A CISO can’t shake a stick without finding a solution for managing excessive privileges. Yet years of data in the Verizon DBIR show remarkably high rates of employees abusing privileges to steal company data. If we have the right tools, why is this still a problem? 

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is our sponsored guest, Itzik Alvas, co-founder and CEO, Entro.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Entro

Full Transcript

Intro

0:00.000

[Voiceover] Best advice for a CISO. Go!

[Itzik Alvas] I mean, it’s budget season. It’s end of the year. You’re probably working on your budget. Set aside like 5% for unexpected software you will need during 2025.

[Voiceover] It’s time to begin the CISO Series Podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark, I am the producer of the CISO Series and joining me since day one, and actually this is close to our six-and-a-half-year anniversary, Mike Johnson. It is Mike Johnson who is the CISO over at Rivian. Mike, say hello to the audience.

[Mike Johnson] Hello, audience. Is the six and a half year, is that like a paper-plus-pen anniversary? Which one is that?

[David Spark] [Laughter] I don’t know what six and a half year is.

[Mike Johnson] I’d love to know.

[David Spark] Maybe our audience could communicate what the six-and-a-half-year anniversary is, but we’re close to it. Just so you know, we started in June, but the CISO Series and the business didn’t start till October. We consider October the anniversary of the business, but Mike and I started in June prior to that.

[Mike Johnson] But it’s great to celebrate two anniversaries.

[David Spark] Yeah, why not? We are available at CISOseries.com. If you have not spent at least half of your day there, I don’t know what you’re doing, to tell you the truth. But please go there because we have other programs there. Our sponsor for today’s episode, great brand-new sponsor. We love working with this new sponsor.

It is Entro Non-Human Identity & Secrets Security Platform. That is what they do. And in fact, they’re responsible for our guest who I’m going to introduce in just a moment. But first, Mike, this is the second week in December, and I’m in Philadelphia right now at the Cybersecurity Marketing Con, which we, the CISO Series, is ecstatic to be sponsoring because the people who support this program are the marketers who work in the cybersecurity industry.

So, why not support their event as well?

[Mike Johnson] Well, that’s amazing.

[David Spark] And so we’re thrilled to be sponsoring the event. And if you are there this week and you’re listening to this, we’re going to be doing a game show. And many of the games that we play here and in our other shows are being played also there as well.

[Mike Johnson] Awesome. Games for everyone.

[David Spark] Yes. Even cybersecurity marketers, and we have custom games for them as well, including the game which you have played and I have specific marketing terms for the audience. You remember playing the game, “What is Dave’s Mom Talking About?” Not an easy game to play.

[Mike Johnson] That is both a hard game and also a fun one at the same time. So, they’ll have a blast.

[David Spark] It is. It is. Because when people are stumped and then it’s revealed, the answer, there’s this [Inaudible 00:02:50] of, “Oh, well, of course.”

[Mike Johnson] It’s either that or a collective groan.

[David Spark] Yes, it is. It gets one of those – collective groan or that. All right. Let’s bring on our guests. I’m very excited to have this person on. So thrilled that we’re working with them and they’re sponsoring the CISO Series. It’s the co-founder and CEO of Entro, none other than Itzik Alvas.

Itzik, thank you so much for joining us.

[Itzik Alvas] Thanks for having me, David.

Managing security changes for business optimization.

3:15.760

[David Spark] “The process is the same regardless of good terms or bad terms.” Now, that advice came from the cybersecurity subreddit on a thread about offboarding, saying that revoking access should come as soon as any notice is given. Others in the thread said that while cybersecurity staff should handle the mechanical functions around offboarding, all the process should come from an already established HR playbook.

The thread was full of good advice, from changing admin passwords to avoiding Apple ID activation, locks and passwords, and rotating API keys. So, yes, lots of good advice. I’m going to start with you, Mike. Where do you see organizations commonly dropping the ball with offboarding, whether amicable or otherwise?

[Mike Johnson] First of all, I agree that the process should be the same regardless of the terms. If someone is leaving on good terms, their access should be terminated just as if someone was leaving on bad terms. The difference is the timing. I think that if there’s going to be a clean transition, there’s business value in letting someone keep their access until their actual last day.

Maybe some roles it’s a little bit different, especially highly sensitive roles or for some regulated companies. But in general, the idea of cutting access as soon as someone gives their notice probably doesn’t really fly very much.

But regarding the problems, like the things that we see, the issues where people drop the ball, I see them in two categories. One is the process failure to notify of a departure. The people who are doing the action or the systems that are doing the action don’t even know. Contractors is a frequent issue there.

A contractor has their last day, and nobody is informed. So, that’s one, failure to notify. And the other is our old inventory problem. How do we know what that person had access to if we’re not tracking it along the way? Odds are they had access to something that is a little bit outside of the norm.

If you didn’t know about it, you’re not going to terminate those access. So, those are the two categories that I generally see issues arise in terminations.

[David Spark] And I think the playbook is important to know ahead of time because…

[Mike Johnson] Oh, yes.

[David Spark] …you don’t want to be last minute scrambling, trying to figure out, wait, what do they have access to? And especially, and that can grow over a year. Itzik, where have you seen – I’m going to ask the same exact question I asked Mike – where do you see dropping the ball? And anything different from what Mike said?

[Itzik Alvas] First of all, I fully agree with Mike. I think two places where I see organizations are dropping the ball, one of them is maybe not offboarding, but someone is changing the role within the organization and now it doesn’t need the same access.

[David Spark] Oh, yes.

[Itzik Alvas] Yeah. So, that’s like a very common, popular one where everybody’s ignoring that.

[David Spark] That should be calculated into this and we’re not calculating it into it. Good point to bring up. Go ahead, Itzik.

[Itzik Alvas] Yeah. So, that’s definitely the first one. Second one, and actually we just, at Entro Security, we just published a report about that. We’re seeing that 91% of all the tokens we’re finding of former employees, of employees who left organizations, are never getting revoked. So, the programmatic access of them, like personal access tokens and so forth, those are never getting revoked, and that’s definitely the second pitfall.

And we actually have stats on that.

[David Spark] That brings up an interesting point is that, and this is rarely done, this whole idea of when you bring a new technology on, that you have to have an end of life for the technology itself. But the bringing the new technology on also means a beginning and end of life for the people who use it.

Or change of life, for that matter. Yes, Itzik?

[Itzik Alvas] Yeah, I fully, fully agree. Just think about it. Let’s give an example. You have a developer. The developer needs to push code. You have a programmatic access key to do it, like a personal access token. He leaves the organization. No one, or at least in 91% of the time, that access doesn’t get revoked.

So, I fully agree. If you’re deprecating, like you’re deprecating a system, you should deprecate access.

What are the evolving challenges in managing identity and access?

7:50.004

[David Spark] Et tu, Brute? Organizations might feel stabbed in the back when employees misuse privilege, referencing our previous segment, but it doesn’t stop it from happening. Since 2020, the Verizon DBIR, that’s the Data Breach Investigation Report, shows consistently high rates of employees abusing privileges to steal customer data, either for direct financial gain or for potentially competing concerns.

But 2024 also saw a new element, a big spike in the theft of internal data, like intellectual property, showing that espionage is a growing factor outside of naked greed that organizations need to account for. So, Itzik, I start with you. There are so many tools out there to manage excessive privileges.

Why is this still a problem? I mean, we’ve had a lot of these vendors on talking about this too. It’s still very much a problem. Is it just like a massive coordination screw-up, kind of like what we were talking about in the previous segment?

[Itzik Alvas] Yeah, I think it’s a great segue from our last conversation, but access management was the biggest problem for the past, or newest and biggest problem for the past 30 years or so, right? It’s always been a problem and seeing the insider threat growing, that’s definitely a concern. So, the main problem I’m seeing is that that access is usually being granted by teams that are not responsible to secure the same data.

So, you have the IT team grants permission, but then security team is responsible to secure that. And IT only wants to move and move fast. So, maybe, maybe it’s an organization problem more than it is a technology problem.

[David Spark] So, is it more of an issue that the organization needs to dictate to both IT and security at the same time as to what’s happening, like an overall plan? Like if you were in this situation, this is what you get, and with change, this is what you get. I mean, where does, I guess, the ruling have to come down from?

[Itzik Alvas] I think the organization should keep doing what it’s doing. Like if IT or developers are the ones who are granting permissions, that should continue because organization must move forward and fast. But security must have the tooling to reclaim control or to see what the other teams are doing.

And if there’s any deviation from the policy security wants to see, then they should be alerted and probably remove that overprivilege.

[David Spark] I mean, it sounds like just a good old-fashioned communications problem, Mike. Yes?

[Mike Johnson] That’s certainly part of it. You have to set those expectations. You have to make sure that people who understand what the data is are part of the answer. If you come to the security team and say, “Hey, I need access to this data,” I don’t actually know if you should have access to that data.

I don’t own the data. So, we now need to go and talk with the data owner and the data custodian to say, “Should David actually have access to this data?” And if between them and David’s manager says, “Yeah, David needs this to do his job.” Cool. Off we go. Part of the problem becomes is the teams that are making the decision.

So, to Itzik’s point, IT might be making the decision. Maybe they just want to turn the ticket, like I just want to quickly grant the access and move on to the next one.

[David Spark] Yeah. Like how do you know you’re even asking the right person should David have the data access? Yeah.

[Mike Johnson] I think that to your point about lack of tools, we are starting to see better and better access management tools where you build that workflow that says, “Okay, David is asking for this access.” First, does David’s manager approve? Okay, got an answer for that. He’s asking for this particular data.

Go and ask the person who owns that data for their approval. They approve it and then off you go. So, you have to build those workflows in and get the right people involved.

[David Spark] Now, I’m going to ask the obvious question here. It sounds like there could be a bazillion requests and then nothing gets done and everything’s delayed because the human has to get heavily involved. Does that cause major problems here, Itzik? What do you think?

[Itzik Alvas] I think it’s a great question. I think there are two access. One of them is speed. Like, do you want to move fast? And the other one is security, right? So, if you want to be secure, then you should review everything, as Mike said. If you want to move fast, you should approve everything and don’t review anything, right?

How can you let the teams do what they want to do, but still monitor and be secured? And I assume you can do it. You can definitely do it with some out-of-band monitoring system.

[David Spark] And it’s finding that balance, which is always a struggle.

[Itzik Alvas] Right, exactly.

Sponsor – Entro Security

13:08.810

[David Spark] Who’s our sponsor this week? Well, it’s none other than Entro. So, let’s talk about something that was not always top of mind, but it’s become kind of one of the hottest topics in cybersecurity, and that is non-human identities or NHIs. So, in the last year alone, the ratio of human to non-human identities has multiplied exponentially with an average of 92 non-human identities per human identity.

That is a lot. So, no wonder NHI-based attacks make up two of the leading attack vectors in 2024.

This is where Entro Security comes in. As the pioneers in non-human identity management, Entro ensures that every non-human identity is accounted for, secured, and properly managed throughout its entire lifecycle. That’s including the secrets behind the scenes. From creation through a rotation to deactivation.

Oh my god, this is exactly what we’re talking about. Entro Security’s cutting-edge solutions protect your organization against threats you didn’t even know existed. Ah, that’s especially important there. So, providing unparalleled visibility and control over all your NHIs. With cyberattacks targeting everything from IoT devices to cloud services, securing your non-human identities is now more important than ever.

Remember, 92 per each human, so if you think you got your humans locked down, you got bigger problems. So, trust the innovators at Entro Security to keep your ecosystem secure. Go to their website. It’s simple. It’s entro.security. Go check them out.

It’s time to play “What’s Worse?”

14:56.805

[David Spark] Itzik, you know how this game is played. Two horrible scenarios. They both stink, but you have to determine which one is worse. You can agree or disagree with Mike. I always make him answer first, but I love it when you disagree with him.

[Mike Johnson] True.

[David Spark] Mike, I will say both of these are painful. I read them and I go, “Wouldn’t want either one.”

[Mike Johnson] Great.

[David Spark] Okay? Get ready. This comes from Jonathan Waldrop, who’s a CISO over at The Weather Company, and here are your two scenarios. Scenario number one, network connectivity is intermittent with a 96% uptime. That means approximately one hour of downtime every single day. Couldn’t tell you which hour it’s going to be, but one hour every day you’re going to be completely down.

Or you run your business entirely out of out-of-support, end-of-life Windows infrastructure. Think Server 2008 or Windows XP. Which one’s worse?

[Mike Johnson] Wow. As you said, these both suck.

[David Spark] Yes. I like that. Jonathan, I think, put together a good one.

[Mike Johnson] Yeah, good ones, Jonathan. So, the first one, you basically have a random outage.

[David Spark] Every day, one hour. Could be when you’re sleeping. That’d be wonderful.

[Mike Johnson] Yeah, that’d be great. Until somebody wakes you up to fix the outage, which…

[David Spark] Right, that would also not be good.

[Mike Johnson] Not so great.

[David Spark] But that’s every single day. Or you’re on the worst secured operating system ever.

[Mike Johnson] Yes. Yes. So, you’ve got this scenario where your data is probably walking out of the building on a regular basis, and you have no way of preventing it because you can’t patch. You can’t fix those security vulnerabilities that you know are there. Realistically, they both suck. I think that that one is the worst.

You have this security weakness that your systems are just essentially randomly spewing whatever secrets you have out to whoever wants them at any point in time. Because that’s how bad it is when you’re running unpatched ancient operating systems. I mean, if I’m going down once a day, that sucks but…

[David Spark] Hold it. Do you think it’s completely impossible to run a business off of like Windows NT, Windows XP? Like you just couldn’t physically pull it off?

[Mike Johnson] So, I always try and avoid the “it depends.” But there’s certainly some scenarios, right? If these things are completely disconnected, completely isolated.

[David Spark] Yes, of course.

[Mike Johnson] Yes. But I don’t think you can actually run a business that way. I think modern businesses need to be connected in some way, shape, or form. And I think that’s where you’ve got just this massive hole into your environment.

[David Spark] All right. Itzik, I throw this to you. Do you agree or disagree? Again, yes, your data’s flowing out, but I don’t know how you run business with one hour of downtime every single day. Itzik, which one do you think is worse?

[Itzik Alvas] Yeah, being a CISO so long, I must agree that running on Windows XP or NT, that’s probably worse. But thinking about it from a business standpoint, probably having downtime one hour each day.

[David Spark] Like your entire staff is furious with you every day. That is a pretty tough one.

[Itzik Alvas] It’s not even that. What about your customers? How can you explain that to your customers?

[David Spark] [Laughter]

[Itzik Alvas] Everybody’s [Laughter] probably leaving you. You’re probably paying them back because of SLAs. So, you know what? I’ll probably choose the downtime as the worst because you’re going to probably lose all of your customers, and the business will go down.

[David Spark] I think Itzik’s right here because the speed your business is going to fall apart is going to be worse. Yes, your data may go out the door, but you may still be in business in the second scenario. But I don’t know how long you’re going to stay in business in the first scenario, Mike.

[Mike Johnson] I view this as death of a thousand cuts versus a big bang explosion and going out in a blaze of glory.

[Itzik Alvas] Yes.

[David Spark] [Laughter]

[Itzik Alvas] I agree. I agree.

[Mike Johnson] You’ll have this slow trickle of you’ll lose customers for your hour outage, again, depending on what you’re doing, but presumably, if you can’t keep your systems up, you’re going to lose some customers. But you might find yourself in court, you might find yourself in jail, probably not in jail, but you might find yourself in a really uncomfortable scenario with that big bang, massive data breach that is simply inevitable in that scenario.

[David Spark] Can I also just call out the 96% uptime? Now, you know how you always see things that say like 90% or 95% or 97% accuracy? You’re thinking like… But that 3% to 5% is enormous.

[Mike Johnson] [Laughter]

[Itzik Alvas] Enormous. Enormous.

[Mike Johnson] There’s a big difference between 99% downtime and 99.9% and 99.99%. You start doing the math and you get to this point where there are companies who have seconds of downtime. And there are companies who actually commit to 100% uptime. Literally, you’re going to be up all the time.

[David Spark] Well, you talk to the banks, they can do complete rollovers to whole new systems.

[Mike Johnson] Well, so that’s recovery.

[Itzik Alvas] And they may run XP as well, by the way.

[Mike Johnson] There’s a difference between recovery and uptime, but these numbers like an hour a day is pretty painful.

[David Spark] That’s very painful.

[Itzik Alvas] Yeah.

Please, enough! No, more!

20:45.980

[David Spark] So, today’s topic on “Please, enough! No, more!” is non-human identities. I’m going to start with you, Mike, on this. These are growing as evidenced by the research that Entro’s done. But what have you heard enough about with regards to non-human identities? And what do you actually want to hear a lot more?

[Mike Johnson] What I have heard enough of here is this concept of non-human identities is just about managing API keys.

[David Spark] Yeah, it’s way more than that, isn’t it?

[Mike Johnson] And that’s getting frustrating. That’s an old way of thinking. And perhaps that’s what it was at one point.

[David Spark] And API keys, by the way, is a problem.

[Mike Johnson] Absolutely.

[David Spark] Yes. Don’t want to discount that.

[Mike Johnson] What I would like to hear more of is the full lifecycle, is provisioning of the keys, of the secrets, how they are maintained, how are they managed, how are they offboarded when they’re no longer needed. It feels like today the state of the art is you put a password in a vault or a password manager, but that’s not a lifecycle.

That’s a storage mechanism. So, I’d really like to hear more about the full lifecycle of managing tens, hundreds, thousands, millions of non-human identities. So, how do you manage that lifecycle at scale? I’d love to hear more about that.

[David Spark] Which is something we have definitely talked about in the past here, the scale. Because of the exponential growth, which you have made evident. Itzik, so I’m throwing this to you. I’m going to ask you in the same way. What have you heard enough about with regards to non-human identities?

What would you like to hear a lot more?

[Itzik Alvas] No, I completely agree. Mike said API keys, but I heard enough about vaults. Vaults are, as mentioned, storage solutions. That’s it. Encrypted storage solutions where you can keep your secrets at, the application will fetch it from there, use it to access whatever resource they need. But I want to hear a lot more about how do we actually understand and manage and secure their lifecycle?

And I think the very first question should be, how do I know anything about it? How do I know how many non-human identities and secrets I have? How do I know how many vaults I have? How do I know what my non-human identities are being used for? Why they were created? How do I actually understand?

[David Spark] Well, this sounds like the beginning of this conversation is asset management, which is the classic discussion of, “I can’t secure what I don’t know.” And it seems that non-human identities have so run amok that people don’t realize the sheer number that are existing. Yes?

[Itzik Alvas] That’s correct. So, they are being created, used, permissioned by developers or DevOps, and they scatter them around, usually. So, I would like to hear a lot more about how do I allow them to continue to do what they are doing and move fast, but reclaim control as a security professional, reclaim control on my non-human identities and secrets because they have excessive privilege, like admin permissions usually, to my production environment and data.

[David Spark] All right. This is where I’m going to switch the conversation to specifically talking about Entro. So, this is your expertise. Obviously, you’ve exposed a lot of the research that you’ve done in this area. How are you approaching this? And are you approaching it from more of a lifecycle stance, like what Mike was talking about?

[Itzik Alvas] Yeah, we’re helping organizations to securely use non-human identities by managing and securing their lifecycle, and we’re doing that with six-step lifecycles. So, the first one is inventory. Let’s understand how many non-human identities we have and where.

[David Spark] The asset management issue.

[Itzik Alvas] Yes, exactly. The second one is let’s classify them, enrich them with business context because those are usually longer than my strings, right? So, let’s create a map of which workload is using what token to access what, permissions, activities, and so forth. Then let’s use that inventory and classification and do static risk analysis, posture management.

So, how many of them are not stored in a vault? How many of them have not been rotated? How many of them have excessive privileges? Then we’re doing dynamic risk analysis, non-human identity detection and response. Like if someone from Africa is using my tokens, and I’m not doing business with Africa, that’s something we should prevent.

And then we’re moving to remediation, like let’s vault all of our secrets, let’s rotate them automatically, and let’s decommission the ones we no longer need. Some statistics, we’re seeing about 40% out of all non-human identities at our customer base, they are actually stale, idle, not needed anymore, but no one is decommissioning them.

[David Spark] Yeah, I’m assuming that. So, give me an idea of kind of like a before and after situation where an organization is not really managing this at all, which I got to assume many don’t have sort of an overarching control of this. I mean, probably a lot of piecemeal tools, looking at it. What does an environment look like before and after taking advantage of how you help with the NHI situation?

[Itzik Alvas] Right. So, let’s take the statistics that I just shared, like 40% are unused. That means that doing the POC alone, you can decrease your attack surface by 40% like that by just removing them. That’s an easy one. You can right-size the permissions because we are tracking each non-human identity.

And if you have admin permission, but it is only using read permissions, then you can ensure right-sized permissions. You can vault all of them and so forth. So, it’s a drastic change to the organization. And also they can be compliant because a lot of regulations are actually requiring rotations of tokens, and we can definitely help with that.

[Mike Johnson] One of the things I was curious about because frankly, a lot of what you’re talking about, I think a lot of CISOs do have this challenge. The remediation, I think, is an interesting aspect. And so I’m curious, how do you actually go about removing access without potentially breaking a process?

[David Spark] Good point.

[Mike Johnson] How do you do that safely, I think, is the question I have.

[Itzik Alvas] So, when I talked about the six pillars that make up the lifecycle, the first one was inventory, understanding how many you have and where. The second one was classification. And in the classification stage, we’re enriching them, we’re understanding their permissions, but also we’re tracking their activities.

So, now we can understand what that token is actually being used for. And if that token is being used for only reading from a database, but he has admin permissions, that’s a gap and we can right-size to read permission without affecting anything.

[Mike Johnson] It’s basically you remove the things that you know you can remove. It’s not that you’re just removing the identity.

[Itzik Alvas] We remove the things, removing the permissions, according to the activity to the actual usage. Yes.

[Mike Johnson] So, in that example, you’re not seeing that identity use its domain admin privileges, so therefore it feels pretty comfortable to remove that.

[Itzik Alvas] Right, right.

[Mike Johnson] Got it. Makes sense.

Okay, what’s the risk?

28:27.303

[David Spark] “Imagine if the credit reporting agencies decided that they’d start evaluating large enterprises with the same credit scoring algorithm that they use for me as an individual.” That’s the challenge for third party risk management industry, according to Andy Ellis, one of our regular co-hosts here and a partner over at YL Ventures.

He wrote this in a recent CSO Online piece. Now we’ve all internalized that these scoring tools and questionnaires are not truly addressing the risks we inherit from our vendors. It’s kind of a universal agreement, but everyone kind of throws up their hands and says, “Well, that’s what we’ve got.” So, I want to just have a sort of an out-of-the-box discussion right here, and I’m going to start with you, Mike.

How can we think about this problem differently? What are some of the out-of-the-box ways to look at third party risk?

[Mike Johnson] So, I feel like this is one that we could do a “Please, enough! No, more!” just like over and over again.

[David Spark] Yes.

[Mike Johnson] Because it’s an area that everyone likes to talk about how much they hate it, but everyone keeps doing it.

[David Spark] Yes.

[Mike Johnson] It’s this weird thing of like, why do you keep hitting yourself? And I think to your point of out-of-the-box thinking, that’s where we’re at. We need to take a step back and figure out a better way of tackling this problem, and I think part of it is companies need to get better about evaluating their risk.

Not everything is the same. If you’ve got a hotel that you’re sending people to on a trip, that’s very different than the place that you’re storing all of your core, most important data. You shouldn’t be evaluating those the same, and you’re going to send both of them this 500-question questionnaire?

And you’re not going to do anything with it. Most people don’t actually do anything with the questionnaires that come back.

So, where I think about it is like start with the end. What happens if there’s an incident at your vendor? What are you going to do? If there’s an incident at this vendor, I don’t actually care? Then you’re kind of done. You just need to know that who your vendor is. You need to have the inventory. You need to have the appropriate contacts and you’re done.

If it is, “Oh, I’m rolling incident response and I’m notifying our regulators,” that then tells you, you need to understand how quickly you can know that a thing has happened. How quickly you can scope it.

[David Spark] Have you ever had an honest discussion with a vendor? Because that’s a really interesting way of taking, of saying, “I want to have an honest discussion with you.” Vendor, partner, “I want to see you as a partner. Tell me, what is the worst thing that could happen with you? Give me a few scenarios so I can understand how I need to protect myself.” Have you ever actually done that?

[Mike Johnson] Not with a vendor, but that’s one of the great conversations that you should have internally with the stakeholder that’s making the purchase. They should understand the data, the information, the use of this widget so they can explain what is the worst-case scenario.

[David Spark] So, you should know that at purchase, not down…

[Mike Johnson] Correct, correct.

[David Spark] Although, if you’re a CISO that walks into an environment, you’ve got purchases already running. You got to just know that then.

[Mike Johnson] Certainly, but for that is, I come back to stop the bleeding.

[David Spark] Yeah.

[Mike Johnson] Make sure you’re not accruing new risk at the least.

[David Spark] All right. I’m going to take this to you, Itzik. Take it any way. I like the idea of just start with what are the scenarios that are going to happen with the vendors and work backwards. What’s your take?

[Itzik Alvas] I think we should think why it started, right? We want to engage with another vendor, and we want to understand what that vendor can get from our environment, which data is flowing his way, right? That’s what we want to know. And we want to know that because we want to know how we would be affected if something would happen to that vendor, right?

So, yeah, people started with a questionnaire, and they are asking a lot of questions like, “Hey, are you accessing my PIIs? What are you doing with my PII data?” And so forth.

I think it’s very similar to the problem we talked about earlier. Like, okay, developers are creating non-human identities, and security have a policy they should store them within vaults. How can you make sure it’s even happening? I think that’s the interesting question [Inaudible 00:32:58]. You’re giving third-party vendors a questionnaire.

Maybe you reviewed that questionnaire, and you’re approving it, and you’re fine with that. How do you make sure they’re in line and doing what they are actually saying they are doing? How do you make sure they’re not accessing other PIIs?

[David Spark] And I think that’s where I think sort of the compliance tools and these trust centers are going to try to provide real-time answers to some of those kinds of questions. I mean, isn’t that kind of the purpose of many of these new tools, the trust centers in particular?

[Itzik Alvas] Yeah, as I see it, if the information doesn’t flow through them, or if they are not monitoring that, they are unable to actually do it. At Entro, we’re actually doing some of it. So, think about it. When you’re connecting to organizations, maybe you have a booking that needs to interact with Hilton, they have some sort of a non-human identity to facilitate that authentication and access.

And because we’re tracking the activity over there, we can say what they are actually doing to your data. So, we’re providing some of that, and if one of them will be breached, we’re going to let the other one know. I think that’s the main topic for me, like make sure they are actually doing what they say they are doing.

[David Spark] So, I guess periodic checkups, and well, that’s just where I think these trust centers come in. And also at the purchase point, as you mentioned, Mike, find out what the worst-case scenarios can actually be. Or if you’re post-purchase, maybe ask them then as well.

Closing

34:34.706

[David Spark] Well, that brings us to the end of the show. This was great. Thank you so much, Itzik. Thank you so much, Mike. Itzik, I’m going to let you have the very last word here. But first, I do want to thank you for sponsoring the show and for Entro as well. Remember, go to their website, entro.security.

There you’ll find all the information you need to know about Non-Human Identity & Secrets Security Platform, helping you with the entire lifecycle. I think that’s fantastic. Mike, any last words from you?

[Mike Johnson] Itzik, thank you for joining us. I was just today talking to someone about how difficult identity is and how it really is one of the chief concerns of security organizations, and so I liked that we had this discussion today. It was very timely for me. But I think all of our audience is really thinking a lot about identity, and non-human identity is something that people are starting to think more about.

The thing that I keep going back to is your data. That 91% of tokens are not revoked when people leave. That is data. That’s things that people can point at and say, “That’s risk.” So, thank you for sharing that exact data point, but thank you for helping remind people and help them think more about identity in general.

Thank you so much for joining us.

[David Spark] Itzik, you get the last word. And we always like to ask our guests, are you hiring over there at Entro?

[Itzik Alvas] Oh, yeah. We’re hiring all of the time. We are actually hiring a lot. So, you can go to our website. There’s a Career page over there.

[David Spark] And if you have any special offer, any sort of suggestion how to reach out to you over at Entro, please let our audience know.

[Itzik Alvas] Yeah, so we do. We actually provide free assessments. So, if you ever wondered how many non-human identities I have within my organization, how many of them are vaulted, how many of them have excessive privileges, how they are being used, all of the above, you can just go to our website and ask for a free assessment.

But other than that, just go to our resources, like the blogs and the different reports we have over there. Education is free. And you should definitely learn more about non-human identities because by Verizon and IBM Reports, who’s leading the industry, those are the second most frequent attack vectors and the number one most costly breach in the industry.

So, just learn a bit more about that for sure, and we have a lot of data.

[David Spark] Please take advantage of their free assessment. We have a good number of our sponsors do offer free assessments, and I have had a few myself. And while, sadly, I like to say you’re not going to like the outcome, no one ever does. No one ever says, “Oh, everything’s perfect. I’ve got everything locked up.” That’s never the result.

It is always better to know than to not. So, please, please take advantage of it. Thank you very much, Itzik. Thank you to Entro. Thank you, Mike. And thank you, audience. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cyber Security Headlines Week in Review. This show thrives on your input.

Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.