Latest / Identity at the Center / #397 - RSM & IDAC Present - The Intersection of Resiliency, Recovery, and IAM

Transcript

#397 - RSM & IDAC Present - The Intersection of Resiliency, Recovery, and IAM · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity Center
0:11
Podcast. I am Jeff and I am flying solo
0:13
today. Jim is out on assignment, as we
0:16
say, in the business. So you've got just me, but I've
0:18
got 2 great guests with us joining before I get to that.
0:20
So I say this is the first episode that we're recording
0:22
here in 2026. So if I haven't heard from you,
0:25
happy New Year. We got a lot of different things
0:28
planned for the rest of this year.
0:29
We got some conferences coming up.
0:31
Jim and I are planning and being in Berlin for the EIC conference
0:34
in May. We got Dunaverse in Las Vegas in
0:37
June. I'm sure Authenticate will come
0:39
around in October and then Gartner at the end of the year
0:41
as well. So lots of things coming on.
0:44
We've got discount codes for as many things as you can find.
0:46
So you want to make sure you hit the website idacpodcast.com.
0:49
If you Scroll down, I've got all the latest discount codes there.
0:51
I believe we've got our EIC code up already and I'm working on
0:55
getting Dad Jennifer's one. So if you haven't registered
0:58
already, those are great ways to show support.
1:00
Doesn't cost you anything, just shows that way.
1:01
Hey, we can bring a crowd to these these conferences and have
1:04
a good time. I also want to thank everyone
1:06
who showed up for the Identiverse in DC at the end of
1:09
last year, as well as Gartner. We played our majority games,
1:12
majority rules game show at both of those and had a great time.
1:14
So if you missed it, you should have hung out, man, We had a
1:17
great time. It was a lot of fun.
1:19
And yeah, I'm sure we bring it to future conferences later this
1:22
year as well. So with that, let's go ahead and
1:25
get started. 2026 starts off with a bang.
1:28
This is a series that we started off last year with our
1:31
colleagues here at RSM kind of talking about the intersection
1:34
of cyber security and X or identity and X or Y or whatever
1:39
it may look like. Today we're going to talk about
1:41
the intersection of identity with resilience and recovery.
1:44
And to help me with that conversation, I'm very pleased
1:47
to have a couple of my colleagues here that I've worked
1:49
with at RSM. We've got Rich Servilis, He's a
1:51
director from our Cyber Response group at RSM.
1:55
Welcome to the show, Rich. Thank you.
1:58
So thanks for having me. You know, as as Jeff said here,
2:02
I spend most of my time in the middle of major incidents.
2:04
I help organizations get control of situations like ransomware
2:07
account compromise, business e-mail compromises, cloud
2:10
intrusions and investigations. So really focusing, helping
2:14
their leadership where they need those answers really fast.
2:17
So what this looks like is on the reactive side, I'm
2:19
coordinating work streams. So think of containment, think
2:22
of forensics, remediation, recovery, all those things that
2:25
help businesses make those decisions under pressure.
2:28
So really that's the the core focus of what I'm bringing to
2:30
the table. So I'm going to make a joke and
2:32
I hope you don't take it the wrong way, but you're kind of
2:34
like the person that you probably don't want to be
2:36
talking to because that means typically something has happened
2:39
is. That right, Yeah, yeah,
2:41
absolutely. The majority of the phone calls
2:42
that I get are either on Friday evening or over on the weekends.
2:45
And that's really where nobody wants to talk to me and nobody's
2:48
ever calling me saying, hey, everything's OK It's usually
2:50
there's a fire. Help us put it out.
2:52
Yeah. So let's talk a little bit about
2:54
that background before I introduce our other guest.
2:56
Tell me how normally the question I would ask would be
2:59
how did you get into identity? But I'm going to pivot a little
3:02
bit and say how did you get into cybersecurity?
3:04
Kind of take me through your background here.
3:06
Yeah, no, absolutely. So I, I would say my interest in
3:10
solving problems got me into this, this space.
3:13
I mean, it started a very, very long time ago, I'd say almost
3:17
1015 years ago, you know, started doing the, the core
3:20
elements of incident response. So, you know, E discovery
3:23
litigation got into that space and then worked my way up
3:26
through investigations, essentially started leading a
3:28
team, then from there got more into the leadership space and
3:31
that's really where the firefighting got started.
3:33
So I really got my got my bones getting my hands dirty and now I
3:38
really just bring a lot of air traffic control, making sure
3:41
everyone's happy and making sure that, you know, we are
3:43
successful as a team. So I'm sure we're going to get
3:46
into pretty much all of that. Rich is part of our
3:48
conversation, but let me go introduce our other guest.
3:51
He is Charles John. He is a director of operational
3:53
Resilience here at RSM. Welcome to the show, Chuck.
3:56
Hi, thanks Jeff. I'm really pleased to be here.
3:58
Appreciate it. Good to see you again.
4:00
Rich, I bring to the table as in a supporting role to Rich.
4:07
So I lead RSMS operational resilience team, which we define
4:14
as crisis management, business continuity, the non-technical IT
4:18
disaster recovery programs both in the public and private sector
4:24
where I spend most of my time focusing on Emergency
4:27
Management, crisis management and business continuity.
4:32
So those are collaborative functions with cybersecurity in
4:37
the in the world of preparedness, response and
4:41
recovery. So I kind of joke that you
4:45
probably don't want to be talking to Rich, but Chuck,
4:49
you're the kind of person we should be talking to because
4:51
resiliency should be built into everything we do.
4:53
It seems to me sometimes it might be something that's a
4:55
little bit of an afterthought sometimes and the rush to get to
4:58
get things stood up. But from a basic, you know,
5:01
know, knowledge setting perspective, give us like the
5:04
one-on-one level of what is business continuity and the
5:08
disaster recovery look like an end.
5:10
Where does that resilience come in?
5:11
Sure, sure. So the resilience is going to
5:14
come in on the preparing side, so the the planning side.
5:19
And so really at the top of the the pyramid is crisis
5:23
management, which is all hazards, all events, the
5:28
management and coordination of an entity's response and
5:34
recovery to any disaster event, any crisis event.
5:39
The business continuity portion is all of the planning and and
5:43
activities and strategies that go into maintaining your
5:48
business when there is a disaster.
5:51
Again, that's any disasters that could be a cyber, cyber attack
5:56
that could be a natural, a natural event like a mudslide or
6:02
a hurricane. So the continuity portion is
6:05
really identifying and addressing the the strategies
6:10
and activities, get those put in place so that your critical
6:15
elements of your business can be maintained during and following
6:20
a disaster. So when do you start the
6:23
planning? And I'm sure you're going to say
6:26
like right away, right at the very beginning.
6:27
Always yeah, an organization should never stop planning.
6:32
It is truly the the hallmark of of successful responses and
6:38
recoveries following a crisis event is part of that begins at
6:44
the the planning stage. So in that preparedness part of
6:48
training exercises, building the the plans themselves.
6:53
Communication generally is where events that response fails is
7:00
right out of the gate with communication and having having
7:05
frameworks and plans in place with folks that are trained and
7:10
know how to use them is really paramount to guiding a company
7:14
through a disaster event. So if the best time to start
7:18
planning was yesterday, I'm guessing the second best time is
7:21
today, correct? Correct.
7:23
Absolutely. So let's say I need to set up
7:27
whatever my my plan looks like. If you talk me through just at a
7:31
very high level of like, what does that look like from a
7:33
process standpoint? Like what should I be thinking
7:35
about if I'm listening to this and you know, most people listen
7:38
this are going to be identity security type people, but they
7:41
are running systems that are really securing the entire
7:43
organization because, you know, identity is such a, you know,
7:47
central part of security apparatus these days.
7:50
Talk to me about how I would go about setting up that plan.
7:53
What are the things that I should be thinking about?
7:55
Sure. I mean you're talking to a kind
7:57
of someone who spent his career in emergency response.
8:00
So safety and security is first. So we're on the physical side of
8:04
safety and security, you know, with with the workforce today
8:07
being very mobile access. So I know we're talking about
8:12
identity access here. I'm talking about access to
8:16
whatever it is that you use. So access to the Internet for
8:20
one. We have a a ton of third party
8:22
products. How do you access those products
8:25
to do your job? And so then the part of that on
8:31
the planning side is figuring out what those are, what are the
8:35
most important ones? Because not everything is
8:38
critical every moment of every day.
8:40
And what can we live with, what can we live without for a
8:45
specific time frame and the critical number of people needed
8:50
to perform their job in an in an event.
8:55
And what often goes overlooked and disasters, especially in the
9:01
the planning side here is everybody assumes information
9:06
technology is going to be fully staffed and that the the people
9:11
are always available to do what's needed for any
9:15
organization. And so that part often is
9:18
overlooked as part of the planning that what happens if
9:22
the IT or the information security team is 10%
9:28
unavailable, 15% are unavailable, 20% unavailable.
9:32
That poses a huge problem on on the planning side.
9:38
Yeah, I mean, I, you know, what if something happens, right?
9:41
What if a hurricane hits Asheville, NC, and you don't
9:44
have water or power for after two months?
9:47
Not that that happened, you know, to me last year.
9:49
You made it fine. That's fine.
9:50
But those are real scenarios. These things happen.
9:52
Correct. Yeah, and they have to be
9:54
planned for. So I'm curious, how did you get
9:57
into this space of like this discontinuity?
9:59
I asked Rich about his background and sort of how you
10:01
got into cyber security. But how did you get into this,
10:04
this world of continuity and disaster recovery and finding
10:08
and all that stuff? So I got into the actual
10:12
industry just a little bit after 911.
10:15
I joined one of the Department of Energy national laboratories
10:20
and my introduction was into Emergency Management and public
10:24
health preparedness. My, my background and, and
10:27
academic training is generally in public health preparedness
10:31
and response. And so I started out there 20
10:36
plus years ago. And then as response and
10:41
preparedness and exercises and training became more to the
10:45
forefront, while the first responder agencies and, and
10:49
partners have been doing it for years and years, it was
10:53
something that seemed to come more to light in the private
10:56
sector. And as as these disciplines in
11:02
these programs around crisis management and business
11:05
continuity and cyber all all started to show that they needed
11:12
to be collaborating with one another and that they were
11:14
mutually supportive programs and should not be done in isolation
11:19
to one another. That's what eventually led me
11:22
into cyber to to partner with my my colleagues in in the cyber
11:28
practice here. What is the thing that that the
11:32
I guess the most transferable skill taken from your prior days
11:36
to cyber side of things? That's a good question.
11:40
I would say the, the actually the ability to, to lead and
11:46
collaborate across multiple disciplines to, to talk again
11:52
that that communication aspect of, of the planning and to
11:58
understand how each discipline and then and in this case each
12:05
department has dependencies upon one another in some shape or
12:10
form. And I, I would say that was
12:13
probably the most transferable of the skills is to communicate
12:19
strongly and to be able to listen to find the collaborative
12:25
space that is most definitely necessary.
12:29
All right, so here's a question for both of you and you know,
12:31
Chuck, I'll start with you and then Rich, if you want to fill
12:34
in the cracks or things that that we don't get to, what is
12:38
the impact of an incident on a business?
12:41
Now I know that sounds very basic, right?
12:43
It's like, what do you mean? What's the impact?
12:44
But, you know, I think most people will think around, you
12:47
know, downtime, you know, loss of money or revenue, right, or
12:50
things like that. But yeah, are there other things
12:53
beyond sort of like what the note does are around an impact
12:58
for for the incident? Yeah, sure.
13:00
And, and in the continuity space, you know, if we always
13:04
again, I lead with safety and security is going to be at top
13:09
of mind once that is is confirmed.
13:13
And if we don't go to what makes money within a company brand
13:18
reputation is, is certainly something that is extremely
13:21
important, especially for cyber events and what could or
13:26
couldn't be said or released or divulged from a breach.
13:32
So we have a lot of focus discussions on protecting brand,
13:38
protecting reputation and that goes for clients across all
13:42
industries, some who have a lot of reporting that have to be
13:46
done as part of their critical work.
13:49
Missing deadlines, missing board reports or public filings
13:54
carries penalties with it, which again goes back to to financial
14:00
ramifications to disaster events.
14:02
So you know, not being able to pay your people systems are are
14:08
offline for again, whatever the reason I'm paying people paying
14:13
your vendors are generally in the top three or four things
14:17
that that must be maintained following a disaster event.
14:22
I can imagine not paying people or vendors could create its own
14:25
incident. Sort of that sort of causes a
14:27
problem. Rich about your perspective.
14:31
Well, you know, I would say that Chuck did a great job of
14:34
covering all the things that I was about to talk about.
14:36
So at the end of the day, I would say, you know, when I
14:38
think of the business impact, it's definitely bigger than what
14:41
people expect because it's not just a security issue, it
14:43
becomes a people. So to the paying them, you know,
14:46
that type of element, the processes that that are in place
14:49
in operational issues and it becomes that very, very fast.
14:52
You know, e-mail goes down, single sign on breaks, financial
14:55
elements get impacted, legal gets involved and then the brand
14:58
damage. That is definitely a a topic of
15:00
discussion during those fire, those fires that my team and I
15:03
are are putting out. And I would say, you know, you
15:06
know, I think outside of the elements that Chuck covered,
15:08
what I am seeing trend wise is definitely class action
15:11
lawsuits. When we see these ransomware and
15:13
these cyber events, you know, it's usually a double extortion
15:16
type of a situation where a bad actor would come in, they'd
15:20
operationally impact the environment by doing a rent like
15:23
a encryption event. But prior to the that, there's
15:26
usually a data exfiltration event.
15:27
And that's what causes some of that brand damage and some of
15:30
those challenges with a breach of, you know, obviously
15:33
potentially, you know, PII health information, those types
15:37
of sensitive, sensitive pieces. And what we are seeing at the
15:40
tail end of these events after the fires all put out is a nice
15:44
and a nice letter and a nice class action.
15:46
And then that's usually a conversation that myself and
15:48
some of the other breach coaches have to have with some of our
15:50
clients and these victims. And, and to stress that
15:53
collaborative part, Jeff, is while all of the activities that
15:57
Rich just discussed, the rest of the business is impacted because
16:04
their work has done something to interrupt the, the I was going
16:08
to say the word normal. Nobody has normal operations,
16:11
daily operations of, of the business.
16:14
And that's what the continuity has to, to plan to deal with is
16:19
there's something that that is going to be impacted that is
16:22
going to change and be removed or or is in downtime.
16:27
The rest of the business still has to operate and this is where
16:32
the collaborative nature between business continuity, business
16:36
continuity and cybersecurity really lies is and that's the
16:41
very heart of of the collaboration between the two
16:43
programs. So if I'm building out a plan
16:47
for recovery, whether it's Dr. or IR or whatever you want to
16:51
call it, right, disaster, instant response, what are the
16:54
like 3 to 5 things that every plan needs to have?
16:59
So if I don't have 1 today and I just need to get something bare
17:02
bones, at least to say, hey, we've started something and we
17:04
continue to iterate on it Like one of those, you know, couple
17:08
of things, whether it's three or five, I just kind of pull those
17:10
out of the air. But like, what do you think,
17:11
Chuck? Everything should you know,
17:13
every plan should have. Yep, every plan needs to have
17:18
some strategy, some alternate way to communicate across your
17:23
team. You have to have a clear
17:25
decision maker and a group of decision makers, usually the
17:30
leaders places, call them crisis management teams, incident
17:33
management teams and those that's a collection of
17:38
individuals generally representing the major parts of
17:40
the company of which cyber, the head of IT would be included in
17:45
that group. You have to have a plan to
17:49
identify what's most critical, how do we keep it going, plans
17:53
to address technological fail, failures and how to recover
17:57
them, and then Rich on the cyber side.
18:01
I, I would say Chuck's number, but for, but in all seriousness,
18:06
I would say, you know, really to, to, to piggyback off what he
18:09
had shared. You know, I would say a lot of
18:11
the, the, the clients that I work with and the plans that we
18:14
kind of work through during these incidents, you know, have
18:16
those commonalities to what Chuck had just shared.
18:18
You know, a, a, a escalation tree, a escalation path, contact
18:22
numbers, you know, a lot of these compromises coincide with
18:27
a lack of trust in your own Microsoft 365 environment.
18:30
So out of bank communication. How do you approach that in
18:33
contact numbers are a big piece as well as escalation points,
18:36
You know, hey, what's that number for cyber insurance to,
18:38
to call to start some of the processes rolling?
18:40
So those are, those are big pieces.
18:43
And I would say part of that, which I would say is also
18:46
important is that severity, that level and matrix, you know, what
18:49
to do during kind of the onset of an incident.
18:53
You know, if it's a, you know, severity level 5 at the lower
18:55
end, you know, all the way up to A1 where you know, you call up
18:58
all the troops to come and bring them in.
19:00
So just some some good strategies around, you know, the
19:03
how to handle the incident, how to handle that business
19:05
continuity, how to handle the communications especially out of
19:08
band and then how to impact, you know the those decisions across
19:12
the board. So I was going to ask you later
19:15
how you guys define like an incident, but maybe it's a good
19:17
time for me to pull that question forward.
19:19
And Rich, let me stay with you for a second there.
19:21
You talked about severity, you know, 5 or one, It could be
19:24
really anything, right? As long as there's sort of like
19:26
a matrix that explains what that is.
19:28
What is an incident and how do you define severity?
19:33
Because is there a standard way to do it or is that really
19:35
organization specific? I I would say it's, it's
19:39
organizational and industry specific.
19:41
You know, in like healthcare, you know, there's obviously like
19:43
the human, you know, life safety impacts manufacturing, there's
19:47
operational downtime. So you know, it could vary from
19:50
from business to business and industry to industry.
19:53
So to that end, there's no one-size-fits-all.
19:55
But I would say that you would make a kind of severity matrix
19:59
based upon some of those key factors and how it overall
20:02
impacts your business. Operationally or from a life
20:06
safety perspective and also financially.
20:09
So usually kind of using a plethora of those types of data
20:13
points, you can kind of rank these these incidents to a
20:18
certain kind of degree and then bring in the right the right
20:21
team and the right support accordingly.
20:24
So Chuck, when you're thinking about what Rich just said in the
20:27
severity, do you need that information to help inform what
20:30
ADR plan looks like? Like what's the chicken and egg
20:33
scenario say, OK, well here's what we need to plan for versus
20:36
what's more important than something else, like from that
20:38
severity level? Yeah, sure.
20:39
Good question. And yeah, I totally agree with
20:42
with with how rich categorized that.
20:45
I think an incident depends on the company.
20:49
I mean they, the severity is going to depend on how they view
20:55
something to be incredibly negatively impacting their,
21:00
their daily operations. What I would say is that's the
21:06
the purpose and the function of an enterprise risk program so
21:10
that an organization can gauge, estimate, assess their risks
21:18
across the their, their company and then they can begin to
21:22
prioritize the most important in which then you can plan against
21:27
the those those risks. Now there's a little bit of a
21:30
difference in in the discussion of risk in terms of the
21:34
enterprise risk versus risk on an emergency, Emergency
21:41
Management or emergency response.
21:44
Those risks might be a little bit different on their impacts
21:48
to an organization. So let me play some word
21:53
association or gut, gut check, gut feeling and rich, let me
21:57
start with you. There is this phrase out there
21:59
that Identity is the new pre-order, which I'll be honest,
22:02
I hate. Shocking.
22:04
This is the Identity Center podcast.
22:05
Why do you hate Identity as a new perimeter?
22:07
Because it's not a new perimeter.
22:09
It's been around forever. It's just people are starting to
22:10
pay attention to it now. So I'm curious, did I, did I
22:13
just, you know, taint the jury with my thought process on
22:16
there? Or like when you hear Identity
22:18
as a new perimeter, like what do you think?
22:20
Well, I I would say from what I do get to see is that in real
22:23
incidents, it's it is often the first thing that gets
22:26
challenged. So and it's also, you know, it's
22:28
the first thing that comes a problem and it's also the the
22:30
last thing that you might want to be able to trust it again.
22:33
So I can kind of understand, you know, how people can say, yeah,
22:36
I mean, maybe that's kind of repeated too constantly.
22:38
But really from an incident command perspective during these
22:40
ransomware and these types of events, you know, it's, it's
22:43
100% accurate. When I think of the perimeter,
22:46
you know, it used to be just network in versus out.
22:49
Now it's, you know, who authenticated they did, what
22:51
were they allowed to do? And can we really trust that
22:53
level of access? So I don't feel at this point
22:56
it's just a security layer anymore.
22:58
It's more of that operational dependencies.
23:00
So when, when I see if that the identity side of your systems
23:03
are impacted, you can't like you don't just lose security, you're
23:07
you're also going to be losing that ability to function.
23:11
So to me, that's kind of how I would kind of characterize that
23:13
as that almost a blast radius kind of multiplier for when an
23:17
event does happen. Thinking about it from identity
23:21
and governance, you know, making sure that, you know, if that is
23:24
tight, then when an incident does happen, it's going to be
23:27
that much more containable. But when you look it on the flip
23:30
side of identity is messy, is is in a messy state that privilege
23:34
sprawl, those stale accounts as we controls those nightmare
23:37
conversations that I'm having with some of the victims, then
23:41
that response effort really becomes more blunt force instead
23:44
of more of a scalpel and more prescriptive.
23:46
It's going to be exceedingly more destructive.
23:49
Let me ask you, Chuck, the same question.
23:51
Identity is a new perimeter. Are you seeing identity come up
23:55
more in ER planning, IR planning in search of that continuity or
24:00
is it still kind of, hey, we got to make sure our firewalls are
24:03
up and that AD is working right, things like that?
24:05
Yeah, it it so my immediate, my immediate reaction.
24:09
And the first question that comes to mind is what don't I
24:13
have that that's what what's offline now?
24:17
Who needs to be in the room to talk?
24:20
What's our risk assessment? And we go from there, we'll
24:24
adjust based on the answers to all those things.
24:26
That's what I when I hear that, I just think there's a breach
24:31
and something is going to get taken offline.
24:35
Who do I call to find out what that is?
24:38
And then we need to get together and talk.
24:41
That's that's literally what I and I would treat that the same
24:45
for any any event. Something's broken.
24:50
Let's fix it. Yep, something's broken.
24:52
We have to talk to figure out what's broken, and then how do
24:56
we fix it? Yep.
24:57
OK, All right, here's another one.
24:59
Richard, back to you. Hackers don't break in.
25:02
They've login. What do you think of that?
25:05
Well, I, I would say that that's, that equates to what we
25:10
do see in some capacity. What I would say is that, you
25:14
know, they're not necessarily breaking things.
25:16
They're, they're using either, you know, easy creds or blending
25:20
into that normal activity. So I'd say that when I think of
25:23
that line, it's, it's probably a good summary of some of the
25:26
modern response that we get that we get to see.
25:29
So when we do see what that like from blogs and like that type of
25:33
analysis that my team does, that activity looks like a real user
25:37
is going to be a real device, a real session, real session and
25:40
some of those normal patterns of, of users.
25:43
So that inherently makes that detection harder and harder to
25:46
ascertain. And when I do look at the
25:49
response, a majority of what we're after is that identity
25:53
telemetry than your traditional, you know, virus hunting, which,
25:56
you know, we still do, you know, we're leveraging our EDR and our
25:59
tools to accomplish, you know, looking for those indicators of
26:02
compromise. But really a lot of the
26:05
questions that change instead of did we block that malware or
26:08
some of those executables? It's really kind of aligned to,
26:11
you know, can we trust this identity plan right now?
26:15
Because I, I would say, you know, more often than not, if
26:17
you can't trust the identity, you know, that's really where
26:21
everything else becomes uncertain.
26:22
Like how do we know that we can safely turn up some of the
26:24
systems? How do we know that these
26:26
backups are going to be OK? These administrator tools, are
26:28
they being used for good or are they being, or are they the
26:31
threat actor living off the land?
26:33
There's SAS applications, cloud consoles, all of that.
26:37
So overall, I'd say that's really kind of where the
26:40
attackers best disguise is what you have in your own
26:42
environment. That's how they're getting in
26:43
and how they're staying active. Well, let's talk about someone
26:47
has gotten in. Can you take me through Rich,
26:49
like the first couple of hours of what do you discover?
26:53
You know what's kind of typical? If there even is a typical like,
26:57
take me to the first few hours of oh crap, something's
27:00
happening and we've got to figure it out.
27:02
Well, in, in my, in my world, it's usually late night, like I
27:06
said on Friday evening. And that's where we get that
27:08
phone call and you know, it's really focused on the scoping
27:10
call and that's, I mean they. Didn't reschedule the break in
27:13
with you. I mean, it's rude.
27:16
Yeah, well, you know, on the, on the bright side, hopefully you
27:18
know, some of the, the victims, they, they do this right, those
27:21
good next steps. And you know, they don't, they
27:23
don't notice something on a Monday and they call me on a
27:25
Friday, which has happened in the past.
27:27
And that's never, that makes it a lot more harder.
27:29
But you know, eventually this, the, the event makes its way to
27:32
my, to my desk and my team. We hop onto a scoping call and
27:35
we, we learn about the incident from the, from the, from the
27:38
client and the victim. But when it comes to, you know,
27:41
the first parts of, of incident, really, you know, it's, it's
27:44
really focused on containment actions or that loss of that
27:47
identity trust, not necessarily in the malware itself.
27:50
So we're working to shut down that access.
27:53
We're stopping that spread. So isolation of the network.
27:56
We're, you know, killing VPN, we're killing site to site
27:59
connections. We're looking at trying to
28:01
disable accounts. We're working to do password
28:04
resets for administrator accounts, you know, again, to
28:07
reinforce isolating systems that are business critical.
28:09
That's a big piece for us. You know, a lot of the
28:12
operations that are ongoing, those end up getting paused
28:15
because you know, the the client and their leadership, we don't
28:18
know it's safe is at that point. And that's really that common
28:21
thread is identity. Once we suspect that there's a
28:23
compromise, we have to take very disruptive actions in very
28:26
quickly. So stopping the bleed is what we
28:28
call it and that coincides with, you know, the core reality,
28:32
which is, you know, we're going to have self-inflicted downtime,
28:35
but it's really necessary until we regain that confidence
28:39
because if we feel at that point the attacker has that privileged
28:41
access, we can't leave things as running around as normal.
28:45
So, you know, that's really where again, to reinforce that
28:48
strong identity governance, it allows us to react more
28:50
surgically opposed to, you know, pull the plug in, you know,
28:54
start working backwards that way.
28:57
But outside of that, you know, post containment, you know,
28:59
we're looking to make sure that the, the victim and the, the the
29:03
client has a good EDR solution. So, you know, leveraging, you
29:07
know, some of our tools on that front and then doing that, the
29:10
monitoring to make sure that, you know, we're picking it up,
29:13
running our triages. And that cadence really focuses
29:16
on communication. So, you know, as Chuck mentioned
29:18
earlier, communication's key, you know, out of band, we're
29:21
spinning up our own e-mail address or the client's spinning
29:24
up new e-mail addresses. We're working out a band and
29:26
moving things forward in a very tactical way.
29:29
So a lot of a lot of conversations, a lot of a lot of
29:32
actions, but very tactical. A ransomware and I guess maybe a
29:37
business CEO cop, our eyes are just social engineering in
29:39
general. Are those still sort of like the
29:41
top ways that people are getting hit?
29:43
Or is there something else that people should be thinking about
29:45
too? And and I guess it wouldn't be
29:47
an episode of I think the center without talking about AI is how
29:50
is AI impacting maybe some of those things?
29:53
Sure, so there's there's a bit to unpack there, but you know,
29:57
just to kind of talk about how the bad actors are getting in is
30:00
through, you know, a a lot of different means.
30:02
And to your point about, you know, phishing emails,
30:05
credential compromise, that's obviously 11 approach that the
30:08
bad actors will take. And a lot of that coincides with
30:11
artificial intelligence and that elevating the reality of, you
30:15
know, how human some of these conversations are getting to get
30:19
people to, you know, click the link or establish a, a remote
30:22
share session. So that definitely does happen.
30:25
But on the other hand, you know, some of those core competencies
30:27
from good patch management to making sure some of your, your
30:31
externally facing infrastructure is well patched.
30:34
A lot of the pieces that we've seen were through
30:36
vulnerabilities and through approaches, through firewall.
30:39
So not to name too many names from a manufacturer's
30:41
standpoint, we do see that as a, as a nice, a nice opportunity
30:46
for bad actors to get into the infrastructure for some of our
30:49
clients and some of the victims. And it's pretty, pretty
30:52
straightforward where they walk in the door that dwell time
30:55
isn't your traditional, you know, 10-15 days of bad after
30:59
activity. You know, they are very precise
31:01
and very scripted on what they do.
31:03
So it's very interesting to see how some of the dynamic has
31:05
changed to get a, a double extortion situation done super
31:10
fast. And that's what we are seeing I.
31:12
Don't know if it'll come through when I added this together, but
31:15
it was like great timing to hear like sirens going off in the
31:17
background, you know, when we're talking about how people are
31:20
getting breached and like what is the things?
31:22
That was a great timing. Like Rich, if you plan that,
31:24
that was awesome. Oh, you.
31:27
Thanks. Chicago for that one.
31:30
Chuck, when you hear about some of these things that Rich has
31:32
been talking about, how much does input like that feed into,
31:36
hey, we need to either revise or update our Dr. or incident
31:40
response plan or whatever that looks like from a content
31:43
interview standpoint to say, OK, nothing's perfect, right?
31:45
There's always an opportunity to get better, faster, stronger,
31:48
smarter. How often should you take inputs
31:50
like that? Say, hey, as much as we tried to
31:53
plan for everything, here's this other thing that we need to
31:55
start thinking about. Let's get that included now for
31:57
next time. Sure, any any real event that
32:01
has just happened, there should be some level of debrief.
32:05
You know, common terms are you know, lessons learned or after
32:09
action debriefing. And from there all plans should
32:13
be updated based on what was said in the experiences.
32:18
The plan should be kind of front and center to identify those
32:22
those opportunities to improve those plans.
32:25
And and one of the real key parts of this is to assign, you
32:33
know, first of all realistic time frames to updating them.
32:37
And then you need an owner, so a stuckey if you will, to to do
32:42
the work. But that has to be done.
32:45
It's of course, again, best practice.
32:47
If any program ever gets audited, the auditors will be
32:51
looking for revisions, update schedules, real events, and then
32:57
this post event reporting as part of the preparedness, the
33:01
planning stages, a lot of that can be templatized and you know,
33:06
having an after action form that's readily accessible.
33:11
And frankly, some of those forms, you know, that that
33:16
document the proceedings, the high level decision making
33:20
that's been done. That should all be occurring
33:23
live during these command level discussions on when decisions
33:27
were made and by whom and the specifics that go into them and
33:31
the rationale to support when Rich's team is activated and
33:35
they respond. There's a lot of data associated
33:40
with their response and that should be documented because all
33:43
of that goes in to the post. Post event.
33:46
Report and I would imagine I mean rich and team deal with the
33:51
insurance companies, I would imagine they want that
33:53
information as part of their their triage and their efforts
33:59
associated with the policies. And so just across the board
34:03
that that's all good, you know, practice, best practice as part
34:08
of any real event. So that's after things are done.
34:12
And, and these, these briefings should be held very quickly,
34:16
even though people are exhausted, you tend to forget.
34:19
And so I mean hours today, like a day or two is, is the best
34:26
time to have a discussion about it.
34:29
But emotions and nerves are still wrong.
34:34
So you sparked a question in my head.
34:35
You mentioned, you know, compliance and legal and
34:38
insurance and things like that to go on to that, like cyber
34:40
insurance. Are you guys seeing any benefits
34:44
to an organization that has like strong Dr. plans with like a
34:48
reduction in cyber insurance rates or things along those
34:51
lines to say, hey, if we do get hit, here is how we are able to
34:55
minimize, you know the blast radius of something that might
34:58
go wrong. And whoever wants to jump in
35:00
first, you know, feel free to have at it if there, if there is
35:03
in fact a reduction there. Yeah, I I would say that that's
35:06
definitely a conversation that, you know, clients and and
35:10
entities should definitely have with their, their, their broker
35:13
and their insurance providers just as kind of see what options
35:15
that are out there to, to really lower some of those those costs.
35:19
But overall, I would say that, you know, from a perspective of,
35:24
of those being almost requirements now to have a good
35:27
EDR, to have incident response plan, to have a tabletop test to
35:31
validate your IR plan. You know, those are starting to
35:34
become kind of more, you know, not nice to house, but more of
35:38
those, you know, you should be having these things as part of,
35:41
you know, you getting insurance. So a lot of those you know, I
35:44
would, I would expect to get really factored in and
35:46
definitely should be part of those conversations.
35:50
Do you see anything with, you know, cyber insurance rates
35:54
with, you know, Dr. planning and instant response where there's a
35:57
badge there? No, no, no, that would be much
35:59
more Rich's Rich's lane. But what we what we do see is
36:03
that they're being gaps in the planning around their cyber
36:07
insurance and and the details around that.
36:10
And so again, that that takes on the planning sides in
36:14
collaboration with legal to understand the terms of the
36:18
policies because that most certainly affects the crisis
36:23
management plan, it affects the Dr. plan, the BC plan and the
36:28
cyber IR plan. All those plans are impacted by
36:32
the details that are in those insurance policies.
36:36
What's an example of a gap that you know that you can share with
36:39
other people, Say, hey, this is something to think about?
36:41
Sure, Rich. And I actually just came across
36:44
this right before the the holiday season and we're coming
36:48
across it more and more and exercises is really where it
36:51
shows itself and that's in the response time.
36:56
And so folks just assume that you know in their insurance that
37:03
it that it may say within I don't know, it's within 12 hours
37:08
and completely hypothetical situation.
37:10
However there are subtleties around the 12 hours you see that
37:15
also in the SL As for your SAS products too, is when does the
37:20
clock start ticking on the 12 hours?
37:22
Is it when the event happens? Is it when the event is
37:27
documented? Is it when the event is
37:30
reported? Is a reported out to the, let's
37:35
say the, the insurance company, the many of their agreements
37:40
have those details in there. And they vastly can affect on
37:46
the continuity side, the, the activities that are developed to
37:50
handle downtime and workarounds. Because 12 hours may mean 12
37:55
hours from which let's say the, the SAS provider responds to
38:01
you. Well, that could be 36 hours
38:05
after the event happened. And they, you know, it's when
38:10
their clock starts ticking on the response, not yours.
38:13
And so now you are a day and 1/2 or two days into an event and
38:20
you're waiting. And and the, the legal term of
38:23
what's in those agreements has dictated some of your response
38:28
and your, your activities and will impact your recovery for
38:31
sure. And I would just kind of add
38:35
into that a lot of that is avoidable.
38:37
Yes, I mean, knowing your contracts, that's right.
38:39
Knowing kind of the the the vendors and some of those key
38:42
dependencies that you do have. So that way you can build that
38:46
into your incident response plan and kind of focus some of those
38:48
efforts ahead of time. So that way you can be a little
38:51
bit more diligent and deliberate about kind of, hey, this
38:54
happens, you know, I need to contact this person immediately
38:57
along along these lines to ensure that the operational
39:01
impact will be as minimal as possible.
39:02
Because otherwise you're going to be sitting there waiting for
39:05
some of those responses, and they're not contractually
39:07
obligated to help you until you know within that SLA.
39:11
Yeah, that's an excellent point. Like it's a you have a
39:13
self-inflicted negative consequence and it's all because
39:17
you just, it's awareness. Well, those are the worst ones
39:20
to inflict. And this leads you to the
39:22
question of like, who's responsible for this?
39:24
Like understanding what those metrics are for responsibility
39:29
and response times and all that stuff.
39:31
Is there? Is that the CSO, is it some
39:34
other part of the organization? Like who is responsible to say,
39:37
OK, here's how we're going to do this?
39:41
So I think I'm not trying to, I mean that that almost gets into
39:44
that finger pointing piece, but it should be a collaborative
39:46
effort where it's a it's a shared sense of ownership for
39:49
the business. I mean, you, you could probably
39:52
want to kind of build that into a racy sort of matrix to
39:55
understand, you know, what that really looks like to be that
39:57
much more effective on how that really, you know, coincides with
40:01
good contract review policies, you know, for critical vendors,
40:04
how to approach the strategy surrounding those Slas and what
40:07
those expectations are. And ultimately, how do you kind
40:10
of enforce those and kind of build those into your, you know,
40:12
renewals and so on so forth. So, so I think kind of that's a
40:16
area that is a shared responsibility that the
40:18
business, you know, should really kind of take on together
40:22
as a as a group. Absolutely agreed.
40:25
Yeah, absolutely agreed. So my last question before we
40:30
start to wrap things up is we like to make this valuable for
40:33
people and hopefully people will find a conversation about I know
40:35
I have this is not an area that I'm an expert in.
40:36
And so I rely on expertise from, from people like you.
40:40
What is something that if I'm an identity professional somewhere
40:44
out there in the world, right, could be I'm a sale point
40:46
administrator, I'm a ping administrator, I'm a cyber ark,
40:49
I'm a *** products, right? Or maybe I'm an architect or
40:53
APM. What, how does their role come
40:56
into this world of recovery response and planning?
41:00
Like what's something that you could say, hey, identity people,
41:03
here's what you should be thinking about.
41:05
And I don't know, Chuck, maybe I'll start with you.
41:07
And then Rich, what? You have the final word on it?
41:09
Yeah, that and, and that's actually a pretty hard question
41:13
to answer on the business side. And I sort of touched on it at
41:18
the beginning and I think it goes back to staffing and
41:23
availability and support. And, but what do I mean by that?
41:27
I, I think the, the identity professionals and in leadership
41:32
especially have to have some level of succession planning.
41:36
If they're unavailable for whatever the reason, it, it
41:39
doesn't matter. And if they are unavailable, 10
41:44
percent, 20% staff, 30% staff, 40% staff, which are not
41:50
unreasonable. You know, four sets of
41:53
percentages. What will be like, how will the
41:57
organization respond to an event that involves them and where
42:03
will support come from if it's needed?
42:05
How can it be emerging like procured and an emergency
42:11
environment And most places have protocols and procedures around
42:17
just staffing support and it's not one phone call and knowing
42:24
how to get that because as I said in the beginning, everyone
42:28
assumes the technology professionals are available 100%
42:33
around the clock all of the time.
42:36
Nobody plans if they're not and and so from my end of the of the
42:42
of the operational resilience paradigm, that would be my
42:46
concern right out of the gate. Yeah, that availability is, is,
42:51
is something to be aware of. I remember.
42:53
And Rich, I'm not sure if you remember this one from way back
42:55
to Chicago. I think there was a Blizzard
42:56
like 2010 or 2012. Yes, 2019.
43:00
Actually I just used it. I just used it in a scenario for
43:03
an exercise last week. So this was like even before
43:06
that because I was working at Walgreens at the time and we got
43:09
like 6 feet of snow, like literally 6 feet of snow in the
43:12
northwest suburbs. And I remember having a
43:14
Bluetooth earbud in one trying to reset people's passwords
43:18
because the VPN was crashing because too many people were
43:21
trying to log in, you know, while I'm out in the driveway
43:23
trying to like, you know, unearth the snow out.
43:27
So that available is certainly a concern is something to be
43:30
thinking about. Rich, for all the identity
43:33
people listening out there, like what's your plea to them to
43:35
help? You.
43:37
You know, recover from. Incidents, well, just to think
43:41
through it, I would say from a identity practitioner
43:43
standpoint, it's those actions prior to an incident that are
43:47
going to be critical because, you know, during those
43:49
incidents, that's, you know, where they have the opportunity
43:52
to take those proactive actions and essentially, like I
43:54
mentioned earlier, reduce that blast radius and really speed up
43:57
that recovery. So really helping elevate the
44:00
ability to, to make kind of those, those actions controlled,
44:03
visible and, and really recoverable.
44:05
But thinking about what you just asked me how to prepare and how
44:10
to kind of react through it when I think of before.
44:13
So think about maybe reducing some of that standing privilege.
44:16
So Pam, you know, just in time access, thinking about
44:19
strengthening MFA for privileged users and along the VPN.
44:23
Those are things that are usually part of the root cause
44:26
analysis that, you know, my team is able to ascertain as a result
44:29
of our investigation. Conditional access is a big one.
44:32
Risky signing controls, service account governance is a big
44:35
piece. And more importantly, the
44:37
logging that allows my team to kind of get into, you know, the,
44:41
The Who, what, where and you know, how they, how they got in.
44:44
And you know, one thing that I would say that often goes under
44:47
looked is that break, like a clear break class process that's
44:50
tested. A lot of people don't think
44:51
about that. And then, you know, during an
44:54
incident when I would say that, you know that the, the teams
44:56
that I'm working with, you know, understanding, you know, that
44:59
analysis and, and clarity around what accounts to disable versus
45:03
preserve, you know, how are we going to rotate credentials
45:06
without breaking the business? That's always a fun
45:08
conversation. Like how are we going to
45:09
disseminate these passwords? This gets challenging sometimes
45:14
how to resolve single sign on safely thinking about
45:17
validating, you know, access is is clean post containment, you
45:21
know, post containment actions. And then what are we doing to,
45:26
to kind of continue to monitor and be in a heightened state of
45:29
alert for any kind of recompromise?
45:31
So really I'm looking for their, their help to act as a, a, you
45:35
know, part of our side of the response efforts to stabilize
45:39
that trust and that access. So that way when we start
45:41
flipping the switches and things coming back online, we're more
45:44
confident in that overall recovery.
45:47
OK. So I appreciate you guys like
45:50
letting your expertise here. Again, this is an area where you
45:53
know people need to be aware of it and they need to understand
45:57
how their role fits into it. So I appreciate you guys, like
45:59
letting your expertise here. Again, I feel like this
46:02
conversation was somewhat of a downer to some degree because
46:05
we're talking about like breaches and oh, man, bad things
46:08
have happened and how are we going to fix it now?
46:10
We're going to prepare for the worst.
46:11
So I want to end our show on a lighter note.
46:14
And the key is lighter. What is something that you guys
46:17
are looking forward to this year 2026?
46:22
Chuck, do you have anything that you're looking for and pleased?
46:24
I hope you do. With that lead in about being
46:28
into down here, if I answer no, that'd be terrible, right?
46:32
Yeah, no. One of my one of my children's
46:34
graduating from college this year.
46:36
So I'm really looking forward to going to her graduation.
46:41
So that is definitely something that's not too far away a couple
46:45
of months. So very proud.
46:47
That's a major milestone. Major milestone.
46:48
So very proud, yes. All right, how about Rich?
46:51
What are you looking forward to this year?
46:53
So so I got two things and and both of them are probably today
46:55
tomorrow. He's got two things he's looking
46:58
forward to. So, so I would say that the role
47:03
that I play for cyber response, we live by the seat of our pants
47:07
and we're always doing something crazy.
47:09
And one of the partners I work with always has a saying, you
47:13
know, you never know when you're going to, you know, get your
47:15
next good meal. So make sure every meal counts.
47:19
So I'm going out to dinner tonight, going to have a nice
47:20
meal that's fun. And then to, you know, I'd say
47:24
that, you know, rope balls around, you know, family and I
47:27
and I feel that, you know, when I have these long days, it's
47:29
nice to get home, you know, hang out with the kids.
47:31
I got like a two and a six year old.
47:32
So it's nice to to be able to shift away from the lens of Hey,
47:36
incident command, you know, really rigid focusing on kind of
47:39
saving the day for some of our clients, shifting and kind of
47:42
like getting to relax a little bit.
47:43
And I'd say that's kind of what I get to look forward to.
47:46
Recovery is important, so I got to ask, where you going to
47:48
dinner? Former Chicagoan.
47:50
You know, I go whenever I'm back.
47:52
I try to hit Portillo's and Giordano's.
47:53
You can't get good hot dogs or pizza here in North.
47:57
Carolina. Sorry, North.
47:58
Carolinians. No, tonight's probably nothing
48:02
too crazy, just RPM steak. My wife has me on a very
48:06
regimented diet and she's not around tonight, so I think I'm
48:09
going to fulfill my my my dreams with a nice steak.
48:13
So medium rare and full of happiness.
48:16
Right, nothing wrong with that. Let's see, what am I looking
48:20
forward to? Well, my wife and I are both
48:22
turning 50 this year, though I'm sure it'll be something around
48:26
that and honestly more international travel.
48:28
So I think heading back to Berlin, my, my first trip was
48:31
last year. I'm looking forward to going
48:32
again in May for the conference and you know, seeing some
48:34
familiar faces. I don't know if I'll be able to
48:37
like extend the trip or not. Last year my wife and I, she met
48:40
me in Berlin after the conference.
48:41
Then we went to Amsterdam, which was amazing, had such a great
48:44
time with that. I don't know if we're going to
48:46
do the same thing or not. We've got a new puppy in the
48:47
house and so we're in the middle of like puppy training.
48:51
So hopefully by may, you know, be in a good spot, but I am
48:54
looking forward to travel and and getting out there.
48:58
Awesome. Outstanding.
48:59
All right, let's go ahead and wrap it up for this week.
49:02
Thank you so much guys for being part of this.
49:04
I'm going to have in our show notes LinkedIn connection
49:07
information. So if people have questions,
49:09
whether it's to commend Rich on his steak choice or Chuck to
49:12
graduate, you know, the, the graduation coming up for your
49:16
family there, that'd be awesome. And if you have any questions
49:19
for us, you know, you can always drop them into LinkedIn, reach
49:22
out to Jim and myself. Our LinkedIn profile is there as
49:24
well, website idcpodcast.com. All of our discount codes are
49:28
there. Again, hope to see people at
49:30
conferences in the future and we'll go leave it there.
49:33
So thanks everyone for watching and or listening and we'll talk
49:36
with you all in the next one. You've been listening to
49:40
Identity at the Center. We hope you've enjoyed the show.
49:44
Make sure to like, rate and review, and we'll be back soon.
49:49
But in the meantime, hit the website at
49:51
identity@thecenter.com. See you next time on Identity at
49:57
the Center.