Are we ready to shift left on identity? What more do we need to know about identities before they enter our environment?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Damon Fleury, chief product officer, SpyCloud.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, SpyCloud

Full Transcript

Intro 

0:00.000

[David Spark] Are we ready to shift left on identity? What more do we need to know about identities before they enter our environment? 

[Voiceover] You’re listening to Defense in Depth. 

[David Spark] Welcome to Defense in Depth. I’m David Spark, I’m the producer of the CISO Series. And joining me as my guest for this episode, you’ve heard him before, whether you like it or not you’re going to hear him again. His name is Steve Zalewski. Steve, say hello to the audience.

[Steve Zalewski] Hello, audience. 

[David Spark] Do you think there’s anyone who is the “not” part of hearing Steve Zalewski? I don’t believe there is a case. I’ve yet to hear anyone say, “I don’t like the Steve Zalewski episodes.” I’ve never heard that. 

[Steve Zalewski] Well, that’s a good thing. We got to keep that track record going. 

[David Spark] So, far, I haven’t heard it. And please, audience member, don’t be the first one.

[Laughter] 

[Steve Zalewski] Don’t ruin our perfect record. 

[David Spark] Yes, we’re going well so far. Our sponsor for today’s episode, a great returning sponsor to the CISO Series. Thrilled to have them back. It is SpyCloud. Act on what criminals know about your business. That’s SpyCloud. We’re going to be talking about it more later in the show. And our guest today, brought to us from SpyCloud.

That in just a moment. But first, let’s talk about the topic at hand, Steve. You said on LinkedIn that IAM programs, that would be identity and access management programs, provide a good baseline for identity. They do, and it’s standard. It’s like getting locks on your doors. But we’re increasingly seeing a variety of identity information being weaponized by threat actors to target organizations.

So, how do we expand our understanding of digital identities proactively? And that’s the key thing here. So, it’s not something where we just accept the identities into our system, but rather we know something about them before they enter our environment. That’s kind of the question you posed to our community, and what was kind of the feedback you got?

[Steve Zalewski] Great feedback, first I want to say, but the thing that struck me in looking at all the feedback was there was no consistency in the answers. It ran the gamut of, “We need to do MFA,” or “We need to look at threat intelligence,” or “We need to do better with authorization,” or “We need to get better alignment with the business.” And what I was really hoping in the conversation, right, and putting it out there was shifting left, whether you believe shift left or not.

But it was to get us out of the box of doing basic identity lifecycle management and understanding it isn’t trusting the identity. It’s determining is it a reasonable expectation to let the identity do something at a point in time? 

[David Spark] And one of the things – I think your point in the reason it was all over the map – unlike IAM, which has been around for a while and well-identified, this effort we’re trying to do is far from well-defined, and I think that’s what we’re going to discover here. Yes, Steve? 

[Steve Zalewski] Yes. And when I say identity lifecycle management, right, this is a key IAM thing, which was an identity is born, it is given rights, and then it is removed, and that’s traditional identity and access management. And everything we’re talking about is it’s not just being born, be given rights, and being removed.

It’s in being born and at the right stage, right, what is appropriate? It’s the enrichment beyond just giving me access to an application. 

[David Spark] And it’s the people you’ve yet to give access to, which we’ll also be talking about as well. Well, we’re going to have this discussion with someone who is an expert on this very topic and will expand our view of identity, and that is the goal here, it is our sponsor guest from SpyCloud, the chief product officer, none other than Damon Fleury.

Damon, thank you so much for joining us. 

[Damon Fleury] I’m really excited to be here, really excited to talk about this topic. It’s such an important topic to any security program. 

What are the elements that make a great solution? 

4:10.149

[David Spark] Bojan Simic of HYPR said, “We need more deterministic ways of verifying both accounts and people across all identity stores. The average enterprise manages an employee identity in 25 different places, which means that we have to think about identity security as a horizontal layer of controls that need to be applied holistically.” I think there’s a lot of people in agreement with that, but not a lot of people apply that, and I think that’s an interesting take here.

But Jay Dance also of StubHub said, “We should perhaps look at data other than identity data, like does a user visit websites that are high risk, use high-risk tools on their corporate devices, access high-value business data? If we are able to deterministically identify high-risk situations, we may then be able to use that score to not only allow for authentication/access to high-risk sensitive data.” So, both of these people here, Bojan and Jay, bring up really, really good points of there are lots of ways to measure people other than the traditional ways we’ve been doing it, Steve.

[Steve Zalewski] And I would say this is what we were starting with. There are two ends of the spectrum here, right? What Bojan is saying is, “Look, let’s have one authoritative source of all identity data so that I know who you are,” and we don’t. We have systems of record spewed all over that duplicate the authoritative source for any number of reasons, which means we’re potentially making bad decisions on bad data.

You get to Jay who says, “Look, assuming we saw that, we need context because we can’t trust authentication.” So, we need additional context to determine not just the authentication, but the authorization. And so now you see kind of the two ends of the spectrum, which was we never got the first part right, and now we’re being demanded to get the second part right.

[David Spark] So, I think Damon… Both of these comments really kind of dovetail, correct me if I’m not, to what you’re doing over at SpyCloud – I’m sorry, kind of just jumping to this right away – in that this is the way you’re thinking, isn’t it? 

[Damon Fleury] A 100% it is. It’s really important when you’re setting up your response to identity security issues to understand everything you can about that individual. And so I think Bojan and Jay have a lot of the right ideas here, of you need to gain access to that information, collect it in a place where you can take action, and then understand and make decisions based on it.

Then I would just like to add to it, I know this will be part of the conversation as we go, that there’s way more information out there than what you have right in front of you and within your one organization. 

[David Spark] Okay, let me pause you there for a second. Let me pause you because I want to delve into that so people can really get a true picture of what you’re talking about. What is that additional information that most of us are just not taking advantage of that is out there? 

[Damon Fleury] Yeah. So, it’s information about that user and whether they’ve logged into other sites that have been compromised. So, the things we all know about our credential sets, right? There are tons of credential sets, and we have actors that use the credentials that are out there to fuzz them and to figure out, “Can I see a pattern?” and then use that information from their old personal life or from their prior work lives to access a particular business.

But the information goes much deeper. There’s session data that can be used as a session cookie to perform session hijacking. There’s information from people’s personal computers that have been stolen by malware. There’s file information. There’s information about the applications that they use and how they access their own infrastructure or access their companies.

There’s even information from people who’ve been phished, and the data that’s been stolen from those efforts, there’s information about their financial lives. All of this data can somehow be brought together if you want to target an organization. You pick out the users you want to target. You can look through their digital identity and the larger sphere of their digital identity and all of that data can be used against our enterprises.

[David Spark] We are going to delve more into that as we continue. 

Would this work? 

8:40.932

[David Spark] Drew Simonis, who’s the CISO over at Juniper Networks, said, “Not to be pedantic, but this isn’t shifting left. It is expanding the scope of intelligence and analytics to include more identity information.” So, he corrects us there, and this is what we were just talking about. Good job, Drew.

Adam Koblentz of Reveal Security said, “We definitely have to move beyond just detecting things like impossible travel and logging in from new countries or devices.” Yeah, that’s usually how this has been defined to us. “And instead, move toward detecting and truly anonymous and possibly malicious journey identities take through IDPs and the application and cloud layers.” And again, just what you were referring to just moments ago, Damon.

And lastly, Andrew Wilder of Community Veterinary Partners said, “How can we tailor that access to just-in-time and authenticated to prevent a bad actor from using that access? This applies to birthright accounts, but even more to non-human accounts. You could use that data to create profiles to feed UEBA user and identity behavior analytics models to identify possibly compromised accounts and help create role-based access control models for new employees.” All right.

I’ll start with you, Steve, on this one again. Both Drew and Adam talk about what essentially Damon was just referring to, but Andrew also brings up the issue of non-human accounts. How does this mess up our discussion when we throw this in? 

[Steve Zalewski] For Drew, where he says, “Look, it’s not shifting left, it’s expanding.” You can also argue it’s not shifting left, it’s actually shifting up and down. If I look at my enterprise architecture stack and pushing identity down at the API layer, down at the data edge, whereas traditionally we held it at the business application and the network edge.

So, I want to expand the conversation to say, so when I was asking for shift left, getting out of the box was simply saying, in some way, let’s change the conversation. Now to Andrew’s point, I would take it a little further, which is what we’re realizing is authentication isn’t nearly as good as we want it to be, and it’s actually getting worse, not better because of all the social engineering and ways that we’re able to bypass our authentication.

Okay? 

So, even providing more context on authentication is actually slowing down a curve that’s going in the wrong way. And therefore, we have to look at authorization, where he’s going, which was assume it’s not Steve that just logged in, and you have to look at how he behaves for authorization because that’s my second line of defense.

And we have to really harden that and things like threat intelligence in the way that I normally operate, what is the business application path flow? How am I looking at data? All of that context enrichment, so that what we can do is make real-time decisions, not on whether Steve is Steve, but is it appropriate for Steve at this point in time to make this transaction?

[David Spark] So, Damon, throwing back to you again, there’s a few issues here, but this whole desire to make just-in-time, and you in the last segment explained all these different factors and all these variables, and it seems quite complex to be able to make a just-in-time decision with that sort of very knotty information you provided.

How is that done? 

[Damon Fleury] Well, it’s through automation. At the end of the day, many of the elements I mentioned, the credentials can be automatically tested and reset, session cookies can be automatically detected and remediated. Information about whether someone’s experienced a malware event can be automatically staged for fixing and for dealing with the stolen data.

So, automation or orchestration is very available to remediate the most severe of these issues, and this goes exactly to Steve’s point of we have to be able to take this data and feed it into our authentication and authorization strategies in an automated way. 

Now, the other data, some of the other data I mentioned, that’s great for context, but all of the available tools today, your very common IAM tools, have the concept of risky users, have the ability to modify policy and access and authorization. But, I mean, straight up, we’re just not doing it within our enterprises.

We’re not taking advantage of this kind of information. Many companies don’t have access to the kinds of things I’m talking about, at least not in high enough fidelity to be able to make these decisions. And so, but once you have it, it does exist, then you can do things about it to specifically remediate it.

And if I could, I’d like to make one more point. I love Drew’s point around is this really shifting left, and I like Steve’s response to it. But I’ll also say I do believe it is actually, this conversation is about shifting left because I spent a lot of time in incident response before this job, and I can tell you, you’re always interested in getting left of boom, right?

Left of that really horrible event. And the things that we’re talking about remediating and getting in front of, we’re not trying to stop that unauthorized access. We’re trying to stop what they’re going to do with that unauthorized access, the ransomware attack, or the theft of IP. And so anything we can do to understand what’s happening to your users, and get ahead of that and make that change, you’re getting way to the left of the real problem when they truly damage your business.

Sponsor – SpyCloud 

14:29.490

[David Spark] Who’s our sponsor this week? Well, it is SpyCloud and let me tell you something. It’s no surprise, given the constant news about high profile data breaches, that the criminal underground is booming. But it’s really the growth of stolen identity data like passwords, session cookies, and personally identifiable information or PII, that’s fueling this fire.

So, if you’re relying on threat intelligence to understand the risk that stolen employee and customer data poses to your company’s risk of cyber attacks, we have news for you. What you really need is to understand exactly what criminals know about your users – the stolen identity data they’re using to target your business now.

How can they essentially take action on it? 

So, our friends over at SpyCloud, the leader in cybercrime analytics and today’s sponsor, know this information and arm security teams with the identity intelligence they need to act on stolen data. Whether it was exposed in a breach, an infostealer infection, or a phishing attack. So, all the classics, they can help you out.

So, their automated solutions, what Damon was just talking about, integrate with your favorite tools so you can act on the exact information criminals are using to target your business now without massive effort or overhead. Which was my concern, so this is good. So, put an end to account takeover, session hijacking, and even ransomware, yikes, with SpyCloud.

Get a report of your users’ exposed identity data for free. Actually, I want to let you know the CEO of SpyCloud many years ago did that for me, and boy was it shocking. So, get that information for free over at spycloud.com. Just go to spycloud.com. Go check them out. 

What do we have to do now and what can wait? 

16:27.349

[David Spark] David Alkema of Optiv said, “From the user side, we need to make it easier for individuals to review their permissions and remove themselves from apps and systems to which they no longer need access. I think there are many who would gladly prune their own access. Lastly, use events like the organization chart changes to trigger access reviews.” These are interesting tips here.

Ashish Shah of Andromeda Security said, “Giving employees self-service access to their own risk and usage data increases your employees’ security awareness.” I like that. “So, you can even gamify this. Once users are aware of their standing privileges and corresponding blast risk, you can also drive towards a faster adoption of least privilege and just-in-time in your organization.” 

So, this is really interesting, throwing some of this back on the users, Damon. I don’t know if this has ever been done or whether it’s been done successfully, but I love the fact that if you give them access, they start to understand security concerns. And if they could see the blast radius of their own sort of access, like, “Oh, I don’t want to cause these problems.

Like, yeah, please shut it down.” Because most people think, “No, I want access to everything.” But if they were seeing, oh, this thing I never use, I should just shut it down, it would make… It’s empowering the individual. Have you seen this happen? And, well, let me just leave it at that. Have you seen this happen?

[Damon Fleury] Yeah, absolutely. I think those are great points around individuals understanding more about what their actions mean to a business is really critical. And I can tell you, I’ve done this more times than I can count that sound just like when our CEO showed you your data on the dark net, David.

Those scenarios where we show people what has been taken that can impact them or can impact their business, it’s always terrifying and eye-opening at the same time, but then gives you an opportunity to be able to deal with those problems before they happen to you. 

And I can tell you, being in this business for a number of years now, there’s nothing more eye-opening than seeing what the bad guys actually have. We all love to think, “Yeah, I have, a little bit lax on this, a little bit lax on that.” I would like having access to HR share that I got when I was in HR.

It’s much easier that way. But then they start to understand, well, the bad guys actually have your company org chart. The bad guys actually have your logins because you got a malware infection. Well, okay, now I really should shut those things down. So, I think that education is really important because we are only as strong as our most tired employee.

But at the end of the day, I also think that we cannot rely on education to fix this problem. We cannot wait for everyone to learn the lessons. We have to take automated action, going back to the last point, to remediate these things before the users have a chance to understand that. 

[David Spark] That is a really good point. Like this, I think the advice here sounds awesome in theory, and it’d be great for security awareness, but it’s definitely not enough to solve the problem now. Steve, you’re nodding your head. 

[Steve Zalewski] There’s two thoughts. You asked me earlier about non-human identities. Non-human identities mean it isn’t Steve. It’s this thing that therefore really has no history of identity, but I have to allow it to be proxied. Okay? So, there’s one where you’re like, well, that’s not going to work so well.

But the other part here where it’s like, what can wait? And it was something that Damon said earlier, which was I would love to prevent a breach. Least privilege is awesome as a concept to prevent a breach. The better I am at it, the better the results, but oftentimes the friction of securing my company is more than the business is willing to accept, and so then they start to go around.

So, while we want to prevent, a lot of what we’re doing here is introducing defense in depth. It’s the, okay, when prevent doesn’t work, what do we do to detect and contain and leverage that data to be able to find – and what Damon said is just because they’re in and they generally log in, they don’t break in, it takes a while for them to move to actually execute an attack – and the better we are at looking at all this identity data and the threat intelligence gives me multiple opportunities to see those breadcrumbs to stop it.

But more interestingly is I’ve got to be relatively permissive because the business demands it, but I can go shields up, and threat intelligence may allow me to not just identify that it’s Steve, but it may be Steve’s team, and I can implement higher multifactor authentication for a day and let them know why.

So, don’t underestimate the what can wait is shields up. Okay? Is almost waiting until we see that there’s a target, but then there’s something we can do about it. 

[David Spark] Let me ask you, is that something you’ve seen, Damon, or you do with your product? Is that you literally like can dial up the authentication process and dial it down? Because I mean, we’ve seen this where, like, you can turn off MFA for a week if we’ve authorized this computer. 

[Damon Fleury] Yeah, we have certainly have implementations and customer implementations where they’re responding to the reality that one of their users experienced a malware infection on a home computer and that data was stolen and taken to the dark net. Well, you need to increase the risk level, and you need to check their credentials.

And so you can immediately take different actions, you can force them to reauthenticate every time they log in. There’s a whole bunch of step-up methods to further authorize, to make sure that they are who you think that they are. And then if you can’t get comfortable with it, or if it’s a non-human account, you can lock the account.

What’s the best tool for the job? 

22:31.887

[David Spark] So, Abhishek Singh of Qualys, he offers this, “You can shift left with identity as code. All identity and authorization policies should be expressed as code. Then you can proactively benefit from best practices and code reviews prior to hitting deployment. Now, this does not mean putting secrets in GitHub.

That would be the antithesis of forward progress. It means that the actual mechanisms for authentication and authorization needs to be orchestrated at runtime, shift right, in a passwordless and ephemeral sense.” So, it like comes and goes, there is sort of essentially no permanent sort of marker out there.

What do you think of this take, Damon? 

[Damon Fleury] I love it, I mean, and I think I agree wholeheartedly with the spirit of what Abhishek is putting forth here. I don’t necessarily agree that it always has to be code, but if we take that to mean automation or automated policy enforcement points, then absolutely. If you don’t have a policy engine that’s either in code or specifically in an automated engine, then you’re too slow at the end of the day.

You’re not going to be able to respond to the needs of your business, you’re not going to be able to respond to the inputs, whether it’s from threat intel or from a change in the org structure. And so I love this idea that in order to shift left, you have to respond to things as they happen, and the best way to do that is automated.

[David Spark] Very good. All right, Steve, I throw this to you. What do you think on this? 

[Steve Zalewski] The value of having everything is code is that I can centralize authentication and authorization because if it’s in code and it’s calling out to common services, I’m 80% of the way there. Okay? Because now I can implement my defense in depth where everybody does roll through it. And oftentimes, legacy applications have their own password stores, or they can’t implement to my SSO policies, or they charge more and I don’t have the money, so I’m not able to do that centralization.

That’s the key is the centralization of our policies and our data, so that as we get smarter with threat intelligence, we’re able to apply it in a variety of stages of access. And I think that’s what Abhishek is really getting at too here is we’ve got to, right, make coding of the authentication and authorization process not business app specific, okay, not developer specific, but you really do need to embrace the centralization of IAM to really have any chance in this day and age of being able to keep the bad guys at bay.

[David Spark] Excellent. 

Closing 

25:25.879

[David Spark] Well, that brings us to the almost end of our session, but this comes to the point where I ask both of you, and I’m going to start with you, Damon, which quote was your favorite? A lot of good stuff in here. A lot of good insight here. Which one was your favorite, Damon? 

[Damon Fleury] Honestly, the one that I was the most attracted to was this conversation of what shifting left means. 

[David Spark] That would be Drew Simonis, CISO of Juniper Networks. 

[Damon Fleury] Right. At the end of the day, is it truly… To me, the conversation around, it just kind of leans into the conversation around why are we doing this? Why are we spending time on trying to understand identity analytics? I’m not interested in doing this to have better stats for the board.

Of course, that’s important for every CISO, but I want to get ahead of the actual threat. And I think it kind of highlights a conversation that we need to continuously have within the industry of identity is how they are getting in. Right? As Steve already said, right, they’re not breaking in, they’re logging in.

And so we need to really adopt the understanding that we can get ahead of identity threats. We need to make identity security a part of our CISO’s purview, which in so many cases, it is not. The identity team is often a completely separate organization, and the CISO doesn’t have the ability to make changes in that world.

And so really, it kind of comes to the heart of do we really understand what it means to stop the bad guys before they get in? And does the CISO really have the ability to take actions to prevent it? 

[David Spark] All right. He liked the shifting left quote. Steve, which quote was your favorite and why? 

[Steve Zalewski] I’m going to go with Andrew Wilder of Community Veterinary Partners, and the reason why is he said, “We have to tailor access to just-in-time.” That’s it. We have to pull as much as we can in to be able to delay the decision to the absolute last moment so we have the most context we can.

And I just thought that was a really good point about whether you believe in a shift left or not, or up or down, but it’s this authentication authorization and that neither are perfect. And that’s what we have to do. And then the second part is he talks about non-human accounts because that gets interesting because they don’t have a profile.

But then he talks about user behavior analytics. The thing we didn’t talk about that really strikes home for me is if I can identify an identity is misbehaving, maliciously, accidentally, whatever, I can do something about it. I can let the automation, okay, deprovision the account. I can hold the account.

I know what the identity is. I know what to do. Whereas if I get a bad network packet, what do I do? Okay? If I got a bad policy on DLP, what do I do? And so I think tripling down on identity-centric, right, security controls is huge because I know how to action a consequence.

[David Spark] Excellent advice, both of you. Well, that brings us to the end of the show, and I do want to thank our sponsor, that’d be SpyCloud. Act on what criminals know about your business. I’ll tell you, so very briefly, and again, I think it was like eight, nine years ago, that Ted Ross, CEO of SpyCloud, showed it to me.

He was showing me what was on the dark web about me. And he kept reassuring me, “This is not me breaking into your system and revealing on my machine your stuff.” He goes, “This is just publicly out there in the dark web.” And it was one of those eye-opening, like, yikes. Like, yeah, I was shocked to see it because I just didn’t know.

And now more and more people know now that that is happening all the time. Damon, any last words, any offer you want to make to our audience? I know, like I mentioned about SpyCloud, they can get some information on exposed data just like I got if they go to spycloud.com. Are you hiring? Anything else you want to say about SpyCloud?

[Damon Fleury] Yeah, I mean, all of those things. Certainly invite everyone to come to spycloud.com and click on the Check Your Exposure link. You can get an updated view, a little more recent than eight years of what David saw a while ago. And then feel free to reach out to us through that website, and we would love to talk more about the kinds of risks that are facing businesses today.

We are absolutely hiring. Seems like we’re always hiring and continuing to grow. So, we’re definitely, if you’re looking around, feel free to check the website on the careers page as well. 

[David Spark] Can they contact you directly through LinkedIn? Yes?

[Damon Fleury] Yes, of course. 

[David Spark] All right. And mention that you heard Damon on the show. That’s Damon Fleury, who has been our guest from SpyCloud, the chief product officer over there. And also Steve Zalewski, you hear him all the time. Remember, if you don’t like hearing Steve Zalewski on the show, I don’t want to hear it.

[Laughter] 

[David Spark] Keep it to yourself. 

[Steve Zalewski] It’s the wrong Steve Zalewski.

[David Spark] Yeah, some other Steve Zalewski.

[Steve Zalewski] It’s the other personality. That’s what I mean. Somebody’s ghosting me. That was that bad guy. 

[Damon Fleury] That’s right. 

[David Spark] Yeah, it’s somebody pretending to be you. Hey, everybody, we greatly appreciate your contributions and for listening to Defense in Depth. 

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.