Latest / Identity at the Center / #128 - Fraud Reduction Intelligence Platforms with John Tolbert

Transcript

#128 - Fraud Reduction Intelligence Platforms with John Tolbert · Identity at the Center

0:09
You're listening to the identity at the center podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what
0:18
let's get started. Welcome to the identity of the
0:27
sender podcast. I'm Jeff.
0:28
And that's Jim. Hey Jim hey Jeff.
0:30
How's it going? Oh not so bad yourself.
0:33
Good good. I can I use the same joke that
0:35
use the previous episode. How do you like my my backdrop?
0:38
How do you like my expensive books and bookshelf?
0:42
Look so real. So many fine leather bound items
0:46
as our friend Ron Burgundy would say you'd be shocked to know
0:49
that it's actually a green screen that I haven't put it in
0:52
a fifty thousand dollar. In my home.
0:55
Yeah, it's a nice-looking Library, that's for sure.
0:58
Not now, your sad pathetic, life of having to like, get up screen
1:03
and look around where you're at, because I I know where your
1:05
record is. Like I like you Jim, but I know
1:08
that that's not through the area.
1:09
Yeah, exactly. Well, maybe someday, I mean, the
1:12
podcast getting pretty popular, your the topic that I wanted to
1:15
bring up is and this will be, you know, stealing from my
1:19
predictions down the road. But I can see us being a top 10.
1:24
Cast in the world and not, we're not just talking about I am
1:28
which you know, that would be pretty impressive in and of
1:31
itself. But what is the statistic for
1:35
top podcast, a top-10 podcast, top 10%.
1:39
I should make that clear, right? We're not going to be a top ten
1:42
podcast in the world, top 10 percent.
1:46
Yeah. So, you know, I've actually met
1:48
to bring this up on previous episodes, but we've been doing
1:51
really well. Surprisingly, I think shocked,
1:54
He's so currently, if you consider all the podcasts
1:58
globally and there's like some 90 million episodes or something
2:02
like that that are out there. We are actually somewhere
2:05
between the top 25 and like 10% or 15% of all podcasts in the
2:13
world like globally. Not just identity everything,
2:16
which is fantastic. And certainly you know I'm going
2:19
to I'm going to nominate everyone who's listening as
2:21
listener of the week for being Part of that Journey.
2:25
As we you know, started us off a little over two years ago and
2:28
it's like, you know, I was just Jim and I listening to it but we
2:31
certainly grown but yeah, it's pretty cool.
2:33
Yeah. I think this is an area that is
2:35
ripe for disruption. So if you're listening and you
2:38
have like a product that does a good job of accurately and this
2:42
is the key word accurately getting podcast statistics for
2:46
listenership across every single service that's out there because
2:50
that's the challenge. I would certainly be interested
2:53
in hearing because Certainly products in this space that do
2:55
it. But it seems to me that accuracy
2:58
is a little bit of a question mark, because if you think about
3:01
like, you know, I know most of our listeners, for example,
3:03
listening on Apple. That just happens to be our most
3:05
popular platform based on the stats that I see, but there have
3:10
a podcast, you know, host and vendor is of their own.
3:13
So, of course, they want to, you know, keep sales information,
3:16
just like any other type of add information to themselves, they
3:19
may or may not make some pieces available to our podcast host,
3:22
for example, spotify's another one.
3:24
One Google's another Amazon and it seems like there's a whole
3:26
bunch of these other different aggregators are out there but
3:30
yeah, based on the stats that I can see.
3:33
We're, you know, we're in the, I would say somewhere in the top
3:37
15 ish percent of all of all podcast worldwide which is,
3:41
which is crazy, absolutely crazy.
3:43
I think so too. The thing I threw out there as a
3:46
challenge to all of our listeners is if you would prefer
3:50
to have this be a video podcast. I can't guarantee that it'll
3:55
happen, but let us know because going to start doing the live
3:59
streaming. We have video cameras, we
4:02
potentially could do it. It's a lot more work and
4:06
honestly after watching a few live streams, you might change
4:10
your vote but you know, let us know because I think it's
4:14
something we've been debating whether or not people actually
4:17
would want that. It is a lot more work that is
4:21
for sure, audio is relatively Easy at this point for me to
4:25
edit and, and host all that. So now we're getting to the big
4:28
guns. But, yeah, the live streaming
4:29
stuff will be interesting. I think we'll start there.
4:31
The last thing I just wanted to mention is, I think this is our
4:33
last episode for the year, right?
4:36
So we will be back in 2022 and so we're just going to take a
4:42
couple weeks off. Try to spend some time with the
4:45
fam and do all that good stuff. You know, last year we decided
4:50
to do the same thing and then the solar winds.
4:54
Um, supply chain hack took place, and we did a special
4:59
episode so something like that could happen again.
5:01
But at this point, we're planning on taking a few weeks
5:03
off. Yeah.
5:04
You're the mad man recording like Christmas Eve or something
5:07
like that. And I was like, all right, I'll
5:08
edit it but I'm not getting them.
5:10
I'm on vacation too. Yeah, last one for for a few
5:13
weeks, but we are planning to continue the live stream through
5:17
the break here. So relatively new for us, we're
5:20
still kind of experimenting experimenting with it but it's a
5:22
live stream on YouTube. Follow us on Twitter at idea.
5:25
See podcasts. That's kind of the well now it's
5:28
when we're going live. If you go to idea CDOT live,
5:32
that'll take you right to our YouTube channel as well so yeah.
5:36
Hopefully people can I check it out.
5:37
It's an opportunity to interact to so you can kind of take
5:40
comments and idea there's been like 15 minutes so it's
5:42
something super easy for Jim and I to get on be a little more
5:45
current with some of a topics and make that going on in the
5:48
world. But also if there's things that
5:50
pop up during the week, we kind of address it as a quick hitter
5:53
so The key is, you know, light and Breezy, nice and easy, you
5:59
know, something along those lines and right now I will try
6:02
to do it on Friday mornings, I think.
6:03
But we may have to flex it maybe to other days of the week
6:06
depending on kind of our schedule.
6:08
So that's sort of the plan as we kind of move forward, but why do
6:12
we get into our main topic for today?
6:14
Since we want to end on a high note, we're going to talk about
6:18
fraud reduction platforms and to help us with that conversation
6:23
is a I guess we just had on just a few episodes ago.
6:26
Episode 124, we talked with John Tolbert, we'd analyst and my
6:30
managing director at Koopa charcoal.
6:32
Welcome back to the show. John.
6:34
Hey, thanks for having me back. Yeah, so thank you so much for
6:37
coming back and I think this is an area that really kind of
6:39
dovetails really well with our previous conversation around
6:43
consumer or customer. I am see I am and, you know,
6:47
this is a capability. I think that kind of resides in
6:50
in, in that area of, you know, how do we make sure that Now
6:54
that we are managing our customers, right?
6:56
That those ideas are maybe not doing things, they shouldn't be
6:59
doing. So why don't we kind of break it
7:01
down for the folks who are listening in?
7:03
Might not be as familiar with this space as we get into it.
7:08
And let's start with what is a fraud reduction platforms, fraud
7:13
reduction, intelligence platform.
7:15
I think of as a service, that sort of Aggregates, lots of
7:18
different bits of intelligence about the consumer retail.
7:24
Dale Finance, lots of different Industries and helps those
7:30
subscribing. Customers to reduce the amount
7:34
of fraud that they have to deal with.
7:37
And again, you know, it is cuts across many different
7:40
Industries, we probably think most commonly about Finance, but
7:44
you know, retail Healthcare travel and Hospitality, you
7:49
know, fraud has been on the increase year-over-year and you
7:53
know the last 18 months or so covid.
7:56
We saw new forms of fraud, you know, being generated.
7:59
So, you know, fraud reduction intelligence platforms, help
8:04
businesses kind of stay ahead of that and reduce those unwanted
8:08
fraudulent transactions. We had a conversation last week
8:12
with our mean from paying around identity proofing and I know
8:15
that's one of a kind of the major areas.
8:16
So I think that's kind of included.
8:18
But are there other other areas of fraud reduction that are kind
8:21
of seen as like a core? In C or capability.
8:25
Yeah. I call it six major capabilities
8:28
and yep. Identity proofing is definitely
8:31
one of the really important ones there.
8:33
It's good in many cases to be able to tie the right individual
8:38
to a digital account and, you know, depending on regulations
8:44
and the type of transaction. It is, that's actually required
8:47
to be able to do that. So, I did any proofing is a very
8:51
important fraud reduction technique.
8:54
But then we also have things like compromised, credential
8:57
intelligence in a knowing where maybe a credential has been
9:02
misused recently that can be a factor that can help, you know,
9:06
throw an alarm, then we have things like user, behavioral
9:11
analysis, device intelligence behavioral Biometrics and bought
9:18
detection and bought management was the major six major areas of
9:23
fraud reduction. Relevance what are some of the
9:25
threats that I guess these kind of platforms?
9:28
Try to solve? I know, we see we tend to see,
9:31
you know, themes, I think from a cycle of where the attacks are
9:35
coming from and what they're trying to look at obviously,
9:36
ransomware is kind of a big one right now, but when it comes to,
9:40
you know, the fraud reduction side of things, what are some of
9:43
the common threats that that are out there?
9:45
It's a woman who's in most Industries are worried about our
9:48
account takeover and it is exactly what it sounds like you
9:52
know, taking over somebody's account.
9:54
Often, unfortunately, it's too easy to do that because they're
9:58
still password-based authentication out there or, you
10:02
know, in some cases, maybe those passwords are backed up by
10:06
knowledge-based authentication. Security questions, you know
10:09
asking you know, mother's maiden name, what high school, did you
10:13
go to or something like that? All that information is publicly
10:17
available if a fraudster wants to search for it.
10:20
So unfortunately, it's in those cases where You're using
10:25
password authentication backed up by K B.
10:28
A then it's all too easy to take over accounts.
10:33
So that's another reason why we recommend heartily multi-factor
10:37
authentication wherever we possibly can?
10:40
But yeah, I can't take over. I'd say is a number one, concern
10:44
globally, and then, there's also new account fraud.
10:47
Sometimes you'll call it account opening fraud, or synthetic
10:51
fraud, and that one's a little bit different.
10:54
That's Are you take bits and pieces of pii personal
10:57
information, and try to use that to assemble an account?
11:02
And fraudsters do that again for financial reasons.
11:05
They're trying to build accounts to, you know, be mule accounts,
11:09
move money Around Here There and Everywhere and information that,
11:13
you know, might be obtainable from Healthcare, records or
11:17
education records, you know, names address date of birth,
11:21
other pieces of information, you know.
11:23
Just how you Building a digital account, normally can be pieced
11:27
together by fraudsters, to create an account that then
11:30
resembles a real person, but it's not the real person.
11:33
And they're going to most likely use it for some sort of illegal
11:36
activity. So I'd say there's the top two.
11:40
There are also things like Sims swap attacks, you know, getting
11:45
a mobile operator to sort of reassign where a number of rings
11:49
to, and this is one of the or where text go.
11:53
This is one of the reasons like SMS OTP one-time passwords, you
11:56
know getting a text on your phone, to get you into a site
12:00
can be problematic. Because if there's a Sim swap
12:04
on, on one end of the channel, then the fraudster can then
12:09
direct those password, reset requests or authentication
12:12
requests to a device that they control.
12:16
So, that's closely related, but different means to get there.
12:20
I think I use Casey brought up their job with the Opening.
12:25
That's the one that I've kind of become most familiar with in the
12:29
fraud reduction. I think it's interesting color
12:31
fraud reduction rather than fraud prevention, right.
12:34
It's kind of acknowledging that. Even with these Solutions,
12:38
you're not preventing fraud. You're just making it more
12:40
difficult for the fraudster to do their, do their Dirty Deeds.
12:47
But, you know, kind of back to that account opening, to me,
12:50
that's the, when you talked about the pi.
12:53
It's, you know, To give a real world example, is when you go
12:56
into an application, they say okay, which of these four of
13:01
these four streets of you ever lived on, right?
13:03
And we'll list for streets and it's just that one that jumps
13:06
out of your like, oh yeah, I've lived there 20 years ago or I
13:09
lived there when I was a teenager or something like that.
13:13
As you know, you slept which one of these cars.
13:15
Have you ever owned? You're like wow how does this
13:18
thing? Know so much about me?
13:19
Well, you know the big major Credit Agencies know that Value.
13:25
And I mean, correct me if I'm wrong but aren't those some of
13:28
the biggest players in this space?
13:30
Yeah, both globally and especially in the US, credit
13:34
rating agencies have a lot of information about all the
13:37
consumers. So, you know, much of that
13:39
information is authoritative a lot of name address pairs.
13:44
All that information is available from places like that.
13:48
But then, you know, there's also different kinds of sources like,
13:51
you know, local government agencies, DMV, These different
13:55
types of licenses that have been issued taxes.
13:58
There's there's information that can be used to construct those
14:03
accounts outside of credit rating agencies to write very.
14:06
Yeah, it seems that there's a whole business model around
14:09
aggregating that data and then there's a business model around
14:14
how Who's the who builds the best mouse trap to use that data
14:19
to create a fraud reduction of the most high-profile prevention
14:22
fraud reduction platform. You know, usually where I see
14:26
the. So we split our time on the
14:28
podcast, talking about Enterprise identity management,
14:33
you know how things are used to manage your Workforce and
14:38
customer identity management. When I think of fraud reduction
14:42
my mind usually goes to the consumer customer, I am
14:46
platform. Is that generally the rule are
14:49
there also some Enterprise use cases that that benefit from
14:54
Frog production. Yeah, I think, I think your ride
14:56
most immediately. We think of how this can benefit
14:59
consumers and consumer facing organizations.
15:03
But, you know, a lot of the mechanics of how this is done
15:07
can be used behind the scenes, just a way for Enterprise
15:11
authentication. So, you know, we want not only
15:14
to see Enterprises using multi-factor authentication to
15:18
protect their assets but also risk-based authentication.
15:23
So a Lot of the same types of risk engines that can evaluate
15:29
bits and pieces of information about consumers, a transaction
15:32
time can also be used to look at how an employee logging in from
15:36
a different location. You know, give it a risk score.
15:39
So you know, technology behind that can be very similar, it
15:43
comes down to you know, what are the information sources?
15:47
How do you prioritize those factors in policies and then
15:53
what do you want to do with you? I mean, one of the things I've
15:56
always kind of wondered or thought about like, wow, you
16:00
could really choose this kind of identity verification so many
16:07
ways, including Enterprise, use cases.
16:08
But what I've kind of heard is that the these very expensive to
16:15
use this fraud production methodology to kind of use a
16:20
just to pick on one of the big players in the space.
16:24
Orion to use an experience application to sc's questions.
16:28
It's not Penny's, it's more than that.
16:31
And obviously, when you're, we're talking about opening a
16:34
bank account or opening an account to trade cryptocurrency
16:38
or something like that. It's Uber important to verify
16:44
that identity versus other scenarios where, you know, in
16:49
like a retail environment as long as you're able to provide
16:52
some level of verification. Chin, it's good enough.
16:56
Well, I think, you know, again, kind of unfortunately with the
17:00
rise of covid, we've seen some interesting technology
17:04
applications though of let's call it fraud reduction
17:08
technology, the identity proofing piece especially for
17:12
onboarding new employees. So again, you know, there are
17:16
certain pieces of information, you need to put together
17:19
depending on, you know what jurisdiction?
17:21
You're in order to onboard an employee.
17:24
So you know, these remote identity proofing.
17:27
Gaps have become quite popular in the last year and a half or
17:31
so. And I think that's only going to
17:33
continue to gain in popularity and that's a direct application
17:38
of, you know, a type of fraud reduction technology for an
17:41
Enterprise use case. I think we're seeing more more
17:45
use cases come out of this because I think of you know the
17:47
current pandemic situation and and vaccine cards, right?
17:51
So I think a lot of organizations are trying to
17:53
figure out how They comply with maybe local orders on
17:56
vaccination, status for employees, you know, Federal
17:59
contractors, for example, in the u.s., you know, whatever
18:01
government mandates are kind of out there when it comes to that
18:04
is how do you securely gather that data rather just say I'm
18:08
just going to put it on our company's SharePoint site?
18:10
Right? I don't think that's that's
18:11
probably the way to go with it. So I'm seeing you know
18:15
organizations take these third tarp third-party approach to try
18:19
and gather that information. So I'm wondering if fraud
18:22
reduction platforms is also play in the role in the secure
18:26
collection of some of this data to kind of facilitate that in a
18:30
way that maybe people are more comfortable, at least on the
18:32
Enterprise side. I'm wondering.
18:34
And it's kind of open question, right?
18:35
I think I'm just curious. If if, if you see it like that
18:39
John or if there's other ways that maybe I should be thinking
18:41
about as well, you know, I think that's an interesting
18:43
possibility, I have not. I don't have any answers right
18:49
now about is this something that's actively going on you
18:53
know in a Commercially available product for me, especially, you
18:58
know, in our Locale. But it does seem like if there
19:02
were authoritative sources of information about vaccination
19:07
status than, yeah, that would be something that could be built
19:10
in. I'm surprised there hasn't been
19:16
a bit more uptake on Solutions like that same thing with like,
19:21
you know, decentralized, I didn't a blockchain based
19:23
identity for these kinds of covid, related, use cases.
19:29
Yeah. Give it 20 minutes.
19:30
I think is fast, Aztec moves, somebody like primary building
19:33
an app that right or their re-engineering.
19:37
Business process under existing at the kind of account for that
19:39
use case. Speaking of use cases, what are
19:42
some of the He use cases that really these products are trying
19:46
to solve because I know it's really the collection of the
19:47
data, right? So it's kind of out is okay,
19:49
this is Jeff and he is who he says he is and I think of the
19:53
typical use case of onboarding a new employee.
19:55
I need to show some sort of documentation that I allowed to
19:59
work whether it's an ID or some sort of government thing,
20:02
whatever it might be at least in the u.s., what are some of the,
20:05
you know, other use cases that this sort of helps with.
20:09
Well, you know again, looking at those types of fraud.
20:13
There's a lot of different variations and account.
20:15
Takeover fraud, for example. So there's you know, probably
20:19
rarely one off attacks on on people's accounts these days.
20:24
You know, we often hear about credential stuffing attacks
20:26
using information from perhaps the dark web combinations of
20:31
usernames and passwords to go out and sort of spray that
20:34
against a bunch of different sites.
20:35
See if people have reused passwords between sites and then
20:40
you know if they have you can take those accounts over if
20:42
you've Her best word for it, you know.
20:46
So, some of these more High Assurance kind of, use cases, I
20:50
think that we've been hinting at, you know, with like
20:53
employment verification and, you know, the need to concretely
20:58
identify where a person has lived over the years.
21:02
There also, you know, lower Assurance kinds of use cases
21:06
that you know maybe certain kinds of businesses retail.
21:10
They don't necessarily Need that rich history or, you know really
21:17
strongly assured identity for, you know, purchasing certain
21:23
kinds of goods online or buying food at a grocery store.
21:26
So you don't need that. But you do want to be assured.
21:29
That, you know, this isn't a fraudulent transaction,
21:31
especially if it's a, you know, card-not-present kind of online
21:36
transaction. So yeah, there's there's lots of
21:40
different applications to this. That's I think we see many
21:44
different approaches in fraud reduction because there's the
21:47
identity of who proofing, but now we see lots and lots more
21:51
use of like behavioral Biometrics.
21:53
So you know for retail use case just having an assurance that
21:59
the person who's using the device is the same person that
22:02
registered, you know, in many cases, that's enough to lower
22:05
the risk, significantly enough to allow transactions to go
22:08
through. So those are some of the
22:10
advantages things like behavioral bias, Magic's could
22:13
bring to fraud reduction John going to get up on my soapbox.
22:16
Here, you talked a little bit about when you're going over to
22:20
six areas of fraud, reduction. One of the areas that I think
22:23
you mentioned, I don't want to verify that, I got this right is
22:28
knowing when an account has been compromised elsewhere, right?
22:32
So this is something that I've seen and I'm going to just call
22:37
out. I think Microsoft was saying
22:39
look across our You know our Office 365 or Azure environment,
22:44
plus Microsoft Live, plus plus plus all these different plus
22:49
Hotmail. You know we've got all this
22:51
these logins billions of logins per day we know which which
22:56
accounts potentially been compromised, plus, we're in a
22:59
Consortium with Facebook and Google who by the way, don't
23:03
compete on the access management side of the house.
23:06
You know to me it's kind of like, you know, they're using
23:10
that. That's Security as a business
23:13
differentiator, which concerns me a little bit, right?
23:17
Because I feel like that's something that potentially puts
23:22
them in a anti-competitive position.
23:25
I don't know if that's something you can talk about but I wanted
23:28
to throw it out there. Yeah, I probably wouldn't come
23:30
in too much on that other than to say, yeah, there's there's an
23:34
advantage in having lots of login and transactions
23:37
transaction information to review.
23:40
I think there are are definite patterns that can be detected.
23:44
And the more information you have potentially, the more
23:48
accurate you can be with those predictions and there does seem
23:52
to be in in some cases silos of information where, you know, a
23:57
particular vendor in this space. They can aggregate information
24:01
about what they see across all their customers, but, you know,
24:05
if there aren't information sharing mechanisms in place
24:09
between vendors, then You know that could tend to limit the
24:14
amount of transaction information available for
24:17
analysis. You know, I think this is where
24:19
we've seen a competitive Advantage kind of breakout from
24:23
a war between the top vendors. Any authentication space,
24:26
Microsoft talks about their signals that they get from
24:28
across their Microsoft stack right of all youth in occasions.
24:30
They have, you know and I think I think at this point we're
24:35
starting to see the beginnings of what might be called
24:40
monopolistic. A hater when it comes to
24:41
authentication and logins. So this is purely my opinion.
24:44
So please don't hold anyone else accountable.
24:46
But I see things like Microsoft Facebook, Google and some of the
24:52
big IDP players that are out there, right?
24:54
Social logins where they're collecting a lot of information
24:57
from the notification standpoint but they're not necessarily
25:00
sharing it. You know Google and Microsoft
25:02
are not sharing, their authentication signals with each
25:05
other because I think that it's seen a little bit as a
25:07
competitive Advantage for the security.
25:10
They can provide for their Their users and I know that certain
25:13
governments are more tolerant of monopolistic Behavior like that
25:18
at some point. Does this type of data enter
25:23
into that realm of well, hold on a second, we need more
25:26
interoperability and if you don't do it voluntarily we're
25:31
going to kind of make you do it, which obviously opens up
25:34
government and all the feelings that go around, you know, big
25:37
government, little government. What you saying?
25:38
Say, you know can and can't do. But if if the current Trend
25:43
continues where Microsoft Google and let's say, log in with
25:47
Facebook, continue to dominate login box is around the world.
25:52
At some point, does it enter that enter that state?
25:55
Now, Apple has started to fight back a little bit with their D
25:58
Central, not decentralized, but with their obfuscated user ID,
26:02
but now they're collecting data as well, right?
26:04
So, they know what you're logging into and I'm just
26:07
curious. John, I won't put you on the
26:09
spot but it was That I would just kind of occurring to me as
26:13
we were kind of talking about this authentication strategy of
26:16
this consolidation of user authentication information at
26:22
what point? Do we really need to open it up
26:25
for the benefit of others or do we leave it as a competitive
26:28
Advantage for these organizations to take advantage
26:30
of and build better products on? Well, you know, I I think I
26:34
would say there is value in the compromised credential
26:39
intelligence, peace to this. But even so there are other
26:45
things that that consumer facing organizations would want to
26:51
consider besides just the Compromised credential until,
26:55
you know, there's user behavioral analysis, and that's
26:58
something that they could do potentially on their own or, you
27:01
know, through interaction with their fraud reduction
27:04
intelligence platform, vendor, you know, thinking about
27:08
financial transactions. For example, going beyond the
27:14
login, it's good to know what the pattern of transactions has
27:18
been for a user over a given month, six months or a year, you
27:22
know. So that if Suddenly there's a
27:24
request to transfer thirty thousand dollars to someone
27:29
that's there's no history of that in the users behavioral
27:33
profile then that should you know raise a red flag and stop
27:37
that transaction until there's some other kind of implicit or
27:43
explicit I mean authorization from the user.
27:46
So yes, login information is useful but there are other
27:52
things like you ba The behavioral Biometrics device
27:55
intelligence device intelligence, I think is, you
28:00
know what we think about strong authentication and needing, you
28:03
know, two out of three different, kinds of factors.
28:06
That device intelligence is in many cases, just as important
28:11
as, as others because then you'll, you can find out, IP
28:15
reputation device reputation, you know, typical location
28:20
history for a device. I think that's something that's
28:23
just As important as all the other factors as well.
28:26
So we'll be back in person at conferences.
28:30
Is some point. Anybody who wants to discuss
28:33
this further for a beer? I would love to to dive into
28:37
this topic, but let's get back on track.
28:40
Do it for a bit here, John, and I wanted to talk about kind of
28:45
the approach. So evaluating the market, you
28:48
know, as a consumer, or somebody who's representing an
28:51
organization that has A need for a fraud reduction platform.
28:57
I'm wondering in your mind, two things.
28:59
One is, you know, what should I be looking for?
29:03
And the second is, you know, from the standpoint of who in
29:07
that organization is, it should be, you know, doing the shopping
29:11
or brought to the table as the shopping is being performed.
29:15
I think, you know, when we talk about who's responsible for
29:20
securing an organization, most people are going to point.
29:23
To the CIO or the ciso, they're not going to point to the
29:28
business. So you guys are responsible for
29:31
securing the data but this is one of those technologies that
29:34
sort of blurs, the line. And I feel like there needs to
29:38
be participation from that business side in the selection
29:42
of a frog production platform, right?
29:45
I'm just wondering do you kind of share that perspective and
29:48
then again, you know, again the kind of the beginning of the
29:51
question was any kind of what Should I be looking forward to
29:54
kind of help me decide? Which platform makes sense for
29:58
me, you know, in a way you're setting up to answer your own
30:02
question, I think you need to know your business in order to
30:07
know what to look for. So yes, to a degree, CIO ciso,
30:13
should probably be involved with these are more business-driven,
30:16
kinds of decisions. So let's say you're in again in
30:20
retail or travel hospitality. Mystery like that.
30:25
The business people probably have a better handle on the
30:29
kinds of threats, that may arise purely from the fraud side.
30:36
Then say those who are charged with taking care of the
30:39
infrastructure. Most of these are delivered as
30:45
services or almost all of them really are delivered as
30:47
services. So, this is something that you
30:50
hook up to Via API. This is a service that you call
30:54
at runtime, you know? Direction until service.
30:57
So it's not something that necessarily needs to involve
31:02
the, the security infrastructure directly.
31:04
So I think of it more as a business decision and having the
31:08
Business Leaders involved in making those kinds of
31:11
selections. I think makes the most sense.
31:13
Yeah. I think that makes sense,
31:14
because at the end the day, right?
31:16
The business of third data. And if I'm in the position of
31:20
saying, okay, we need to have this capability.
31:23
Who's going to help me Define what the rules are to even?
31:25
Identify a pattern of fraud, right?
31:27
The business is going to help me make that decision.
31:29
So if I, you know, I guess for my own personal perspective is
31:32
like, okay, I'm going to give a tool and then someone's gonna
31:36
make me use a tool. I should at least have hopefully
31:37
have a say in what tool is being used.
31:39
I think having that input is it would probably make a lot of
31:41
sense and I think of things now of other areas that Miss might
31:45
stretch into things like kyc or know your customer or am L
31:49
anti-money. Laundering are these are these
31:52
types of capabilities and services part of that first Rod
31:55
reduction platform or is, are those separate capabilities.
32:00
How does that work? That is built into, many of the
32:03
solutions. Many of the solutions that I
32:06
reviewed this time around, do have those kinds of capabilities
32:10
for do it both kyc and I am l in, you know, in some cases,
32:15
even more, you know, pep compliance politically exposed
32:19
persons effect, lists things like that can be checked for a
32:24
bed. Auction time so that those are,
32:29
you know, have a smaller audience maybe than some of the
32:32
broader lower Assurance, kinds of customers, they may be
32:36
dealing with but it's extremely important that they comply with
32:39
those regulations to. So, yes, to succinctly answer am
32:46
L, KY C is built into many of these solutions that are out
32:50
there today. Yeah.
32:51
And, and this is an area that you did did some recent
32:54
reporting on, right? I think it was June of this year
32:56
2021 that you had the leadership quadrant for the fraud reduction
33:00
intelligence platform. So I have a link to that in our
33:02
show notes so that people can check that out any anything that
33:07
you want to kind of tease people who might be interested.
33:11
Yeah, there's there's a lot of content.
33:12
There's a lot of variety in the solutions that are out there.
33:15
There's a like a base set of capabilities that needed to be
33:20
in there but I think going through it carefully.
33:24
I mean, if you're in the market, Ticket for this kind of a
33:26
product service. Really.
33:28
Then you look at look at the details, see who covers your
33:32
industry, your particular technical requirements and make
33:37
decisions based on that. So I think what we'll try to do
33:40
now is pull us back up out of the the heavy-duty fraud
33:44
conversation and since this is the end of the year and we
33:47
typically end a little bit on a lighter note, it would not be an
33:50
end of your show of any sort. If we didn't do some sort of
33:54
predictions, 20:22. So what I'd like to do is take
33:58
us around the room and we'll start with you, John and then go
34:00
to gym, what are your identity predictions for 2022?
34:05
And they can be good or bad, right?
34:06
I'll leave it up to you if you want to be a an optimist or a
34:10
pessimist, well, I'm gonna go out on a limb here and say that
34:14
we will probably still be entering passwords and answering
34:17
security questions here and there.
34:20
That's, that's a real stretch. Well, you know, okay.
34:25
Okay, so on a more serious note, you know this identity proofing
34:29
piece I coming at this from both the fraud reduction side as well
34:35
as the consumer identity side, I'm seeing much much more
34:38
interesting this especially the different gradations of how that
34:43
might be included into the transaction level analysis.
34:48
I think in 2022, we're going to see a greater emphasis on
34:52
identity proofing even, you know, amongst Different kinds of
34:56
consumer facing sites. I think that will Avail itself
35:01
as add-ons through a lot of the cin solutions that are out
35:05
there. Sounds like a byproduct, right?
35:07
Of the pandemic and the less in person, but still need to verify
35:13
identities and validate statuses of maybe bits of pieces of
35:16
information. So I'm on board with that Jim.
35:19
What about yourself from a production standpoint?
35:21
What do you see for 2022? You know, Jeff and I'm typically
35:24
a very A optimistic person. But the thing I wanted to come
35:30
through as some kind of prediction that wasn't just
35:33
like, hey, I think more people are going to move to the cloud
35:36
because I think that one is kind of like John's, you know,
35:40
password still going to be around.
35:42
I mean, here's what I'm worried about.
35:44
I'm worried about continued. Escalation of, not only
35:49
ransomware but, you know, potentially state-sponsored
35:53
hacking events that Start to blur the line between computer
35:59
hacking and physical military intervention, and that this
36:04
continues to create more tension between the United States and
36:10
China and Russia and to the point that maybe some of it
36:14
boils over into military level conflict.
36:17
So that's my concern. I don't know.
36:20
That's definitely not ending on a lighter note.
36:22
All right, we'll just the the goal of this segment but that's
36:25
my real. Star in a movie, we saw with
36:26
the, you know, the pipeline hacking this year.
36:32
I think a message was sent that, you know, the rent somewhere,
36:37
Crews need to really back off. But there's just so much
36:41
opportunity to make money with attacks like that where you have
36:45
companies that are going to have to pay.
36:48
And they've, you know, under invested in technology and then
36:52
plus the reports that you keep seeing come out with Zero day
36:56
vulnerabilities in software has gotten so complex as listening
37:00
to listening to a podcast from couple charcoal actually say,
37:05
okay? Casey live has a fantastic
37:08
podcast that I recommend people check out and Martin was talking
37:12
about the amount of lines of code that go into traditional
37:18
software product. And it's almost impossible
37:21
nowadays, not to have bugs, inherent in complex.
37:26
For program. So I think you know zero-day
37:28
vulnerabilities continue to be found which means that every
37:33
organization is vulnerable and, you know, anyway, I don't want
37:38
to harp on that that - prediction but I can I don't see
37:43
anything that's going to turn the tide in the other direction
37:46
to me just seems like. The problem is getting worse and
37:50
at some point the government's going to have to step in and
37:52
say, you know, we can't fight this with ones and zeros.
37:55
Okay, so yeah, I'm good. I don't know if I necessarily
38:00
more positive one. I feel like it's a little bit of
38:02
a Debbie Downer situation, but I think I think we're going to see
38:07
a couple things. I think we'll continue to see
38:08
zero trust be sort of like the the marketing term du jour for
38:13
organization. Shifting that we've already seen
38:14
that kind of this year. Kind of take hold, I think just
38:17
based on the slow moving moving trains that a lot of
38:20
organizations are is 2022, will really be when.
38:24
Okay, now we've got room, Budget to kind of address some of those
38:27
things for this hybrid, environment of people working
38:30
from home remote. I think VPN will still be
38:32
around, but I think it's days are starting to get numbered and
38:35
I think it will start to see more of that zero trust Edge,
38:38
kind of process be in place. I think I'm going to see a lot
38:43
more organizations struggle internally if they have not
38:47
invested in just the basics of identity management, you know,
38:51
Jim you and I the work that we do, we see a lot of kind of
38:54
immature organizations, just by the nature of We work on.
38:56
And, you know, they don't, they're using basic processes,
38:59
things are manual, and they've really fallen behind where they
39:03
should be at this stage of the game where they don't have, you
39:07
know, dedicated IGA tool sets, they're kind of doing things and
39:11
Lotus Notes or other things, right?
39:13
You know, we joked about several months ago, you know around hey
39:18
if you're using Lotus, Notes successfully and you're really
39:20
happy with that. As an IM platform, please come
39:22
on the show and tell me I'm wrong 0, people have come.
39:26
To be on that one just as an update if you want to look back
39:28
on that. But I think you know just from
39:30
maturity standpoint. If you're not doing the blade
39:33
basic blocking and tackling and add any perspective, you know,
39:36
even just the basics of identity governance automated onboarding
39:39
off-boarding at a just for active directory.
39:41
Even basic access reviews, basic privileged access management.
39:46
That means more than just, I have this Vault and I put
39:50
passwords in there but they don't rotate.
39:52
You know, there's no discovery of those things, you're not
39:55
doing anything. Unlike session management.
39:57
You don't have MFA pin place or even adaptive or conditional
40:00
rules in place, like that's the basics and I think it's so hard
40:04
to catch up if you don't keep up with it.
40:08
So what we typically see, at least from my perspective is, is
40:11
this hurry up and wait and then you stop investing and all of a
40:14
sudden what used to be considered?
40:16
Great was. Yeah, you're barely cutting it
40:19
and you're having to spend a lot of money doing any number of
40:21
things manual, you know, support for things fraud.
40:26
Issues that might come up because you're not you don't
40:28
have the appropriate behavior analytic.
40:29
So unfortunately I think I'll continue to see a lot of those
40:33
organizations that just have invested internally and identity
40:37
and I think hopefully, the positive spin on.
40:40
That will be that they took this last year and realized, oh crap.
40:45
We really need to get our identity hats on and kind of fix
40:48
some of these systems systemic issues that might be present
40:51
organization. So that's going to be my my
40:54
prediction. John, do you want to weigh in?
40:57
Do you think are we - Nancy's here or Debbie?
41:01
Downers, for free people who are familiar with Saturday Night
41:04
Live? Well, don't leave it to me to be
41:08
the optimistic one that's not a good idea for the voice of
41:13
reason and Santa Yeah. I mean there will continue to be
41:19
attacks. I'm sure.
41:20
Ransom ransomware is not going to go away.
41:23
If it makes the criminals money frauds, not going to go away all
41:27
these things mutate and change. I mean the real world.
41:32
Analogs are really good examples.
41:38
You know, things like viruses themselves, you know, these
41:41
things change, we have to kind of retool and adapt our own
41:45
processes to Deal with it. So in those that do a better job
41:51
at that are going to be more resilient against different
41:53
kinds of attacks. So Jeff what I was going to add
41:56
based on what you're talking about with organizations that
41:58
are laggers that are closer to the starting line than the art
42:02
at the Finish Line. It reminds me of that one meme
42:05
where there's a you can see a lion and these these two
42:10
envelopes are talking one elipsis.
42:13
The other I don't have to be faster than lion.
42:16
I just have to be faster than you.
42:18
That's the old. How do you run away from a bear,
42:19
right? You don't be the fastest on
42:21
Skype you faster than your friends.
42:23
Yeah. It's just got to be faster your
42:25
friend and I mean what how that applies to what we're talking
42:28
about is there's so many of the fraudsters out there that are
42:31
looking for Easy Pickins. A lot of them are not computer,
42:36
scientists who can come up with the zero day, there are people
42:40
who can download scripts and go on the dark web and download
42:44
tools and work their way into Your environment and then run
42:49
Mimi cats and on your active directory.
42:51
But once they own your active directory, they own, you you
42:56
pretty much are in a position where you can't conduct
43:00
business. And so I know that's you have to
43:05
be faster than your friend or you have to be faster than the
43:07
other envelope. You don't want to be the total
43:10
lagger that is just sitting pray.
43:12
Yeah, exactly. All right, so somewhat I don't
43:17
feel, we were successful in ending, I don't know, I don't
43:19
know. But I think it was interesting
43:21
from a thought-provoking perspective to say, okay, you
43:25
know, what are your thoughts going into 2022?
43:28
Like what do you see happening right?
43:29
Is this the year passwords will die again for the 10th year in a
43:33
row? Who knows?
43:35
Right. I'm optimistic.
43:36
I think there's a place for it but you know, we'll see before
43:40
we wrap up here. Any final thoughts?
43:42
John is, we kind of anything we've talked about today whether
43:44
it's the Diction side for 2022 or the fraud reduction kind of
43:50
components. We talked about before.
43:51
What are some final things you want to leave with us for 20 21?
43:55
No pressure. Well, I guess I would say, you
43:58
know, just thinking back on fraud reduction, there has been
44:03
a massive Evolution fraud techniques.
44:06
And what I find valuable about the solutions that are out there
44:10
in frog reduction spaces, they evolve as well, you know, and I
44:15
think there's, There's Hope in that just like there is for
44:20
identity management in general. Yes, there are organizations out
44:24
there that don't have as mature infrastructures or processes and
44:30
places they should. But you know there are those of
44:34
us who are part of this community that are willing to
44:38
help and provide assistance and guidance in that.
44:42
So I think that you know, taking a look at The kinds of work that
44:47
you're doing with the podcast and others in the industry here.
44:51
I think that maybe that should give us a way to end positively.
44:56
I think I think John just called us Heroes and I'm going to take
44:59
it. I think that's at least that's
45:00
what I'm going to glean from that.
45:03
So but yeah, I think you're totally right, John?
45:05
Right. There's a bunch of I am Heroes
45:07
that are running around. If you're listening to this,
45:09
you're probably an IM hero for your organization, or your
45:12
providing iom, heroics for some other organization, whatever.
45:16
It looks like so, well done. John.
45:18
I like that. Jim.
45:19
How about yourself? Final thoughts?
45:21
Yeah. Silver Lining here is that for
45:24
folks who are looking for a career where they can make a
45:26
difference, I make an excellent living identity.
45:30
Access management or information, security, Fantastic
45:35
Field. I encourage anyone who's
45:38
interested to, you know, tap into us as resources tap into
45:43
the community, I'd love to see. More universities, put together
45:48
degree programs. Focus on information, security
45:52
and identity, and access management.
45:55
It's just, it's a field where right now there are more,
45:59
there's more jobs than there are people to fill those jobs.
46:03
So, I mean, maybe overall in the economy that's always the, that
46:08
is where we are across all Industries.
46:10
But it seems like this problem you've good economy or bad
46:15
identity and access management. Judgment and information
46:17
security are, you know, white-hot fields.
46:21
That you could you could build a great career and plus you can be
46:24
one of the the weirdos that actually picked identity and it
46:27
just fall into it by accident. Like my theory is that most
46:30
people did anyway. But yeah, it's a great
46:32
Community, tons of great resources out there and tons of
46:35
great people who are totally interested in sharing the
46:39
knowledge, right? This a lot of this is not
46:42
competitive Secret Sauce where people are not willing to share
46:44
it, so, We encourage people who are interested, check it out,
46:48
tons of resources. We've had some folks in the past
46:51
that have been, you know, getting back to the community as
46:52
well. I think it's people like Andrew
46:55
and David, and things like that. Where there's just tons of
47:00
resources out there that's community-driven.
47:02
So, so there we go. We brought it back to the
47:04
positivity side of things, so that's good.
47:07
We're going to go ahead and end it there.
47:09
I think, you know, this has been a great year for us and we
47:12
certainly hope to see the continued growth and
47:15
listenership that we have all around the world and hope people
47:18
have a great holiday season here, over the next few weeks
47:21
while we take a break. So, again, just a reminder, we
47:23
will take a break here for a few weeks for podcasting, but we are
47:27
going to continue theoretically, some of the live streams.
47:30
So, keep an eye on Twitter at idac podcast, that's where we'll
47:33
announce it. And we'll be streaming on
47:36
YouTube here and there, over the holiday break.
47:38
So, come join us there for some quick conversations.
47:41
So with that, we'll go ahead and leave it.
47:43
Thank you so much John. Thank you so much Jim and we
47:46
we'll talk with everyone in 2022.
47:48
Thanks. Thanks for listening to the
47:54
identity at the center podcast. If you like what you heard,
47:57
don't forget to subscribe and visit us on the web and identity
48:00
at the center.com.