Latest / Identity at the Center / #178 - Authenticate 2022 - Target's FIDO Journey with Tom Sheffield

Transcript

#178 - Authenticate 2022 - Target's FIDO Journey with Tom Sheffield · Identity at the Center

0:09
You're listening to the identity of the sender podcast.
0:12
This is the show that talks about identity and access
0:14
management and making sure you know who has access to what
0:18
let's get started. Welcome to the identity at the
0:25
center podcast. I'm Jeff and that's Jim.
0:26
Hey, Jim. Hey, Jeff, how are you?
0:28
Oh, not so bad yourself. I'm doing good.
0:31
Did you think you would come to Seattle and have great pizza?
0:34
No, the Sheraton Grande, Seattle has great pizza.
0:38
They had lunch today, it was fantastic, but I'm having a bit
0:43
of a carp coma at the moment so but you know nothing that
0:49
caffeine can't fix so, all right, I'm sorry.
0:53
I grew up in Chicago area, which is a pizza mecca for a lot of
0:58
people. I am of the persuasion that most
1:03
Pizza is pretty good. Like, it's pretty, even a bad.
1:06
Pizza is still pretty decent with the exception of one that I
1:09
had in Paris, which was completely awful.
1:11
We're not going to go there right now and I feel like that
1:13
is common for the most part. I mean, you're talking do cheese
1:18
sauce, some toppings, things like that.
1:21
Yeah, BFFs admit to some pizza. Better than others, right?
1:25
It sounds better than others for sure.
1:26
Yeah. But even a bad Pizza.
1:27
Still pretty good. Yeah, this was good pizza.
1:31
It wasn't like good bad Pizza. There's just good.
1:34
Good pizza. I didn't have any of the pizza
1:36
lunch and saying, yeah, you missed out.
1:38
You also eaten the The partially cooked chicken.
1:41
No, I have the partially cooked pasta was fine.
1:45
It was difficult to scoop because there was so much cheese
1:48
on the on, the spooned, couldn't like get it to come off the
1:51
spoon. So it's like, I'm like one Piece
1:54
of pasta to piece of pasta. Trying to get it but those are
1:57
all first world problems. I mean, I yeah, the first world
2:00
problems but I'm thinking that conferences and this conference,
2:04
the authenticate 2022 conference which were sitting in shout-out
2:08
to and Russia are again for, you know, and Adrienne for settings
2:14
up with a fantastic podcasting milk, which is where we're
2:18
podcasting from now. But, you know, I think the food
2:23
Was so good. Here.
2:24
That is like having it might give thanks giving a run for the
2:28
money in terms of the amount of weight that I put on, that's a
2:32
bold statement. Yeah.
2:33
Well, they also had a great breakfast, buffet downstairs.
2:36
So I don't know. I'm going off about the food.
2:38
I've eaten a lot of food since I've been here.
2:42
Yeah. Why don't we talk identity?
2:43
As you mentioned, we are at the authenticate conference here in
2:46
Seattle, we've been having lots of great conversations with
2:49
folks that are here, some who are giving presentations some
2:52
that are not and just The dining space, Our Guest right now falls
2:57
into the former category. His name is Tom Sheffield.
2:59
He's a senior director cyber security at Target.
3:02
Welcome to the show. Tom, thanks for having me.
3:04
Yeah, thanks for so much for being here.
3:07
You're going to give a talk tomorrow as we're recording this
3:11
around targets, Enterprise journey to adopt Fido, but this
3:15
is the first time you've been on the show.
3:16
Hopefully, not the last, but we have tradition whenever someone
3:19
joins the first time, I like to find out a bit more about their
3:21
identity background sort of their, their Origin story.
3:25
How did you get into that dining space?
3:26
Is something that you chose, or did it choose you?
3:29
I think it's a combination of both.
3:31
I chose to take the role but at the moment, I didn't realize it
3:33
was an identity role. I started out in General
3:36
Electric at the aviation division in Cincinnati, Ohio.
3:39
And it always been in a, what I would call an application
3:42
infrastructure type role. So application to support
3:44
product teams, engineering teams, things like that.
3:47
And there's an opportunity at our corporate headquarters to
3:50
launch at the time will be called the directory initiative.
3:52
And didn't know really what? It was but it ended up being the
3:55
beginning of our single sign-on capability for GE and it had
3:58
becoming the capability, the core capability for our
4:01
centralized provisioning for GE. And then at the time, it was
4:05
just one of those things that we did was a productivity play,
4:07
right? We had situations, you know,
4:10
prior to single sign on every user had multiple accounts,
4:12
multiple logins, multiple passwords.
4:14
We had different ways to get access to different systems.
4:17
And so at the time, we really focus on productivity and the
4:20
sarbanes-oxley hit a couple years later and You started to
4:24
see some of the compliance opportunities that identity
4:26
could play Within. And so we started focusing more
4:28
on compliance in addition at. So as you're doing centralized
4:31
provisioning, you get centralized access.
4:33
Your views are the capabilities for centralized access reviews.
4:35
So we started driving a lot of, a lot of our focus on to
4:38
ensuring GE remain compliant. So beings actually being the
4:41
initial one and then after, you know, a few years cybersecurity
4:45
became more like what it is today where you actually had a
4:48
security Focus simultaneously and I've been doing it, you
4:52
know, I guess now for most last Two years and it's so amazing
4:55
how far it's come. So it sounds to me like it chose
4:59
you to some degree, which has been sort of my working Theory
5:02
over us. Say this is I think episode 178
5:05
and we think maybe two people. During that time have said that
5:09
they actually chose identity. Well, I think if you're an I am
5:13
live for today. You've been doing, I am for 20
5:15
years, there's no way that you chose it because most people
5:18
didn't even know what it was back.
5:20
Then this is absolutely true. I would agree.
5:22
Yeah. If you're coming into To the
5:23
industry. Now you're likely choosing it
5:26
and you're probably choosing it from a cyber security angle not
5:29
as much maybe as an identity angle and what we found is that
5:31
identity its core identity is core to a good cyber security
5:35
posture. Yeah, I would say it's at the
5:37
center. Let's talk a little bit about
5:41
the talk that you're going to give tomorrow and it's titled
5:43
insights from targets Enterprise journey to adopt Fido.
5:47
So that sounds very cool and impressive.
5:49
What is the, you know, the the subtext there that we should be
5:52
thinking about as we go into it for For your talk tomorrow.
5:55
Yeah, we. So we've been on our final
5:56
Journey for multiple years. Now most recently about a year
6:00
and a half ago, we'd made the transition to support Fido as
6:04
what I call a primary authenticator.
6:05
So replacing the use of the password and using Biometrics.
6:09
So we chose to use platform authenticators on our devices.
6:12
So laptops and mobile devices, very natively.
6:16
And so we've been talking about our journey now to get to that
6:18
point. We had deployed phyto previously
6:21
as a second Factor authentication are for step
6:23
above Indication risk-based authentication, but we quickly
6:26
saw the opportunity to leverage Fido as a possible alternative
6:29
and so we haven't eliminated password yet but we have
6:32
absolutely tried to reduce our dependency on passwords across
6:34
our Enterprise. So you mentioned that this has
6:37
been a multi-year journey to get this done that.
6:39
I think, I think a lot of people who say go fight, oh we're done,
6:42
right? And I think Fido has been around
6:43
for a while. So most 10 years.
6:46
Yeah exactly. We're coming up on the
6:48
anniversary of, you know the passwords going to die soon.
6:50
Right. So we saw her do not want to get
6:51
into and I think about From your perspective, sort of leading
6:55
this group and sort of this charge through it.
6:58
What are some of the challenges are wrinkles that, you know, the
7:01
people who are listening us are probably out in the real world
7:03
doing real identity, things. And their thing about some say
7:05
that Fido sounds cool like what are the things that I could be
7:08
looking out for maybe gotchas or things like that?
7:10
Yeah, I think there's obviously going to be a well I said
7:14
there's likely going to be a cost component, right?
7:17
So getting buy-in for your organization on why you need to
7:20
do it and for us it actually starts to hackathon event.
7:23
We Actually chose to write our own Fido server initially.
7:27
And as far as a hackathon, we were trying something.
7:28
We are helping helping to give our team members opportunities
7:31
to learn new technologies or new skills and it just grew from
7:33
there. So it's something that we've
7:35
really been able to tackle organically, we haven't required
7:38
significant investment in our world and so it's fun that we
7:41
can just continue to try and push out, sort of organically
7:44
and keep pushing. I will admit, we're probably
7:47
very unique there. We have a very mature Enterprise
7:51
authentication pattern. So as we integrated fight, We
7:54
integrated fight with hundreds of applications initially
7:56
because we had that tight pattern again, that's probably a
7:59
little bit unique to Target. So depending on where you're
8:01
coming from your story, your starting story might be
8:04
completely different. I would say at the at the most
8:06
basic stop. Once you understand what Fido is
8:08
and what it can do, it's about creating the business case and
8:11
your business case, maybe a financially driven one.
8:14
Right. Maybe your helpdesk costs are
8:15
expensive around passwords maybe use your frustrations run.
8:18
Passwords are very very challenging.
8:20
It may also be a security one. Maybe you're in the middle of
8:24
something where you identified that that Fido is a, is a strong
8:27
authentication capability and that's the angle.
8:29
You want to go, but you need to get that buy-in first as the
8:32
first step. And then, from there, it's about
8:34
making you making small iterations trying things out,
8:37
testing things and and then moving forward and trying it.
8:39
Again, you mentioned this multi your journey as well.
8:42
Like what was the what was the aha moment?
8:45
Where as I go? Yeah we should probably be
8:47
looking at this vital thing and doing something about it.
8:49
Was it that hackathon? Or, you know, what was the sort
8:52
of like the The Genesis of like, oh, this is Wilbur.
8:56
This is the future for authentication at Target.
8:59
Yeah, I think the Genesis was the belief that Fido had legs,
9:04
right? Was still very early, right?
9:05
We didn't have broad industry support yet.
9:08
At the time, you know, Apple wasn't yet a member of the Fido
9:11
Alliance. So we knew that we were up
9:13
against some challenges in terms of Enterprise adoption, right?
9:16
We needed to make sure that we had a an environment that all of
9:19
our users would be able to use, right?
9:21
It wouldn't make sense to roll out the solution and then I have
9:23
half your users who were on maybe that platform not be able
9:26
to use it. So once we saw Apple get
9:28
involved, that's really where we said this is real.
9:30
Now, this is something that we can actually do.
9:33
The hackathon was our sort of internal impetus to get started
9:36
and that was just a trial like, let's try it.
9:38
Let's, let's let's have our team's learn something new in a
9:40
safe environment and so we just iterate it on that, sort of
9:43
behind the scenes, until we have the opportunity to actually take
9:46
it forward as a, as a platform for authentication.
9:49
So Tom, is this something that you decided from a Grassroots
9:53
perspective? Of that like, hey, we really
9:55
need to do this. And then use salt it up to your
9:59
management leadership team. Okay?
10:01
So that is a really big Point. What was that, like, what top
10:05
walk us through, you know, how you made that case, how you put
10:09
it in the business terms that, you know, executive leadership
10:13
got behind it and was willing to make the, I'm sure sizable
10:18
investment to make this happen. Yeah, for us, it was really, our
10:21
goal was to try and demonstrate that it Could be as easy as a
10:24
consumer experience. So so everybody at that point
10:27
had mobile devices right with either a touch ID or face ID
10:30
like experience and what platform you're on.
10:32
So something that we basically tried to demonstrate, we can do
10:35
the same thing for the enterprise.
10:37
We can do it at scale again because we had a very robust
10:39
Enterprise authentication pattern.
10:41
We could demonstrate that we could get all of our
10:43
applications integrated with it. It was also something that we
10:45
could use from a security perspective to highlight the
10:48
security benefits of logging in with a biometric, right?
10:52
The other final protocol. Under the covers as opposed to
10:55
password. And so we all know the inherent
10:57
weaknesses of passwords as an industry.
10:59
The news is full of stories around them and we are
11:02
continuing to look at ways to try and strengthen that
11:05
authentication experience and make it easy for our users.
11:08
We talk a lot about our users in the moment.
11:11
They're logging into an application, not that they don't
11:13
care about security but it's not top of Mind in that moment.
11:17
It's about friction. It's about how easy was it, how
11:19
fast can I do it? And we've been able to
11:21
demonstrate through Biometrics that it is actually Easier to do
11:24
that than to enter a password. Yeah, absolutely.
11:27
So Tom not sure if you made it to the session yesterday, where
11:31
is the one of the it leaders from City talked about, you
11:38
know, they rolled out to like 200 million consumer users.
11:42
Roll-off find out. Roll out roll.
11:44
Yeah, and question came, why did you choose to do consumers
11:51
before Enterprise and Khalid to summarizes answer.
11:54
I think he said that, we thought it would be easier to do
11:57
consumer than Enterprise, which is like a head-scratcher, right?
12:01
Because on the scale of things, even though they have a lot of
12:04
employees, if you have 200 million consumers, you started
12:09
with the Enterprise. And what I think about the
12:12
diversity of types of users, got your corporate users.
12:16
You got your Warehouse users, you've got retail users.
12:20
I'm sure some in between. And then on top of that, You've
12:23
Got A diversity of application which I think was essentially
12:27
City's point, right? It's like the internal users
12:29
have 20 100 applications. Whereas consumers have one, two,
12:33
maybe three so talk us through maybe some of that challenge,
12:38
right. The diversity of user types and
12:41
you know just how hard it must have been to roll out Fido to
12:47
your Enterprise. Yeah.
12:49
So for us I touch on an initially a little bit so from
12:52
from a I'll use the application side first, right?
12:55
For us, we have that that robust Enterprise authentication model.
12:59
So we already had, even though we have hundreds of
13:01
applications, there are already leveraging, our single sign-on
13:03
solution. They're already integrated into
13:05
our login patterns. So as we enabled Fido for our
13:08
users, it was immediately available for all those
13:11
applications as soon as we launched and every no
13:13
application that launches in Target now, going forward that
13:16
launches onto our platform automatically gets benefits as
13:18
well. So we actually had situations
13:20
where our users users were going back to the application.
13:23
Occasionally and saying, why can't I log in with fingerprint
13:27
ID? Why can't I log in like that?
13:29
So that's actually been a partial driver for us to get
13:31
more applications on-boarded into our pattern.
13:34
If you think about our user population, we initially
13:37
targeted, specifically, targeted through our campaigns rh-q
13:40
population because we had control, the desktop, I knew
13:44
they had a capable device, I had ways to reach them through
13:47
email, through internal portals, things like that.
13:49
So our Target population initially was our HQ users But
13:54
we quickly realized as we've rolled out and as we've
13:56
continued to roll out, now, almost a year and over a year
13:58
and a half later, is that a significant number of our non HQ
14:02
users have registered as well? And we attribute that to our
14:05
communication strategy. We put together a very robust
14:08
communication plan again, Direct Communications, targeted
14:11
Communications campaigns in the like, but we also leverage and
14:14
indirect methods. So, we put some of our messages
14:17
across internal portal Pages. We partner with some of our
14:20
larger application teams to help up them deliver our message on
14:24
our behalf. So if your login to our HR
14:26
application, we had an FAQ within our, a chap like within
14:29
it which, in our within our HR applications, FAQ Pages, the
14:32
suggest that those users register for our solution.
14:36
So we've actually seen about 60% of our of our stores users, for
14:40
example, register for our solution, the registering on
14:44
personal devices, mobile devices, and personal laptops
14:47
workstations, are otherwise, and they're primarily using it at
14:50
using those devices access. Their HR information, They're
14:53
paying benefits information. So we provided value for them.
14:56
That we were able to that they were able to see and we like to
14:59
say we Inspire them to go from a log and experience of your
15:02
passwords to log experience via Biometrics.
15:05
Yeah, I think that one of the things you're bringing up there
15:09
is the importance of communication and then the other
15:13
thing that I took away is that you've been investing in?
15:17
I am over time, right? So you have some platforms that
15:21
you're able to leverage I think You know, you can't just decide
15:24
to jump right to Fido and expect that.
15:26
It's going to be a snap of the fingers.
15:28
If you don't have kind of those building blocks that you're able
15:31
to plug into, or at least you could turn on Fido.
15:35
But to get like hundreds of apps to all be on Fido overnight,
15:40
right? You're leveraging that
15:42
investment in that IDP that you already stood up.
15:45
Correct. We had laid out our identity
15:47
Vision about I joined Target about six and a half years ago
15:50
and shortly after I joined we laid out our identity vision and
15:52
we We built it on Three core, tenants.
15:55
First, we want to simplify technology.
15:57
We recognize that the the the Computing environment was moving
16:02
to the cloud, devops things like that.
16:04
So we want to be there. We wanted to enable our
16:06
engineering and product teams to go deliver solutions for their
16:09
customers for their users, without becoming a barrier or
16:12
bottleneck. And so, that's the foundation
16:15
cyber security, and identity can become those two things.
16:17
If you're not careful. We also recognized early on
16:20
that. We want to take advantage of
16:21
Open Standards, right? I didn't want vendor.
16:23
Lock in. And I want to make sure that had
16:25
interoperability both within my ecosystem as the tools that I
16:28
use, but also again, with the developers ecosystem.
16:31
So, I want to make sure that we could, again, support them and
16:33
help them do the things they need to do.
16:35
The second tenet of our vision was focused around enhancing
16:40
security, we all recognize the inherent path weaknesses of
16:43
passwords and so we knew we want to get rid of them.
16:45
We knew we needed a lever, strong authentication and fight.
16:48
It was a perfect story to tell about how we could do that.
16:51
And then finally, we wanted hands.
16:53
Your experience, just the average user that consumer.
16:55
And I made the comment before about, you know, easiest and
16:58
fastest in the moment. That's what the team members
17:00
want, when they're log. In order to do their jobs, they
17:02
want to get it done as quickly and seamlessly as possible.
17:05
So our goal was to enable productivity for them.
17:07
But in a compliant secure way, I didn't want them to have to make
17:10
the traditional trade off that people often make its those
17:13
trade-offs that cause problems, right?
17:15
From security perspective, from a compliance perspective and we
17:17
want to make sure that they were leveraging, our solution right
17:20
away. But to do, so in a compliant and
17:22
secure way. What about feedback from users
17:25
themselves? Have you gathered any sort of,
17:28
you know, I always cringe right feedback from users might be -
17:33
some might be positive. But what has been the response
17:36
to sort of the rollout as it's gone so far?
17:39
It's been it's been really really positive two responses.
17:42
A lot of a lot of positive feedback we haven't yet hit full
17:45
adoption and I don't know what full adoption looks like.
17:47
I love to think that I'm gonna get the 100 adoption at some
17:50
point. We realized during the pilots
17:52
for example, we Number of Pilots over our journey, we realize
17:55
during the pilots this was during the during the pandemic
17:58
time. So all we had all shifted to a
18:00
remote working environment and what we quickly realize, for
18:03
example, is that a lot of our Engineers, for example, they
18:07
were able to set up their multiple monitors dual monitors
18:09
at home, external keyboards, external mics things like that.
18:12
And what we learned is that their, their laptop is often off
18:15
to the side of their desk often times with a lid, actually
18:17
closed so that fingerprint sensor isn't even available to
18:20
them. So you think about platform
18:21
authenticators, right? They're not even able to
18:23
authenticate the way we'd like them to.
18:26
Now, there's no way that I can tell them change your desktop
18:29
setup. I need you to do this for me.
18:30
That's just not going to fly. I'm not very good.
18:32
Even I'm going to entertain that type of a conversation.
18:34
So we've been working with looking for ways to help them
18:37
authenticate via biometric, enable security keys.
18:40
For example, there's still some reaching challenges, perhaps
18:43
depending on which side of the desk, the keyboard, the the
18:46
laptops on, or where the keys actually plugged in.
18:48
But we continue to look for ways to help enable them to be able
18:51
to try and leverage the solution to Down the same productivity
18:54
and Security benefits that everybody else is receiving
18:56
since interesting pivoting. During this test right to say,
19:00
okay I'm one of those people right.
19:01
I generally have my laptop off to the side and it's closed and
19:05
yeah I'm not getting Touch ID that but I do have things like
19:09
Windows hello. If I have you know an IR camera
19:11
that can kind of look at me from a distance, things like that.
19:14
So there's certainly options around that.
19:16
I guess what are some of the other patterns from a MFA
19:21
perspective that you're You're deploying.
19:23
You mentioned the security Keys, obviously, the hardware itself.
19:27
Other other things that might be out there because I would
19:30
imagine you probably are like the terrible analogy, like,
19:33
Hawkeye from from The Avengers. He's got this, you know, Arrow
19:38
quiver, full of a whole bunch of different arrows.
19:40
They do different things and I think the modern I am program,
19:43
probably has a whole bunch of different arrows to solve
19:47
specific use cases or you know, things like that.
19:50
I'm wondering as you were looking through.
19:53
This process of deployment. You know what were the arrows
19:55
that you were looking to kind of put in that quiver?
19:58
Yeah so we've been on the multi-factor journey for years
20:01
now as most companies have so so you know otps right we support
20:06
we support what I'll call generically Legacy tokens,
20:11
right? You all if you've been in the
20:13
industry for any period of time, you likely had one on your
20:15
keychain. If not have one right now, we
20:17
continue to support those in environment.
20:19
We also support OTP push as well.
20:22
Not a Has it each of those are fishing, right subject to
20:25
fishing susceptible to fishing so Fido gives us that fishing
20:28
resistant capability but your comment we feel that they have
20:32
different clickable use cases. And so what we try and do is we
20:36
provide our support as many as we can and then we tailor their
20:41
adoption or tailor their their consumption based on the data,
20:44
the application being accessed. So we may not off, we may not
20:47
allow you to authenticate with one of them into a certain
20:49
application depending where you are in the network but that's
20:53
Choice. You're making consciously as
20:54
part of our data classification and application risk
20:56
considerations but I was reading the synopsis of your talk.
21:02
One of the things it said was that you had a goal of not
21:07
having people call the help desk to get through this process,
21:10
right? So I want to ask you kind of a
21:13
further question on that. So most of expected that some
21:16
people are going to call the help desk.
21:18
What is it 2% 5% 10%. I want to know Like what was
21:23
your estimate and then how close were you to actual?
21:27
So we didn't have a specific numerical estimate when we
21:31
started, we were concerned. We're absolutely concerned I
21:33
didn't want to overrun the help desk and I didn't want to
21:35
overrun my engineering team from a level 2 or level 3 escalation
21:39
perspective. The more time that they would
21:42
have to spend supporting our users is less time, they're
21:45
working on the solution less than they were going to
21:47
capability. So we were very interested early
21:50
on about what it might look like.
21:52
What else? Say, is that we've had my
21:55
numbers? Well, less than 1% of support
21:58
engagements coming from our user base.
22:01
So very, very happy with what we've seen so far.
22:04
It's been relatively easy to roll out relatively easy to
22:07
adopt relatively easy to use when measured from a support
22:11
perspective. It's been very very low support
22:13
engagements overall, which is which is surprising, but also
22:17
very, very happy to see it sounds like we're done here.
22:21
Tom has solved. Roll out of Fido for every
22:24
organization out there. Just talk to him.
22:26
She needed help. I know, I mean, it sounds like
22:28
it's going well, I wonder if the pessimist of me is thinking
22:33
like, okay, when does the other shoe drop right?
22:35
Do you have any sense of impending dread or Doom or do
22:40
you feel pretty confident like? Yeah we're on the right track
22:42
and it's just a matter of time and execution and sort of the
22:45
rollout like are there are things on your radar that you
22:48
think could be an issue if you don't get in front of it?
22:52
Yeah. I think we're absolutely on the
22:53
right track. We're happy with where we are.
22:56
We continue to tweak our experience.
22:57
We continue to tweak our messaging on our flows to try
23:00
and encourage more. Adoption that desktop setup will
23:04
be a struggle to get past, right?
23:06
I still have users, some users. A small pocket of users.
23:09
This will have privacy concerns. They're concerned that quote,
23:12
unquote Target as access their Biometrics.
23:15
And we trying to articulate that the same biometric that you, you
23:18
likely use today, to unlock your phone, right?
23:20
We're just using that same biometric in a different way.
23:22
Yeah, but again, those are battles of their discussions.
23:25
That I may not ever convince those users to move past, I
23:29
would say the biggest thing that we're tracking right now is
23:32
passkeys as we think about the people that do engage our
23:35
support channels today, one of the top top engagement requests
23:41
that we get are people that get a newer replacement device.
23:44
So they don't realize immediately that they need to
23:47
re-register their credential, you need to re-register for our
23:49
program. And so that is something that
23:51
we've got messing around. Now we try and I've fa Q's to
23:53
try and eliminate the help desk all but it's definitely
23:56
something that we see. I think pass keys are the answer
23:59
there and I'm excited about the future of passkeys but as an
24:02
Enterprise I think there's some considerations that we're all
24:05
going to have to convey think about before you can actually
24:07
take advantage of passkeys. One of them that I like the
24:10
Highlight is what I call a philosophical one.
24:13
What is your company's position on allowing corporate
24:16
credentials, which is the pass key to be synced to a personal
24:20
cloud or keychain account a second one that we talk about
24:23
internally is what is your company's position on allowing
24:26
access to corporate resources, corporate applications via
24:29
non-corporate devices. So personal laptop, personal
24:32
mobile devices, Etc. We have some of those at Target
24:35
and so it's something that we're now considering as you think
24:37
about. Passkeys, how do we want enable
24:39
that? Well, I think the way people
24:41
have work has changed, right? I think the blending of what is
24:46
a personal device versus a work device has probably changed
24:50
quite a bit over the last couple years, especially where, you
24:52
know, of course, Always use their work computer to do
24:54
things, sort of ancillary, but a lot of people now that they just
24:59
there on a computer, it's just what, the, what's in front of
25:02
them, they're using it. And I think that question of,
25:05
you know, do you allow X on Y, is really so fundamental to the
25:10
strategy because if the answer is yes or no, that opens up a
25:14
branching decision, kind of beneath it, right?
25:16
I think having the, you know, the the foresight to look at it
25:20
and say, OK, these are the things that we need to answer
25:22
before we even get get to like that's that's not a pass key
25:25
question, right? That's do.
25:26
We even a lot want this thing to be in our merits, why we call it
25:30
a philosophical conversation, right?
25:32
It goes back to what is your company's position around
25:34
security or your network, or things like that.
25:37
And then how do passkey support or not, as the case may be that
25:41
position, then what do you need to do to change your position or
25:44
not as the case may be and then what does that do?
25:46
Then? Do your decision around.
25:47
What passkeys will work for you. So it's a domino effect if you
25:50
will but you have to have the conversations first and Stay in
25:53
your positions. Now is one of the themes I heard
25:56
about yesterday. Which was that the hackers the
26:00
adversaries? Don't go after the happy path.
26:03
They go after the unhappy path. It's the scenario.
26:07
You brought up got a new device need to re-register and okay.
26:12
Now that they put a weakness in that workflow that I can
26:15
exploit. So, yeah, I think you're on the
26:18
right track. I'm wondering what else coming
26:21
from this conference kind of Resonated with you you talk
26:24
about passkeys big thing, use usability and user experience.
26:29
Ubiquity was something that's talked a lot about that piece.
26:33
I just talked about with the adversaries going after the
26:35
unhappy path. Were there any other key themes
26:38
that resonate with you or maybe spark some new ideas outside of
26:43
the final room? Specifically, I think cape has a
26:46
lot of has a lot of opportunity. I know it's very early, but it's
26:50
something that we're beginning to take a look at in terms.
26:52
Of those signals. And then the Eventing off of
26:54
those signals. We had any significant work or
26:57
specific work yet. But as we think about 20-23, I
27:00
hope to do a little bit of Investigation there.
27:02
That may become a hackathon topic for next year.
27:04
If you will, for us, as we just want to get our arms around and
27:07
understand what it might do for us, how we might be able to
27:09
leverage it. And then from there, we can
27:11
determine if it's a priority and then if we have to sell it, you
27:14
know, what's the business case, we want to wrap around it, to be
27:16
able to make it a priority? So for people who aren't
27:18
familiar with cape, can you kind of explain it to folks who are
27:20
not neck-deep in this? Yeah.
27:22
Way, I describe Cape at the highest level Cape begins to
27:26
allow for a continuous authentication experience.
27:28
So today if I log in and I'll use a SAS application.
27:31
As my simple example, when I log into that application, I'm given
27:35
a token, right? And there's nothing that the
27:37
vendor knows, or the SAS provider knows about me at after
27:40
that, receiving or issuing that sorry, issuing, that token to
27:42
me. That says that token, maybe
27:45
isn't as valid, or isn't as strong as it was before I should
27:49
do something about it and say, okay provides the ability for an
27:52
eye P like us to be able to send an event saying.
27:55
Hey, something's changed about Tom's experiences,
27:59
authentication experience, maybe, change networks.
28:01
So maybe something else happened.
28:03
You should consider doing something, so it's an event
28:05
based system from the IDP and then the the RP would be able to
28:09
do a response to that and a simple response maybe to revoke
28:12
the token or to prompt for a secondary authentication at
28:15
which point we come back to me the IDP and I would either allow
28:18
or disallow that secondary authentication.
28:21
For example, I think it's in testing trying to determine
28:24
what's normal in those sort of scenario, especially as we're
28:26
just talking about multiple devices, right?
28:28
You might be flipping from your iPhone to a laptop to a tablet
28:32
to a workstation, right? Whatever may be and trying to to
28:37
take all those signals and not like drive yourself crazy with
28:41
hey is this legitimate log on there or not right and and at
28:45
the same time trying to balance that against the usability,
28:47
right? On the user side?
28:48
It's like okay you know if I'm constantly getting prompted for
28:50
am, if a right weeds there's this thing called MFA Teague
28:53
that's out there. You know, you get the Spam on
28:55
your phone and says, yes. Yeah, you know, approve this
28:57
and, you know, it's not you and people know it's not then and
29:01
they will still click approve and that they just have to get
29:04
it from, you know, wrong once and then and then it's game
29:08
over. So, I think it's an interesting
29:10
approach. I do want to say something about
29:12
the MFA fatigue, so, I remember where I would get prompts from
29:19
Microsoft authenticator saying, you're trying to login.
29:22
And what happened was? My laptop session had timed out
29:26
and it tried to re-authenticate me and it's going to push
29:29
authentication on my phone. And I was in sitting at the
29:32
laptop, it was in my office and you know, ultimately I would not
29:38
approve it. But after that, it happens to
29:41
many times. I kind of like thought, okay,
29:43
that's what's happening but because I'm an information
29:45
security. I'm going to be the wise person
29:49
and not approve it, but yeah. I think the average person once
29:51
they realize that that's Probably what happened.
29:54
They're going to go ahead and approve it.
29:55
They know anything about Exchange ActiveSync and such as
29:59
like that. These are driving crazy.
30:01
Even Jim knows, I am constantly trying out new devices so I
30:05
would constantly be in the throes of re-registering devices
30:09
to get you know work emails and calendars and things like that.
30:12
But that is certainly a first world problem.
30:15
What other conference thoughts that you have?
30:16
You know it you're a presenter but you're also hearing it as an
30:19
attending. I think this is the first one
30:21
you've been here in person. For thoughts, comments
30:25
recommendations. Like what should people who
30:28
haven't been able to make it here in person?
30:30
Like there are viewing it for your eyes.
30:32
What would you put out there? I would say it's a great
30:35
opportunity to learn what other people are doing, right?
30:38
So again, we're here to share our story.
30:39
There have been a number of companies like us that are
30:41
telling their roll out, roll out stories and so it's a chance for
30:44
you to learn. I talk about in my presentation
30:47
about just inspiring, right? If you haven't yet started,
30:50
maybe it's an inspiration to get started or if your Our early in
30:53
your journey maybe it's an inspiration to go faster,
30:55
everybody's got to make that decision for themselves but
30:58
sharing our information. This is this is why we like to
31:00
say that cybersecurity is a team sport and conferences like this
31:04
are opportunities for all of us to go out and share with the
31:06
community what we've done, some of our lessons learned, maybe to
31:09
inspire, at least, to help somebody else to be able to go
31:12
through their Journey. May be a little bit better and
31:14
if we can get that moving and sort of like a domino effect,
31:17
right? There's the people come on later
31:19
in the journey. Hopefully, it's going to go
31:21
much, much smoother for them. Because they'll learn from
31:23
everybody else that went first. So let's end on a lighter note
31:27
because I want you be able to get out and listen to whatever
31:30
the next keynote is because the fact that the content has been
31:32
Stellar here before we go, I like to get stupid and ask dumb
31:38
questions and kind of bring things up a level and I've got
31:41
something really stupid here for us to end the day on if animal,
31:45
okay? If animals could talk, which
31:48
would be the rudest animal. The rudest animal.
31:55
I would say something like an ant and and I you're constantly
31:59
at risk of getting stuff done. Your casa looking up around you
32:03
at the feet coming down on you, right?
32:05
If you imagine bumping into somebody on the on the road
32:07
today, right? You give dirty looks right there
32:09
may be words exchanged and has to do that all the time.
32:13
And with with no almost no chance, right?
32:16
Because of the side, the relative size of them versus the
32:19
foot, coming at them. So I have to believe that an ant
32:22
would be pretty snarky if they're constantly dodging.
32:24
Eat all day. I guess I would be snarky to if
32:26
I was dodging feet. Jill dry yourself.
32:28
What is the rudest animal? So as Tom was devious
32:32
explanation I thought well first we need a definition of rude
32:36
because there's like rude like you know I will talk to you kind
32:40
of rude and then there's just doing rude things.
32:43
So not talk to you I was thinking okay?
32:45
Maybe it would be an animal like a deer or something like that.
32:48
That's afraid to be around people and but then I thought
32:52
I'm going to go with my original answer which was Was the camel
32:55
is new for like spitting like nasty stuff on on people and
33:00
stuff. That's downright rude.
33:02
So camel. All right, I'm going to go with
33:04
the honey badger just because the honey badger doesn't care.
33:08
It will go after anything for sure.
33:10
So, you know, that's a shout-out to the famous internet video.
33:14
Yes, that is. Video is not that the honey
33:16
badger doesn't care if it gets a little more rude than that.
33:19
Yeah, exactly. That's going to go with Tommy
33:22
been a great sport. Join us here.
33:24
Hopefully your you'll continue to conference and we'll see you
33:27
out there as well. Any takeaways you want to leave
33:29
his people before we wrap things up?
33:32
No, no takeaways go out and try get started, do something.
33:35
I think, I think the first step is taking taking the first step,
33:39
right? So build your business case, do
33:41
your valuations, build your understanding of what phyto is
33:44
and whether or not it's going to work for you and then build your
33:46
case from there. And hopefully, we'll see you on
33:49
the on this talking circuit in a year or two and you can bring
33:51
your story forward as well, right on will be chairing in.
33:54
The understands for you stop talking and start doing is one
33:58
of my favorite things. So all right with that, we're
34:00
going to go ahead and leave it for this one.
34:03
You can find us on the web at identity of the center.com.
34:06
We're on Twitter. At idac podcast will have a link
34:09
to Tom and his LinkedIn profile if you want to Ping him for
34:12
ideas on how he was. So successful in solving all of
34:16
targets of medication problems, not that I didn't just totally
34:19
blow things up for you, Tom but sorry and with that we'll go
34:22
ahead and leave it. So thanks everyone for listening
34:24
and we'll Talk with everyone in the next one.
34:29
Thanks for listening to the identity at the center podcast.
34:32
If you like what you heard, don't forget to subscribe and
34:34
visit us on the web and identity at the center.com.