Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Identity Protection in AI World in Privacy with Bob Burke and Punit Bhatia in the FIT4PRIVACY Podcast E153 S07

Transcript

Identity Protection in AI World in Privacy with Bob Burke and Punit Bhatia in the FIT4PRIVACY Podcast E153 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  Identity protection has been at the centre of all the
• 0:04
  conversations on security privacy in last decades or last
• 0:08
  years because it's all about protection of identity.
• 0:11
  We do data protection so that the personal data of individuals
• 0:15
  is safe. We do security measures, access,
• 0:18
  access controls, multi factor authentication and so on so that
• 0:21
  identity of the person logging in is controlled and is secured.
• 0:25
  Now this identity protection space is changing because of the
• 0:29
  AI world. Of course the fundamentals
• 0:31
  remain same, but there are changes and the threats to
• 0:34
  identity are also changing. There are new threats.
• 0:37
  How do you identify these new threats?
• 0:39
  How do you eliminate these threats?
• 0:41
  What can you do about identity protection?
• 0:44
  Is it the same for a startup and same for a bank?
• 0:48
  Certainly not because the resources are different, the
• 0:50
  challenges are different, the systems are different.
• 0:52
  So we are going to have an interesting conversation with
• 0:55
  Bob Burke on identity protection.
• 0:58
  And as we do this conversation, I invite you to visit Grow
• 1:02
  Skills Dot Store and take a look at ISO trainings.
• 1:06
  Like if you're in the security field, ISO 27,001 can be an
• 1:10
  interesting addition to your competence, and adding a
• 1:13
  certification on that can help you.
• 1:22
  Hello and welcome to the Fit for Privacy podcast with Punit
• 1:26
  Bhatia. This is the podcast for those
• 1:28
  who care about their privacy. Here, your host, Punit Bhatia
• 1:32
  has conversations with industry leaders about their
• 1:35
  perspectives, ideas, and opinions relating to privacy,
• 1:38
  data protection, and related matters.
• 1:41
  Be aware that the views and opinions expressed in this
• 1:43
  podcast are not legal advice. Let us get started.
• 1:51
  Hello, and welcome to another episode of the Fit for Privacy
• 1:53
  podcast. And today I'm with Bob Burke.
• 1:56
  My name is of course, as you know, Puneet Bhatia.
• 1:59
  And we are going to talk about many topics on security, on AI,
• 2:03
  on privacy. Today, Bob, welcome to Fit for
• 2:05
  Privacy Podcast. Thank you, Parineet, it's a
• 2:08
  pleasure to be here. Thank you so much.
• 2:10
  It's a pleasure to have you. So we are in a world in which
• 2:14
  it's changing. I mean, if you look about two
• 2:16
  decades back, we were talking about security and compliance,
• 2:19
  then we talked about privacy. In between we were talking of
• 2:22
  digital trust. And nowadays we are talking
• 2:25
  about quantum as well. But a few things have remained
• 2:28
  common. Every time they said be
• 2:30
  responsible, be accountable. And these days, the new buzzword
• 2:34
  is responsible AI or ethical AI, and I'd like to have your
• 2:38
  opinion on this concept of responsibility AI.
• 2:42
  Yeah, I, I think it, it kind of falls into, if I can, I'll break
• 2:46
  it up into two general categories.
• 2:48
  There's building a system that understands that responsibly
• 2:53
  takes the current threat landscape and the AI threat
• 2:56
  landscape into consideration. We are very quickly moving away
• 3:00
  from legacy solutions where there are sufficient.
• 3:02
  We're moving into a, a, a world where the scope and the scale of
• 3:07
  those threats are growing exponentially.
• 3:11
  And then there's the other internal perspective, which is
• 3:14
  companies who are deploying AI solutions.
• 3:17
  Now this is really interesting because as you deploy AI
• 3:19
  solutions internally and you have agents and you have LLMS,
• 3:24
  it changes the whole privacy model of information.
• 3:27
  And I'm sure this is something you know quite a bit about
• 3:29
  Panit. But fundamentally the
• 3:30
  architecture changes, authentication, authorization
• 3:33
  changes, and more importantly, we've moved away from a static
• 3:37
  kind of well understood privacy model.
• 3:40
  And now we're running it through inference engines.
• 3:44
  And one of the things I've been thinking about recently has been
• 3:47
  around what does it mean when you have an inference engine on
• 3:50
  top of a bunch of aggregated data?
• 3:53
  We as privacy people have spent so much time ensuring that we
• 3:57
  anonymize data and it can't be de anonymized.
• 3:59
  And now we're putting an inference engine on top of data
• 4:03
  that is doing exactly that. What does that mean to privacy?
• 4:06
  Yeah, indeed. That's a good one.
• 4:08
  I think we need to start looking at anything, whether it's
• 4:12
  security, privacy, responsibility in 2 dimensions,
• 4:15
  one for those who build it and that one for those who deploy
• 4:19
  it. Yes, in the past, application
• 4:22
  was built and deployed in the same organisation, but it's no
• 4:24
  more the case. And that's a very interesting
• 4:27
  perspective. And when we talk about this,
• 4:29
  security or data protection matters.
• 4:33
  I think let's start with a start up scenario, use case, let's
• 4:37
  say, because these start-ups have a focus or priority on
• 4:40
  getting the concept out, the thing out, the product out.
• 4:44
  But then comes security and privacy folks like you and me,
• 4:47
  and we say no, you have to focus on privacy and security.
• 4:51
  So what does privacy or security mean for these start-ups?
• 4:55
  What would you start with? Yes.
• 4:57
  So that that again, they're very interesting and I've seen the
• 5:00
  evolution radically change over the last five or six years.
• 5:05
  And it's not related to AI. We'll talk about that in a
• 5:07
  minute. But fundamentally, because we've
• 5:10
  seen the explosion of interconnected organisations,
• 5:15
  the explosion of SAS solutions, everybody's Federated.
• 5:18
  So you're at your, your organisation isn't the only one
• 5:21
  that's Federated, but companies are Federated between
• 5:24
  themselves. And so a startup just has to
• 5:27
  face the reality that you can't just do that anyway.
• 5:30
  You can't build it and then make a compliant private privacy and
• 5:35
  security after the fact. Right now, today, when you sell
• 5:39
  your first solution and you're a five person startup or a six
• 5:42
  person startup, they're going to ask you about compliance.
• 5:46
  They're going to ask you if I deploy your solution, what does
• 5:48
  it do to my automated GRC programme?
• 5:51
  What does it do to my automated compliance programme?
• 5:54
  Where's your SoC audit? If you're going to sell
• 5:57
  overseas, do you have a GDPR stance?
• 6:00
  Compliance is no longer and privacy is no longer something
• 6:03
  you put in at the end. It has to be baked in early.
• 6:06
  And surprisingly, I mean, just to my own journey, 5 or 6 years
• 6:10
  ago, I probably maybe someone asked me about a CCPA because I
• 6:14
  was selling in California maybe and maybe I got a A2 line
• 6:19
  spreadsheet saying do you support it or not?
• 6:20
  And we just say, yes, that is not the case anymore.
• 6:24
  You are going to get data privacy impact assessments.
• 6:28
  You're going to have to fill out do SoC audits and Dpas.
• 6:33
  It's just the way it is today. Yeah, I agree with you.
• 6:37
  It's no more a question that compliance is asking.
• 6:40
  It's also the question that customers are asking.
• 6:43
  And it's better that you do these things and produce
• 6:48
  proactively saying this is my GDPR compliance statement, this
• 6:51
  is how I'm managing security and that way the trust in your
• 6:54
  product goes up. But then while for start up we
• 6:59
  talk about doing it proactively, I'm very sure that it's not the
• 7:03
  same intensity or the same extent to which you deploy
• 7:07
  because the system landscape, IT landscape is very different
• 7:11
  compared to a bank. So what are the few things you
• 7:15
  recommend to start-ups usually starting like you mentioned, 5-6
• 7:20
  people company? Yeah.
• 7:21
  And I think, you know, it's kind of, again, I've learned this
• 7:24
  through the school of Hard Knocks.
• 7:28
  You know, we, we saw an evolution of the analogy I like
• 7:31
  to use when people ask, you know, wait a SEC, how do I get
• 7:34
  this going is let's take a look at how we did deployment, SRV
• 7:37
  and engineering just for say 5678 years ago.
• 7:42
  Those were siloed organisations and they deployed independently,
• 7:46
  do stuff over the wall. Now we have integrated dev SEC
• 7:48
  OPS, right? The teams just work
• 7:50
  collaboratively all the time. And I, some of the younger
• 7:54
  engineers coming up don't even understand how it was done
• 7:57
  before and they can't imagine how it was done before.
• 8:00
  It's the same thing, I believe right now.
• 8:02
  It's the same thing with product compliance and engineering.
• 8:05
  We're seeing that change now. And it may be strange to some of
• 8:09
  the privacy and the CEO's and the CIO's today who are used to
• 8:14
  that separation, but it's being put together and in a few years,
• 8:18
  we won't think of it as separate kind of separate functions.
• 8:21
  It's just kind of like that dev SEC OPS, but it's almost like,
• 8:24
  you know, compliance privacy OPS.
• 8:27
  And that's the only way you can deliver.
• 8:30
  No, I think definitely it's not privacy or security or
• 8:33
  compliance. It's integrated into dev OPS and
• 8:36
  what dev SEC OPS and that's how it's being done.
• 8:39
  But one thing which I believe has remained common or there are
• 8:44
  two things I would say 1 is the protection of assets.
• 8:48
  So your system, your website and things like and that.
• 8:51
  And then is the protection of customer identity or individual
• 8:55
  identity, whether it's your employee logging in, whether
• 8:58
  it's your customer logging in, supplier logging in.
• 9:00
  And that those are the two concepts on which the security
• 9:03
  or privacy, privacy of course on the second part and security on
• 9:06
  both revolves. So how would you define that
• 9:12
  identity needs to be protected in the basic sense of it?
• 9:15
  Because we will. I would like to have eventually
• 9:18
  a conversation on the threats to identity.
• 9:22
  But let's say, how would you protect identity normally?
• 9:25
  Yeah. So first I'll say that and let
• 9:27
  me back up just a bit. We'll get into that
• 9:29
  specifically. And I'm, I'm sure we're on the
• 9:31
  same page here. At the core of everything that
• 9:33
  we do is, is digital trust, right?
• 9:36
  It's in, you just need to have a digital trust model.
• 9:38
  And now you're pinning that you have secure by design, compliant
• 9:41
  by design, privacy by the sign, those all underpin that digital
• 9:46
  trust relationship. Core to all of those, you cannot
• 9:49
  establish a trust, a security or a compliance programme without
• 9:53
  strong identity. And so fundamentally, and this
• 9:56
  is really one of the core offerings that Beyond Identity
• 9:59
  has, is we work with organisations to secure their
• 10:03
  identity if through secure authentication and drive that
• 10:07
  into the access plane across all the different deployment
• 10:10
  scenarios. And the best way you can secure
• 10:13
  a strong trust relationship with your customers, the first thing
• 10:17
  you can do is protect their identity.
• 10:19
  How many times has somebody used a solution?
• 10:22
  Well, let me back up how many times the listeners, I bet you
• 10:26
  every one of your listeners has received an EA letter in the
• 10:29
  mail saying your identity has been compromised.
• 10:32
  We have now given you a free identity security plan, right,
• 10:37
  or identity protection plan because the systems are
• 10:40
  fundamentally insecure and that's kind of quarter beyond
• 10:42
  identity's mission. But it you got to secure the
• 10:45
  identity, it's fundamental. Without that, you can't build a
• 10:49
  privacy plan or a compliance regime.
• 10:53
  No, I agree with you, but how has the threat to identity
• 10:57
  changed in last few years, especially with the more and
• 11:02
  more AI coming into into our systems?
• 11:05
  It's it's actually crazy. So one of the things that when
• 11:08
  we talk to our customers is the absence of proof isn't proof of
• 11:13
  absence. Just because you haven't been
• 11:15
  breached doesn't mean your programme working.
• 11:17
  It means probably the threat actors have done a cost benefit
• 11:22
  analysis and you haven't been on their radar.
• 11:23
  OK, that's completely changed today.
• 11:27
  The cost benefit analysis with phishing as a service, malware
• 11:31
  as a service, and has changed that landscape.
• 11:35
  So now it's a few $100 and I can deliver a phishing campaign that
• 11:39
  is hyper realistic out-of-the-box.
• 11:42
  Then you layer on AI and they become hyper realistic, very
• 11:48
  contextually focused. And then you layer on vishing
• 11:52
  and then deep fakes and the entire landscape has changed.
• 11:55
  Not only the attacks more effective, but the scope and the
• 11:59
  tempo is increasing. So everybody needs to take a
• 12:02
  hard look at kind of how they've secured their systems so they
• 12:05
  get ready for the oncoming onslaught.
• 12:07
  I mean, it's, it's common and it's coming fast.
• 12:09
  Yeah, that makes sense that it's changing.
• 12:14
  But the question is how do you determine, how do you identify
• 12:17
  this kind of a threat? Because we all know there are
• 12:21
  threats. We all know we should invest.
• 12:23
  But how does one go about identifying an identity threat?
• 12:28
  Yeah, I think, I think First off the, so the, the if, if we put
• 12:33
  deepfake aside, AI is just accelerating the ability to
• 12:37
  drive traditional threats across the board both in scope and
• 12:40
  tempo. The kinds of identity threats
• 12:43
  that we have are very well understood.
• 12:45
  There's the attack change that we we understand which initial
• 12:49
  credential access, fishing, fishing, whaling, all of these
• 12:52
  things are well understood. They're just being
• 12:54
  industrialised, OK. And So what, what I, what I,
• 12:59
  what I, what a company needs to do is I need to go revisit those
• 13:02
  kill chains, both from initial access and lateral movement.
• 13:06
  And they need to look at their solution architecture and say,
• 13:10
  do I have a password? Yes or no?
• 13:12
  If I have a password, I need to get rid of it because that's,
• 13:15
  you know, do I have an MFA solution that has out of band
• 13:21
  communication like OTP or SMS, whatever.
• 13:24
  If I do, you just need to design it out.
• 13:27
  So I think the the threat landscape and the types of TTPS
• 13:32
  are well understood right now. It's just that the scope and the
• 13:37
  volume is changing and the, and the realism is changing.
• 13:40
  So design the solutions out. I mean design the designing
• 13:45
  attack vectors out with an architecture.
• 13:48
  You're still going to have to double down on your training
• 13:50
  with your with your your team because of the new types of
• 13:53
  threats like deep, fake and vision.
• 13:56
  OK. So if you have identified a
• 13:59
  threat, the immediate reaction is to contain it, to eliminate
• 14:03
  it so that they get back to the normal.
• 14:05
  And would you have any suggestions on how do a company
• 14:10
  eliminate the threat? Yeah, it's all right.
• 14:13
  So if you there's fundamentally there's prevention, detection
• 14:18
  and then response, right. And everybody, all your
• 14:21
  listeners know this. So from a, what you want to do
• 14:26
  is you want to look at, and this is where a lot of organisers
• 14:28
  make the mistake. They spend a lot of time on
• 14:30
  operations detection and response, which is critical.
• 14:33
  But you need to go down and look at the threats, meaning the
• 14:36
  threats are well documented. I can go through the MITRE
• 14:38
  attack chain and I go through all the initial access threads,
• 14:42
  the TTPS, I can go look at all the lateral movements and
• 14:45
  they're very clear what they do. You need to look at your
• 14:48
  architecture first and you need to say is my architecture moving
• 14:52
  a lot of those threats to prevention and resilience?
• 14:57
  And that's kind of what a lot that's a big part of what the
• 14:59
  Beyond identity does, both on the the initial access, then on
• 15:02
  the detection side, yeah, you have to move as quickly as you
• 15:06
  can to contain that right And completely understand it.
• 15:09
  And I think AI is really going to accelerate that ability to
• 15:12
  respond to that, the detection and response.
• 15:15
  But the way I, the way how I communicate the organisations
• 15:18
  and how we work internally is understand the threat landscape
• 15:22
  and the traditional threats and make sure that my architecture
• 15:26
  is eliminating those, moving them from detection to
• 15:28
  prevention. And then when I look at my
• 15:30
  detection and response, I'm going to augment that with more
• 15:34
  capabilities and particularly AI so that I can so that I can
• 15:37
  increase my response times. OK.
• 15:41
  And what role does then your company play the you are from
• 15:46
  beyond identity? What was the scope in which
• 15:50
  beyond identity operates in all this?
• 15:52
  OK, great question and thank you for that.
• 15:55
  So beyond identity originally started when we we started our
• 15:59
  our journey, it was 2 million passwords.
• 16:02
  We had a passion for fishing resistant MFA which which is
• 16:07
  great, but as we started to see the landscape change radically
• 16:10
  and things moved from the network layer into the to the
• 16:14
  identity perimeter. When everybody was Federated,
• 16:16
  bring your own devices and the workforce changed.
• 16:18
  This all radically changed over and particularly was accelerated
• 16:21
  with COVID. We realised that the identity
• 16:25
  was the new perimeter and the identity teams didn't have the
• 16:28
  security capabilities to address that because the security team
• 16:32
  was trained on legacy infrastructure because they were
• 16:34
  fighting last last year's war, right?
• 16:37
  And so the identity teams had a big gap.
• 16:39
  So what beyond identity did was it came in and said, you know
• 16:43
  what, we're going to build a custom built solution from the
• 16:45
  ground up that is secure by design, in compliant by design
• 16:51
  that targets that identity kill chain.
• 16:54
  And so it starts out with all the initial access and
• 16:59
  eliminates probably just designs out probably about, I think it's
• 17:03
  about 60% of those initial access threats.
• 17:07
  And then it also targets lateral movement.
• 17:09
  And we also recognise that what you have to do to do that
• 17:12
  properly is you have to bring the device and you have to bring
• 17:17
  the device to device trust and proper identity into that access
• 17:24
  plane to address a lot of the lateral movement threats and the
• 17:28
  other kind of token based threats.
• 17:30
  OK, that's good to know. So you're doing some good work
• 17:33
  to help people protect identity. The question would be if we look
• 17:38
  back and people are interested in knowing all the concepts that
• 17:42
  we talked about, basically saying you look at security or
• 17:45
  privacy in 2 dimensions or even responsibility and build versus
• 17:48
  deploy. You look at the
• 17:50
  interconnectedness of the today's organisation because
• 17:53
  everything is Federated. Then you set up an identity
• 17:56
  management approach, set up a security approach, which is
• 17:59
  security and privacy by design, not an afterthought.
• 18:02
  Yep. And then if someone says, oh,
• 18:05
  that these are interesting concepts and they want to talk
• 18:07
  to you or get in touch with you, so what's the best way to reach
• 18:10
  you? Reach out to.
• 18:10
  You. Thank you.
• 18:11
  Yeah. First go to beyondidentity.com.
• 18:15
  That's our site and we have a tonne of really, we have really
• 18:19
  great blogs and YouTube videos and podcasts and all kinds of
• 18:22
  great stuff. And we will be at Black Hat.
• 18:25
  So please reach out to our to set Black Hat.
• 18:26
  OK. That's good to know.
• 18:28
  And with that, I would say it was very interesting to
• 18:31
  understand how to go about security and especially identity
• 18:34
  protection, identifying the threats, eliminating the
• 18:37
  threats. And of course, we simplify here,
• 18:39
  but there's a lot of work to do and you're helping companies do
• 18:42
  that. So thank you so much and thank
• 18:45
  you so much for your time. Thank you very much.
• 18:47
  Thanks for listening, If you liked the show, feel free to
• 18:50
  share it with a friend and write a review if you have already
• 18:53
  done so. Thank you so much and if you did
• 18:56
  not like the show, don't bother and forget about it.
• 18:59
  Take Care and Stay Safe Fit for Privacy helps you to create a
• 19:03
  culture of privacy and manage risks by creating, defining and
• 19:08
  implementing a privacy strategy that includes delivering
• 19:11
  scenario based training for your staff.
• 19:14
  We also help those who are looking to get certified in
• 19:17
  CIPPECIPM and CIPT through on demand courses that help you
• 19:23
  prepare and practise for certification exam.
• 19:26
  Want to know more? Visit www.fitforprivacy.com.
• 19:32
  That's www.fitthe#4privacy.com. If you have questions or
• 19:40
  suggestions, drop an e-mail at hello@fitforprivacy.com.
• 19:46
  Until next time, goodbye.