioners and how can the industry get better?
44:20
Right. And so it's very unfortunate.
44:22
I think that these things happen to our our colleagues at other
44:26
companies that they're having to deal with this.
44:28
Because, you know, I'm sure they're going through some
44:31
discomfort and take the Uber example.
44:33
I mean, they are, like, they weren't like, flagrantly, like
44:37
not doing their jobs by any means they just have Them to be
44:41
the target of this attack. And I think the same thing with
44:44
like, you know, the others that we talked about, this lot that
44:46
they were asleep at the wheel and even if they were just like,
44:50
it's not when somebody's down like an organization town.
44:54
We don't want to beat on them. We just want to take away.
44:56
What can we learn from it? All right, you Jeff you don't be
44:59
next, I think. Yeah, it's okay to get smarter.
45:02
Also runs these sort of the olds infosec adage, there's two types
45:05
of companies, those that have been breached and those that
45:08
don't know it yet. So, You know, I think those that
45:11
kind of mindset of always making sure that you're playing, you
45:14
know, the appropriate level of Defense to the risk is
45:17
important. But yeah, we'll go ahead and
45:19
leave it there for this week then you can check us out on the
45:22
web where identity the center.com we're on Twitter.
45:25
Ad, idac podcast, I'll have a bunch of Show links as well on
45:29
our brand. New listen page that we rolled
45:31
out a few weeks ago. We joined the 2000s and put
45:33
search on there. All the link to You, Kurt on
45:36
LinkedIn, for people who have questions as long with
45:38
equivalent along with a Link to Sir, be CER be why.com as well
45:44
as that social media link. And of course, you can always
45:46
connect with Jim and I unlinked, and we always love to engage in.
45:49
If you've got ideas for future episodes or topics, you'd like
45:52
to see us cover, hit us up on LinkedIn.
45:54
We're always willing to take that and incorporate that into a
45:57
show in the future with that. We'll go ahead and leave it for
46:01
this week. Appreciate everyone for
46:02
listening, and we'll talk with everyone in the next one.
46:08
Thanks for listening to the identity at the center podcast.
46:11
If you like what you heard, don't forget to subscribe and
46:14
visit us on the web and identity at the center.com.