Latest / Identity at the Center / #405 - RSM 2026 Attack Vectors Report

Transcript

#405 - RSM 2026 Attack Vectors Report · Identity at the Center

• 0:04
  This is identity at the center. Welcome to the Identity of the
• 0:11
  Center podcast. I'm Jeff, and that's Jim.
• 0:12
  Hey, Jim. Hey, Jeff, how are you?
• 0:15
  Oh, not so bad yourself. Good, I got some breaking news.
• 0:19
  I got married on Saturday, Valentine's Day.
• 0:24
  So now it's Mr. and Missus McDonald.
• 0:27
  Denise McDonald, for those who maybe know her, she goes to,
• 0:31
  she's gone to a lot of conferences with me and you over
• 0:35
  the past few years. Yeah.
• 0:38
  Congratulations. I knew it was happening but you
• 0:40
  literally like told me right before we hit record, so you
• 0:43
  gave me no time at all. I should.
• 0:45
  Now that I think about it, I shouldn't have even told you
• 0:47
  then. I should have just waited and
• 0:49
  popped it on you right now. And you.
• 0:51
  Because when I told you, you looked completely floored.
• 0:56
  I, you know, I figured it would be like sometime in the summer
• 0:58
  or, you know, whatever it may be.
• 0:59
  But yeah, no, congratulations to you and Denise.
• 1:02
  Like I said, you know, Denise has been visible, I think a lot
• 1:04
  of the conference we've been to kind of recently and over the
• 1:06
  last couple years. So yeah, punching way above
• 1:09
  your. You're punching way above your
• 1:10
  weight class, Sir. Yeah, well, that's for sure.
• 1:13
  That's for sure. But yeah, it's exciting stuff,
• 1:17
  man. I'm really happy.
• 1:19
  That's good. That's the whole point of it.
• 1:22
  I want to ask you a question because we had, I had a LinkedIn
• 1:25
  post, I think the other day, I think it might have been our
• 1:26
  400th episode 1. And you posted how are you?
• 1:30
  Hey, Jeff, how are you? And I'm wondering if it was a
• 1:33
  subtle nod to how we intro almost every show.
• 1:35
  Or you say how are you and I say not so bad yourself.
• 1:39
  Exactly. That's exactly what it was.
• 1:41
  You did get it. And I was actually thinking, I
• 1:44
  was going to say for the 400 and first time, hey, Jeff, how are
• 1:47
  you? But then I was thinking, well,
• 1:49
  there were probably about 10 episodes that I wasn't on.
• 1:52
  So anyway, I just went with that.
• 1:56
  I'm glad you got the subtle, subtle hint.
• 1:58
  It took me a a day or two. I was like, is that what I think
• 2:00
  it was? I'm like, is Jim that clever?
• 2:05
  Yeah, and. I and, and we got it.
• 2:08
  So no. Well, congratulations, that's
• 2:10
  great to you. And Denise, what else we got
• 2:13
  going on in the world. We got a bunch of conferences
• 2:15
  that we're going to be hitting up here.
• 2:16
  I think it's March by the time people listen to this.
• 2:18
  We've got EIC and Berlin coming up.
• 2:21
  So we've got discount code for that on our website,
• 2:23
  idacpodcast.com. Just Scroll down.
• 2:25
  I've got a discount code for that.
• 2:27
  What else? We got ideniverse in June, just
• 2:29
  a couple weeks after that. Tip for both of those if you
• 2:34
  think you're going to go to the conference, well, especially at
• 2:38
  Ideniverse, right? Because hotel cancellation rules
• 2:42
  are usually pretty LAX in the US is book your hotel, especially
• 2:47
  if you can do it without a cancellation fee.
• 2:51
  Because they're so often that we're at the conference maybe
• 2:54
  with our close compatriots who knew they were going to go to
• 2:58
  the conference. And they're like, yeah, I'm
• 3:00
  staying like 10 properties over. This place was sold out.
• 3:03
  And you're just like, how does that keep happening to you, man?
• 3:07
  That is the pro conference attendee move is to make sure
• 3:11
  you stay at the hotel of the conference.
• 3:14
  Or if you don't want to be seen with anybody after the
• 3:18
  conference, then don't stay at the conference hotel.
• 3:21
  Stay far away. You know, whatever that looks
• 3:22
  like depending on your persona and your style and however that
• 3:25
  one is. But you know.
• 3:27
  Be strategic about it, yeah. For this, I think it just makes
• 3:30
  sense. Less walking.
• 3:31
  You know, I know lots of people, myself included, have like ended
• 3:34
  up staying at the Luxor and then having to walk to Mandalay.
• 3:37
  And that's, that's legit like a mile walk every day.
• 3:40
  It's air condition but if you are like outside and having to
• 3:43
  walk in June in Vegas, it could easily be 100°.
• 3:48
  Yeah I wouldn't recommend. No, if you are carrying a heavy
• 3:52
  bag or God forbid you put a like a Sport coat on or something.
• 3:57
  You know, stuff like that. Not fun.
• 4:00
  Yeah, no. So stay at the hotel, book
• 4:02
  early, book often, go for the cancellation.
• 4:05
  I booked my Ideniverse hotel I think in like January and it was
• 4:09
  like straight through Mandalay and I got to tell you my rate is
• 4:12
  way cheaper than what the what the rate.
• 4:14
  Was I, I use the the room block that the Cyberisk Alliance had
• 4:19
  and I think it was like 178 tonight.
• 4:22
  So you can't say you haven't been warned, right?
• 4:25
  Get out there, book the room. Hopefully you have the approval
• 4:29
  already. Use the discount code that we
• 4:32
  have on idacpodcast.com. Yeah, save some money and show
• 4:36
  some support for the show. So there you go.
• 4:38
  You do that for EIC, do that for Ideniverse.
• 4:42
  If there's other events, let us know what you're looking at
• 4:44
  attending. And who knows, maybe Jim and I
• 4:45
  can pull some strings and get some discount codes for those as
• 4:48
  well. That's our goal.
• 4:51
  All right, let's talk about our main topic for today, which is
• 4:53
  the RSM 2026 Attack Vectors report.
• 4:58
  We don't typically we'll get into like a lot of RSM stuff on
• 5:01
  this show because we don't want it to turn like a commercial for
• 5:03
  RSM. And ours is very generous.
• 5:05
  This is for a lot of people don't know, it's like we do not
• 5:07
  do the podcast full time. This is nights and weekends.
• 5:09
  RSM is our employer. You and I are identity
• 5:12
  consultants by day. Been doing that for almost a
• 5:14
  decade together the last few years, you know, here with RSM.
• 5:18
  So we have this report that has just come out.
• 5:22
  It's called the Attack Vectors report.
• 5:23
  And we've got the person really kind of in charge of all that,
• 5:25
  David Lawrence. He's the principal with RSM or a
• 5:28
  principal with RSM, I should say.
• 5:30
  So let's get him on the show. Welcome to the show, David.
• 5:33
  Hey, thank you. Thank you for having me.
• 5:35
  So I've known you for almost 4 years because I'm coming up on
• 5:38
  four years with RSM and you know, we've kind of worked in
• 5:41
  the same circles. You've moved to other areas
• 5:45
  where this attack vendors report is of, you know, probably a key
• 5:48
  component of that. But before we get into the
• 5:50
  report, before we get into all that stuff, I always like to
• 5:53
  find out histories, backstories, origin stories.
• 5:57
  How did you get into the world of cybersecurity and is it
• 6:01
  something that you chose or did it choose you?
• 6:04
  Well, I think it kind of kills me.
• 6:07
  I mean, in high school, I had a pretty active, I guess, group of
• 6:11
  people that I used to hang out with.
• 6:14
  And whenever we went into computer lab, I mean, we just
• 6:17
  started playing with different things.
• 6:19
  And at that time, back in the 1990s, there was this thing that
• 6:23
  we was called Netbus, basically like a root, a rootkit Trojan
• 6:29
  type of thing. So I guess I'm accepting that
• 6:33
  between my friends and I, basically we installed netbooks
• 6:36
  across all the computer lab computers.
• 6:39
  And one of the things that this thing could do is just allow you
• 6:43
  to open the CD-ROM or close the turn on the TV, the monitor or,
• 6:48
  or just turn it off make sounds like modify the way that the
• 6:52
  computer was was working from another computer, right.
• 6:56
  So it was really cool to see all your friends.
• 6:58
  What I mean, basically doing whatever in their computer and
• 7:01
  then all of a sudden you're open the CD-ROM and then they will
• 7:04
  they will be surprised about it and then you'll be able to close
• 7:06
  it again or just turn off the computer.
• 7:08
  So it would be just chaos overall, having a good time.
• 7:11
  That was one of the things that basically piqued my interest and
• 7:14
  I was just like, I want to know how this works and what is the
• 7:17
  back end to follow this? And that's how I got interested
• 7:21
  into cybersecurity. And the second thing that got me
• 7:24
  interested into cybersecurity was in the same computer lab.
• 7:28
  That was the time where everybody was going into, I
• 7:31
  mean, opening e-mail accounts. And I mean, the first few times
• 7:34
  where you would communicate with your teacher through e-mail.
• 7:39
  And at some point I logged in into my e-mail and I didn't
• 7:43
  notice this, but my e-mail was compromised or hacked by someone
• 7:46
  else. And I didn't know better to to
• 7:49
  understand that. I mean, obviously if we
• 7:51
  installed netbooks on computers all across the computer labs, it
• 7:56
  was probably not a great idea to log into your e-mail and just
• 7:58
  just look at your e-mail in the same computer.
• 8:00
  But I didn't know any better, right?
• 8:02
  So my e-mail got compromised and someone I never learned who took
• 8:07
  my e-mail and sent a really nasty e-mail to a teacher in
• 8:12
  that school. And I almost got spell at that
• 8:15
  point. And I remember spending two days
• 8:20
  just trying to find ways to prove that it was, it hadn't
• 8:24
  been me and that in all honesty, it had been someone else to the
• 8:29
  point that the principal told me, if you're able to show me
• 8:32
  that it wasn't you, then I'll, I'll reconsider the, the, the
• 8:36
  punishment. And that's how I got into
• 8:38
  cybersecurity. I started doing forensics
• 8:40
  investigations in a lot of computers that were compromised,
• 8:43
  trying to find a way to clear my name in front of a teacher.
• 8:47
  And then from that point forward, I was just like, this
• 8:49
  is never happening to me again. I mean, I could go into a
• 8:53
  computer and I'd better know what I do.
• 8:56
  I'll never get compromised. And I'm sure that I got
• 8:58
  compromised, and I mean a few other times, but I've never,
• 9:01
  least not to the extent that I was compromised on that day.
• 9:05
  So that's what got me into computer.
• 9:06
  And then really from that point forward, it was all about trying
• 9:10
  to get into computers, trying to hack computers and try to teach
• 9:14
  people how to not get hacked, to be honest.
• 9:17
  So you got into this because of poor digital identity security?
• 9:21
  Oh, absolutely. Pure, like, yeah, absolutely.
• 9:25
  Like everybody was using the same username and password in
• 9:27
  the computer lab, right? So just from starters, that was
• 9:31
  an issue, right? And that's why we could
• 9:33
  basically start this Netbus product into all these different
• 9:37
  computers. And then second, I remember that
• 9:39
  my password back in the day wasn't as strong, even though
• 9:43
  there was a key logger into Netbus as well, so they could
• 9:45
  read my passwords. But that was the reason for sure
• 9:49
  why I got into cybersecurity. So I introduced you as a
• 9:54
  principal with RSM. People may not be familiar with
• 9:57
  consulting terminology, but maybe briefly explain what a
• 9:59
  principle is and then your specific role with RSM because
• 10:02
  it's changed a couple times over the years that I've known you.
• 10:04
  But I think what you're doing now is really kind of the sets
• 10:07
  the table for the topic today. Yeah, I think that what a
• 10:10
  principle is in RSMI would say is just a partner without a CPAI
• 10:13
  mean someone that is part of, I mean the leadership of the
• 10:16
  company and is helping the company to, I mean, going the
• 10:20
  direction that the company wants to go from a strategy
• 10:22
  perspective. And I think the CPA firms
• 10:25
  distinguish between someone that has ACPA and someone that
• 10:28
  doesn't and they decide to call the whoever doesn't have a CPAA
• 10:32
  principal. So that's what a principle is.
• 10:35
  And then my role in RSM today, I lead the offensive security team
• 10:40
  and the cyber response team in RSM.
• 10:42
  And I'm also the product creator or owner of RSM Atlas, which is
• 10:48
  an, I guess, a, a tool, AI enabled tool that helps a lot of
• 10:53
  companies just to rationalize their controls and make sure
• 10:56
  that they have the right information in their GRC tools.
• 10:58
  So a lot of hats I guess, but mostly offensive security and
• 11:03
  leading the offensive security in RSM and globally as well.
• 11:06
  Well, Jim and I, you know, joke an awful lot that this is the
• 11:09
  show sometimes turns into AI at the center.
• 11:11
  And we'll probably want to have a separate conversation around,
• 11:14
  you know, Atlas and kind of what that does.
• 11:16
  But let's focus on on, you know, the offensive side of things and
• 11:20
  this report, so it's called the 2026 RSM attack vectors report.
• 11:25
  What is it? How does it get generated and
• 11:28
  maybe kind of take us to the background of it before we start
• 11:30
  talking about what what it entails.
• 11:31
  So. This is a report that we
• 11:34
  published every year for the last, I think four to five
• 11:39
  years. And the reason why we started
• 11:40
  doing this report is because we have obviously a number of
• 11:45
  engagements on the offensive security side with different
• 11:48
  clients and we have identified a number of trends every single
• 11:52
  year, right. For example, two years ago, you
• 11:55
  could see that companies were going into cloud and they were
• 11:57
  heavy on cloud and you could see a lot of the identity and access
• 11:59
  management components focusing on on cloud heavy
• 12:03
  implementations. And, and one of the things that
• 12:07
  we're trying to do is just still share what we expect companies
• 12:11
  to do from a technical point of view to protect themselves
• 12:14
  against, I mean, any attacker or any hacker that is using the
• 12:18
  most common techniques, right, like the low hanging fluids that
• 12:21
  you see out there. And one of the things that I was
• 12:23
  discussing with Jim the other the other day was that it's,
• 12:27
  it's funny how when you're doing offensive security, you hear a
• 12:31
  lot of cybersecurity practitioners talk about all
• 12:34
  their own perspective, I guess, topics and themes.
• 12:38
  But it, it does feel that sometimes offensive security
• 12:41
  just lives in a different world 'cause we see things that most
• 12:46
  other consultants, professionals don't really focus on because
• 12:50
  we're really, I guess going one step further into the technical
• 12:54
  aspect of things, right, Of just techniques, I would say.
• 12:58
  So the, the report itself, what it's trying to do is just create
• 13:02
  some big themes that people can take and then just leverage
• 13:07
  those, those themes to implement recommendations into their own
• 13:10
  environment without really trying to go through the whole
• 13:14
  effort of doing an offensive security test in their whole
• 13:18
  environment. Right.
• 13:18
  And it gives you specific recommendations on how you can
• 13:22
  implement identity and access management in your environment.
• 13:26
  The specific challenges that we see in each of these companies
• 13:29
  that we test in general levels, configuration management,
• 13:33
  vulnerability management and so on.
• 13:36
  With the idea that eventually, if you go through the report and
• 13:39
  you take the, the key takeaways and implement them in your
• 13:42
  environment, you're really moving the needle forward
• 13:47
  honestly, in, in a better and you're, you're getting to a
• 13:49
  better place than your competitors in, in, in most
• 13:52
  cases, right. So that's the idea just to share
• 13:54
  with the community and allow the community to understand what is
• 13:56
  happening across different companies, different sizes,
• 14:00
  different technologies, different industries and take
• 14:03
  what they're were giving them back so they can get better
• 14:06
  without, I guess like to to to buy services from us, you know.
• 14:13
  So David, we're recording this episode prior to the report
• 14:17
  being dropped. I think it's going to drop on
• 14:19
  2/22. So February 22nd, this episode
• 14:23
  is going to drop on March 2nd. We'll have a download link in
• 14:29
  the show notes. We don't have that link to
• 14:31
  verbalize it today, but I'm sure if you follow us on LinkedIn,
• 14:35
  you're going to see us reposting this thing because it's a ton of
• 14:39
  value. I got to review kind of a
• 14:42
  preview copy of it. And no surprise here, there's
• 14:47
  identity security is highly mentioned within the report.
• 14:52
  Wonder if you could speak to that and tell us like why?
• 14:55
  Why do you think that is? Yeah.
• 14:57
  I mean, obviously identity has taken a big, a big role into
• 15:03
  every single organization. And I mean, especially in 2025,
• 15:07
  we saw a lot of companies heavily investing on, I mean,
• 15:11
  just application development, cloud services and on top of
• 15:15
  that trying to push for AI services being enabled in both
• 15:19
  sides, the cloud and application.
• 15:22
  And then with that, you need to manage your identities better,
• 15:25
  right? Like I think in 2024, for
• 15:27
  example, we saw a lot of, hey, let's just focus on client
• 15:30
  identities and make sure that client identities are working
• 15:33
  well because that's our user experience.
• 15:35
  In 2025, we saw a huge push, especially on the second part of
• 15:40
  2025 from companies to enable AI in their own applications, make
• 15:46
  sure that they had some sort of, I don't know, functionality or
• 15:49
  feature related to AI And that created, I mean, multiple
• 15:52
  challenges, right? I mean, now I was just
• 15:55
  mentioning this to Jim, like one of the things that we saw in
• 15:58
  many applications where we're doing our offensive test is chat
• 16:01
  bots, right? Like this is a thing that I
• 16:03
  mean, it's an easy thing to add to your application.
• 16:06
  So you can think about, oh, let's just embed AI into our
• 16:09
  day-to-day applications. And one of the things that
• 16:11
  companies didn't do well at the very beginning is they they were
• 16:14
  not taking the identity of the user and matching it with the
• 16:20
  chat bot, right. So if David Lauren goes in into
• 16:23
  the application and then he's using a chat bot, you would
• 16:26
  expect that chat bot to be as restricted as David when David
• 16:30
  is using that chat bot to extract, to get free information
• 16:33
  and and review. I mean different things that I
• 16:35
  might have access as a user into the application.
• 16:38
  Well, many, many companies implemented chat bots just with
• 16:42
  way more privileges into the data and into the application
• 16:46
  overall. That created I mean some of the
• 16:48
  attack vectors that were I mean mentioning in the attack report
• 16:53
  for example. Yeah, you just mentioned there
• 16:54
  the over privilege accounts and that's something that I think
• 16:57
  that's been the bane of Jeff and My's existence for the last two
• 17:01
  decades. But I'm kind of wondering like
• 17:04
  what are some of the tell tale signs differences between
• 17:08
  organizations that got breached within a couple of hours and
• 17:12
  maybe didn't even discover it to those that were able to contain
• 17:16
  the breach or even prevent being breached?
• 17:20
  So we so just to give you some context, what we have in the
• 17:24
  report is we have I mean just anonymized data that we analyzed
• 17:30
  from upper market all the way to middle market, different
• 17:33
  industries and then different levels of activity as well,
• 17:36
  right. So when you try to extrapolate
• 17:38
  this into what is that is working for some companies and
• 17:41
  what is not working for some companies, it's really difficult
• 17:44
  because we do have a lot of companies that I mean for some
• 17:48
  that are on the upper market scale is really a big challenge
• 17:52
  because they have such a large enterprise environment that is
• 17:56
  really difficult to manage. And it's not easy to just
• 17:58
  pinpoint one thing. And then there's other companies
• 18:01
  in the middle market that are, I guess smaller and they're, I
• 18:05
  mean, better managing security, but they're missing budgets,
• 18:08
  they don't have the tools and they don't know how to implement
• 18:11
  some of these identity things. So going back to your question,
• 18:14
  what are the common things that you see companies doing that I
• 18:17
  mean, really work? I would say the easy one, right?
• 18:20
  And we did, we do point out this in in the report as something
• 18:25
  that is not well implemented, but is the easy one that you can
• 18:27
  implement right away is MFA multi factor authentication.
• 18:31
  If you're not implementing multi factor authentication for your
• 18:34
  users, especially for anything that external is externally
• 18:37
  exposed or internally for anything that is sensitive,
• 18:41
  that's an issue by itself and something that is an easy path
• 18:44
  for attackers. The second one is privileged
• 18:48
  access management. I think that is becoming a big,
• 18:51
  big, big, big theme again. Like I think 10 years ago
• 18:55
  everybody was just like, let's just implement Pam for all my
• 18:58
  privileged users, right? And it was just like human
• 19:00
  identity. Nowadays I think it's getting
• 19:04
  back to the point where non human identities are taking
• 19:08
  front and center of everything, especially with AI agents and
• 19:13
  just applications in general. So companies that were doing
• 19:17
  privileged access management correctly were the other
• 19:21
  companies that I mean it was a hard time to compromise them.
• 19:24
  And then the last one, which is less related to identity from a
• 19:31
  point of view of what what they were doing, but is related to
• 19:34
  identity as an indicator or something is wrong, which is
• 19:38
  lateral movement. The way that you identify
• 19:42
  lateral movement in many organizations is by seeing the
• 19:45
  same user jumping from computer to computer to computer to
• 19:48
  computer in a way that doesn't make sense from a human
• 19:54
  perspective. Like you don't want to see Jeff,
• 19:57
  for example, going into Jim's computer and then from Jim's
• 20:00
  computer to David's computer, or using the same identity all
• 20:04
  across different computers. Because the only way that you
• 20:07
  would use that is coming from a server.
• 20:09
  If it's coming from a computer, that's a problem.
• 20:12
  So identifying those patterns, whether it's someone using the
• 20:16
  wrong identity in the wrong places, someone using.
• 20:19
  The I mean a privileged identity across multiple systems in in a
• 20:24
  matter of, I mean minutes instead of matter of hours or
• 20:27
  days or someone logging from, I don't know, country A without
• 20:34
  going into, I guess an specific country, just country A and then
• 20:38
  logging in from the US as well. That would be another issue,
• 20:41
  right? Like if you have the same login
• 20:43
  coming from the the two different, I guess remote
• 20:45
  locations or different geographical locations, that's
• 20:48
  an indicator that I mean immediately can tell you, you
• 20:50
  know what, these guys are compromised.
• 20:52
  So you're not, you need to be careful with that.
• 20:54
  So those are the three things that I would say are main
• 20:56
  topics. And then for the more advanced
• 20:59
  companies, I would say, I mean just credential rotation.
• 21:06
  We have faced some really cool companies that every freaking
• 21:11
  days, every 8 hours, they would just rotate all their privileged
• 21:17
  user accounts like this. So as an attacker, you would
• 21:22
  come in and you would compromise A privileged user account.
• 21:26
  And the team that I managed, they would feel really confident
• 21:28
  that they were really good to go, right?
• 21:30
  Like I have a privileged user account and I have the whole
• 21:33
  week to just do whatever I want in this company and then next
• 21:36
  day they show up and all these credentials were rotated.
• 21:40
  They cannot access these credentials anymore.
• 21:43
  And every time that they try to use that credential is creating
• 21:46
  a new alert or flagging something that is a problem for
• 21:49
  them. And then they need to restart to
• 21:51
  try to compromise anything. So that is what I have seen most
• 21:55
  companies doing. Well, it's easier said than done
• 21:58
  to be honest. Like it's, it's just there's a
• 22:01
  lot of caveats to what I just said.
• 22:03
  And I know that it's not not easy to implement, but those are
• 22:05
  the things that I would say are common themes on, on really good
• 22:08
  companies that that have done identity and access management
• 22:11
  well and security well as well. So I'm glad you put that
• 22:14
  asterisk towards the end because I was going to say, you know,
• 22:16
  secrets rotation is I think, a target that most companies want
• 22:21
  to get to, but not a lot do it still, relatively speaking,
• 22:24
  right? Well, in in again, it, it
• 22:28
  depends on the industry and the complexity.
• 22:30
  But if you think about secrets and non human entities
• 22:34
  specifically, you're going to have service accounts that are
• 22:39
  more Microsoft based. And I think those are the easy
• 22:41
  ones once you start going into, I mean databases, specific local
• 22:48
  passwords for, for servers that are not Windows based, things of
• 22:54
  like that are just not easy to manage in general, right.
• 22:57
  And then the the last piece, which is probably the biggest
• 23:00
  challenge for most organizations is that many companies think
• 23:05
  that they know what they have. And what the engagements that we
• 23:09
  deliver really point out is that many of them just know, don't
• 23:14
  know what they have. They don't know what assets they
• 23:16
  manage, they don't know what identities they manage.
• 23:20
  And because of that, they think that they are really doing
• 23:24
  things well in their own world, but they they really miss the
• 23:28
  point of what is the universe, right?
• 23:30
  And that's the biggest challenge, I think in
• 23:32
  cybersecurity thing, why you bring sometimes, I guess,
• 23:35
  consultants, right? It's easy to just get lost in
• 23:37
  your own chaos and, and lose the bigger picture.
• 23:40
  And consultants, sadly, for whatever reason, can come in and
• 23:43
  just tell you, hey, you know what, you're too lost in here
• 23:45
  just to step back and look at the bigger picture.
• 23:48
  So David, you've kind of referenced 2 of the biggest
• 23:51
  topics that I really wanted to get into with you today on the
• 23:54
  non humans. That's really, I've always felt
• 23:57
  like we, we've kind of figured out how to manage human
• 24:01
  identities within the enterprise.
• 24:04
  But then there's the attack path that you also referenced, which
• 24:07
  is, you know, switching roles and, and basically lateral
• 24:13
  movement. And your goal may be to get up
• 24:17
  and take over the like the Active Directory and have the
• 24:20
  global administrator account access.
• 24:23
  Maybe start with a service account, You move to a help desk
• 24:27
  account, you reset the credentials for the global admin
• 24:30
  and bingo, that company's out of business.
• 24:35
  But I wanted to go back to something else that you said.
• 24:37
  I don't want to like let it go without talking about it because
• 24:41
  you did talk about large enterprise.
• 24:43
  Then you talked about the middle market, which is the main area
• 24:47
  that RSM focuses on and the this attack vectors report, a big
• 24:52
  focus is on the middle market. And I guess when I think about
• 24:55
  the middle market, I, I think you mentioned a good point,
• 24:59
  right. The scope is probably smaller of
• 25:02
  what we have to protect than a large enterprise, but a lot of
• 25:06
  times we're also playing with a smaller budget to put towards
• 25:09
  cybersecurity. So my question to you really is,
• 25:14
  is what's more important? Is that the size of the budget?
• 25:17
  Is it you know how much money you spend on cyber or is it the
• 25:23
  like how well you spend the dollars or is it just
• 25:26
  inseparable? Oh man, that's a great question.
• 25:30
  So to, to me, there's, there's, there's a threshold, right?
• 25:35
  There's, there's a point in time where you can have a budget and
• 25:40
  still you can make it work. But there's some companies that
• 25:42
  don't have even that, right. And I think if you're not past
• 25:46
  that threshold where you have enough budget to make it work,
• 25:49
  then I mean, just just forget it.
• 25:52
  There's nothing that you can do or, or a few things that you can
• 25:54
  do because you're still going to need licensing.
• 25:57
  You're going to need all the things that would help you,
• 25:59
  especially with technology today to manage everything that you
• 26:03
  need to manage in cybersecurity. Once you're past an specific
• 26:07
  threshold and you have that budget already approved, then it
• 26:11
  does matter how you spend it and it does matter how you're
• 26:16
  managing your own technology, how you're managing your
• 26:20
  investments, and how you're collaborating with other
• 26:23
  departments. I think this is something that
• 26:25
  is really easy to miss. When you talk about
• 26:29
  cybersecurity, especially cybersecurity professionals.
• 26:32
  We tend to be in a silo and feel that we're in a silo.
• 26:36
  And the better cybersecurity teams are the teams that are
• 26:39
  really good collaborating with the rest of the enterprise,
• 26:42
  whether it's a small middle market company all the way to
• 26:46
  the enterprise. They find ways to make what is
• 26:50
  important happen, whether it's with their budget or some other
• 26:54
  else's budget. And they've, they, they identify
• 26:57
  really good ways to understand what is important to the
• 27:00
  business and not to the cybersecurity professionals.
• 27:04
  And you made, you made a really good point on, on your comment
• 27:06
  about, well, you might be coming in and trying to compromise
• 27:11
  Active Directory or compromise my identity and access
• 27:14
  management solution. And that might be relevant for
• 27:18
  the cyber security professional that that is in front of me on
• 27:23
  the other side, right, like the CISO or whoever.
• 27:26
  But in reality, one of the things that I think is really
• 27:29
  easy to me is from a cyber security point of view is what
• 27:32
  is important to the business. And I have been and this is this
• 27:37
  I think a privilege. I have been in organizations
• 27:40
  where you can compromise their whole Active Directory and the
• 27:46
  CEO, the CFO, the CEO can just watch it.
• 27:50
  This is like, I don't care. This is not important to me.
• 27:53
  My business is somewhere else. I know that I can recover.
• 27:57
  It's going to be a really uncontrolled day for the CIO and
• 27:59
  the CIO. So I give you that.
• 28:02
  But my business is going to continue to run.
• 28:04
  So I think there's this balance, right, where you, when you talk
• 28:08
  specifically about cybersecurity of what is important for
• 28:12
  cybersecurity professionals and what is important to the
• 28:14
  business. And I think the people that
• 28:17
  understand what is important to the business are the people that
• 28:19
  are actually investing their budget correctly.
• 28:21
  So that that would be my long winded way of saying that that's
• 28:24
  how I see cybersecurity being spent correctly, if that makes
• 28:28
  sense. Well, I think that's valuable
• 28:30
  because if you can use other people's budget to further
• 28:33
  security goals, that's a win as far as I'm concerned.
• 28:36
  And the best way to do that is to tie security objectives with
• 28:40
  business objectives. Absolutely.
• 28:42
  And this is something that, again, not a lot of
• 28:46
  cybersecurity professionals do well because it tends to be a
• 28:51
  confrontational relationship and a lot of friction.
• 28:53
  But I have seen really smart people using internal audit for
• 28:58
  their own purposes. Why?
• 29:00
  Because internal audit talks about the business risks.
• 29:03
  And if you're able to present your cybersecurity challenges
• 29:07
  through internal audit, most likely the CEO and the CEO and,
• 29:12
  and others are going to pay attention to this is an
• 29:14
  independent party that is coming in and just saying the same
• 29:17
  thing as the cybersecurity professional has been shouting
• 29:20
  for a very long time to the same people, right?
• 29:22
  So that's an example of how some of the better CISOS have that I
• 29:27
  know have I mean done well creating internal relationships
• 29:31
  in the organization to accomplish what they they need
• 29:34
  even with a really small budget or I guess a less of of not a
• 29:40
  good budget I would say. Yeah, they might be shorted
• 29:43
  somewhere, right? Everyone's trying to claw back
• 29:45
  money. I feel like this is definitely
• 29:47
  where there is where you know, the vertical or industry you're
• 29:50
  in definitely impacts probably what tools you can afford and
• 29:55
  how mature you are, right? Finance probably doesn't have a
• 29:58
  problem spending with it because you know you're you're you're
• 30:01
  saving dollars and risk and things like that.
• 30:03
  But the reality is there are so many other organizations that
• 30:07
  are not in maybe highly regulated industries that would
• 30:12
  like to be more secure but have to get creative from a.
• 30:15
  Budget, well, absolutely. And that's the other thing that
• 30:17
  I think going back to the question that Jim just just
• 30:20
  made, right, the other good part of the cybersecurity
• 30:23
  professionals that I know of at the executive level, some of
• 30:27
  them are really good explaining the risk through other means and
• 30:30
  collaborating, collaborating with other parts of the
• 30:33
  business. And some of them are really good
• 30:36
  understand explaining to the business how cybersecurity is a
• 30:39
  business enabler instead of a business deterrent.
• 30:42
  Because when you talk about risk, the first thing that comes
• 30:45
  up immediately is, Oh my God, like I'm going to have to start
• 30:49
  to stop my operations. This is going to be
• 30:51
  uncomfortable to someone. It's going to be really
• 30:53
  annoying. But if you implement, and this
• 30:56
  works really well in identity, like if you implement a really
• 31:00
  good identity and access management program, I mean, you
• 31:03
  can enable your business from a client perspective, right?
• 31:07
  Because a good identity and access management user
• 31:10
  experience, I mean, it's a huge benefit for the business and it
• 31:14
  attracts better clients to your business as well, right.
• 31:18
  So those are the, the other places where I see really good
• 31:21
  security professionals coming in and those, I mean, making a
• 31:24
  change. I mean, with, with a better
• 31:26
  story other than, Oh my God, we're going to get compromised.
• 31:30
  I mean, it's going to be a horrible day when we get hit by
• 31:32
  ransomware and then our operation is going to be, I
• 31:34
  mean, really bad. Nobody wants that day.
• 31:39
  Nobody wants that day, but I mean you can, you can recover
• 31:42
  from that day if you understand the business as well, in my
• 31:44
  opinion. And hopefully you've got like
• 31:47
  good backups and the backups haven't been like tainted in any
• 31:50
  way. So we did a whole episode on
• 31:52
  recovery and resilience. Okay, that's good to know
• 31:54
  because you were going to drive me into that rabbit hole of, I
• 31:58
  mean, where to invest if you're really concerned about those
• 32:01
  things. And for sure in mutable backups
• 32:04
  would be one thing that I would immediately invest on.
• 32:08
  So print out your entire system, right, put it on to like a
• 32:12
  binder and put it into like a shelf on an offset location and
• 32:15
  then code it back all in. You can use AI right?
• 32:18
  Probably to help you, you know, vibe code your entire business
• 32:21
  operating. System you can call that in
• 32:22
  mutable as well in some sort of way, right?
• 32:24
  I mean, probably not agile, but in mutable for sure.
• 32:27
  We have the backup. We we can't restore it, but we.
• 32:30
  Have the backup. I want to go back to a little
• 32:35
  bit about the service account and sort of this non human
• 32:37
  identity, because look, this has been sort of the topic du jour
• 32:40
  in the identity world for like the last, I'd say six months,
• 32:43
  maybe approaching a year at this point.
• 32:45
  And you know, look, it's it's an explosion of these accounts,
• 32:49
  right? I think everyone's familiar with
• 32:50
  like service accounts from like an Active Directory perspective
• 32:53
  or, you know, SQL or whatever those, you know, systems are.
• 32:56
  But now we've got non human identity, agentic identity AI,
• 33:02
  right? All this stuff is happening.
• 33:03
  And I'm curious, you know, based on sort of the report, what are
• 33:06
  some of the things maybe that you want to kind of pick out
• 33:08
  around that idea of not only the service accounts, but this idea
• 33:13
  of, oh boy, now we've got a new, a new class of citizen called
• 33:17
  Agentic. Well, I mean, so first I would
• 33:20
  highlight that for me it's awesome because it's job
• 33:22
  security. I mean, in all honesty, it's.
• 33:26
  Tell me your consultant without being a.
• 33:28
  Without telling me you're a consultant.
• 33:29
  It's insanity right now because it feels like we went back maybe
• 33:35
  20 years ago when I mean, and that tells you that I'm really
• 33:39
  old. But I mean, back in the day, you
• 33:41
  would see everybody going crazy because the Internet was there.
• 33:44
  Everybody wanted to have a website.
• 33:46
  And then creating a website was like the thing that you wanted
• 33:50
  to have, right? And people would be paid, I
• 33:53
  mean, just crazy amount of money to create a really basic
• 33:57
  website. But now you could say as a
• 33:59
  company that you have your website and no one cared about
• 34:02
  security, no one cared about how that was being built.
• 34:05
  Everybody was wanted to just have their website and then just
• 34:09
  move on. So it's, it's seems to me that
• 34:13
  AI is so similar to that. Everybody wants AI.
• 34:16
  Everybody wants a gentic to be working.
• 34:18
  Everybody wants to claim that they're using AI.
• 34:21
  No one is paying attention to security, no one is paying
• 34:23
  attention to these identities that are being created and these
• 34:26
  are going to stay for a very long time out there.
• 34:29
  So going back to the report, one of the things that my team is,
• 34:33
  has been able to do, I mean, throughout the years, but just
• 34:36
  lately more and more is compromising service accounts
• 34:42
  with, with high privileges, right?
• 34:44
  And the reality that many organizations don't have a
• 34:46
  strategy to take high privilege service accounts, embed them
• 34:51
  into a process or a factory model, where before even just
• 34:54
  creating that identity, you have a way to embed it into your Pam
• 34:58
  or embed it into your identity and access management
• 35:02
  infrastructure and then secure that identity before it becomes
• 35:05
  something that is live. What happens is the opposite,
• 35:08
  right? The identity, I mean for
• 35:10
  whatever reason, it starts us as a strong high privilege identity
• 35:15
  that goes live and then everybody forgets about it and
• 35:18
  then they remember when we compromise them.
• 35:21
  So the way that we usually compromise them and in
• 35:24
  identities is there's two different ways identity through
• 35:27
  cover asking which is something that is really on but still out
• 35:30
  there. And the second one would be
• 35:33
  just, I mean misconfigurations on, on the specific certificates
• 35:38
  that you're assigning to different identities and how
• 35:41
  certificate based type of a type of authentication is being used
• 35:45
  in a Microsoft tomorrow, right. So those are the 2 main main
• 35:49
  ways I guess or techniques that we're using.
• 35:51
  So one of the things that struck me as I kind of read it was this
• 35:55
  idea of prompt injection is is a very real threat.
• 35:58
  I don't want to get into specific statistics.
• 36:00
  I want to say it was like 70 or 75% of the things that were
• 36:04
  tested fell prey to some sort of prompt injection, which, OK, so
• 36:09
  now we've got to worry about that.
• 36:11
  And those are just the things that, you know, as me, as a
• 36:13
  security person, these are the ones that I know about.
• 36:16
  Imagine all the shadow AI that's taking place as an organization,
• 36:21
  and that's how to protect those. I mean that is another topic by
• 36:25
  by it's own right. Like, I mean, so many
• 36:26
  organizations have AI right now that I mean, they don't even
• 36:29
  know that they're using. But going back to the prompt
• 36:33
  injection component, it goes back to what I mentioned with
• 36:35
  Jim, right? Like you have this chat bot of
• 36:39
  some sort that is exposed to the application and then you know
• 36:43
  that that chat bot is going to have access to more things that
• 36:47
  you do as an user. And the thing with AI is that
• 36:50
  they usually don't have really long term memory.
• 36:53
  Like they can have context for, I mean, few prompts, but then
• 36:57
  little by little they start losing that memory, right?
• 37:00
  And that's the main risk, the main issue with the other lens.
• 37:03
  So what my team usually does is they continue to inject new
• 37:06
  things into the prompts until the, the, the bot or the lens
• 37:11
  starts getting lost into the prompts.
• 37:13
  And then they start asking questions with assumptions or
• 37:17
  things that they can imagine. And from there, I mean, the, the
• 37:21
  prompt would just, the, the chat bot would just forget the
• 37:26
  context that they're in. And then they start to giving
• 37:28
  information back that they shouldn't be giving.
• 37:30
  And this happens not only with the chat bots that we have
• 37:33
  tested, but just many, many AI applications that are out there
• 37:36
  right now. But yeah, that's a, that's a
• 37:39
  challenge by itself. And again, I don't think
• 37:41
  companies even realize that the biggest challenge is not as
• 37:49
  simple to fix because once you create that chat bot and you
• 37:53
  didn't create the right identity and access management structure
• 37:57
  in your application and you didn't segment data correctly
• 38:01
  and everybody's using that application for whatever reason,
• 38:04
  this is a vulnerability that can live there for years without you
• 38:09
  knowing. And people can be extracting
• 38:11
  information and it would be close to impossible to monitor
• 38:16
  that someone is doing this through the application.
• 38:19
  So to me, really exciting times, as I mentioned, like there's a
• 38:23
  lot of really interesting things that are happening that are
• 38:26
  going to be there for a very long time for my team to
• 38:29
  continue to test. But in reality, a really
• 38:32
  difficult challenge to match if I'm on the other side, right?
• 38:35
  Like if I'm someone that is a CISO or cybersecurity
• 38:39
  professional in a company and I have my CEO and the rest of the
• 38:43
  board just asking me to implement AI no matter what.
• 38:47
  I mean, I can't see why some companies just go directly into
• 38:50
  AI and then they just don't have a real security assessment
• 38:53
  before even doing these things, right?
• 38:55
  I think some companies are getting better and clever, but
• 38:58
  most of the companies that I have seen or we have seen
• 39:01
  implementing AI, they have not been able to implement
• 39:07
  correctly. And I mean with really simple
• 39:10
  tests you would be able to compromise data that is
• 39:13
  extremely sensitive for those companies.
• 39:16
  So Dave, we've recorded over 400 episodes and our focus has
• 39:20
  always been on the practitioner. And one of the things that we've
• 39:24
  always tried to do is make our episodes be actionable for the
• 39:31
  practitioner. And you kind of talked about
• 39:33
  some of the framework and some of the philosophies.
• 39:35
  So whether working like a DIY from a DIY perspective or
• 39:41
  working with a partner, what are some of the things that the
• 39:46
  practitioner can do to kind of self assess or to assess where
• 39:51
  they stand, where their weaknesses are?
• 39:53
  Because we talked a lot about those weaknesses today, and I
• 39:57
  think if you know where they are, you can do something about
• 39:59
  it. Yeah.
• 40:01
  I, I mean, I, I, I'm going to sound like I'm promoting myself,
• 40:04
  but I'm not. I I think we have documented
• 40:06
  really well some of the actionable recommendations in
• 40:09
  the report that you and Jeff mentioned.
• 40:12
  Like we do have really a specific things that we
• 40:15
  recommend people to follow for the most part is really having
• 40:21
  a, as much as possible good hygiene with your identities,
• 40:26
  being able to monitor when things don't look precisely as
• 40:31
  as a natural way of operating, whether it's human or non human,
• 40:35
  you can identify it if you know your environment.
• 40:38
  I think over communicating also helps across the enterprise so
• 40:42
  people can understand the risk. And one thing that I think as a
• 40:45
  practitioner, I mentioned that I'm expecting from people to do
• 40:48
  that we don't do enough as cybersecurity professionals or
• 40:51
  identity and as management professionals is really
• 40:55
  understand what are the main business drivers and I mean main
• 41:00
  business risks, right? Like a lot of people that live
• 41:03
  in technology, they live in technology without understanding
• 41:06
  what is important to their own company.
• 41:09
  If you understand what is important to your own company
• 41:12
  and then from there you drive the rest of the investments, I
• 41:15
  think everything clears out, right?
• 41:18
  If not, you're going to be in this weird, I mean rabbit hole
• 41:22
  and cycle where you're investing things and you don't feel that
• 41:24
  you're really making a good progress or moving the needle.
• 41:29
  So those would be really, I guess, high level things that I
• 41:33
  would think are actionable. And then the the last piece more
• 41:37
  technical to your, to your, I guess to your listeners would be
• 41:42
  make sure that you're matching identity and access management
• 41:48
  with something else. These are the things that I
• 41:52
  think sometimes are missed. Many companies as I mentioned
• 41:55
  have MFA, have Pam, have I mean good identity and access
• 42:00
  management hygiene, but they miss to manage configuration
• 42:05
  well or they miss to do logging and monitoring well.
• 42:09
  So if you do identity and access management and you add one thing
• 42:13
  more, whether it's configuration management, whether it's logging
• 42:16
  and monitoring like something else that you're really good at,
• 42:20
  usually those two things complement themselves really
• 42:24
  well and you end up being a really good environment that you
• 42:28
  can manage, right. So I don't know how actionable
• 42:30
  that that is, but I mean, at the very least I can tell you that
• 42:33
  that is what I would, I would recommend to people.
• 42:36
  And then again, if you want to go into the technical details,
• 42:39
  I'll, I'll refer you to the report.
• 42:41
  But I mean, I think that is what I would recommend to some of the
• 42:45
  people that you have that are listening to this.
• 42:48
  There's a lot to cover here and I think, you know, one of the
• 42:50
  things that was out there was run MFA and I don't want to
• 42:53
  spend too much time on it because I think the the gist of
• 42:57
  that finding was that's great you've got MFA, but do you have
• 43:00
  MFA everywhere? There were some findings that
• 43:04
  maybe there were still some holes in the deployment of MFA
• 43:06
  where there weren't, you know, it really wasn't everywhere.
• 43:09
  There were certain. Well, so I'll explain like, I
• 43:12
  mean, the report itself says that you can have MFA, but then
• 43:15
  MFA can be implemented in really secure ways on just or just in a
• 43:20
  more generic way, right? And what my team is able to do
• 43:24
  in other teams as well, not on my team is basically able to
• 43:27
  trick the users to go through the MFA process, but then steal
• 43:32
  their token or their session when they go through the MFA
• 43:36
  process. Once they go through the MFA
• 43:39
  process, and I mean, the attacker has your session and
• 43:42
  you still have your session. You can have two logins going
• 43:46
  in, but then you have a starting point as an attacker, as a non
• 43:50
  privileged user. And the beauty of this is that
• 43:53
  once you cross that line from a no user to a non privileged user
• 43:58
  as an attacker, the whole world opens up because now you have
• 44:03
  access to data, you have access to assets, you have access to, I
• 44:08
  mean multiple identities that are already lingering over there
• 44:11
  that you can see if you can basically compromise or not.
• 44:14
  When you are not a user in a company, you have no access to
• 44:17
  everything, right? So everything that you're
• 44:18
  gathering is external. Once you get that first user is
• 44:23
  just like day and night for for the people that work in my
• 44:26
  group. And once you get that user, even
• 44:29
  as a regular user, as I mean, one of the things that we point
• 44:32
  out is the the certificate based challenges that you might have
• 44:36
  in Active Directory as a regular user, you could compromise and
• 44:40
  escalate privileges all the way to domain admin if you didn't
• 44:43
  configure your Active Directory correctly with that certificate
• 44:47
  based vulnerability. Well, not vulnerability, but
• 44:49
  misconfiguration that you can have in Microsoft, right?
• 44:52
  So that's one of the things that I mean in matter of hours can
• 44:57
  get you from no user to regular user to full compromise.
• 45:02
  So those are the things that I think again, you can implement
• 45:05
  MFA, but if it's not implemented correctly, it's, it's a
• 45:08
  challenge. Now the report will tell you the
• 45:11
  best way to protect against this is implement 5O2 and like a GODB
• 45:18
  key or whatever. And everybody in your podcast is
• 45:20
  going to say what the hell? I mean, this is, I mean, many
• 45:25
  are going to say that's impossible to implement.
• 45:27
  It's it's close to, I mean, it's not a user friendly and, and you
• 45:30
  still have to manage the hardware.
• 45:32
  And, and I agree with that. And what we recommend instead of
• 45:36
  implementing Fido, even though there's some organizations that
• 45:40
  they shouldn't have an option, just have Fido too and GOB keys
• 45:44
  for most of the organizations that is not a reasonable type of
• 45:48
  implementation. So what is actionable?
• 45:50
  What is actionable is implement the MFA and then add
• 45:54
  configuration management on top of that, which is conditional
• 45:57
  access. Impossible logins like for
• 46:02
  example, David and and another person in another country
• 46:05
  shouldn't be logging at the same time and this and at the same
• 46:08
  time just implement processes around those configuration
• 46:11
  controls so you can act on it immediately when someone gets
• 46:15
  compromised. That is the part that is
• 46:17
  missing, right? So MFA can't be implemented.
• 46:18
  But if you know it's implemented incorrectly, you need to add
• 46:22
  more steps and security in depth so you can actually manage your
• 46:27
  risks overall, right? So that that's a little bit of I
• 46:30
  guess of the recommendation. Dave, you sound like a modern
• 46:33
  day identity security guy. So look, you're on identity at
• 46:38
  the center. Sometimes it feels a bit like an
• 46:40
  echo chamber, but what I'm going to say is identity security is a
• 46:46
  board level issue. I mean, we say that on the
• 46:48
  podcast a lot. I want to know does that
• 46:50
  resonate with you? I mean, I think so.
• 46:55
  I'm not an identity Nexus management experts.
• 46:57
  I'm going to challenge anyone over that comment just in
• 47:00
  general, right? I think that board level issue
• 47:03
  to me is identity as a whole because I want to engage my
• 47:10
  clients, I want to engage my customers.
• 47:12
  I want to make sure that identity is enabling my business
• 47:14
  in some sort of way. Identity security, it's a board
• 47:22
  relevant issue, but it's not a board issue itself.
• 47:25
  I guess because it there's that's why you have a CIO&ACISO
• 47:29
  that would manage and would help you, right.
• 47:32
  But at the board level, I see, I would say maybe other more
• 47:37
  relevant challenges being managed.
• 47:40
  Now again, depending on the industry, I would say yes, if
• 47:44
  you're talking about cybersecurity as being one of
• 47:46
  the major risks in any enterprise risk management
• 47:50
  framework, identity has to be part of the conversation for
• 47:54
  sure, if that is what you're referring to.
• 47:58
  So let me let me spin that question a different way, OK?
• 48:01
  OK. Instead of presenting identity
• 48:07
  to the board, right identity security, let's flip it.
• 48:11
  Should the board be asking questions around how are we
• 48:15
  doing an identity security as part of their due diligence to
• 48:18
  make sure that security for the organization is good.
• 48:21
  Now, this assumes that the people who are on the board know
• 48:26
  what questions to ask, but I bet we've got a lot of board members
• 48:29
  who are listening to this podcast now.
• 48:32
  They probably know identity's important.
• 48:34
  At least I hope they do. Otherwise, why are you?
• 48:37
  Listening to. Right, but should the board
• 48:40
  start asking more identity security related questions to
• 48:44
  their CI OS and C CS? OK, so that's a yes.
• 48:47
  I mean short answer is yes. And the reason why the, I mean
• 48:51
  the, the, it's a no brainer, first because of the importance
• 48:56
  and second because a lot of people at the board level can be
• 49:00
  intelligent about their questions related to identity.
• 49:02
  Identity is something that I mean you can understand at a
• 49:05
  high level and still ask really tough questions to someone that
• 49:10
  is technical, right? So you don't have to be
• 49:13
  extremely technical to understand identity and
• 49:15
  challenge someone on the way that they have it, I mean,
• 49:18
  implemented identity or the way that they're securing your
• 49:21
  systems with the identities, I guess management processes that
• 49:26
  they have. So her answer is yes, like at
• 49:28
  that level for sure. And then you mentioned just are
• 49:31
  they required? So if you're a public company,
• 49:34
  you probably need to be looking at this because there's a SEC
• 49:37
  rule that says that you're liable as well if you get
• 49:40
  compromised. So yes, some of the boards need
• 49:43
  to be thinking about this and they need to be asking.
• 49:45
  That question for sure. OK, see we got to yes.
• 49:49
  So now we're back on the same page.
• 49:52
  I want to wrap up the conversation with, you know,
• 49:54
  something actionable. You know, Jim and I like to make
• 49:57
  this a conversation that people can kind of take back and say,
• 50:00
  oh, let me go ask these questions or go find out these
• 50:03
  answers. So there was a lot to read in
• 50:06
  this report. And so coming out again, a link
• 50:08
  will be in our show notes and I'm sure you'll see it, you
• 50:10
  know, plastered all over LinkedIn with RSM and probably
• 50:12
  Jim and myself sharing in yourself, etcetera.
• 50:15
  And I'm actually working on a follow up article for RSM that
• 50:19
  kind of the specific identity components of the attack
• 50:22
  vectors. I meant, I want to say I meant
• 50:24
  like 3500 words so far. I don't know if that'll be the
• 50:28
  final version or not after it gets edited and kind of, you
• 50:30
  know, reformatted or whatever, but there's a lot to cover.
• 50:34
  So let's digest this in a way that something in a see, so
• 50:37
  reading this report saying, OK, what are the next three things
• 50:41
  that I need to be focused on for the next year?
• 50:44
  So let's say through the rest of 2026.
• 50:46
  According to David Lawrence and the RSM Attack Vectors report,
• 50:50
  these are the three things you should be spending time on.
• 50:53
  I mean Pam, Pam to me is just I, I mean, I see so many companies
• 51:00
  misusing and miss implementing Pam.
• 51:03
  So that would be my first one. If you have to invest money in
• 51:08
  some sort of way and time and effort, I would say Pam is
• 51:13
  significant, right? And there's so many solutions
• 51:15
  out there now that can help you in many, many ways.
• 51:19
  So Pam would be the first one to me.
• 51:23
  The second one, I mean just removing as much as possible
• 51:32
  privileges from users. And I think when I say this,
• 51:37
  users are just like, Oh my God, this guy's insane.
• 51:40
  What I'm, but in reality, one of the things that I think is, is
• 51:47
  extremely important is as a user and, and I, I say this and I
• 51:53
  don't want my, my RSMIT team ever listening to this comment.
• 51:59
  I don't need to be an administrator on my computer to
• 52:01
  do my day-to-day job, right? I don't need to have
• 52:04
  administrative privileges or high privileges in other places,
• 52:07
  right? So that clean up of users while
• 52:11
  you're implementing Pam is, I mean just the best thing and and
• 52:17
  most of the financial services companies that I visit that have
• 52:21
  implemented this correctly are really, really hard to
• 52:25
  compromise. David, why is that so important?
• 52:27
  Because I think that's like the third rally, try to take some
• 52:30
  most administrative privileges away.
• 52:33
  Why is this so important to do? So from an attacker's
• 52:36
  perspective, because in general terms, if you're not
• 52:42
  implementing this type of let's take away from users their
• 52:46
  privileges and then let them use their privileges, high
• 52:49
  privileges when they are just needed.
• 52:52
  It's almost impossible to identify when, when a compromise
• 52:57
  just happened, right? If you think about everything
• 53:00
  that we just discussed, Jim, service accounts, non human
• 53:06
  identities, and then high privileged user accounts.
• 53:10
  If those three things are used always in a specific places at a
• 53:16
  specific times and you know that there's a pattern because non
• 53:19
  human identities usually have a pattern, whether we like it or
• 53:23
  not. They're always enacted in some
• 53:25
  sort of way that you can identify patterns on it, unless
• 53:28
  you have an spaghetti of things, which can happen at the
• 53:30
  enterprise table, but that is one thing, right?
• 53:33
  And then the second piece, users, like humans, usually need
• 53:38
  their privilege, their privileges when you're acting on
• 53:41
  a change, right? If you're not changing anything,
• 53:45
  you don't need those privileges. You just need, I mean, to act as
• 53:49
  a regular user when you're acting as a privileged user all
• 53:52
  the time. It's the best way for anybody to
• 53:57
  hide under that noise. So at some point in time, if
• 54:02
  anybody uses that privileged account in a malicious way,
• 54:05
  whether it's an internal person or someone else, you'll find
• 54:10
  out, I mean days, months, years in advance and you'll never know
• 54:16
  why, right? So that is, that is the key
• 54:20
  piece of everything. That's just, there's no need.
• 54:23
  And if there's no need and you don't restrict it, then you're
• 54:27
  just going to allow someone to hide themselves in the noise.
• 54:30
  And, and the last piece, I would say go back to the change
• 54:34
  management comment. I mean, the biggest issues that
• 54:38
  we have seen in large scale technologies nowadays is because
• 54:42
  people implementing changes without really understanding the
• 54:47
  type of privileges that they had.
• 54:48
  And the change that they did was so impactful that they couldn't
• 54:53
  come back to, I guess, a stable state, right.
• 54:56
  So even if it's from an operations point of view, remove
• 55:00
  the cybersecurity component and then just go into CIO view, you
• 55:07
  cannot be doing changes without a real analysis of what the
• 55:12
  change is going to be with a privileged account.
• 55:14
  So that that would be my my immediate reaction to that.
• 55:18
  Yeah, and that, you know, I, I've always thought of it as
• 55:21
  like, if you're not an administrator, if you don't have
• 55:23
  the ability to install software, you get that attachment that
• 55:29
  looks like a doc, but it's really an EXE and good to
• 55:33
  install it. Your computer's going to stop
• 55:34
  you, and probably that was some sort of malware or spyware or
• 55:38
  something. So taking away that admin
• 55:41
  privilege stops them from putting the worm on the network
• 55:45
  in the kind of the old context, or doing a keystroke log or
• 55:50
  something like that. Yeah, like you guys are
• 55:52
  forgetting something very important here.
• 55:54
  What if? What if I need that access?
• 55:57
  Yeah, exactly. And well, and then and then as.
• 56:00
  Argue with that. Yeah, well and then as IT people
• 56:04
  you don't want to be dealing with the hey, can you give me
• 56:06
  this access and then someone that is not in a good mood just
• 56:09
  I mean delaying the access, right.
• 56:10
  But I agree with that. The what if is the challenge.
• 56:13
  And the last piece I would say because you asked for three
• 56:16
  things, right. And the last thing is you need
• 56:20
  to redefine what privilege is in your organization.
• 56:25
  So you you made a really good point, Jim, which is if I need
• 56:29
  that, if I don't have admin privileges, then you cannot do
• 56:34
  XI think one of the main failures in cybersecurity is
• 56:37
  that everybody thinks that privilege is just admin
• 56:40
  privilege. And in many cases, you have a
• 56:43
  lot of privileges in your organization that require the
• 56:47
  same type of the scooting or more than an administrator.
• 56:53
  And we, because cybersecurity doesn't understand the business
• 56:56
  well or the processes of the business, we decide that the
• 57:01
  only thing that we shouldn't can protect is the administrators
• 57:05
  and not maybe other roles that might be way more concerning to
• 57:09
  the business than just your administrator in IT.
• 57:12
  So that's that's the last thing that I would say that they they
• 57:15
  should be focusing on, which are not easy, but those are the
• 57:17
  things that I would immediately focus on if I was on the other
• 57:20
  side, I would say. Well, the definition of
• 57:22
  privilege is something that I, you know, bring it comes up
• 57:25
  quite a bit, I think in my day job is how do you define that?
• 57:28
  Because I think a lot of people just assume when they hear
• 57:31
  privileged access management, they think of things like, you
• 57:33
  know, domain admin, cloud admin, right, all the sort of built in
• 57:37
  rules. But there are a host of admin
• 57:40
  type privileges that exist within every application out
• 57:43
  there, including your social media apps.
• 57:46
  You know who can go on LinkedIn and post something that maybe
• 57:49
  your company doesn't want posted?
• 57:51
  Absolutely. Or Facebook or Twitter or you
• 57:54
  know, whatever, whatever it's called now X, you know, you
• 57:56
  know, blue Sky or Mastodon or whatever it is.
• 57:58
  Like I would argue that social media should be part of the
• 58:02
  definition of privileged access management, Maybe not managed
• 58:06
  specifically, but at least from a policy standpoint, how are we
• 58:09
  governing these? Accounts, I can see that,
• 58:10
  especially if you're a public company, right?
• 58:12
  Because if you're a public company and someone in social
• 58:15
  media, someone that owns social media publishes something, I
• 58:19
  mean, they can actually manage to hit your stock in a negative
• 58:23
  or positive way in some sort of way, right?
• 58:26
  So I think, I think you have to distinguish obviously between
• 58:28
  the type of company and the size of the company.
• 58:31
  But I I would agree with that comment for sure.
• 58:33
  Yeah, everyone has to be protective of their public
• 58:36
  persona, and there's no quicker way to to destroy that than to
• 58:40
  post something on, you know, a social channel that shouldn't
• 58:42
  be. There and that that that's
• 58:44
  actually a fun story. So one of the things that we
• 58:46
  find most of the time, I mean, I would say probably 40% of the
• 58:51
  time in the, in the places that we visit and, and we know this
• 58:54
  type of offensive security analysis is we do find a lot of
• 58:59
  SharePoint sites or OneDrive with just usernames and
• 59:03
  passwords, right? Which tells you that there's a
• 59:07
  need for some sort of a Pam and there's a user there that
• 59:12
  doesn't know what to do. And I mean they're not being
• 59:15
  enabled in some sort of way, but the by the IT department to
• 59:20
  manage their credentials correctly.
• 59:22
  I'm sure every Cecil listening to this just kind of cringed.
• 59:25
  Oh, they're going to love me. Like it's just like these guys.
• 59:27
  It's just. All right, we're coming up on an
• 59:31
  hour here. David.
• 59:32
  I feel like there's so much to unpack.
• 59:34
  Read the report, it's great. And then read my follow up,
• 59:36
  which will also be great. I'll just show that as well.
• 59:38
  There'll be links in our show notes.
• 59:40
  There'll be links kind of everywhere for it.
• 59:42
  We like to end our shows in a later note.
• 59:44
  And one of the things that you do in your spare time that you
• 59:47
  shared with us is you play soccer and you know, other
• 59:51
  family type sports. I don't know if we have time to
• 59:54
  touch on everything, but tell me a little bit about your soccer
• 59:56
  because I thought it was kind of interesting that did I hear you
• 59:59
  correctly or that you play you used to play like semi pro or at
• 1:00:02
  least approaching pro. Semi pro, I was approaching pro
• 1:00:05
  level and at some point I stopped because I didn't want to
• 1:00:09
  risk it on my knees to, I mean, basically make my money.
• 1:00:13
  But yeah, at some point and I was really competitive for a
• 1:00:16
  very long time. And now I play, which is the,
• 1:00:20
  the, the joke of the house in the house is now I play over 40s
• 1:00:27
  on Tuesdays and then I play soccer on Saturdays with my kids
• 1:00:32
  parents class parents, right? And I mean my son every time
• 1:00:39
  that goes and just goes and watch and watches me how I'm
• 1:00:42
  playing, he's, he's always telling me, man, it's just like
• 1:00:45
  you're playing in a slow motion. You're totally washed.
• 1:00:48
  You cannot do what you used to do before because he, he knew me
• 1:00:51
  when I was better, I think. And now I'm not that good.
• 1:00:55
  So that's one of the things that, yeah, I I do on my free
• 1:00:58
  time, but I don't know how much time I can still do it.
• 1:01:01
  I guess we'll see. So what position does a washed
• 1:01:06
  player like yourself play these days?
• 1:01:09
  Offense, you know, you kind of roaming midfield like where you.
• 1:01:12
  At So I stopped playing on Sunday's league because that was
• 1:01:16
  involving the 20 year olds and I was, I mean, basically on the
• 1:01:22
  different side, basically on, on the left side defense.
• 1:01:29
  On the other teams. I still can't play midfield or
• 1:01:31
  forward and I'm, I'm doing pretty well.
• 1:01:34
  Like I can run, I can do all these other things, but when I
• 1:01:37
  play against the 20 year old guys, I'm the guy that is just
• 1:01:40
  kicking and I mean trying to survive for 20 minutes because
• 1:01:45
  it's not to shave anymore. The other thing that happened to
• 1:01:47
  me, I mean, I'm you cannot tell, but I'm not a tall guy or really
• 1:01:51
  strong person either compared to the average American, I would
• 1:01:56
  say. And I used to play soccer in
• 1:02:01
  Latin America where you could be playing really hard and strong
• 1:02:05
  and, and you'll feel strong because most people are the same
• 1:02:08
  size as you are. Then I came into the US, started
• 1:02:12
  playing and it was just like it was day and night like I used
• 1:02:16
  to. Like I used to go in and class
• 1:02:18
  with people. Like I felt that I could do it
• 1:02:20
  and I felt in the best shape of my life.
• 1:02:23
  And then I would go clash with all these people and it was just
• 1:02:27
  like running into a wall. And I remember like the first
• 1:02:30
  two years that I was playing soccer here in Houston is still
• 1:02:32
  pretty competitive. My wife, my wife would tell me
• 1:02:36
  what the hell is going on with you?
• 1:02:37
  Because I would wake up the next day and it would have been like
• 1:02:41
  I have taken a beat from someone, right?
• 1:02:44
  Like I couldn't walk. Like I had bruises all over the
• 1:02:48
  place. So basically that made me change
• 1:02:50
  my style of, of flame and now I'm less, I don't talk trash
• 1:02:56
  that much anymore. And then I, I don't crash into
• 1:02:59
  failures anymore. But yeah, for sure, soccer is
• 1:03:02
  something that I, I love to do and I'll play until I, I can, I
• 1:03:05
  guess. So I'll share a soccer story.
• 1:03:08
  I used to play in high school and so I played right fullback,
• 1:03:11
  which is defender for us. And I'm not a tall person
• 1:03:15
  either. You know, I, I stand up very
• 1:03:17
  proud 5-6. Now imagine me in high school
• 1:03:20
  and like middle school where, you know, definitely I've been
• 1:03:23
  approaching that. And so, you know, I was, I would
• 1:03:26
  say I was pretty good for high school.
• 1:03:28
  Well, you know, never going to go to like school for anything
• 1:03:29
  like that, but I was good enough.
• 1:03:31
  And you know, here is this short little, you know, Jeff Wright
• 1:03:36
  fullback playing for this team and we were pretty good and we
• 1:03:40
  played what was it I want to say?
• 1:03:42
  And this is for my my folks in Illinois.
• 1:03:44
  I think we played a school in Schaumburg, IL and they showed
• 1:03:49
  up to the to our field and they were all men who showed up for
• 1:03:54
  this like 9th grade, you know, high school game.
• 1:03:58
  And they were all like 6-2 towering above.
• 1:04:02
  And I remember when to that game and, and we won, we beat them
• 1:04:05
  because we were a good team. But my dad was watching and he
• 1:04:10
  described me as a gnat on the leg of this horse of a forward
• 1:04:16
  that was coming down to my side. And I, I locked that kid down,
• 1:04:20
  you know, like he couldn't get past me.
• 1:04:22
  I was good. And he got so frustrated that
• 1:04:24
  he, like, you know, got a yellow card on me by like shoving me or
• 1:04:27
  whatever. But you know, power toll is all
• 1:04:30
  the short kings, David. I know.
• 1:04:32
  And that's the thing. Like, I mean, for for me soccer,
• 1:04:35
  that's the beauty of soccer, right?
• 1:04:36
  Like, I mean, you can be not as strong as the other players, but
• 1:04:40
  you can still win. And it's a team sport and it's
• 1:04:44
  AI think a really mental sport. People misses that a lot.
• 1:04:47
  And we used to have this saying in Mexico when when I used to
• 1:04:51
  play soccer and there was a bigger team, like our coach
• 1:04:53
  would tell us. I mean, it doesn't matter if
• 1:04:56
  they're big or not, you're not going to carry them.
• 1:04:57
  You're just going to score on them.
• 1:04:58
  It's like that is a true statement.
• 1:05:00
  Like you don't carry them. Like I don't have to fight you.
• 1:05:02
  I would just have to score on you.
• 1:05:04
  So anyhow, you know. All right, let me ask you one
• 1:05:06
  last question. That's trash talk, something
• 1:05:10
  that either you've received or given out that someone listening
• 1:05:14
  to this, maybe me, maybe Jim, I'm going to ask you the same
• 1:05:16
  question here a little bit. But what's a good like trash
• 1:05:19
  talk that you were like? I'm pretty proud of that one.
• 1:05:21
  That was a good one, either given to you or you've dished
• 1:05:27
  out to somebody else. So the, I mean, the one that I
• 1:05:29
  remember that's given me in my head right now is the one that
• 1:05:32
  my son applied to me just recently, to be honest, like I
• 1:05:37
  mean it. Hurts because it came from
• 1:05:38
  inside the house. Yeah, I mean whiff, slipping
• 1:05:41
  phone, I mean almost every weekend.
• 1:05:44
  And then he, he's usually getting, he's getting pretty
• 1:05:49
  good at it. And at some point when he's
• 1:05:52
  getting really good and he's winning point after point after
• 1:05:54
  point, he starts saying, Oh, I'm knocked in, I'm knocked in.
• 1:05:57
  I'm going to get you, I'm going to get you.
• 1:06:00
  And then at some point with the last time that he, I mean, he
• 1:06:02
  continued to build up on that, right?
• 1:06:04
  Like he said he was like, oh, I'm locked in.
• 1:06:05
  I'm locked in. And I was like, I'm starting, I
• 1:06:07
  was starting to get pissed off from myself.
• 1:06:09
  Like what is going on? Like, why is this guy just start
• 1:06:12
  talking trials? And then he actually won.
• 1:06:14
  And, and when he finished the, the, the, the game, he just put
• 1:06:21
  his paddle on the table and he was like, I owned you.
• 1:06:24
  It was like, Oh my God. And like, that means so many
• 1:06:28
  things for me, right? Because even going from a
• 1:06:31
  cybersecurity perspective is like, anyhow, that is probably
• 1:06:36
  the better one that that has been applied to me daily.
• 1:06:40
  And he always tells me that I'm washed.
• 1:06:42
  So those are the two things that I'm just like, but I just live
• 1:06:45
  with it now. I don't think I, I, I, I get
• 1:06:47
  that often. I just laugh.
• 1:06:50
  Then he sets him upstairs to do his homework.
• 1:06:52
  Yeah, yeah, go work, whatever. And then his mom would do the
• 1:06:56
  same to me. So she just all across the
• 1:07:00
  family that runs in. So what about you guys?
• 1:07:03
  Jimmy got good trash talk. You know, I I'm a little old
• 1:07:07
  school Jeff, which I'm sure you had no no clue of that.
• 1:07:12
  But here's the trash talk. I think it works if you can, if
• 1:07:16
  it's actually true and it works in every sport, which is
• 1:07:19
  scoreboard. You know, one thing I can't
• 1:07:22
  stand is like a team is down 5 touchdowns or five scores or
• 1:07:27
  whatever sport you're playing and they're in the end zone
• 1:07:30
  dancing because they got a sack or something.
• 1:07:33
  It's like scoreboard, dude. That's all they're that's all
• 1:07:38
  you have to say. Yeah, my favorite is when the
• 1:07:40
  wide receiver gets up, they've got a first down and a
• 1:07:42
  meaningless drive at the end of the game, and it's like, OK,
• 1:07:45
  dude. Like yeah, scoreboard.
• 1:07:47
  Get over. It you know, my first down
• 1:07:49
  signal like whoa, yeah, I caught a 11 yard pass and we're losing
• 1:07:53
  40 to nothing. Unless that catch got you like
• 1:07:56
  $100,000 bonus, go back to the huddle.
• 1:07:58
  Yeah, right. You know, my favorite trash talk
• 1:08:01
  that I always like to do was I played a lot of basketball and I
• 1:08:04
  was, I was pretty good back in the day.
• 1:08:06
  You know, Spike being short and all that stuff.
• 1:08:09
  I could shoot dribble Dr. you know, it's kind of a point
• 1:08:11
  guard. And I would call my shots
• 1:08:14
  against all my tall friends. Oh, nice.
• 1:08:17
  And they're all, you know, 6 feet plus.
• 1:08:19
  And, you know, in the in the words of your son, David, I
• 1:08:22
  owned them. It was my court.
• 1:08:25
  And I would call the shot that I would do in the game very much
• 1:08:29
  like Larry Bird used to do Nice. Now I have I am.
• 1:08:33
  Those days have long passed me by SO.
• 1:08:36
  They don't ask you. What were they going to do?
• 1:08:40
  I was going to, I, I would score.
• 1:08:42
  It will. Let me just put it that way.
• 1:08:45
  Yeah. So that was my trash talking
• 1:08:47
  was, you know, OK, here's what I'm going to do.
• 1:08:50
  And every once in a while, we would lower the rims in my
• 1:08:53
  backyard because I had a basketball hoop in my backyard.
• 1:08:55
  And we'd lower it down to like 9 feet and I could dunk on 9 feet
• 1:09:00
  and I would call the shot. And I remember one of my
• 1:09:02
  friends, you know, shout out, shout out to Chad out there.
• 1:09:05
  I've known since 8th grade. I told him that I was going to
• 1:09:09
  bounce the ball off his head and dunk it.
• 1:09:11
  No. And I did.
• 1:09:13
  Oh my God. I wish it was a.
• 1:09:17
  Video for that. Well, I'm I'm glad there wasn't
• 1:09:19
  because there was probably a whole bunch of language that
• 1:09:21
  probably would not make it safe to error these days.
• 1:09:23
  But that was my thing was, you know, that was my safe place was
• 1:09:28
  the basketball court. And this is this was my house,
• 1:09:32
  and I was going to tell you how it was going to run.
• 1:09:34
  That's really cool. I didn't know that you played
• 1:09:37
  basketball. So that's.
• 1:09:37
  Very, very long time ago. Don't ask me to do it now.
• 1:09:40
  But you should see Jeff's calves or like they're jumping calves.
• 1:09:44
  Yeah, I used to be in the backyard.
• 1:09:47
  Yeah. It was, you know, it was, it was
• 1:09:48
  my thing. That was just bat and soccer.
• 1:09:50
  So OK, we're in a like an hour and 10 minutes and we just spent
• 1:09:54
  10 minutes trash talking and talking about soccer and
• 1:09:57
  basketball. But go to the website, go to our
• 1:10:00
  show notes. You know, we'll have a link to
• 1:10:01
  the the attack vectors report. David, thank you so much for
• 1:10:05
  joining with us and sharing your wisdom and, you know, putting us
• 1:10:09
  report. You know, I think it's, it's one
• 1:10:10
  of the things that we want to get more involved with.
• 1:10:12
  I think you know from the podcast perspective is when we
• 1:10:15
  have these types of information to share, do it in a way that is
• 1:10:19
  as free from commercial as possible.
• 1:10:21
  So it is coming from our. Company, this was fun.
• 1:10:24
  Thanks so much. Really appreciate it.
• 1:10:25
  So I'm gonna have a link in our show notes to your LinkedIn
• 1:10:28
  profile so people can reach out whether it's, you know,
• 1:10:30
  something about the attack factors report or maybe a really
• 1:10:32
  good trash talk that you'd like to share and we'll.
• 1:10:35
  Go. Ahead and leave it there for
• 1:10:38
  this week. You can find us on the web, IDC,
• 1:10:41
  podcast.com. Like subscribe, share with a
• 1:10:44
  friend, share with an enemy. Doesn't matter as long as people
• 1:10:46
  are listening, that's all it matters to us.
• 1:10:48
  And yeah, thanks everyone for watching and or listening and
• 1:10:52
  we'll catch you with you all in the next one.
• 1:10:56
  You've been listening to Identity at the Center.
• 1:10:59
  We hope you've enjoyed the show. Make sure to like, rate and
• 1:11:03
  review, and we'll be back soon. But in the meantime, hit the
• 1:11:07
  website at identity@thecenter.com.
• 1:11:11
  See you next time on Identity at the Center.