Latest / The HIDDEN Podcast by Babble / Episode 4: Who Can Get into Your Business Right Now?
Transcript
- Lynn Murape: Joining me in the virtual studio today is Anton Davies. Hi Anton, thanks for joining us. Welcome to the HIDDEN™ Podcast, where we simplify cyber security and all things tech for those of you who, like need it to be explained without all the So if you've ever wondered why you still feel vulnerable even though you've bought all the fancy tools, come to the right place. ⁓ your host, Lynn Murape and job is to take one of our resident experts and help them translate their cyber expertise into plain This means having practical conversations That's a wrap on today's episode of the HIDDEN™ podcast. If this episode gave you an aha moment that helped you untangle something that's been bugging you, subscribe and share it with a friend who's in the same boat. And if you're wondering where you stand across the six HIDDEN™ layers, our cyber security snapshot in the description below. a lot less painful than a breach. Until next time, don't let your risks stay HIDDEN™. Anton Davies: Hi, no worries, no worries at all. I'm glad to be here. Lynn Murape: Before we in, do you mind telling our friends listening or watching out there a bit about yourself terms of what you do and where you live? Anton Davies: Yeah, so I'm we refer to as a senior solutions engineer for Babble. My really is being the conduit between account management and the customers. So being the voice of the customers essentially to look at products, services, solutions that fit their needs. I'm there to consult on their If a customer needs anything, they can reach to me either directly or via their account manager and I'll work with them to at finding a solution that fixes their problems basically. Lynn Murape: usually built around Babble's HIDDEN™ cyber security framework, which we break down in the show. Or sometimes we'll take a hot topic in the tech industry, like a major breach or a new legislation, and we'll explain how we help you stay ahead. Basically, this podcast exists so that you can sleep well at night, preferably not during the podcast. Nice, solution oriented. Do mind telling us what you like most about what you do? Anton Davies: What like most, it's been a problem solver. like to get into the depth of issues with customers and understand what their challenges are, what keeps them up at night. And ultimately, get my, kicks from resolving those issues in whichever or form I can. And yeah, really the buzz for is to help people and help customers. I'm like that inside work and outside work, so it works for me. Lynn Murape: Yeah. Love that. Thanks sharing Anton. All right. So we're unpacking why identity is the new perimeter in cyber security. Now that statement laced with technical terms. Do you mind explaining what and perimeter mean in this context? Anton Davies: and things like that, we tend think of things like firewalls and areas of entry that the people might come in from a perspective. And those are kind of the traditional way of thinking about security. But identity really is the way of thinking about your security in of your attack surface and the way that might get into your business. And identity is really anything that is driven by humans. We pretty an identity across the board on the internet or whichever or form. It could be from LinkedIn, it could be from various different things that we're involved and ultimately need to be making sure that we're doing our due diligence to secure that way of entry and that be education, extra facilities to be put in place to protect it. But yeah, that's really the new world looking at identity as being the prime factor for an entry point for would-be attackers, really. Lynn Murape: All right, thanks for that Anton. So compromised identities one of the most common attack paths. ⁓ In modern environments, happens when credentials are compromised? When someone's password is stolen, for example. Anton Davies: theft is just one thing. You have to understand that password would be so in first place. There's probably already some information about that user on the various different things like that. I know we use the dark web as a blanket term but on various different forums and databases or whatnot for would-be attackers to start leveraging. So there could be anything from just simple credentials left to actually building out a of what an attacker need to then actually impersonate that individual and get into the business and effectively cause absolute whether it be financial damaging to internal Lynn Murape: ⁓ my goodness. you That is crazy to think about, that, it's not about gaining access into a system, but also creating this digital identity, right? Because you have be mindful of kind of information you have out there about yourself as and the access that someone can get just from getting a password. Anton Davies: Because they're ultimately building a profile, right? They're profiling everybody who they're trying to attack. So they understand from looking at LinkedIn that I'm senior solutions engineer. So they're going to do things to then impersonate me in certain ways and build out what I might behave like to then utilise that get further into the business by communicating to my peers as if they're all sorts of stuff, if they can bypass some of our levels of security. Lynn Murape: Yeah. Anton Davies: our case, we have a lot of things within Babble that we do facilitate securing that, live what we So ultimately, we want be that and sharing that with our customers that they can also have secure environments in the same way. Lynn Murape: well. Exactly, because in speaking to that, of course that would be expected from a tech company, right? But average small business doesn't go to the same extremes, as a tech business So I love that emphasis on just disseminating best practices to our customers as well. Yeah, so moving on, why is credential theft the primary attack method for smaller businesses? Anton Davies: Yeah, absolutely. The easiest way to get into a is playing to somebody's and... by doing something that you can manipulate them to giving away information without them even knowing that they're doing so, is the quickest way to get into an Lynn Murape: goodness. Yeah, I mean it's literally psychological warfare at this point in time and ⁓ threats aren't that obvious, ⁓ It's not someone asking you for ⁓ a password or for some kind of credential allows them to gain access into whatever platform, but it could be click on this link, it could be scan this QR code, they're getting a lot more Anton Davies: Yeah, absolutely. Lynn Murape: savvy and just smart because they have the luxury of just watching behaviour and just knowing what the weak points are as you had already touched on. yeah, scary stuff, but it's all part the game and that's exactly why we're having these kinds of conversations in the first place, right? Yeah. Anton Davies: Yeah, yeah, and you catch me smiling. It's not a funny topic, but it's, you it's something that I think the reason I'm saying that is because it's something we can all relate to. Even the IT savvy things catch us out. Lynn Murape: Yeah. All right, so gears to now where these gaps in identity management exist, right? So starting off with password access, ⁓ Anton, why is that still common security gap in smaller organisations? Anton Davies: convenience. But it's to do with education, I guess, not really having the right resource to educate on behaviours. what I mean by that is, know, will go down password stuff because they don't want to necessarily encourage people or they're concerned about having kicked back around, adding multi-factor authentication. Because let's face it again, humans, want to do things the most efficient and quickest way possible. We don't want something else that's going to slow us down in our job to get things done. But having to log onto a system and then you're being prompted for another notification to then allow it to sign in is frustrating. However, if you'd have a bit of education around it as to the reasons why you might have that, because protects yourself as a business and it protects the end user, then all of a sudden it's a different type of conversation. So Lynn Murape: ⁓ yeah. And it makes sense, right? I mean even outside of the work we just live in instant era, if you will. So especially when you're chasing tight deadlines all of that, the last thing you need is, to log in on this device and scan your face and all the rest of it. But like at end of the day, these measures Anton Davies: Yeah. Lynn Murape: are put in place not to frustrate you but to actually keep you protected as well. All right, so now moving on to excessive privilege, right? That's a little bit of a mouthful. So ⁓ how dangerous is ⁓ admin in reality? Anton Davies: Extremely dangerous. Admin roles be really analysed and distributed with the utmost of care. quite often isn't and touch on that but you know with too much access or elevated access gets compromised because they're not even aware of the level of access they have, then the knock-on effect that that has to your environment, your data, your your products that you're utilising or consuming to do everyday work is all of a sudden a big issue. see this a lot in Lynn Murape: Yeah. Anton Davies: SaaS platforms or software as a service solutions or platform as a service you know people just want to get up and running really quickly. so just go right this is little bit complicated. They may not be educated on the platform properly so they'll just give everybody elevated rights so everyone can just log in and do whatever they want. The problem with is internally an end user might be malicious, we hope not. They might make a and not own up to it. But furthermore, they might get compromised and that person has full access to the domain full access to this particular platform that has company data in it and stuff. So yeah, excessive privilege is a big issue. lot of housekeeping should be done and should be taken very Lynn Murape: ⁓ no. Yeah. And you know, as you were speaking, I was thinking about how everyone in an organisation essentially a target, right? So those malicious actors are counting on, everybody having access in a small business, right? So they don't necessarily need to target business owner or the CFO or CTO, depending on how big your company is. But basically, they don't have to target Anton Davies: Yeah. Absolutely. Lynn Murape: leadership necessarily because they could essentially, someone that's little bit lower on the food chain, if you will, hierarchy, ⁓ and then they get access to the crown just from accessing their accounts alone. Yeah. ⁓ Anton Davies: Yeah, you're bang on. know, It's in the same way that, know, criminals will operate in the same way as testers. And this is why, you know, you'll have organisations that will go out and do penetration testing in the same way. The easy way for me to it is doing if that, then there kind of approach. So, they'll come in at low level with nothing. And they'll try their access. And then if they can't get access, they'll do things to elevate it into other areas. And they'll do the same end users. So, just because an end user might be, I don't know, a receptionist or somebody who's got very minimal access to the systems, doesn't necessarily mean that they do only have minimal access to the system. So they might access the receptionist's environment or the account, do a bit of testing and realise, actually, like you said, Lynn Murape: Yeah. ⁓ Anton Davies: they don't have to go to the CEO or CTO admin because somebody's gone and given receptionist the wrong level of access. However, if it is secured, then they'll might do something to mimic the receptionist to go speak to somebody else, then work out how they can impersonate themselves the chain. Lynn Murape: Mm-hmm. Yeah. Either way, you don't want your account to be compromised. Whether you have access to that data or not is basically the take-home there. ⁓ just going back to something that you had just said around penetration testing, ⁓ is that exactly, Anton? Anton Davies: Ethical hacking is probably the old term for it. Ultimately you're trying to go in there with nothing as if you're a would-be attacker to look at vulnerabilities and ways document every step of the process that you're going through to uncover risks, vulnerabilities, open doors that can be brute forced, all these other things and effectively present that to an organisation to say, right, well, these are all your elements that I've exposed, and these are my recommendations that you need to do to close them off. Lynn Murape: Yeah. Okay, all right, nice. Thank you for that clarification. Just wanted to make sure I was on the same page. All right, another common security gap in identity management is life cycle control. ⁓ So what happens when joiners, movers, and leavers of the company ⁓ aren't governed? Anton Davies: No, it's alright. Yeah. Yeah, so goes back to what saying earlier around housekeeping. So we're talking about housekeeping, about roles, but it's housekeeping around, leavers, joiners and things like that. If there's governance in place for it, you're knowing what's going on, again, there's a risk. For example, somebody might leave the organisation if their account hasn't been suspended or shut down deleted, depending on what your policies are. you're at risk as an organisation. As an example, that end user might leave and go to another business and get hacked from that other business. So if they're being attacked or compromised at that other business, but then there's a history, if you tie that back down to LinkedIn, because a lot of people have their profiles on business social media like LinkedIn, we go, well, Lynn Murape: ⁓ no. Anton Davies: now this person's working for company A and we've breached and we'll try those credentials for company B where they worked for before. Oh look, we can still get in because that account's not been terminated. And then again, wreak havoc. So housekeeping is really, really important. You've got to make sure that the roles, privileges, everything else are associated in the right way. If somebody leaves, there needs to be a process about off boarding them. And in the same way, if you're onboarding them, you need to do it in a structured manner that you have an understanding of what permissions you're giving them. Lynn Murape: Anyway, uh-huh. Yeah. Mm-hmm. Anton Davies: and what roles you're giving them from the offset so it's easier to manage. Because if you have that in place, it's sustainable and repeatable. And if these things are sustainable and repeatable, you can ensure there's a level of security and process it. Lynn Murape: ⁓ Mm-hmm. Yes. ⁓ Oh yeah, for sure. Wow, a lot going on there. It's just crazy to think how these hackers are essentially virtually stalking us, just tracking engagement online. Anton Davies: Yeah, we're being hunted. We are the prey. Lynn Murape: Literally, literally. But I mean, all interesting as you had said earlier, all of ties into each other, right? we're talking about identity management, managing that identity. But then we've also been interweaving, human risk because that into the behaviour side of things. And then in managing that identity, we talk about managing those devices. the devices that those people are using, which we'll be discussing in an upcoming episode. now switching gears to if you to define the non-negotiables for SMB identity security what they Anton Davies: So non-negotiables for SMB security, I would say MFA should be on everyone, absolutely, a shadow of a doubt. It's everyone's responsibility. Multi-factor authentication is probably the easiest one to for. But yeah, because everyone's a target, right? As we mentioned earlier, like, it's no longer scenario whereby you need to protect the top 1 % of business. It's everyone. Because we can be impersonated. And we trust the people we work with. So that's the primary one. And then depending on your environment, talking from what we're familiar with and what we utilise internally, use Microsoft. We're a Microsoft partner. But if you are in a Microsoft house, I would recommend conditional access because where you might have challenges and going back to what I saying before, when I was mentioning around convenience. Lynn Murape: Okay. Anton Davies: an adoption of these things like multi-factor authentication. Conditional access can be really useful because actually it might mean that when you're connected to the office Wi-Fi or office infrastructure or internal network, you don't need MFA because it knows you're in a trusted building. But if you're using applications or you're external to the internal infrastructure, then it will actually invoke MFA because it knows that you're in an area that is not necessarily to be trusted. And so it means that anybody that is connecting externally, even if your account has been compromised, it should invoke the MFA solution to then protect you so you get notifications or people can't get in. Lynn Murape: Okay. Right. Just to quickly pause on conditional access. So basically, if my phone had to get stolen, touch wood, and it winds up in some way random, like Indonesia, I'm in South Africa, and let's say they take phone and they have their hands on my password. They wouldn't be able to access, any of my files, even if they do have my password, because they're logging in from Indonesia and the system is like, wait, Lynn wouldn't be in Indonesia. Okay, yeah, depending on the settings that you. Anton Davies: In effect, In yeah. Now There are nuances to it because sometimes people have their MFA tokens on their phones. And this is my own personal opinion, I try and advocate from keeping devices separate. If I'm accessing email one device and I need to be my MFA system on another one, but then also this is where the... Lynn Murape: Mm. Anton Davies: the kind of thought processes around zero trust networks and things like that is actually, you know what, if it's not on there, it's not, you know, maybe even MFA doesn't get invoked. It just doesn't allow it depending on where it is or the geographic location. So there's all sorts of things you can do about it. I'll probably go into full nerd mode if I continue. Lynn Murape: Okay. We'll have a episode on conditional access alone. Okay. Anton Davies: Yeah, yeah. So park it there. But Another one would be the access management element of things as well. looking things around elevating the way that people have So what I mean by that is my privilege access management will only give access Lynn Murape: Yeah. Anton Davies: for that period of time when they need it and then it'll drop it down. So, if there's elements whereby somebody needs to access something for a period of time, then it's only elevated for that short period or, after that, there's no longer access. So account gets compromised, they're no longer at this level, they're at this level. So everything is tiered. So you'll always have a baseline and you can't do anything more than that unless you request permission for it. Lynn Murape: Okay, okay. So we've spoken about, privileged access management before and you've, described it as a double-edged Do you mind unpacking what you meant by that? Anton Davies: Yeah, so Access Management is great, Because want to that people only have access to things as and when they need to as opposed to all the time. So if I'm a global admin and I've got global admin permissions all the time, then it means that at any time somebody breaches my account, they can get in and cause all sorts of chaos. So really, if only elevated access at those periods of time, then I'm protected as an organisation generally because actually when somebody does breach my account, I'll say when, if somebody does breach my account, can't get elevated access. The challenge then that it moves the goalpost to the admins of the Privilege Access Management System. So therefore, actually, whilst it's a great utility to have, what you then need to do is make sure that you're ultimately protecting the Privilege Management System with even more rigor because... If somebody gets into that, then they can start elevating permissions to wherever they need. Lynn Murape: Yeah. Okay, now I see what you meant by that. Thanks for that, Anton. right, so in summary, we have multi-factor authentication, conditional access, and ⁓ access management as the for SMB identity security. So now, moving on to governance and ownership, because sometimes this can be where things get a little bit murky, especially when we're talking about identity management. Who should actually identity in the average small business? Is it IT, HR, security, leadership, E, all of the above? Anton Davies: Well, I think just kind of answered it with the last one. But that because there's not a simple answer. It's with its own nuances, but everybody ultimately should be responsible for their own identity. However, the organisation needs to be putting things in place to help define what that structure looks like and give people the tools to be able to own that piece for themselves. Lynn Murape: Mm, okay. Anton Davies: Ultimately, yes, it might be my and your responsibility, but how do we then do that, you know? Lynn Murape: Yeah, What does that actually mean? Okay, that makes sense. All right, so even that receptionist that you mentioned earlier on, she's also responsible for identity, at least her own. All right, yeah. Okay, so then how often should access be formally reviewed? Anton Davies: Yeah, yeah, exactly. and I'm glad you put emphasis on the word formally because in the ideal world you'd like to think that access should be reviewed on real time but the reality is that's not always possible. But at the very least, at very least I would say annually but urge people to fall more in line with frameworks it on a quarterly basis with the addition of proactive monitoring. Lynn Murape: Yeah. Yeah. Yes. Anton Davies: So you know what I'm saying around real time, again, we don't necessarily have the capabilities individuals to monitor everything, but got solutions in place to actually provide some real time monitoring that will alert us when there is a challenge or a problem or things like that, that's at the benefit to the organisation. But I would say, very least yearly. But to fall in line with certain frameworks an organisation might belong to, or if you're doing things like, I don't know, I'm gonna throw out acronyms here, but SOC 2, Type 2 accreditation and things like that, or you're the guidelines from NIST if need to, then might wanna looking at that quarterly. Lynn Murape: So speaking to this review process. What metrics actually matter the most in identity security? Anton Davies: That's a good question. I an analogy for it. A clean will always expose when something is dirty, right? What I mean by that basically keeping a clear view of and a document of any unused accounts, reducing the amount of accounts that elevated to them. Going back to what we talking about earlier around the elevated rights or various based stuff that we not have taken visibility of properly because we just to things done. Well, actually, if you do a bit of housekeeping and keep everything tidy, then when something bad comes in, you're more likely to be able to see it. So that's why I was using that analogy of clean house will always expose when something's dirty. I've If I've got a clean carpet or a clean floor down in my kitchen, I'll know when a speck of dirt lands on it. But if it's already dirty, then I don't know how much more dirt's been added to it until it gets ridiculous. Lynn Murape: ⁓ I love an analogy because it makes that abstract concept that much more tangible and relatable, right? So in closing, Anton, this might be a bit of a hard question answer but I will ask you anyway. What would you say is a quick win that a listener or viewer can take back to the office protect their organisation's passwords. Anton Davies: A quick win would be to look at passwords in different way. a Crest certification course a back and it actually changed way that I thought of passwords altogether. And it's actually using what we refer to as passphrases. So they're in the same way as passwords, but passphrases I think are a little bit more obtainable because... When talk to the end users about passwords and you say, all right, yeah, you need an eight character alphanumeric password with a special character in there and everything else. And people are stuck trying to think about what are they gonna put in their passwords because then you're told, you shouldn't think about anything that is relating to you. You've got no and families, no birthdays, nothing about Christmas, all these other things. You're having a bit of a mind melt. And then the negative aspects of that is that what people will do is then they'll think of a password. And then they'll use that password on everything because it's complicated and then they get stuck with it. So they're like, well, I can't think of five different complicated passwords. And, some businesses don't allow you to use a password keeper or anything like that. And then when, the 90 days are up, they'll change the number and the digit ever slightly. And that's it. So that's the problem with passwords. Passphrases actually changes the narrative mentally. So you can look at it being like multiple words. Lynn Murape: ⁓ no. Okay. Okay. Anton Davies: But because it's a phrase, like, you can think of it like song lyrics. The more that you repeat that to yourself internally in your brain, the more that you're gonna remember it. So you could have something like, sausage, cheese, frankfurter, foot. ⁓ Just making it up, but with hyphens in between and couple of capital letters. And all of a sudden that is a 25 character password. Now 25 character password is a hard thing to break and the likeliness is because these words are all different, something that somebody can't necessarily breach very easily. However, from your perspective, because it's so random, it's something that you probably remember. Lynn Murape: Right. Right. Yeah. ⁓ Anton Davies: So when you're thinking of phrases, it's something that you can reprogram in your brain to then use. And then you can use another one for something because phrases are much more easier remember than passwords. If you look at these password generators when you go onto a website, when you're creating a new account, it'd be hashtag. the star sign, five, capital C, lowercase capital ⁓ hyphen, hyphen, GW. And you're like, how am going to remember that? You're not. So then you need a password and you're saving it. But then if somebody breaches password keeper, then they've got access to all your stuff. I know I've gone off on a tangent. I really make things a little bit more outside of the world of MFA is to go down the passphrase route. But MFA should be turned on for everyone unless access is enabled. Lynn Murape: right. So I couldn't think of a better note to end this on. Is there anything else that you would add in of identity management that we haven't covered? Anton Davies: If there's any of this stuff resonates and you to talk about, you can speak to us guide you along that journey. Lynn Murape: Perfect. I've definitely learned a few things talking to you today. So you again for joining us, Anton. Anton Davies: No worries, thank you very much, thanks for having me. Lynn Murape: All right, always a pleasure.