Latest / Identity at the Center / #51 - Insider Threat with Phil from Preempt

Transcript

#51 - Insider Threat with Phil from Preempt · Identity at the Center

0:08
Identity and access management welcome to the identity at the
0:17
center podcast. This is Jeff and that's Jim.
0:20
Hey, Jim hey Jeff, how's it going?
0:23
Pretty good. Good, you getting ready for
0:27
vacation next week? Oh wait.
0:30
You know, me going on vacation to a hot spot of, please, please
0:38
do not contract anything because I'm going to be swamped if not
0:42
if so. You know what I find ironic
0:44
though is I'm going to Florida for in because no, and I booked
0:48
it like three months ago when it looked like Florida was the safe
0:51
place compared to New York and New Jersey well.
0:54
Now, New York and New Jersey are saying, hey, if you're coming
0:56
from Florida, you're going to need to self quarantine for two
0:59
weeks. Well, isn't that ironic?
1:01
Yep, that's the way it works. We're doing a great job of
1:06
containing this but I don't want to get political on it because
1:08
like everything else. It's now everything is political
1:12
political except The Insider threat.
1:14
That is still a political I'm excited about having that as,
1:18
you know, our main topic today and, you know, I've always felt
1:23
like, oh, maybe maybe does get political but I've always felt
1:27
like it's an ignored area because it Take the focus is so
1:31
much on getting hacked from the outside.
1:33
And, you know, since I've been in it that the standard approach
1:37
has been hard, crunchy shell and kind of soften the inside.
1:42
In other words, have a firewall really guard, the perimeter of
1:46
your network and then trust the people inside, heck, Jeff.
1:50
You and I work with clients all the time where we hear, you
1:54
know, well only we only have this number of people with
1:57
administrative accounts and what it boils down to is.
2:00
These are the people that we trust, but The Insider threat is
2:05
very real. And, you know, we we have one
2:07
slide that we pulled from the Gartner, IM Summit back in.
2:12
Nineteen feels like a century ago, but back in 19 and it
2:16
talked about you know, the percentage of actors who make up
2:23
each data breach and was the Insiders are like over 30
2:27
percent so it's a very real issue.
2:30
Shoo. Yeah, I think that traditional
2:32
thinking of the you know the M&M right, the crunchy shell and the
2:35
soft gooey Center is something that was you know 20 years ago
2:40
you know maybe even ten Outta ten years ago but you know this
2:44
whole zero trust framework has come about what you think is
2:47
good and you do have to watch the out for The Insider threat,
2:51
a third of a tax, you know, roughly come from the inside and
2:55
it's typically you know you don't want to You don't really
3:00
care about your normal users other than as a means to an end,
3:03
right? They want to get into the
3:04
accounts that actually have access to things that are
3:08
important from a data perspective or from a social
3:11
engineering perspective, right? If you can breach the executive
3:13
account, you can pretty much ask for whatever you want, people
3:16
give it to you. So that's one way to do it.
3:19
So, it's a good thing that we're talking Insider threat because
3:21
we also have a guest today we have for preamp security film
3:26
analysis. Welcome Phil.
3:28
Hey, thank you. Great - yeah.
3:32
So we know one of the things that we like to get into with
3:36
all of our guests as before we get into, kind of the topic here
3:38
is kind of their background and I am and you know what?
3:41
They've been working on and maybe we can start there Phil.
3:44
Where did, how did you get into? I am.
3:46
Let's start there. Sure.
3:48
So I started my career in and really software engineering and
3:53
post sales Professional Services.
3:56
And then when I started in, I am was about 10 years ago.
4:01
I joined a company called in Privada, which focuses on strong
4:05
authentication and single sign-on for hospitals and
4:08
Healthcare Systems. I wanted to get into pre-sales
4:12
engineering so I started there as an inside SE and then moved
4:15
into selling in the field. After a couple years, then
4:18
started to manage a team of about 82 Tennessee's from there.
4:24
I had a year in network security as a little bit.
4:28
Gap but then I missed it so much.
4:30
I came back to I am focusing on security where I am now at
4:33
cramps. She actually started with I am,
4:38
which is kind of interesting because most of the folks that
4:40
we talked to Lisa and my experience my.
4:42
So, my theory is that most people who are in, I am didn't
4:45
start there, they started somewhere else, and then kind of
4:49
fell into the, I am space. So, thanks for pulling that up
4:52
for me. Appreciate that.
4:55
What? So I was a software engineer.
5:12
I was on the post Hillside that. That was, that was not.
5:15
I am that was complete, so it's for your theory.
5:17
Does still stand. Okay, good safe.
5:20
Appreciate you. So now you're a preamp security,
5:24
can you tell us a little about what preamp does and what you're
5:26
doing for them? Yep.
5:28
Preamp. So Prim takes a, look at your
5:31
users identities. Just behaviors the different
5:35
risks are user or an endpoint has and combine those all
5:39
together to understand where the risks in your environment.
5:44
How can we proactively address those risks and then putting in
5:50
place, the ability to do things, like, trigger MFA or
5:55
conditionally block access when rules are in place to to decide
6:01
the user shouldn't be doing what they're supposed to do.
6:03
Doing, or maybe they're doing something suspicious or
6:06
malicious. That should be contested.
6:09
So, basically the perfect person to have on to talk about Insider
6:13
threat, huh? So there's a report that you
6:18
guys are now we're working on and you guys have been kind
6:20
enough to, you know, share maybe some stats before that gets gets
6:25
out there and we'll have a link to it as part of our show notes
6:28
for people who are listening out there, I know that you guys have
6:31
been working on this for a while and it's around the hidden risks
6:33
of Workforce identities. Maybe we can start with that.
6:38
You know, are there? Either you know what's what are
6:40
some of the key findings that you think you took away from
6:44
what you might find in that report?
6:47
I think some of the biggest ones that I was surprised by were
6:52
just taking a look at users and all users in general.
6:57
We could found that 10% of all users were found to be high
7:01
risk. So whether it's a privileged
7:04
user, a regular user without privileges, a service account
7:10
ten percent of those users had risks associated with them that
7:14
considered that user to be high risk.
7:17
So things that contribute to high risk, things like does the
7:21
user is the user using a compromise or weak password.
7:25
That's been part of a known. Breach, our are their password
7:29
policies, not strong enough. So do they have a password
7:33
policy that doesn't require? Let's say, over 10 characters or
7:39
the complexity is minimal. So those are just a couple of
7:43
examples of Factors contributing to high risk, users one other
7:50
one. Other stat.
7:51
I thought that that was that stood out. 15% of accounts are
7:57
still authenticating with with ntlm every week.
8:02
That's a week, Microsoft active directory protocol that has been
8:08
replaced by by Kerberos, but there's still plenty of
8:13
applications out there that require Or ntlm.
8:16
So the fact that that that protocol is still out there and
8:19
still is being used not just by regular users, but by privileged
8:24
users as well, really exposes them to two different types of
8:28
attacks. Yeah, ntlm is really kind of
8:32
designed for interoperability, right?
8:34
So a lot of, you know, that's what happens when you try to try
8:38
to do too much with one thing, right?
8:41
You're trying to make things Backward, Compatible.
8:42
You have to inherit, maybe some security weaknesses that come
8:45
along with that Jimmer. You say something cause you're
8:48
saying, you know, pretty much exactly what you said, but I was
8:51
also going to say that ntlm and teal and man I guess antisense
8:57
for new technology, right? Because that package And T 3 .5
9:02
+ NT 4.0 days. That was new technology.
9:07
But ntlm has been around for a long time, right?
9:13
And one of the ogs right, when it comes to Windows
9:15
authentication. Yeah.
9:17
It's oh gee. Okay.
9:19
I think maybe they need to Rebrand.
9:20
It may be new technology isn't the rate monitor for it?
9:22
But I think it's too late now. Yeah.
9:26
A ilm. Yeah, so it's definitely
9:30
something Felton plan, man. We make it sound very new.
9:36
Four against a film. Sorry.
9:38
I was just going to say, we're, you know, we're definitely
9:40
seeing customers, trying to remove the amount of NT elements
9:46
used in their environments. And it's, it's a struggle.
9:48
It's hard to to, to fight that battle and understand who is
9:55
using that protocol where it's being used, where it's forced to
9:58
being used. We see a lot of security tools
10:00
using using ntlm and requiring ntlm.
10:04
So it's a, it's Like the password.
10:07
It's it's it's something that will will be around for a while.
10:12
Let's try it. We're trying to remove it from
10:14
an Enterprise's but it's a tough thing to to completely abolish.
10:20
Yeah. Especially because a lot of
10:21
these accounts, maybe our service accounts, right?
10:24
Or things along those lines which may not have multi Factor
10:28
associated with it, because of the nature of it, right?
10:31
You don't have a service account.
10:33
You have some, some poor guy out there with the fennec are just
10:35
going off. Every second to approve
10:38
everything. So, you know what?
10:40
I guess, maybe we should kind of work its way backwards from.
10:43
So if you've got an ntlm, hash right, where the Kerberos ticket
10:47
might be going against, that's something that can be exported
10:52
out of an organization and you could run Brute Force attacks on
10:56
that. Is that right?
10:58
That's right. So, one of the, one of the
10:59
common attacks that we see is an attack called Kerberos Ting and
11:05
what that is. Where you typically service
11:09
accounts have what's called an ESPN associated with them, a
11:13
service principal name that allows them to uniquely identify
11:20
them and allows them to request an application to request that
11:25
service authenticate and what users can do?
11:30
It's in. It's a very any user can do.
11:32
This is request all the accounts in active directory.
11:35
That has Of an Espeon associated with them.
11:37
So it could be a service account, it could be a human
11:39
account as well. So once that's done requesting
11:44
those, those Kerberos tickets for all those users who is where
11:50
is Aunt, was where an attacker can can take those tickets and
11:53
attempt to correct those hashes offline, The Brute Force.
11:58
So if any of those users, whether human or service account
12:02
has a password that is is weak because of Having a bad password
12:07
policy or its week because it's been compromised, or part of a
12:11
known bridge that that password, or that hash can be easily
12:15
cracked. Yeah, I think, you know, I think
12:19
that's really important for people understand is that this
12:23
is an offline attack, right? Once you've exfiltrated those
12:26
password hashes, you can spend as much time as you want, trying
12:30
to crack it. And, you know, those accounts or
12:32
those, those hashes I should say, without ever, you know,
12:35
coming up on anyone's radar essentially.
12:37
So, really, the key is to kind of catch people who are
12:40
requesting, maybe the ESPN's within an organization, right?
12:44
Or requesting in a normal amount.
12:46
Out of Kerberos tickets, you know, those sort of things to
12:48
try and, and identify a potential, you know, compromise
12:52
kind of incident. So I think that's, I think
12:55
that's really important to understand is that you said
12:57
something, he there is that, you know, any active directory, user
13:00
can request it. Right and active directory users
13:03
are typically insiders, right? So you know, if you've got
13:08
someone who is either assume the identity of one of your insiders
13:12
or one of your insiders and is looking to do some damage, you
13:15
know that's a great way. To kind of work on it on your
13:18
own time and come back. And, you know, if you especially
13:21
if you've got service accounts that are using weak passwords or
13:25
cracked passwords, this is why you want to have really strong
13:28
passwords for those accounts that are randomize and never
13:31
used anywhere else make it. You don't want to make it easy
13:34
for people to kind of roast you from the inside.
13:37
And it comes with all the time when when customers conduct pain
13:43
tests could roasting is one of the most Common techniques used
13:47
by pentesters and usually is one of the findings that they have
13:53
where they were able to successfully, grab an account
13:56
credentials through through that type of attack.
14:00
You know, I learned to inject here, jet to just kind of talk a
14:04
little bit about motives because I think sometimes when it comes
14:08
to this, it's maybe a little bit, esoteric, for a see, CEO of
14:13
a company that hasn't traditionally thought of
14:16
themselves as a Target. Right?
14:18
They the Banking and Financial Services industry, has long held
14:23
themselves a Target because hey, if I steal banking information
14:28
from people or I can turn that into getting money but it's
14:34
really the information that leads to either the financial
14:38
crimes and pack. I mean I think what we're seeing
14:41
going on in the world not just recent events but just over the
14:45
past couple decades is is really that there's there are other
14:51
motives than just Financial crimes Financial crime.
14:55
Still leads the is the majority. But you know just getting data
14:59
about people. You know and stealing emails and
15:04
things like that, you can either blackmail a company which of
15:08
course the financial crime or you can just embarrass a
15:12
company. And there are a lot of clients
15:14
that we've worked with, who are very afraid of kind of having a
15:19
Sony type incident where their emails were dumped out on the
15:23
dark web. And, you know, it just really
15:26
hurt their company from like a Branding perspective.
15:32
But I've talked to seizures before.
15:34
He said, you know, we're not a bank.
15:37
We make food, but as long as you are, the keeper of private
15:42
information on, you have social security numbers, maybe you have
15:46
even more more sensitive pii data, you could be a target for
15:52
these Insider threat. So I guess the long and short of
15:55
it is that I can't imagine any company that this isn't kind of
16:00
an ace. Recent issue too.
16:01
And I think everybody is listening.
16:04
Should take this very seriously. Absolutely.
16:10
And I guess what I'd like to do is complete the pick, this kick
16:14
this back to fill because you're working a lot of inside threads.
16:18
What are you seeing in terms of industries, that seem to be more
16:23
interested in this versus Industries, who are investing
16:28
Less on The Insider threat or you see it pick up across the
16:32
board? I think it's, you know, I think
16:36
across of all the industries of think Financial Services is
16:40
probably the highest, but really the, the the interest is across
16:45
the board. It's an issue in any vertical,
16:51
and we're seeing that as we work with our, with our customers,
16:56
it's Insider threats. It's its external threats.
17:00
It's really It's something that every customer and you mentioned
17:08
that the Foodservice industry. Also the retail industry
17:11
Healthcare there are there are there's data to be to be taken
17:17
and and to be sold and whether it's for a malicious intent or
17:21
whether it's for just somebody snooping, its users are are
17:26
trying to access things that they're most likely not supposed
17:30
to be in the find ways to do it, and that's it.
17:34
Back to service accounts. That's that's something that we
17:36
often seek service accounts have elevated, privileges typically
17:41
to do the tasks that they were, they were made to do, but
17:45
there's a human that that has access to those service account
17:49
credentials and sometimes the leverage, those credentials to
17:54
perform their job quicker or easier because the credentials
18:00
are available to them through that service account versus not
18:03
having them too. Their own account.
18:05
So it's definitely understanding what a service account is doing
18:08
where it's going. What it's what it's accessing is
18:14
is very important, especially how that, that service counters
18:17
authenticating is it, is it doing that scheduled tasks or
18:21
what it was meant to do on a scheduled basis or is it logging
18:26
interactively be already P or an interactive logon where
18:30
someone's actually using those credentials in a way they
18:32
shouldn't be I think he's hit one of the things that Jim, and
18:37
I see quite a bit when we're working with organizations
18:40
around privileged accounts is in service account.
18:43
Specifically is a lot of these have passwords that I have been
18:46
hard, coded, or set and are not change very often.
18:49
So if you have a user, who knows what that service account ID and
18:53
password is, if it can be difficult to change it certainly
18:58
in a timely manner, unless you've got tools in place that
19:01
are helping you manage your Privileged access and, you know,
19:05
people may walk out the door with that access then may keep
19:08
it for a while until either the discovered or someone says
19:11
change the password. So, I think it's a port from a
19:13
hygiene perspective to understand, you know, as a
19:18
privileged access management keyholder, if you're responsible
19:21
for those types of keys is to make sure that those are being
19:25
changed on a routine basis. And you know that when you have
19:29
a, you know, termination event type thing that anybody who It
19:33
had access to that, that you make sure that you definitely
19:37
change those accounts. Yeah, I say we see that everyday
19:40
wear and application was brought in to an Enterprise and back in
19:46
2005 and then a service account was created specifically for
19:49
that application. It was set with, you know, high
19:53
privilege, has a password set to never expire.
19:57
And then, Here Comes 2020. And we see that that same the
20:02
the password has been Unchanged in 15 years, it's still set to
20:05
never expire. And now it's been part of a
20:08
known Bridge. So it's considered a compromise
20:11
password so the combination of the high privileges not being
20:16
changed in a long time, not needing to be changed and the
20:20
worry of an Enterprise to change that password because they're
20:27
nervous about what they're going to break if they do change that
20:29
password because they don't know what that service count is
20:32
doing. It's a very real concern but
20:35
it's also like if you have a house and you know you know your
20:39
electric bills $200 a month and you know that there's all these
20:43
leaks you've got to go around and start sealing them up.
20:46
You can't just say there's so many leaks in this house that
20:49
will never get to the mall. So we're not going to do
20:52
anything because they think if you go around and you close up,
20:56
you know, 50% of leaks, you're going to drop that electric bill
20:59
quite significantly. You know, I think that's one way
21:02
of looking at it. It another words what I'm
21:04
getting at is that you don't have to be perfect to be better
21:09
and I think that's a big thing. That holds you back is that the
21:13
enormity of the problem the enormity of how do we get our
21:16
arms around this situation. We have so many service account
21:19
you mentioned that service account after.
21:23
And I know this this area very well.
21:25
We're their service accounts. Like where are all the places it
21:28
could be it's being used and things like that.
21:32
But You have a service account seeing around for long enough.
21:36
A lot of people who are no longer with your organization
21:39
potentially know that password or a potentially that passwords
21:43
gotten out on the internet, probably the passwords very we
21:47
could be could be proved forced potentially.
21:52
If that comes back to those part of a breach, you can bet your
21:56
bottom dollar, they're going to change that password.
21:59
So they're going to figure out a way to Julie.
22:01
So why are we eating till After the breach has occurred, that's
22:06
unfortunately, that's what we see a lot in the industry is
22:10
that when two things get taken seriously, after they've gone
22:14
too far right after a breach has occurred.
22:17
Now, we're going to take it seriously.
22:18
Well, you know, too bad, we take it seriously before that, right?
22:23
It's understanding where those those risks are as far as, from
22:30
a user perspective or from a, an end point perspective and
22:33
Proactively cleaning them up just you know you again like you
22:37
said, you can't be perfect but it helps a great deal if he can
22:40
do it ahead of time before before something bad happens.
22:43
One of the things that Jeff and I talked about a lot because
22:46
comes back in various reports and surveys that are done is how
22:50
long it takes to realize that a breach has occurred.
22:54
And I don't think that the numbers are consistent because
22:57
there's a report that came out recently that you know shortened
23:01
versus what I've seen in the password.
23:03
Just, you know, I'm on the magnitude of six months plus to
23:07
discover breach, but I think, you know, when I think about
23:13
what has happened in, I am over the past five years, the
23:17
definition of I am is changing from who has access to what to
23:24
who has access to, what plus was being done with that access.
23:29
And that's to me, you know, really the next Frontier Choose
23:34
ensure, you know, expanding our scope to buy and not just to
23:38
make sure that the right accounts have the right access
23:41
and we have shown controls or who can log in.
23:44
But then monitoring the use of that access and being able to,
23:50
you know, Define patterns for normal behavior and identify
23:55
when that normal behavior is not being followed.
23:58
So, you know, today, this account that only logged in as a
24:03
sir, Discount once in a while logged in through the VPN, it's
24:07
a legit through the VPN before. Whoa.
24:10
Well, maybe somebody better look into that, right?
24:14
And I think that that's, that's the biggest change I've seen in
24:18
I am recently. I think there are a lot of
24:20
things happening with AI and and things like that, but to me the
24:27
understanding of what identities are doing on the network is
24:30
really the big next. Sure.
24:33
And it helps with Insider threats and it helps with
24:37
external outside or breaches as well.
24:42
Man if only there was a podcast that you know, focused on
24:45
identity and why it's important cheese where can I find
24:49
something like that? I don't know.
24:51
There's one that's been around for about a year it's going up
24:54
on that but I you you bring up a really interesting point in that
24:59
is that, you know, identity really is at the center of a lot
25:01
of these things, especially when it comes to threat detection,
25:06
Phil, what kind of role do you see identity playing when it
25:09
comes to identifying threats? It's so one interesting stat I
25:15
saw her recently was that 80% of the text breach, the identity
25:23
store or credential compromise or an Insider using credentials
25:28
inappropriately, so focusing on identity based attacks just
25:33
makes sense. It's if we're seeing the
25:37
majority of attacks or on this the identity side, it's
25:42
obviously the best place to start to start to look at.
25:48
How are we going to detect these different types of attacks and
25:51
also prevent them prevent them from continuing on prevent them
25:56
from from moving across the network?
26:01
What are some of the things that organizations can look for when
26:05
it comes to Identity and trying to find, you know, indicators of
26:09
compromise? So really things like as Jim was
26:14
just mentioning before being able to identify a user or an
26:21
endpoint user, typically accessing servers, a b and c.
26:27
Now, all of a sudden for the first time ever there, They're
26:30
accessing server D, is that something that is should be
26:37
allowed? Should we should?
26:39
Do you want to take an action on that?
26:40
Do you want to alert somebody, the fact that that happened
26:43
trigger MFA should up block that access being able to see again,
26:49
starting with visibility understanding where the risks
26:52
are in your environment on a per user per endpoint bases.
26:56
Being able to clean that up as much as possible, but But where
27:00
you can, when you see indicators where somebody's doing something
27:05
suspicious being able to take, take an action on that Jim, what
27:11
about you? What do you see as some other
27:14
ways to look at identity and figure out if there's maybe a
27:16
potential incident? Well I think you know, again
27:20
kind of I think where I get energy comes into play is that
27:26
in the past, were we Had like a sock or knock focus on wear
27:34
breeches. May be taking place, it's been
27:36
IP based, so it's been devoid of the context of identity.
27:42
We've looked for, hey, there's some weird activity that's
27:45
coming from this IP address across our network.
27:49
But it said, identity context, that tells you whether or not
27:55
that fits in from a user Behavior, Standpoint and to me,
27:59
that's really the key is Larry and identity, like I mentioned
28:04
earlier with the, you know, they're both important IP is
28:10
very important as well because you have a computer that all of
28:13
a sudden is like scanning the network.
28:16
It doesn't matter what I didn't either using, that's a problem.
28:19
Pray, that's a potential compromise that has happened
28:22
within your within your network, but I mentioned that idea of
28:27
okay, we Service account that logs in I don't know twice a
28:32
year because that's how often those servers give rebooted for
28:36
example and all the sudden the logs in from the VPN, you know,
28:40
that one time event of logging into a VPN for an IP standpoint.
28:44
Doesn't look like any kind of issue at all.
28:47
Especially if the login is happening from some, you know,
28:51
normal location either, you know, within the home country of
28:56
that of that company or If the global company, who knows
29:00
there's no there's nothing about that.
29:02
Login, that looks suspicious until you take the identity
29:05
context and wrapped around it. So to me that's what's so
29:08
important around. You know, Building A View From
29:14
identity standpoint of what is normal behavior so that you can
29:19
then identify, what is abnormal behavior?
29:24
I think those building blocks are really important, right?
29:26
You have to have to know who has access to what and then what are
29:30
they doing with? It is really important.
29:31
I think it also to it like I am hygiene when it comes to
29:35
inactive accounts dormant accounts.
29:37
Right. A lot of times you have accounts
29:39
out there that haven't been used in a year, two years, three
29:43
years and people are afraid to remove them or you know, do
29:46
whatever to clean them up because of the potential impact
29:50
of what it might cause versus, you know, the Of what could
29:54
happen if someone gets ahold of one those accounts that there's
29:56
I think there's a lot of different ways that the identity
29:58
plays in that. Is there any difference between
30:02
trying to figure it out at the identity layer versus maybe just
30:06
taking a log based approach? May be something like through a
30:09
Sim or a tool similar on those lines.
30:13
I guess. Phil.
30:13
Maybe that's a question for you, sure.
30:16
So when you when you're able to look at it authentication as it
30:20
happens at the protocol level. So looking at Things like in
30:25
parade active directory as an example.
30:28
Ntlm, Kerberos ldap held at best understanding and having the
30:34
advantage to detect things that are, that just aren't as easy to
30:37
detect when looking at logs, things like attacks.
30:41
Like pass the hash ntlm relay, we talked about curb roasting
30:47
log based analysis is going to always be primarily detection.
30:54
Tried to take an action and stop something suspicious and
30:57
potentially malicious, that happened minutes or hours ago.
31:02
It's just, it's just way too late.
31:05
You need to be able to, to, to Really prevent something from
31:09
from happening or prevent it from continuing to happen
31:13
quickly. You really need to, to be able
31:16
to look at the the authentications as they're
31:19
taking place. Yeah, I think this is where
31:22
artificial intelligence and machine learning is really kind
31:24
of become a Force multiplier for security operations and other
31:28
folks who are looking at this because I know that my past one
31:32
of the things that had been historically challenging as
31:34
trying to find those needles in the haystack right?
31:37
When we're looking at tons of logs all day long right?
31:39
Need help and this is an area that you know, robots do really
31:43
good at spotting patterns and helping kind of fluff things up
31:47
the top not perfect, but if they can reduce the The chaff that's
31:51
out there, it makes it easier to respond on approach to and you
31:54
know in a fully mature and you know, Cutting Edge, I am system
31:59
or I am program where you've got a bunch of different
32:01
Technologies working together. You can even automate some of
32:04
those things where, you know, maybe you do see a service
32:06
account login through VPN for the first time ever, and you've
32:10
got that connected up with your IGA, in your, your privileged
32:13
access management systems and you do something about it,
32:15
right? Maybe you change the password on
32:17
it or you disable it or, you know, throught and Fay or
32:21
something on those lines to try and mitigate those attacks.
32:26
Yeah, it's it's something. Where you know, if you're if an
32:30
analyst is receiving Ten Thousand Words a day, it's going
32:35
to be hard for them to decide which ones to react to and
32:40
respond to an investigate. It's much easier to after the
32:46
fact, after the incidents occurred to look back and say,
32:50
oh, okay. Oh, we did detect this in our
32:51
logs, but it was one of 10,000, which we didn't catch.
32:56
So the Fidelity of the different types of awards that you're
32:59
receiving, has to be, has to be high.
33:02
Yeah, absolutely. I think that's, I think, I think
33:05
that's just, it's super important, right?
33:07
If you can find it, you need to know what to do about it.
33:10
And I think the f is a big part of the of the problem.
33:13
Some are there, any specific types of threats that I'd any
33:16
information that can help stop? Whether it's at the credential
33:18
or the identity store level? Just looking at the Deep look at
33:23
the identity store on its own provides, a ton of useful
33:27
information. So just understanding that the
33:30
basic ability to understand who your privileged users are not
33:34
the ones, not just the ones that are easy to find, you know, in,
33:38
well, defined groups like domain, admins Enterprise,
33:41
admins account operators but also the ones that are
33:44
considered, you know, what we call Shadow admins are stealthy
33:48
admins ones that have been granted, privileges.
33:50
Images, individual delegated privileges over time.
33:55
Do they still need those privileges?
33:57
You know, they might have had a role in a company where they
34:01
were part of the helpdesk team and they were resetting
34:04
passwords. Now, they've moved on to a,
34:07
maybe a customer success for Professional Services role where
34:11
they don't need that, that privileged anymore, but it was
34:14
never taken away from them. So, being able to identify the
34:19
Privileges of a you User of all your users and being able to
34:25
decide. You know, does this user still
34:27
need? This privilege is super
34:29
important. Absolutely.
34:34
I know we're coming up on time here and certainly appreciate
34:37
you helping us out with this topic.
34:40
I think cover roasting is the word of the day just because
34:43
it's a great use of it. But before we wrap up here Jim,
34:47
do you have any things you want to add to what we've discussed
34:50
so far today? Yeah.
34:51
And a couple thoughts on those holding onto your.
34:54
So one of them is just, you know, I think we have a lot of,
34:58
I am practitioners out there. And I, you know, I think about
35:02
what your question there earlier of, you know, logging and to me
35:10
where you get your value from logging as what goes into the
35:12
logs, like, what are you, what are you collecting?
35:15
Is it just basic information? Or is there more to it?
35:20
I think, isn't I am practitioner.
35:22
It's our responsibility to establish a self-service, or a
35:27
shared service, that is clear. Easy for application teams to
35:33
use. And to make sure that they're
35:35
logging the information that we need.
35:38
Once we have the data, we can start to use the technology in
35:41
the AI in the machine learning to give us value, but there's
35:46
the whole thing, which is that, as I am practitioners, we don't
35:50
control the applications and we are beholden to the applications
35:55
at some level to provide us, the data, the logs, and so I think
36:01
It's our responsibility to make it available which also leads me
36:04
to think about another responsibility that we have,
36:07
which is that, you know, we have audit using the air quotes
36:13
because there's a lot of different names where audit
36:16
professionals, whether it's, your security risk, whatever you
36:19
want to call it professionals within our organization, who
36:22
play an oversight role as a kind of checks.
36:27
And balances to what we what we do in I am Or what applications
36:32
are doing and we're kind of the middleman making it available
36:35
for audit. So I just someone our listeners
36:38
not to forget that we need to design system so that it serves
36:43
the purposes of those checks and balances because ultimately at
36:47
the end of the day it's providing services to
36:50
Applications but it's also making it so that it's secure
36:54
and the audit professionals play, a key role in that and
36:58
kind of making sure that we understand their requirements.
37:00
Moments, that usually, they're pretty technical people but not
37:04
the most technical people. And so we need to kind of frame
37:09
things in kind of their business language.
37:11
So that they can take the security information and make
37:17
and be able to perform their activity, which is a checks and
37:21
balance over over what we're providing.
37:24
The last thing I wanted to say was just, you know, on the whole
37:27
Insider threat thing. I think what should be very Very
37:31
clear take away. If it wasn't already in your
37:33
mind is that you know the trusting of people is is
37:37
Honorable, right? But within our industry and with
37:41
in what we do for a living trust trust but verify I guess is you
37:46
know it's a the catchphrase they often goes to this but trusting
37:50
people is is not the way to go. I always go back to a story of I
37:55
work for a company and there was a you know it's a little old
37:58
lady. The grandmother brought in In
38:01
chocolate chip, cookies and worked for the company for 20
38:03
years. And everybody trusted her.
38:05
And for 20 years, she was embezzling money from the
38:08
company a little bit at a time. And that just goes to show you.
38:11
If you can't trust her, you can't trust anybody.
38:14
And when people have super administrative rights and
38:17
they've been with the company for 10 15 years and they talk
38:20
the talk and you just you still need to have the checks and
38:24
balances and you still need to have the good governance
38:27
processes over your identity and access management.
38:31
Information security as a whole. So that's what The Insider
38:33
threat thing is all about is just because somebody works for
38:36
you just because they've been a loyal employee doesn't mean that
38:39
they're not doing things in the background, like Phil said,
38:43
maybe it's for fun, maybe it's 44 game and, you know, really
38:49
doesn't matter. People should be, you know,
38:52
following the rules. I'm not not breaking into
38:56
systems and things like that. So that's all I had to say about
38:59
that job, okay? Okay, I want to make sure that
39:01
we're very clear here too. Is that chocolate chip chocolate
39:04
chip? Cookies are totally fine to
39:05
bring to the office. So don't take away that.
39:08
That was that. That was - it was the embezzling
39:11
part that was bad. The chocolate chunk, Ledger,
39:13
good, glad you cleared that up. I'm sure people miss that point.
39:20
All right, Phil anything you want to close up with, yeah,
39:23
just to add to Jim's. Comment, a lot of times,
39:28
insiders might be doing something.
39:31
Suspicious, or malicious and intentional, but oftentimes,
39:35
it's completely unintentional. It's a mistake, they access
39:39
something. They did something that they
39:42
shouldn't have done, but it's not something that they were
39:45
doing on purpose. So, you know, like you said,
39:50
trust. But verify, make sure that the
39:53
the user is is what they're doing is even though they might
39:57
not be trying to do something harmful.
40:01
If you can proactively stop that from happening, that's that's
40:06
ideal. I think trust.
40:08
But verify is, is really important.
40:09
And I like it, you said that, because I first heard that
40:13
phrase many, many years ago from for mercy, so that I worked with
40:18
Jim Kelly and that was kind of the motto at the time was trust.
40:22
But verify, and I think that's stuck with me, you know, through
40:25
the years is that trust is good, but you need to make sure that
40:28
things are still being followed from a real perspective, I'm
40:31
glad you brought that up. So that's good.
40:33
With the hottest hitch. Phrase right now.
40:35
Jeff is your trust zero? Trust is zero trust but verify.
40:40
There you go. That's the next extension.
40:42
Yeah. All right.
40:44
Well I think that's a pretty good spot that we can leave it
40:46
for this week. Phil appreciate you taking the
40:48
time to spend with us. I know that you're on LinkedIn
40:52
and I'll be sure to put that profile on our show notes so
40:55
that way people out there have questions, you know, for
40:57
yourself or for preempt, they can get a hold of you there.
41:00
And looking forward to those findings getting published on
41:04
the preamp website at some point and we'll provide a link to that
41:07
as well. And the show notes and for folks
41:10
who are falling off the show, you know, you can always visit
41:12
us at identity the center.com and we'll go ahead and wrap it
41:16
up for this week and stay happy and healthy, everybody, thanks
41:20
for listening. You've been listening to the
41:30
eye. Identity of the center podcast
41:32
for more episodes of visit identity at the center.com.