Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / How to Protect Identity & Eliminate Threats

Transcript

How to Protect Identity & Eliminate Threats · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  So first I'll say that. And let me back up just a bit
• 0:02
  and we'll get into that specifically and I'm.
• 0:04
  I'm sure we're on the same page here.
• 0:06
  At the core of everything that we do is, is digital trust.
• 0:09
  Right, it's in. You just need to.
• 0:11
  Have a digital trust model and underpinning that you have
• 0:13
  secure by design, compliance by design, privacy by design.
• 0:17
  Those all underpin that digital trust relationship.
• 0:21
  Quarter all of those. You cannot establish a trust, a
• 0:24
  security or a compliance programme without strong
• 0:27
  identity. And so fundamentally, and this
• 0:30
  is really one of the core offerings that Beyond Identity
• 0:33
  has, is we work with organisations to secure their
• 0:37
  identity if through secure authentication and drive that
• 0:40
  into the access plane across all the different deployment
• 0:43
  scenarios. And the best way you can secure
• 0:47
  a strong trust relationship with your customers, the first thing
• 0:51
  you can do is protect their identity.
• 0:53
  How many times has somebody used a solution?
• 0:56
  Well, let me back up how many times the listeners, I bet you
• 0:59
  every one of your listeners has received an EA letter in the
• 1:03
  mail saying your identity has been compromised.
• 1:06
  We have now given you a free identity security plan, right?
• 1:10
  Or identity protection plan because the systems are
• 1:13
  fundamentally insecure and that's kind of quarter beyond
• 1:16
  identity's mission. But it you got to secure the
• 1:19
  identity, it's fundamental. Without that, you can't build a
• 1:23
  privacy plan or a compliance regime.
• 1:27
  No, I agree with you. But how has the threat to
• 1:30
  identity changed in last few years?
• 1:32
  Especially with the more and more AI coming into into our
• 1:38
  systems? It's it's actually crazy.
• 1:40
  So one of the things that when we talk to our customers is the
• 1:46
  absence of proof isn't proof of absence.
• 1:48
  Just because you haven't been breached doesn't mean your
• 1:50
  programme working. It means probably the threat
• 1:54
  actors have done a cost benefit analysis and you haven't been on
• 1:57
  their radar. OK, that's completely changed
• 2:00
  today. The cost benefit analysis with
• 2:03
  phishing as a service, malware as a service, and has changed
• 2:08
  that landscape. So now it's a few $100 and I can
• 2:11
  deliver a phishing campaign that is hyper realistic
• 2:15
  out-of-the-box. Then you layer on AI and they
• 2:19
  become hyper realistic, very contextually focused.
• 2:23
  And then you layer on vishing and then deep fakes and the
• 2:28
  entire landscape has changed, not only the attacks more
• 2:30
  effective, but the scope and the tempos increasing.
• 2:34
  So everybody needs to take a hard look at kind of how they've
• 2:38
  secured their systems so they get ready for the oncoming
• 2:40
  onslaught. I mean, it's it's common and
• 2:42
  it's coming fast. Yeah, that makes sense that it's
• 2:47
  changing. But the question is how do you
• 2:49
  determine, how do you identify this kind of a threat?
• 2:53
  Because we all know there are threats, we all know we should
• 2:56
  invest, but how does one go about identifying an identity
• 3:00
  threat? Yeah, I think, I think First off
• 3:04
  the, so the, the if, if we put deepfake aside, AI is just
• 3:09
  accelerating the ability to drive traditional threats across
• 3:13
  the board both in scope and tempo.
• 3:15
  The kinds of identity threats that we have are very well
• 3:18
  understood. There's the attack change that
• 3:20
  we we understand which initial credential access, fishing,
• 3:24
  fishing, whaling, all of these things are well understood.
• 3:27
  They're just being industrialised, OK.
• 3:30
  And So what, what I, what I, what I, what a company needs to
• 3:34
  do is I need to go revisit those kill chains, both from initial
• 3:39
  access and lateral movement. And they need to look at their
• 3:41
  solution architecture and say, do I have a password?
• 3:45
  Yes or no? If I have a password, I need to
• 3:47
  get rid of it because that's, you know, do I have an MFA
• 3:51
  solution that has out of band communication like OTP or SMS,
• 3:57
  whatever. If I do, you just need to design
• 3:59
  it out. So I think the the threat
• 4:03
  landscape and the types of TTPS are well understood right now.
• 4:09
  It's just that the scope and the volume is changing and the, and
• 4:12
  the realism is changing. So design the solutions out.
• 4:17
  I mean, design the designing attack vectors out with an
• 4:20
  architecture. You're still going to have to
• 4:23
  double down on your training with your with your your team
• 4:26
  because of the new types of threats like deep, fake and
• 4:28
  vision. OK, so if you have identified a
• 4:33
  threat, the immediate reaction is to contain it to eliminate it
• 4:37
  so that you get back to the normal.
• 4:39
  And would you have any suggestions on how do a company
• 4:43
  eliminate the threat? Yeah, it's all right.
• 4:47
  So if you there's fundamentally there's prevention, detection
• 4:52
  and then response, right. And everybody, all your
• 4:55
  listeners know this. So from a, what you want to do
• 4:59
  is you want to look at, and this is where a lot of organisers
• 5:02
  make the mistake. They spend a lot of time on
• 5:04
  operations detection and response, which is critical.
• 5:07
  But you need to go down and look at the threats, meaning the
• 5:10
  threats are well documented. I can go through the MITRE
• 5:12
  attack chain and I go through all the initial access threads,
• 5:16
  the TTPS, I can go look at all the lateral movements and
• 5:19
  they're very clear what they do. You need to look at your
• 5:21
  architecture first and you need to say is my architecture moving
• 5:26
  a lot of those threat, threats to prevention and resilience?
• 5:30
  And that's kind of what a lot that's a big part of what the
• 5:32
  beyond identity does, both on the the initial access, then on
• 5:36
  the detection side, yeah, you have to move as quickly as you
• 5:40
  can to contain that right And completely understand it.
• 5:43
  And I think AI is really going to accelerate that ability to
• 5:46
  respond to that, the detection and response.
• 5:49
  But the way I, the way how I communicate the organisations
• 5:52
  and how we work internally is understand the threat landscape
• 5:56
  and the traditional threats and make sure that my architecture
• 6:00
  is eliminating those, moving them from detection to
• 6:02
  prevention. And then when I look at my
• 6:04
  detection and response, I'm going to augment that with more
• 6:08
  capabilities and particularly AI so that I can so that I can
• 6:11
  increase my response times. OK.
• 6:15
  And what role does then your company play the you are from
• 6:20
  Beyond identity? What was the scope in which
• 6:23
  beyond Identity operates in all this?
• 6:26
  OK, great question and thank you for that.
• 6:29
  So beyond Identity originally started when we, we started our,
• 6:33
  our journey, it was turbulent passwords.
• 6:36
  We had a passion for fishing resistant MFA, which which is
• 6:41
  great. But as we started to see the
• 6:43
  landscape change radically in, in things moved from the network
• 6:46
  layer into the to the identity perimeter.
• 6:48
  When everybody was Federated, bring your own devices and the
• 6:51
  workforce changed, this all radically changed over and
• 6:53
  particularly was accelerated with COVID.
• 6:56
  We realised that the identity was the new perimeter and the
• 7:00
  identity teams didn't have the security capabilities to address
• 7:04
  that because the security team was trained on legacy
• 7:07
  infrastructure because they were fighting last last year's war,
• 7:10
  right? And so the identity teams had a
• 7:12
  big gap. So what beyond identity I did
• 7:15
  was it came in and said, you know what, we're going to build
• 7:17
  a custom built solution from the ground up that is secure by
• 7:21
  design in compliant by design that targets that identity kill
• 7:27
  chain. And so it starts out with all
• 7:30
  the initial access and eliminates probably just designs
• 7:36
  out probably about, I think it's about 60% of those initial
• 7:39
  access threats. And then it also targets lateral
• 7:42
  movement. And we also recognise that what
• 7:44
  you have to do to do that properly is you have to bring
• 7:47
  the device and you have to bring the device to device trust and
• 7:56
  proper identity into that access plane to address a lot of the
• 7:59
  lateral movement threats and the other kind of token based
• 8:03
  threats.