Latest / Identity at the Center / #26 - IAM in Monterrey with Arturo

Transcript

#26 - IAM in Monterrey with Arturo · Identity at the Center

0:06
Do you know who has access to what this is?
0:08
The identity at the center podcast?
0:10
If you're looking for identity and access management talk
0:13
you've come to the right place and now on to the show, Welcome
0:26
to the identity of the sender podcast.
0:27
I'm on the road. Visiting my good friend Arturo
0:30
here in Monterrey, Mexico. This is my last week of travel
0:33
for 2019. So while I'm excited to be in
0:36
Monterey and see the mountains, that's it's gorgeous here.
0:39
By the way, whether it's perfect, it's like 50 degrees
0:42
Fahrenheit which is great for me.
0:45
Clear skies mountains, all over the place.
0:47
It's awesome. I thought it'd be a good time to
0:50
catch up with Arturo. Kind of pulls out the year and
0:52
talk about some of the different.
0:54
I am experiences. So So welcome again to the
0:56
podcast Arturo. How'd you?
0:58
Thank you. Thank you for having me.
0:59
Thanks for setting aside some time and no and actually you are
1:04
very lucky right now because we are having, as you say it, very
1:07
clear skies right now, so you can have other pictures from the
1:11
mountains. I hope to get some good pictures
1:12
from Vermont, top of the hotel around.
1:15
So let's dive a little bit into. There was some recent news
1:19
around I am in Mexico and that was pemex getting hit with
1:23
ransomware. Depending Who you talk to or
1:26
which article you read, it was either not a big deal according
1:29
to the company wine but there were other articles that were
1:32
quoting inside sources, saying it was a much bigger deal than
1:36
maybe it was being led on and systems were down for much
1:39
longer than we thought. The ransom was five million in
1:42
Bitcoin which is quite a bit. Has there been any discussion in
1:46
the Monterey? I am Community around that topic
1:50
and how that might affect other things.
1:52
Yeah, well in get, I think that Indian and all he did.
1:55
Cyber security Community. It has been along with the pemex
2:00
hack few weeks back. They were some others companies
2:05
in Mexico that were affected by the same type of attacks.
2:10
I don't have details. If we're the same type of
2:14
malware sample, or something different, but at the end, they
2:18
were different companies that got hacked using this ransomware
2:21
attacks. And I think, like, in Here in
2:26
Mexico different than in the u.s. we don't have a very tight
2:32
regulation in terms of communicating properly, this
2:36
kind of incident. Some of them they weren't public
2:39
because they wasn't a public or a bigger company like that Max's
2:45
case. And I think that I might agree
2:49
with you that the the issue is more about the Vacation because
2:56
we don't really know it was something important in terms of
3:01
real application of the company or not.
3:04
And so a lot of big cases that are happening in some other
3:09
countries. For instance, in the US, the
3:13
good things that we have in some cases is that communication was
3:17
very effective. So actually there are certain
3:20
articles that they highlight that the very good action of the
3:24
company after Interior was properly communicate, either the
3:28
public or the customer, the customer got affected.
3:32
So some of the hacks at the end, I think that more than be ready
3:36
to prevent the hack because it was providing, it was able to
3:41
prevent or not, some quesadillas and some other not.
3:45
But I think that the the ultimate point is they were able
3:50
to react properly after they got hack or after they have the
3:54
incident. Aunt, and I believe that the
3:57
things to highlight or the companies who are more or we as
4:02
a professional security professional.
4:04
We say, okay, this guy's seems like they're doing very good job
4:07
or they were prepared to react are the are the good ones in.
4:10
In the other hand, we have the companies who cannot react or
4:14
they're having misleading communication of the incident.
4:18
In this case, I think that that makes because it's a company of
4:21
the government. So it was a lot of talking,
4:25
Features or say one thing some other experts say other some
4:29
internal sources to reporter made some totally different.
4:33
I think that the cows was more around the communication in this
4:37
particular case. Yeah, I think that makes sense
4:40
and I guess it is a glad you brought that up that pemex is a
4:44
nationally controlled petroleum company.
4:47
So my understanding from what I've read is the hack affected
4:52
more on the billing side of things and sort of back office.
4:55
I didn't really affect what may be customers of pemex might have
4:58
seen, but it's probably more affected, B2B type things.
5:03
So people who maybe have a financial relationship, whether
5:07
you're a creditor or, you know, some sort of Builder within the
5:11
organization might have seen some more effects, but that does
5:13
make me wonder because the communication was vastly
5:17
different based on who you talk to.
5:19
So it's not, you know, it's fine, everything's under control
5:21
versus boy, things are real nightmare behind the scenes.
5:23
Really ideal for Is of computers are down.
5:26
Can't do whatever. And I think, I still feel like,
5:29
even in the US, that's still something that companies
5:31
struggle with it's the response to this.
5:35
So you know there's tons of information out there but really
5:39
the focus that people are taking now is it's it's not if we get
5:43
hacked, it's when we get hacked how we're going to respond to
5:45
it. So it's interesting that the
5:48
hack also that pemex face was also seen in the u.s. so
5:52
companies like Merck, I believe there was a like a shipping
5:55
company. Any Mercy, I think is what it
5:56
was, they had a very similar profile and they think that
5:59
maybe those hacks were done by the same group.
6:01
So there's clearly a targeted, you know, environment here, that
6:07
people that are using this specific ransomware were looking
6:10
for, very specific profiles for companies to try and breach,
6:14
right? And in some other things that I
6:16
just read these week is about how these type of Hearts like
6:20
the pain makes and certain others.
6:22
That happened a few weeks back. Gaining the attention of the
6:27
hackers because they say, well, there's a Target that seems to
6:30
be easy to have, right? And then so they are probably
6:34
try to look different companies based in Mexico that they can
6:38
Mexico Latin America that they can take advantage of this.
6:42
Yeah, I feel like the There's an opportunity.
6:44
If I'm looking for the Target to breach companies, that may be in
6:48
the small to mid size range that don't have the technical
6:52
controls in place, things around, privileged access
6:54
management. Or maybe their users are all
6:57
local administrators and I drop a thumb drive in the parking
7:01
lot. And, you know, the person is
7:02
trying to be helpful. I wonder what this is or they're
7:03
curious and they plug it into their machine and bang.
7:06
You know, now I've got their stuff and all their friends.
7:08
So it's just so I think something that companies are
7:11
starting to pay attention more to.
7:14
But at some point there will have to be some investment to
7:16
try and mitigate that through security training, security,
7:20
awareness. And then, you know what?
7:22
The technical controls to try and block those things from even
7:25
happening. The first place.
7:25
Yeah, and I think that the old, these things are good in general
7:30
because drag the attention of the top Executives and they
7:34
start making decisions based on this environment in general.
7:39
But but the other hand, we have that all the sales guys are
7:44
basically based their speech on our yet.
7:48
This product is Magic, product can help you with everything
7:51
including ransomware, which is, you are not very deep into Uh,
7:55
George, you are manager, photos, and have a deep understanding
7:58
about everything. You can probably try to buy
8:02
something to help you with the ransom.
8:03
We're having our first, don't something totally different
8:08
things like that. So you have to be cautious also
8:11
in making this decision. Yeah.
8:14
I mean you are you saying that sales people might not be honest
8:18
and their products that would never happen.
8:20
I know some very good sales, folks, you know shout out to my
8:24
guy Tim You know, he was he's really good and there are a lot
8:28
of really good sales folks that really do a good job of position
8:32
where they can help and where they can't.
8:33
But there are eyes. I feel like there's way more,
8:36
especially having sat on the customer side for so long of, oh
8:39
yeah, this is the Magic Bullet. Like you said, it will solve
8:41
everything solve, all my problems, Etc doesn't exist.
8:45
Right? Even the best magic bullet that
8:48
is out. There will only reduce the
8:50
chance of something happening will not outright eliminated.
8:54
Yeah. But after that, Wild used are to
8:56
identify these guys. Start to identify where even
9:00
with the words that they are using, you never did you
9:04
guarantee, you just knowing any guarantee to go to size.
9:07
Exactly. Let's talk a little bit about.
9:11
I am work done specifically this year and kind of the program
9:15
that you've been working to set up here.
9:17
What are or what is the biggest? I am accomplishment that you're
9:22
most proud of for 2019. I'll put you on the spot here.
9:26
So we'll give you a second to think about it.
9:28
But now, in terms of, I think, one of the things that I really
9:34
proud of is that this year at the beginning of the year, we
9:38
accomplished to enable multi-factor authentication to
9:42
the Hokum again, that it took us some time to actually go and
9:48
communicate and convince the user into that at the beginning.
9:52
But eventually after almost Four months or rolling out the
9:58
solution to more than 23 case of users.
10:05
I feel like we did it. I mean it's something I think
10:08
that is very good milestone for security posture and and also
10:15
it's like okay we are moving forward in terms of security or
10:19
users and in this case the employees and yeah, it's like
10:24
big step. It's in terms of security and
10:27
and and based on that, you start getting more traction on
10:31
different security feature that you can enable along with this
10:36
there knowing the near future, or I don't two years time,
10:39
probably, the biggest achievement should be part
10:43
World. A so that's what I'll say
10:44
something related to that. So we are Step-by-step right?
10:48
But this is the first step I think.
10:50
So I would say that is the first one over.
10:53
That's a big one. MFA is huge and for 23,000
10:56
people and that's across the globe to.
10:58
That's right. Not just a Mexican a different
11:00
culture people who doesn't want to use their phone for that.
11:03
And so the other thing is that technology right now using these
11:09
conditional access or this context of the authentication in
11:15
order to make decision? It's also Helps to right now.
11:18
This because otherwise, we'll be more complex or even impossible.
11:22
I would say, because if you are not having this context of the
11:25
user it, you cannot lowering the friction of the end user and at
11:29
the end that will kill you though.
11:31
So if you are going to prompt the MFA, every time that they
11:35
are signing in is going to be too much for them.
11:38
So being able to take advantage of that conditional access as
11:41
part of the MFA was probably a big help, right?
11:43
Yeah. Brody in our case, we doubt that
11:46
it wouldn't have gone through. It will be like just certain
11:49
amount of you sir and certain condition but not like totally
11:56
that's great. I think that's a pretty good
11:57
goal or a pretty good achievement for the year for
12:01
sure. Yeah and that's a second one.
12:02
That is also important I think is to And moving out things
12:08
around formal from licensed, the young program and everything
12:12
related with that because it's a complex conversation and as
12:16
difficult to get the message through top management.
12:20
And I know you and I have had several conversations special
12:25
over the last several months. Making sure that the message of
12:29
I am is being communicated effectively and received at the
12:34
executive level so that you can set up up these programs and
12:38
you've got to win through MFA. So yeah you want that went well
12:40
and it's providing value to the company would reduce risk.
12:43
What else can we do to help that?
12:45
So I think that was an important conversation to have and I'm
12:48
glad to hear that that worked out you know the way that it
12:50
did. That's I think that's very good.
12:52
So let's flip the coin. What's something that maybe you
12:57
wish had gone better in 2019 or something that you know on those
13:02
lines of going better, I will say Say.
13:06
And then this is probably, well, he needs related to the EMT
13:10
program, implementation, or, or trying to really formalized am
13:19
program. And I will say that this,
13:21
everything related with politics.
13:23
I remember that last year that you were here and you were
13:26
saying about, okay, Diem Program.
13:29
And everything related young program is more politics and
13:32
process and people than then. And the rest of the things, like
13:37
technology. And New toys for the company and
13:42
I was politically. Yeah, I get it.
13:45
We need that both at the end, I think that because of different
13:50
things internally, here in the company and culture and the type
13:53
of politics that usually the company has I think that could
13:59
be a bear or we can improve that how we should probably try to
14:05
make some connections, internally try to convince more
14:10
people having or looking to expand the sponsorship that we
14:14
have internally. And, and I think that this is
14:17
different based on every company based on the organization.
14:22
And where are you seated in the organization, the organization
14:25
chart? Well, and And culture.
14:30
So probably politics here in Mexico is kind of different and
14:33
Uso. I need to watch more house of
14:37
cards. Also, cards game sometime
14:39
hopefully. Yeah, it could be house cards.
14:40
Could be Game of Thrones. Hopefully not, his bloody is
14:42
either like those are. Its this is the real world,
14:46
right? Yeah.
14:46
People have thoughts and opinions.
14:48
And you know, that's that's something that, you know,
14:52
earlier in my I am career was something that I wish I had done
14:57
a little more effective job. 1M previous roles is understanding
15:01
the politics of it because you get when you're working, you
15:05
know, neck-deep in. I am a lot of things make sense,
15:09
right? But there are larger discussions
15:12
that are taking place above that, that can certainly impact
15:16
ability to get things done. So, being able to make
15:20
relationships and, you know, play the game sometimes of
15:24
bringing people in and understanding what their motives
15:27
are and the psychology behind Find it.
15:29
And I think politics is a huge part of it.
15:31
And I know that, you know, whenever I'm working with, you
15:34
know, clients and customers is, there's a quote from for store
15:37
that I was like to use and I can't think of it.
15:39
Exactly right. The moment but politics is
15:42
included as part of that quote. And it's the reason I like it so
15:44
much is because it's one of the only quotes I've seen that
15:47
includes Politics as this is something to account for as part
15:51
of your eye and program is being able to play that game,
15:54
understand it, you know, kiss the babies, shake the hands, you
15:58
know. Politician, you know, being able
16:00
to be as a big the parts of the picture and yep.
16:02
Yeah, exactly. And I'm getting back on that.
16:07
I mean, going back to 12 months ago, it wasn't the same person
16:11
in terms of politics either, so I hope next year, it's getting
16:16
better better. So from a resolution standpoint
16:19
for 2020, did I just is that, is that one of the resolutions
16:23
you'll have is from a 2020 perspective when I am is
16:25
politics. Yeah, but if you just believe,
16:28
Beeps. Yes, and but he's also about
16:32
started growing the Professional Network, including, I mean
16:38
inside the company for sure. But also outside, try to find
16:43
folks are working on my MBA program for any M initiatives.
16:48
In some other companies here in Mexico, to be honest, right now,
16:53
there's not any GM Community getting together or having
16:57
something like that. Since I saw the all the job that
17:02
I deployed doing with the different user groups around the
17:06
u.s. one of my ideas for next year or one of the resolution
17:11
that I have is start or local group here in Monterey.
17:15
And and I think that one of the biggest challenge is to find the
17:21
right people because here those guys are saying people who are
17:25
working on identity, they are either developers working in
17:30
some user interface for some application.
17:34
So they are TAG themselves as a developer.
17:38
I haven't met in coding and I'm developer and some other folks
17:41
are working more on security size so they are Security
17:44
Professionals knowing professional so I need to go and
17:48
leave that open. Okay, bringing a come with me.
17:52
And let's talk about identity. And so it's going to be at the
17:56
beginning that way, try to identify the The people
17:59
threatened by people just to join us and start talking about
18:03
different topics around identity.
18:05
So hopefully next few months we will have some Community here.
18:09
Yeah, that'd be great. I think do you think that you'll
18:12
run into resistance with? Why are you talking to me?
18:15
Like what are you trying to do like, will people be guarded at
18:18
first known really? No, I mean, they are very open
18:21
and they are I mean I always see the it Community very Very
18:27
friendly General Tso. And if you are always trying to
18:32
share knowledge, they will be open.
18:35
If you are trying to gain and probably the sales myself friend
18:39
will kill me, but you selling this guy kind of events.
18:45
When you advertise the meeting you have to say that it's free
18:50
or free of sales grades are they are, there's no selling nothing.
18:56
And so it's just sharing information and need to be clear
18:59
about that because otherwise you will be.
19:04
People got scared and they won't attend.
19:06
But if you are saying okay no it's just were talking about
19:08
this topic and sharing information and that's it.
19:12
So, what I'll do is in the show comments for this, I'll put your
19:17
LinkedIn. So if you're listening and sure
19:19
Monterey or close by and Mexico and want to and, you know, help
19:23
our turret with setting up an, I am group, I'll put your
19:27
information, so they can reach out to you on LinkedIn.
19:29
So, actually, in the next few weeks, I will start sharing both
19:32
on LinkedIn as well. Great to have more information
19:35
about that and hopefully, by the end of January, we will try and
19:39
set up the first one. Very cool.
19:41
So, for next year, are there any conferences that you might be
19:45
interested in attending? Because sometimes those are
19:47
great hubs to be able to talk with other people.
19:49
And yeah, actually happened last time when I met people from from
19:53
Ida Pro and identity versus Washington this year.
19:56
So, yeah, I am willing to attend identifiers.
20:01
Be one of them in general, for me, I never attend black hat
20:08
before, so it's still mine. Bucket list.
20:10
So I went to attend black hat, super, we get to wear a black
20:16
hat. Black is interesting because
20:17
it's not really an I am focused show but there are certainly, I
20:21
am topics because how to breaches happen typically
20:24
through a credentials, right? So being able to understand how
20:27
that happens, is important, it can be expensive sometimes to
20:31
go, but I found a cheap way to get to black hat.
20:34
If you are able to, if you're not able to get the full funding
20:39
for the full path, which is Be like two thousand dollars or
20:42
three thousand dollars in u.s. you can also get a what they
20:46
call like a business Hall Pass which is only five hundred
20:50
dollars, so you can still go go into the business Hall, talk
20:53
with the different vendors who are there and see some of the
20:55
sessions. So that's an option that I've
20:57
used somebody do several times over the years as a way to say,
21:00
okay. Well, sometimes funding for
21:02
conferences, might be hard to come by.
21:04
What if I could get in there, little bit cheaper.
21:07
And save some money for that. So that could be an option for
21:09
folks who are listening that have never been to a black hat.
21:11
It is it's a great conference to go to.
21:13
I mean, definitely laid back. Definitely casual.
21:17
You'll see everybody wearing, you know, suits and ties down to
21:19
shorts and t-shirts and everything in between.
21:22
It's a fun one to go, too big to is like 30,000 people.
21:25
I think that go to it, but sometimes can be expensive.
21:28
So an option to consider might be something like a business,
21:30
all pass and that would also apply to things like the RSA
21:33
conference. Yeah.
21:35
Ref a way I never attended. He's a successful in some other
21:39
item in the bucket list but what I heard from that conference is
21:45
that hotels are like crazy. It's ridiculous.
21:49
It's San Francisco. So there's already you know, the
21:52
built-in cost of that but yeah, I think that's the biggest knock
21:55
on RSA is it's a huge conference.
21:57
It's in a great City, a great City.
21:59
That happens to be really expensive.
22:02
So unless you have a really good deal from a hotel perspective,
22:05
that's another one that's tough to get.
22:07
Another one that I'll try and save money on sometimes is I'll
22:10
just get the conference, you know, are the business Hall Pass
22:14
and spend all my time going back and forth between the do for two
22:17
different expose that they have, and sometimes they include
22:19
Keynotes is part of that, so there are ways around it.
22:22
But yeah, it is really expensive.
22:23
Today, did he move to let you know?
22:26
I don't want to I've received surveys in the past that they
22:28
might be considering that I know oracle, I think recently signed
22:31
a three-year deal with the city of Las Vegas.
22:34
So they're moving out of San Francisco.
22:37
And moving to Las Vegas, their show and the hotel costs were
22:41
one of the reasons they cited as being that and that's that's a
22:43
big loss for San Francisco. I think I think was a 64 million
22:46
dollar loss to the economy per year because of them leading
22:51
that conference meeting the city.
22:53
So I love San Fran's. Well, my favorite season world,
22:55
but yeah, it's expensive. And I hope they start to
22:58
recognize that and maybe try to figure out a way to make it a
23:00
little bit easier to have conferences there because
23:02
otherwise Las Vegas is going to eat the world because they're
23:05
so. Well designed and You know
23:07
relatively affordable and it comes to certain things.
23:09
All right. Yeah.
23:10
And I mean I heard that everything is a huge conference
23:14
and probably going to be difficult to move some smaller
23:16
cities. Yeah.
23:17
But I like from Identity versus that they are moving each year.
23:21
Yeah. Different city.
23:22
So it's like a torso. You're attending every single
23:26
year is not like you are going back to the same city, right?
23:29
And you don't have nothing new to see or something like that.
23:32
So you will enjoy, actually the city and all the cities you
23:35
never been there. I think the sheriff It's in
23:38
Denver, I believe. Yeah, Colorado, so that'll be
23:40
nice to you will be. Yeah.
23:42
Mountains will be different than Washington, d.c., that's for
23:44
sure. It won't be as hot as and humid.
23:46
Is it was this year, I hope the weather people who want to go
23:50
skiing, they'll be I think you know relatively close to do that
23:53
or outdoor type things and previous years, it was New
23:56
Orleans and Chicago and yeah, they do a good job of picking
24:00
cool spots to kind of go to and hopefully people are able to
24:04
extend their trips. You know, go for a few days for
24:06
identifiers and Add on a couple days to either do a vacation
24:09
with families and stuff like that.
24:10
So, that'll be pretty cool. All right, well I want to have a
24:14
kind of a quick conversation and take advantage of the time that
24:17
we've had here and kind of get your thoughts down and accost
24:21
you with our podcast. Again, all gonna be always very
24:25
happy to have this conversation and all the offline conversation
24:28
that we have while you are here and thank you for inviting me
24:31
again. Cool.
24:32
I appreciate it. Just as a kind of a note for
24:36
folks who are listening Just want to thank everyone who's
24:38
been listening throughout this entire year.
24:40
This is actually episode number 26 over the last six months.
24:44
So we started to show back in the first week of July, of 2019
24:48
and Jim, and I have been putting out content every week.
24:51
It's been a learning experience for both of us.
24:53
As we're doing this, we've never done a podcast before, I've
24:56
never done anything as close to this, as far as editing.
24:59
So you know, we're learning on the Fly and I think that, you
25:02
know, things have gotten a little, you know, little easier
25:04
and faster as we're going along, we That folks have enjoyed the
25:08
ride so far. We both have time coming off
25:12
time time off coming up next few weeks.
25:14
So this is probably going to be our last show for the year.
25:17
I'm assuming. So we plan on picking back up in
25:21
early January. So we're going to take a couple
25:23
weeks off here for Christmas and the New Year's let our
25:26
respective cases of holiday brain.
25:28
Clear up as somebody if a cue from from the New Year's for the
25:33
folks that are working in, I am operations.
25:37
Over this break, you know, mayor systems stay up and running, may
25:42
your password reset calls go very smoothly because, you know,
25:45
everyone's going to call January 2nd with I forgot my password
25:48
that's you know, when the seasonal spikes like yeah.
25:50
So I want to thank everyone for listening.
25:53
Hope everyone has a great holiday and we'll talk with you
25:56
guys early next year in 2020. Take care.
26:03
You've been listening to the identity at the center podcast
26:07
To access all episodes. Visit identity at the
26:09
center.com. To access all episodes.
26:08
Visit identity at the center.com.