Latest / Identity at the Center / #43 - Passwords and Phishing in the COVID Era

Transcript

#43 - Passwords and Phishing in the COVID Era · Identity at the Center

0:08
Identity and access management. Welcome to the identity of the
0:16
center podcast. I'm Jeff.
0:17
And that's Jim. Hey, Jim.
0:19
Hey. Jeff.
0:20
How's it going? It's good.
0:21
It's Friday. And Friday night was a good
0:25
thing Mother's Day. And it's looked at looking like
0:29
this. Crazy weather throughout the
0:31
u.s. There's a snowstorm, hit the
0:34
Northeast. I think.
0:36
I think we'll be okay here in Chicago, but it's been kind of
0:38
rainy the last few days. Yeah.
0:42
I'm the southeast. Look like it.
0:44
Son. Seasonably cool.
0:46
Usually it's the time of year where it starts getting.
0:49
I'm sure you'd be uncomfortable to sit down with normally right
0:53
now. Low humidity and I mean this is
1:03
this is great living. Whether yeah, the high heat and
1:06
humidity is something that really are my Is My Kryptonite
1:10
and I think I think you know that well, I know the humidity
1:13
is, I mean, you know, I might as well share their story with
1:16
everybody Jeff Perry. Yeah.
1:18
I know. I always tell it which is the
1:20
time. We went to Orlando in January
1:27
for Lando. It's humid.
1:28
It was In the 80s, I think but humidity is always the thing
1:32
that I really hate about Florida and really kind of any human
1:35
location. Pretty sure it was 74 degrees
1:41
away man. It was like 100 degrees and it
1:44
was like a thousand percent humidity.
1:57
And it was not not my favorite type of whether that's for sure.
2:01
That's very so, it's Friday. And today is May 8th.
2:06
Yesterday though was May 7th. And that was world s word day.
2:11
How did you celebrate? I mean, you know, it's like
2:15
Christmas for me. I just I celebrate the password
2:20
but up a password tree. No, I just reminded myself that
2:25
that quote from From Office Space.
2:28
I celebrate his entire collection.
2:31
I celebrate all of my password. I mean, you know, I think that
2:36
I'm just gonna sound so original here, but passwords are crap.
2:41
They really should have been eliminated long ago because now
2:46
the internet is such an integral part of our everyday life and
2:52
her. So ingrained in how we
2:55
authenticate over the internet. They're almost barely imagine a
2:59
world without passwords yet. That's where we need to head.
3:05
Yeah. Password is not modern
3:06
authentication. That's for sure.
3:09
You know, once you get a hold of a password, it's really just a
3:13
matter of time. Even if it's encrypted, right,
3:14
you're running. If you gotta encrypted hash
3:16
somewhere, you're running rainbow tables and once that has
3:20
been cracked, once it's cracked everywhere.
3:22
And that's you know, why? The guidance is always have a
3:24
different password for each website, but The reality of the
3:27
world, right? That's very hard to do.
3:30
Most people pick, you know, one, two or three different passwords
3:33
and they just start adding numbers to it.
3:34
The becomes very easy to solve for.
3:38
I like the concept of moving towards, you know, password
3:41
list, but I don't think we're quite there yet though.
3:43
It is gaining in popularity. I've had a couple of passwords
3:47
that I reuse. So one of the, one of the things
3:52
that I read a long time ago that I thought was, Good advice.
3:58
Was that because I don't use a password safe to have kind of a
4:06
framework for how you use password, think so, or really
4:10
kind of critical applications that I want to make.
4:14
Sure, never get cracked. I either ensure that one.
4:17
They have multi factor or two that I'm using a unique path.
4:21
In other words. They invest the Life Energy and
4:24
making sure I have a unique password for that.
4:27
Site, I like that. The Life Energy.
4:29
Yeah. Well, I've had I think some of
4:30
my energy to have like, you know extra passwords that you don't
4:34
have elsewhere and to remember them.
4:36
And then there are sites where it's like, okay, I am not going
4:40
to store my credit cards with this, you know, online Commerce
4:44
site. I'm probably going to buy
4:45
something or here once or twice. I'm, they're making me create an
4:49
account. So I'm just going to reuse that
4:51
same password of used million time.
4:55
And so I do that. And one thing I've noticed is
4:58
that Google Chrome now has a feature to kind of Shame you.
5:02
And it's I think it's a really cool feature which is like, oh,
5:06
hey boss, you're you know, this pastor is already on the dark
5:09
web. Holy moly.
5:11
Wow, because I need to go make a change.
5:15
Yeah. Yeah, like, okay.
5:16
Maybe I should stop using that one from now on.
5:20
But yeah, you know, that's that's kind of been my Approach.
5:23
Is that either ensure the multi-factor or I'm using a
5:35
fresh new password. He really taking a risk based
5:38
approach, then to ask for it is it is a risk-based approach and
5:44
partially the laziness because they know if I were to use a
5:48
password safe, I could be doing something much more secure by I
5:55
find that there's a certain level of inconvenience involved
5:59
with doing that especially when you have many devices.
6:03
And those devices span different ecosystems.
6:07
We've got like, you know, some apple stuff, and you grab some
6:11
Microsoft stuff, and some Google stuff.
6:13
And you want to just be able to log into something.
6:19
I'm making excuses, specially for somebody to use in this
6:22
industry, but it kind of shows. Chose the problem, even somebody
6:25
who understands all the risks of doing things, exactly.
6:30
The way I do them. I do them my way.
6:32
Anyhow, you accepted the risks. I fall on the other side of it.
6:36
I use a password manager. I use LastPass.
6:39
And, you know, I wouldn't say I've always done it, but since
6:44
I've become more involved with security, I've tried to go more
6:47
random passwords and the struggle of, you know, cross
6:51
devices and different. Since between Apple and
6:55
Microsoft IOS and Android, I'm someone who is constantly
6:58
jumping around between all of those services.
7:01
So, I've settled on LastPass as my password manager, because
7:05
they have an app, basically for everything.
7:08
And that lets me really kind of tame the Beast a little bit.
7:11
So I use, you know, randomized passwords and, you know, all the
7:17
different complexity things and I try and I been trying to make
7:20
a more conscious effort of having a different password for
7:22
each website. If I have it as I come across
7:25
it, you know, I've been going to the password change process to
7:30
kind of get it synced up and that so far has worked pretty
7:35
well for me. You know, my my workflow
7:36
stretches across Windows machines back Mac OS and iOS or
7:43
phone and tablet. And I found LastPass has made it
7:46
a lot easier for me. So obviously we don't have
7:48
sponsors on this show. Otherwise, we'd have a better
7:50
dream situation as Ron mentioned.
7:54
Weak. But, you know, it's something
7:56
that I've been using for years and it's free at least the
7:59
version, you know that I'm using and it works.
8:01
Well, so now we work in the company of under 100 employees
8:06
and so we don't have managed devices, but I can imagine that,
8:12
you know, if you were working in a corporation, you could have a
8:16
number of passwords for the corporation and personal may, or
8:21
may not be allowed to install last.
8:23
Passing the corporate devices. Yeah.
8:53
Yeah, that's why you've got to make sure that I mean, you know,
8:57
use MFA even on that your I'm using, you know, a password by
9:00
itself that is not used anywhere else just facility for that.
9:03
I mean, it is a lot of work and I think it covers up the problem
9:07
which is passwords just inherently are insecure and I'm
9:12
excited about password lists, you know, future, whether you
9:16
know, how often or how quickly that comes along, you got things
9:18
like Windows. Hello, and you know that akator
9:21
apps and so forth. I Recently, there was an article
9:25
that at Microsoft's ignite, 2019, which is about six months
9:30
ago. There were 100 million people
9:33
that were using password, password list of logins every
9:35
month and that includes things like Windows.
9:37
Hello. It's gonna cater app, you know?
9:39
Push-based and then different security type.
9:42
He's like, etcetera and they've seen as of a couple days ago
9:46
that's grown by 50% already. So now 150 million people are
9:50
using Capital. So I think it's great.
9:53
You know, I think it's a step in the right direction, but I'll be
9:56
happy when we can finally say. Yeah, the password truly is
9:58
dead. But I have a feeling that's
10:00
going to be your carrying something else.
10:02
That's your password. Right?
10:03
It's a lot of companies are focusing on your phone as kind
10:06
of, like, your secondary off, or even maybe even primary
10:10
authentication in some cases, right?
10:13
And having a session of tiger over who was with earlier this
10:17
week and we're talking about, you know, the whole idea behind
10:21
like why? Don't companies or why don't
10:25
more folks invest in, you know, hard tokens.
10:31
And part of it is that it seems like something is like there.
10:36
It's hot. It's the now, but the next thing
10:39
is right around the corner. And so, how much, how many
10:43
dollars would you invest in something?
10:44
Like that? Knowing is probably going to be
10:46
obsoleted in a couple of years. Yeah, I can imagine, you know,
10:52
going back to my operations days having to manage RSA tokens and,
10:56
you know, having to deal with the logistics of Hardware Keys,
11:01
is a challenge, right? I mean, you've got to get them
11:04
out to people, people lose them. They break, you know, they're
11:07
not configured, right? And accomplish the things going
11:09
wrong. Now, that was admitted really 15
11:12
years ago, roughly. So now, the process has gotten a
11:14
lot better right now. It's now it's more of a
11:16
app-based thing on your phone, but I think it'll be interesting
11:21
to see how this space of all is because there's also other
11:24
things to right. There Li keyboard analysis,
11:27
you're typing Cadence, right? Can be a way to biometrically
11:31
authenticate, which I find interesting.
11:34
I'm trying to remember a typing. DNA was one of the examples that
11:37
we've looked at in the past as brand of evaluate space, but I'm
11:42
waiting for, you know, natural language.
11:44
You know, when is the computer from Star Trek going to be there
11:48
and be able Bill natural language queries of the negate
11:52
based on voice patterns and prints Pollock.
11:53
Good stuff has kind of routine, you know, absolutely anything we
11:59
can do to get closer to. What did they have in Star Trek,
12:03
where it was a room where it was like a virtual reality Beyond
12:09
Holodeck. I mean, that is like, that's
12:13
everything right there. I don't think I've ever heard.
12:16
Well, that's why I think that's kind of where VR is right now
12:19
and You know, I've I've dabbled around with it here and there
12:22
and it is very good. But your it's still for the most
12:25
part. Unless you've got a really good
12:26
set up a tethered experience. So we are stuck in a room or you
12:31
have a wire something connected to you.
12:32
And there's there's Wireless versions of it out there too.
12:34
But you're still very limited by the space.
12:37
I have seen that there are some like, you know, like laser tag
12:42
type style games right that take place in giant warehouses where
12:46
it's a VR experience, but man, I'd hate to be running, you
12:49
know. Headfirst and correction tool
12:51
wall or something like that, right?
12:53
Exactly boundaries, but I think you know, it's the beginnings of
12:57
it. It's like anything else at some
12:59
point. It'll miniaturize and get
13:00
cheaper and become standard. Microsoft been trying to make
13:03
hololens a thing for years and hasn't caught on the consumer
13:06
space. But this is all things that we
13:10
are PR is going to to go the route of 3D TV.
13:15
Well, I don't know. I know a lot of people were like
13:18
with 3D TV was hot. A lot of I don't care about
13:22
that. I don't want that.
13:23
I thought it was the coolest thing ever.
13:26
I think it's very cool. But a lot of people it makes a
13:27
lot of people sick. Yeah, they it's not good enough
13:32
to the Quality, where the experience in the Fidelity, can
13:37
trick the mines for all people. The other thing too, is the
13:40
discomfort people who wear glasses, have to put something
13:43
over there, you know, over that to be able to see things.
13:46
It's and I used to wear glasses, but right before I had, you
13:49
know, Like done in that. Struggle is real.
13:52
Trust me, you know, putting a VR mask over your glasses is not
13:56
the most comfortable thing in the world and there's a lot of
13:59
different things that kind of go into the comfort of it.
14:03
Who knows, maybe maybe Holograms will become, you know, the thing
14:05
at some point when you have first are working together, you
14:09
were really into VR useful. A lot of money on it.
14:12
What were you saying with that? Now?
14:13
Are you doing much? I'm staring at it right now.
14:16
It's in a box underneath my, my computer desk.
14:20
Here. It's kind of a hassle for me to
14:23
kind of pull out and put together.
14:24
The technology definitely works but it is like I mentioned have
14:29
a tethered experience and I really haven't been using it.
14:31
It's probably time for me to say goodbye to it.
14:33
But for those wondering, I have the eight of the HTC Vive
14:38
there's Oculus, which is owned by Facebook.
14:40
Now, they have another, you know, product out there as well.
14:43
That's pretty good. But yeah, I find myself not
14:46
using it and it's not for Anything other than I guess,
14:51
General laziness. Let's put it that way.
14:55
Yeah, that's what I mean. It has to be worth the time
14:58
investment for you. Otherwise, you're not going to
15:00
do it. Yeah.
15:01
I mean there's there's a lot to set up for that one.
15:04
I think the newer versions are a lot better where you don't have
15:06
to put these base station ups. And you know, you don't have
15:09
wires come over the place. I think Oculus is has gotten
15:11
that part, right? The experience is a lot better
15:14
and you know, who knows from a virtual workspace perspective,
15:18
you know, that might be A method to look at maybe.
15:22
Maybe your mask your VR mask will become your device.
15:26
Right? Right.
15:27
Or yeah. So, with the vrms word, did they
15:31
have any kind of facial recognition or daddy Mac?
15:50
Yeah, I think the one that would make the most sense would
15:52
probably be some sort of retinal scan, because you've got your
15:54
eyes with in this enclosed area. You know, that would probably
15:57
Drive the cost up quite a bit. So, you know, as the prices come
16:01
down might make sense to when you put your mask on it, you
16:04
know, it does a nice can and authenticate you that way.
16:07
It'd be tough to do. Facial recognition because mask
16:11
is covering half your face at least at this point, based on
16:13
current technology. So, I think it's the same
16:15
problem that a lot of people are having wearing masks out right
16:17
now because of covid. You know, face ID, doesn't work
16:22
because you're you got a mask covering up and Apple has
16:24
recognized as a problem and, you know, supposedly in the next iOS
16:29
Point update that they're releasing, you know, they'll
16:31
have a solution for that which will find find interesting to
16:34
see how they're going to keep the security.
16:37
But also, you know, make it still user friendly.
16:40
So I think that's that's something to kind of keep an eye
16:42
on punished and ha ha. Yeah, right.
16:45
So you keep this on the password K conversation.
16:50
And you know, I think that they would multi-factor.
16:52
Here's the way I look at multi factor is yes.
16:56
Usually one of those factors is a password, which is going to
16:59
complete. But then the second factor is
17:01
usually something out of band or some biometric.
17:06
And while we know a lot of the out of Baron methods can be
17:11
cracked, I take from many, many use cases this to still try up.
17:17
In other words. It creates an open for her role.
17:19
That going ahead and crack the is too much effort for what
17:25
you're feeling. Now.
17:26
I think of you are National Secrets or potentially even like
17:33
financial data. You know, SMS text is a second
17:38
factor is not strong enough. However, if you're protecting,
17:43
you know, their ability to upload to Facebook or something,
17:47
it probably is The problem with Facebook.
17:52
This one came to my name's Facebook has become an identity
17:56
provider that people under so many different things that it
17:59
kind of concerns me that, you know, game.
18:02
So active. Somebody's Facebook isn't about
18:04
just doing their pictures are putting up a, you know, stupid
18:10
Post-its. What can you then Branch off to
18:14
do when you have hijacked a Facebook account?
18:17
So find out the best. Example, but if you thought of
18:20
something else, save more trivial, you're having a second
18:24
factor is an SMS text or an authenticator app name of
18:29
authenticator app, like, for me and you and probably most people
18:32
listening to this. We don't think of authenticator
18:35
app to his company not far and but I keep the person I use them
18:39
in my world who is a non computer person is my dad.
18:44
I just imagine trying to explain to him how to set up Google
18:47
Authenticator. Yep, I get I get a panic attack,
18:53
even thinking about trying to have a conversation with him.
18:57
Yeah, there is definitely a hurdle to get to gain entry be
19:02
able to do that easily and I always pick on Apple as a good
19:08
example of how they've kind of common eyes and Fa.
19:11
For example, you know iOS specifically has MFA built into
19:17
the OS itself. It's very easy to Use and
19:19
they've kind of people are used to.
19:21
Okay. I'm going to get a code summer
19:22
right on my phone or whatever it is.
19:24
Whether it's SMS or a popup on the device and Android does
19:27
something similar as well and other devices as well.
19:29
But or other voices, I should say, but yeah, trying to explain
19:34
here. I want you to load the OCTA app,
19:37
right? And then register the app to app
19:38
with systems. It's easy for you and I because
19:41
we get it. But yeah, I can see how, you
19:44
know, people struggle with that. I've been trying to get my wife
19:46
to use LastPass, you know, for years because Constantly, you
19:49
know, having her log in a different machines, you know,
19:52
what's my Microsoft s approval? I don't know what's your
19:54
password and then, you know, she's sitting there kind of
19:56
thinking about it. Like, well, why don't you use a
19:58
password manager? And she's like, well, why don't
20:01
we just use the same password for everything?
20:04
All right, so she knows that much, I think, as far as you
20:08
know, me educating her, she knows that's bad and, you know,
20:11
when she spots something that's weird at her company, you know,
20:13
she'll tell me about, I'm like, oh, you wouldn't believe this.
20:15
So, I've kind of turned her into a little bit of password or
20:18
identity. Kind of, you know, evangelist,
20:21
but worry, it's not easy right to spotting things that are
20:26
weird companies. And obviously, I think the thing
20:31
that I see every day. I want to send you money or this
20:51
time scanners like oh my God believe.
20:53
Right. The IRS is wants to refund your
20:55
money and you need to pay them back and Apple gift cards or
20:57
Google. Now.
20:59
Those are those are obviously legitimate because you know, the
21:02
IRS accepts a gift cards has been.
21:05
Yeah, of course, I mean, what would take a couple gift cards
21:08
because hey at some point there might be working for more than
21:11
US currency. That's another, that's another
21:14
conversation. So some of them are ones,
21:18
especially And when they were persistent, like, you know, this
21:21
is the final warning, your Apple ID is about to be disabled got
21:27
like seven of these now maybe and you think, no, you know,
21:32
anything do you open them? And by the way, when you open an
21:36
email, a lot of times has been reached email email or have a
21:41
tracking bit is what you usually call it.
21:43
Other words. It's like some image that wanted
21:47
to need one. Solar to be an image.
21:50
It's like it's a unique URL that says, you know, this particular
21:55
email is open by this particular user.
21:57
Now. They know they have somebody on
21:59
the other end who potentially always, at least billable enough
22:03
to open their email and now they've got someone, they're
22:08
going to keep sending those spam emails.
22:10
Do, some of them are looking great.
22:14
I mean, they take but you just have to be diligent.
22:18
Agent to follow certain rules, not click on links that are in
22:22
those emails. I mean if you just simply from
22:24
PayPal, be redirected to your PayPal app or go directly to
22:29
paypal.com., Don't trust the email, the link in the email and
22:35
usually, you know, if you really know you're doing you can tell
22:38
if it's a fake URL, but it's just better to be pushing
22:43
talking about educating. And I think there's a big thing
22:45
that companies do is come up with cyber.
22:48
Security awareness, training, education, programs to get,
22:52
people, especially around phishing attempts, to be able to
22:58
spot them and not fall, prey to them.
23:01
And then I know a lot of companies are going out and
23:05
trying to screw fissuring users and Spearfish.
23:09
That's a very intense, very technical particular individual
23:16
and trying to convince them that an email from somebody else
23:21
within the organization that may be is their boss or somebody
23:26
higher up and say, it's directed directly at them and, you know,
23:30
versus regular fishing, which is where you can send it to
23:34
everybody in the company for fishing is kind of like I see is
23:39
like, you know, you're you're just cast on the line and
23:40
whatever. B.
23:41
B spearfishing, you know, you're going after a Big Tuna.
23:44
Right? That's really very specific,
23:46
specific thing. You're looking for specific
23:48
person. Yeah, usually there's somebody
23:50
who's high up in the organization, who would have
23:54
access to sensitive data or might have some information in
23:58
their email. Those are usually people who can
24:01
be correct. Sometimes they go out for system
24:03
administrators and system administrators.
24:06
You would hope are a little more sophisticated than to fall for
24:10
phishing attempt. But I think that obviously, if
24:15
you are able to get your hands in there, credential could be
24:18
much. More valuable.
24:20
Yeah, I'm glad you brought this fishing thing because came
24:24
across an article this week and it's it's from Barracuda
24:28
networks, and they had commissioned a research Company
24:32
by name of census wide. With I've never heard of,
24:35
hopefully this isn't any type of fake news or whatever they
24:39
surveyed. They went out and surveyed 1,000
24:41
different business decision makers across the United
24:44
Kingdom. U.s.
24:45
France and Germany, so obviously not Global, but enough.
24:48
Representation, I think the draw some conclusions and one of the
24:52
things that they saw was over half of them. 51 percent had
24:58
seen an increase in phishing attacks since this whole
25:02
covid-19 and shift to the remote working model took place.
25:06
So I think it's definitely a, you know, on the rise, you've
25:08
got Bad actors who are trying to take advantage of the situation.
25:12
And, you know, part of that is the train that goes along with
25:18
it. Over half again, said that their
25:20
Workforce wasn't proficient or properly trained in cyber risk
25:24
associated with remote working. So, remote working is brand new
25:28
for a lot of companies, right? This is not something that
25:30
they've had to consider, you know, in the past and now all of
25:34
a sudden, you know, within a span of a week, two weeks right
25:39
now. They've got most of our courses
25:40
working from home. They've had to put in, you know,
25:43
very tactical probably processes to kind of keep the business
25:48
running. You know, throughout this up and
25:50
demek. So I think it highlights some of
25:53
the things that maybe people are already seeing or, you know,
25:56
should be aware of. But there's always more training
25:59
that can be done. But I thought it was interesting
26:01
that, you know, over half basically are saying yeah, we're
26:04
seeing a rise in fishing because of the whole pandemic and I
26:08
would expect that that number will continue to grow.
26:11
Because I expect that, you know, most companies, at least big
26:15
ones have announced that they're going to extend, you know, work,
26:18
From home as a primary method through the, at least the end of
26:21
this year, you know, some are already saying, you know, for
26:23
summer of next year, you know, full you're out.
26:27
So it's something I think that as people in the identity space.
26:30
We need to make sure that are communicating to the folks that
26:34
we work with colleagues Etc. Right?
26:37
To be able to hopefully improve level of security that's out
26:41
there and at least just make people aware of hey, you know
26:44
what, you may see, you know, an uptick in and phishing attacks.
26:48
Yeah, and then a couple things, I mean, you little my radar of
26:52
the key things there and I'm going to pick on the
26:55
non-security thing for our. So it's the increase and semi at
27:01
least semi permanence of work from home.
27:05
I've been a proponent of this for a long time.
27:08
I've worked from home for a decade and I feel like it's
27:14
probably not for everybody and there's definitely some benefit
27:19
to everybody being in the same place.
27:23
So I'm going to make that statement.
27:25
However, from a quality-of-life perspective and the ability for
27:32
a company to I think retain employees allowing work from
27:36
home. Look what's the average commute
27:40
in the United States to and from work.
27:43
It's probably more than a half hour each way, right?
27:48
It's probably a half hour to an hour.
27:50
Each way. People are sending a an hour to
27:53
two hours a day. Ten, you know, five to ten hours
27:56
a week of their light sitting in their car.
27:59
Burning fossil fuels spending money on parking wear and tear
28:05
on their car. And and it's just a reduced
28:09
quality of life. I think versus the ability to
28:12
work from home. Now, every job.
28:15
I understand all the caveats. I'm not going to Go through them
28:18
all. But to me this up, that could be
28:21
a positive development to come out of this is that I think a
28:24
lot of companies were afraid to even try it and maybe I've maybe
28:29
companies out. There may be some situations or
28:33
finding this is very suboptimal. But I bet you there are some
28:38
organization or anything or, you know, we could, we could
28:41
actually do this. We just save money on
28:43
Commercial, Real Estate and improve the lives of our
28:48
Hawaii's by you know allowing work from home either more or
28:53
all the time. Yeah.
28:55
I feel like there's a lot of people who I've been told over
28:58
the years. The job that they can't do.
29:01
Remotely can absolutely be done remotely.
29:04
Yes, the technology is there now.
29:06
It is, you know, not something that's, you know, new or Cutting
29:11
Edge and you're waiting for other people to take out all the
29:14
bugs and wrinkles for it. You know, it's like anything
29:16
else that's out there. It's Infrastructure is
29:19
configured correctly in your following good hygiene on
29:22
security and you know identity management than I feel like the
29:26
most most people could probably do some if not all of their work
29:31
from home and I'm a big fan of it.
29:33
I've worked for companies in the past that did not have work from
29:36
home and have slowly, you know, at least when I was there kind
29:40
of come to an agreement. Okay, you can work from home,
29:45
one Friday a month, right? And It became okay every Friday
29:50
right or something along those lines and this has really
29:53
thrust. I think that decision-making
29:57
back to the Forefront to say look.
29:58
What are we? You know, what are we doing
29:59
here? I think I think life is a lot
30:01
easier when you can do from home, but it is not definitely
30:03
not for everybody. Like you mentioned.
30:05
I think there is some discipline that needs to be there because
30:09
you know, you may have deadlines or there's work that needs to
30:11
get done within a certain amount of time and you may have
30:14
distractions at home or, you know, there's two Any other
30:18
things that might be competing for time, especially right now
30:20
with kids at home from school, right?
30:22
I can see that being an issue when you're trying to manage
30:27
children in the house as well as work responsibilities.
30:29
So I think fortune on a companies are recognized that
30:32
and kind of working around it, but there is definitely things
30:35
to consider just from that side, but I am, I am a huge proponent
30:40
of being able to work from home, when it makes sense for all the
30:44
reasons you listed. I think that the biggest thing
30:48
that I'm seeing since the pandemic started is that people
30:53
who maybe even wear work from home folks, traditionally now
30:59
have her kids home either because schools have been
31:02
canceled or a closed and you know where they might be able to
31:06
rely on even you know, other family members watching their
31:13
kids or however they had child. Care who seems dried up.
31:17
And so now you've got a four-year-old and five-year-old
31:21
kids hanging on their parents while they're trying to work.
31:24
Also, totally different situation than what I've run
31:28
into traditionally with people who are work from home, who
31:32
designed their life around, making sure that that doesn't
31:35
happen or event. Only happens on, you know, weird
31:40
things like snow days or whatever, not thinking, like
31:43
it's like the everyday occurrence.
31:45
Mercer people that I've been working with, who were working
31:49
for other companies, where they work from home.
31:52
They've worked out a situation. So say, you know, Mom and Dad
31:55
are both room working from home now.
31:58
And now the kids are there. They're figuring out some way to
32:01
split the working hours, so that there's somebody's watching the
32:05
kids and keeping them away. So I saw a really funny video.
32:09
The other day was a guy doing a television interview and and one
32:14
of his kids boss. through the gears, you know, the mom like
32:46
That was good those golden. But yeah, I so I mean and now to
32:50
pull it all together. So I think one of the biggest
32:55
risks overall with working from home is if you rely on passwords
33:03
to get to as your only form of authentication to get the
33:07
services, whether they be proud services or to get back into the
33:11
internal Network, I mean then it's huge.
33:14
Obviously, you've got open to the outside world at those
33:18
passwords are weak, because, I think what's happening, is that
33:22
companies are now having to open things up in a way.
33:26
They haven't in the past, and one of the things I'm going to
33:28
put it on in there. We don't like our podcasts to be
33:30
a commercial, but it is that being, who's one of our partners
33:35
have been male and female that, I think it's either for the
33:39
current customers or I'm not sure if anybody can use it.
33:44
For anybody where you can essentially start leveraging,
33:49
their multi-factor authentication Service for free
33:53
to help, secure your remote Workforce during the pandemic.
33:56
So I mean, to me that's like if you're in a situation now where
34:01
you're humming ha I'm head sleeping at night because, you
34:03
know, your, your entry from the outside world is just secured by
34:08
password. Look into this, looking to
34:12
whether or not this free service is something that That you could
34:15
Leverage The you to protect ya. If ya if your work from home, I
34:20
don't think you could seriously say that you're, you're, you
34:24
know, have the right security for just using password.
34:26
I think that that is a no-brainer.
34:29
Hey, if you're doing any type of remote work, there needs to be
34:32
that second Factor somewhere to make sure you've got the proper
34:35
level Purity or, you know, what something that I found
34:39
disturbing in that same report and I'll put this report into
34:43
the show notes. So that people can find it
34:45
wherever they get their podcast. That usually is some sort of
34:47
detail page. We also get questions on that.
34:50
It'll be in there. 40% of respondents have cut their
34:54
cybersecurity budgets. As a cost-saving measure measure
34:58
to help tackle. The covid-19 crisis.
35:00
So I think that's scary because now you're you know, you've got
35:06
more people working from home. And theoretically you're
35:09
spending Less on security to cover those people.
35:14
Not not a direct one-to-one correlation, but people cutting
35:17
cybersecurity has time when there's going to be more
35:19
phishing attacks more, you know, everything else that goes along
35:23
with with that. I think it's just a terrible
35:25
combination. And you know, the other thing I
35:28
think that was really interesting was half of them
35:31
would consider asks, what would half of the the companies would
35:36
consider making Workforce reductions if it meant company,
35:39
data protection, could be properly funded.
35:41
So they're cutting funding. But the way that they see,
35:44
Buying back that funding is by doing reductions in an already
35:48
terrible job market because of you know, all the shutdown that
35:52
are happening. So I think it's I think it's a
35:54
really interesting and you know, unfortunate approach to it.
35:58
I think this is a time when security should not be on the
36:02
table for cuts, especially if you are doing the work from home
36:07
type stuff that is become so prevalent.
36:11
Well, I think yeah, I mean we could do it.
36:14
In the airline industry, how can you not uncover front?
36:19
Turn over every stone. Look for places to God, you
36:24
know, they put their businesses in the tank.
36:28
At the same time. It just creates a perfect job
36:31
for me to talk to you. So bright, you know, you don't
36:35
if you do and damned if you don't, I do think a couple of
36:39
things because, you know, you've got to expect that this and
36:44
done. Was going to end at some point
36:47
and that things will shift back to normal.
36:50
And one of the things that we saw was that cybersecurity
36:55
professionals were in high demand for this habit and you
36:59
know, higher than them other field.
37:03
And so if you wind up cutting Workforce and on the way funding
37:08
Workforce isn't free is not like we're paying you, you know a
37:12
thousand dollars a week. Week and then we're going to get
37:16
rid of you and it's going to cost us nothing.
37:18
There's there's some kind of residual cost people paying, you
37:22
know, on a separate offense or thumping, get rid of somebody.
37:26
If you have turn around, six months later.
37:29
Hire somebody back into that position.
37:31
Are you got the cost of recruiting somebody?
37:34
I'm being realistic. Just seeing what's going on in
37:38
certain industries. They might not have any choice.
37:41
So that might be enough to you for a company.
37:44
The mountain is better place to eat.
37:47
You feeling pain, higher, the price of cyber security.
37:51
People are pretty good out on the streets right now.
37:54
I don't think there's not many Industries hiring a they were
37:58
released the unemployment numbers today and something like
38:02
16 percent unemployment in the United States must have great
38:07
has been that low or that high since the Great Depression, but
38:11
it feels like it's going to be a temporary.
38:14
Things are starting to open back up, but I have talked to people
38:17
who are extremely worried that I'm not that worried about it,
38:25
but other people. I'm sorry.
38:44
I'm turning to see restaurants, open up and the Mexican
38:48
restaurant. That's been my house.
38:49
Was, they had a line outside on Cinco de Mayo.
38:52
I think people are ready to get back to things or move.
38:56
A lot of people are worried about things.
38:58
So I feel like a lot of people, I think, the next we will be
39:03
listed in a month or two months. I'm doorbell and see if the
39:08
pandemic spikes again. If it doesn't, then maybe a safe
39:12
to go out again. To feel like there's different
39:16
levels of passion that people are following depending on their
39:19
risk tolerance. Yeah, I think everybody's making
39:22
a risk-based decisions. And you know, I'm happy staying
39:25
at home, letting all the guinea, pigs out.
39:27
Figure it out. I'm definitely one of your
39:31
guinea pigs definitely. But yeah, I think going back to
39:35
the point of, you know, talent. I think there will definitely be
39:38
Talent available, but I think security, you know, security has
39:42
always been a hot Market. It or positions and for people
39:47
looking to get into the space and I don't see that dropping
39:52
any time soon because I think if anything right this, this
39:57
current situation highlights the need for good security,
39:59
especially these as these companies get hit, whether it's
40:01
fishing or ransomware, you know, or even just taking in.
40:05
Now, a flood of, you know, e-comm customers that weren't
40:10
there before because you were a traditional brick and mortar
40:13
restaurant. Right, or some other type of
40:16
business. I see a lot of a lot of
40:18
companies that have now gotten into the consumer.
40:20
I am game and have no idea what they're doing, right?
40:24
And are figuring out as they go. So I think, I think, you know,
40:29
the, the identity space, specifically, than security is
40:32
very strong position right now. I don't see that going going
40:36
down anytime soon. Right here, advice for somebody
40:40
who's just getting into. This industry would be Continue
40:45
to do so, it's okay to do. So get some experience in your
40:49
watch YouTube videos, check out ID Pro, which is an organization
40:54
specifically for identity professionals.
40:56
That voice that I'm a member of. They have a good body of
41:00
knowledge that's designed for people to get into and start to
41:03
learn things. You know, it's not and it's not
41:05
just for newbies. It's, you know, for people who
41:07
maybe focus on one specific area, but want to brush up on
41:10
another area. Maybe you're, you're great on
41:12
the identity governance, but you need to bone.
41:14
Up on the sonication or offers a right.
41:16
I think there's something out there but it's like any other
41:19
job. You've got to keep your skills
41:21
relevant and current and be able to adapt to the changes that are
41:24
that are part of the natural ebb and flow of business.
41:27
And as long as you do that, you know, I feel like you'll you'll
41:31
have done everything within your power.
41:33
To make yourself, marketable, and hireable and relevant to an
41:37
organization. Absolutely.
41:40
And listen to the podcast. That's a no-brainer.
41:45
Jim. I mean, we you know, we should
41:47
obviously be the number one source for all have any
41:49
information. All right.
41:52
Well, I think that's probably a good spot to leave it for this
41:55
week. Anything else you want to bring
41:57
up Jim before we wrap up? No, I think, you know, just
42:01
yeah, shout out to all the mothers out there who know
42:06
Mother's Day. We all have one and most mothers
42:11
do an amazing job. Abso shout out to all the
42:16
mothers, especially identity and access management mother's right
42:21
on. So if you Mother's Day everyone
42:24
stay healthy and I think with that we'll leave it and we'll
42:29
talk to y'all in the next one. You've been listening to the
42:42
identity of the center podcast for more episodes of visit
42:45
identity at the center.com.