Yeah, so if you had basically let's do that one. Yeah, so what would you send emoji or a gift?
To our CEO maybe a gift and it would be snarky as hell. I just don't know what it would be off the top
I'll save my response for the actual thing if we want to actually use that one but
Sure dive right in I
And so off the top of my head just because I haven't been working here very long
I'm going to just be super creepy and it would just be like a little gift
That's just like a person like like peeking out from somewhere no context no words just really weird
I mean you're like diamond to it like yeah, I'm like the weird smiley face that you're like, what is this?
Oh, me
I
Would say if it was an emoji for me
It would almost always be just the thumbs up because we just kind of drive by drop information in the
Teams chat all the time and most of time. It's just acknowledgement good. I got it
But for whatever reason I was looking back and my last gift was one that says whoopsie
So I don't know what I said, but I screwed up
That one even for no context just throwing that one out there being like you're a panic
I know I think I'd have to find something knowing that he likes 80s movies and back to the future
I'm like, I think I'd find like a good back to the future one that works in multiple contexts to be like choose your adventure
It's back to the future. So I'm sure I'll be looking on the side not multitasking during this podcast and go
I'm gonna find one. I'm gonna put it in the chat
Yeah, yeah, if I had to send Kyle a
Emoji it'd probably be like a thumbs up or a heart or something like that
You know it's a thumbs up usually because he's asking me something and then heart because I'm super appreciative, right?
Yeah, there's been a couple great mentors for myself here at CIT pals one of them now for the question was to the COO
It definitely be the middle finger
For those that are listening that is my boss so
Because we joke around all the time so
It could be a hard to but
I would say paired with another emoji
Mine would be the blue heart with like a smiley face and a hug because I just had a correspondence via email with Kyle about
Autism Speaks and how we're going to then continue on with our corporate charity of some things coming down
A little bit later this year. So I was like yay super excited. So that was that was my thing
Love it. Love the plug. We got a wide range
The sweet the good the bad the ugly of
Information for Kyle and
After this podcast, we'll all have to just
Send him with no context
All of this stuff and see what he says
But today on our tech for business podcast. We don't have Kyle, but we do have Todd and Nate Todd our CEO
And CISO and Nate our director of cybersecurity and we're discussing privileged access
management specifically
For banks and it seems like a really obvious question
But I'd like to start with why a financial institution would need a PAM
Or maybe just a quick what is it?
How do you want to kick off the way of the
How do you want to kick off for what it is and I can maybe start talking about why sure yeah, so
As people may or may not be aware the way windows and networking was initially set up was for the most part
everybody started out with
administrative access and
Which means you've got the keys in the kingdom you can do whatever you can install your own software you can make updates
Etc. Somewhere along the line microstoff put in
the UAC
UAC and which was the annoying box that pops up and says are you sure you want to make that change and
So that was kind of the interim of don't just randomly click yes on everything and as the world has
continued to progress and the threats in the world especially for cyber security have increased what you're starting to see is those
Privileges are being abused and that's whether it's getting ransomware install or something along those lines and so
That's where privilege access management comes in
It's the tool sets that allow you to go through a process and start to restrict the amount of access that individuals have
Most compliance industries use the phrase least privilege, which means you have the absolute
Minimum access you need to complete your job. That's the concept most people really don't comply with it
But a tool like a PAM will help you achieve that
Yeah, and specifically in the banking industry
You know, we are seeing you know the authors saying have you removed a local administrator from all of your users?
Right. I'm not gonna go too deep here, but there are some pretty critical attack paths that
are used
paired with bad
practices from IT administrators that can quickly lead to an account
sorry and
Organization level compromise all the way up to the highest level permissions which tends to be your domain admin your enterprise admin
so the danger that any organization faces not just the banks but
Yeah, is that
We tend to see IT administrators using domain admin for desktop support as well
But that's extremely dangerous Microsoft doesn't always recommend that right the domain admin should only be used for your top level servers
When a user has local admin what we see is when that IT admin logs in on that workstation
Their password is cached or kind of temporarily held on that device and so then
when someone has local admin
If a threat actor gets on to that device they can then take that and log right into the servers without ever having to crack a password
It's called pass the hash. That's the most technical I'll get today, but it is a very very dangerous exploit that we see
fairly regularly it's and then it's also attempted and we see that in sent a one from time to time as well. So
By removing that local admin
You're going to be hitting what the auditors are asking for but also you're reducing some very very critical
security exploits that are commonly attacked right off the bat when trying to gain elevated permissions within the organization. So
So I wanted to hit two points off of that one is I want to clarify for the most part when we're working with banks they do tend to be in the small to mid-sized
area. It doesn't mean that these tools don't extend into the enterprise because they can. So I just kind of want to clarify that so the vast majority of this conversation will revolve around that
As we were talking about the need for access and whatnot. There is a lot of stuff that happens in the network that does require that administrative access and I mentioned it right at the beginning is
Sometimes it's installing a tool or it's installing an update or something along those lines in where tools like privilege access management come into play as it has the ability to automate some of these tools. So
When we take away the administrative access we still have a tool that says let's say my marketing team is on here. So this will be a great example. My marketing team wants to update the Adobe suite.
Well instead of having to reach out to the network administrator they can just say yes I want to do the update. It'll go compare the MD5 hash against a known good one and says this is really the update. Yep all good
Automatically apply for it and I can do that across a network. I can do it across a company or individual etc. So it gives you a lot of flexibility a lot of automation and then removes the friction which we talk about often on a lot of our podcast
But still gives us high security value. Yep. Yeah and one of the things that come to mind as well is
There's Pam solutions out there today that you have to approve every single update which is not the best user experience. So for example if Chrome has an update or Adobe has an update right.
Todd mentioned it does compare against the MD5 hash and if it's not there because again it's an update there's a new hash value you have to re approve it.
Better solutions today will also take a look at whether or not the update is signed by that publisher already. And so even if it is an update but it's still digitally signed that to be valid from them.
It'll automatically apply the same update without any additional approval. So this is where once you start taking a look at some of these Pam solutions it really becomes powerful on time savings and administrative burden for the IT staff.
So oftentimes we see IT staff is already stretched thin. The last thing that they want to do is apply a new security product in the environment because it's going to require more work for them.
These tools are designed to really reduce that friction and then as we're talking about rolling it out across the organization there are solutions that are free but they are very intensive on the labor to get it set up.
And so again time is money and so these tools do have ways to automatically categorize and inventory the software that is installed already within the environment and then dynamically build policies to reduce that internal labor.
And that's really where we start seeing things like ROI discussions come into play saving the IT teams and then also trying to really elevate the security of the organization as well.
One housekeeping item I realized both Nate and I throughout MD5 and in the hash and it probably doesn't mean a darn thing to most people.
It's basically the nerdy tech portion of data integrity. So when there's a file out there this is kind of the reference we use to say is this valid. Does this come from the place I think it should.
So sorry about that.
I was going to give you a crap about using MD5 because the new one is shot one or shot two but we won't go down there.
Same concept though it's an encryption and log rhythm. It doesn't really matter basically the concept is it's the encryption used to validate the data integrity.
So my apologies and I deserve crap for not using the latest and greatest.
One of the other things that I wanted to talk about and I mentioned this as kind of a focused heavily on the SMB spaces. We do work with a lot of banks and as Nate mentioned you were toying in that space.
I just kind of want to clarify. We do see a lot of times where the examiners are coming in and they're saying what do you do in this particular case show us prove it etc.
But the reason why this can become really important is a lot of times those smaller banks will use a core banking app that's provided by another vendor.
And this is true for in other spaces as well. You'll tend to have a lot of legacy applications out there. And unfortunately the way the world is stored because I mentioned you had access to everything is they were written to require administrative requirements.
So for example there is a banking application out there called Maui and Maui does a reference and a call to an outside application that says I need access to run this additional application to run a batch file.
Kind of a really poor design in today's world unfortunately but you still go through the process of saying is this legitimate valid can so forth and so forth and we can define the tool in the PAM to say in this one instance I will allow that to happen.
And so that tool will help with the automation with it. So as Nate was mentioning earlier you do have some tools that are doing things that would in the cybersecurity world look incredibly malicious and scary.
And we can still lock it down but still remove the friction of saying OK the admin has to look at this every single time because A the IT guy doesn't want to do it and people don't want to be slowed down.
So there are instances where we see that and again in the SMB space in general you'll see it with other legacy apps as well. So that's where tools like this come into play.
Yeah and that's definitely one of the biggest things that we see from the security side over here at CIT is the core banking applications.
It seems like every single one of them requires local admin permissions to be able to execute which then the banks are tied into a hard spot where they say I need to still allow my users to work and I can't spend my entire day just inputting credentials to allow them to work because I'm already bogged down.
But then on the other side you have your auditors coming in saying remove local admin otherwise you're not compliant. And so that's that's where the tool comes into play really reduces a lot of that.
There's other protections that you could put in play and I've worked with other banks that you put in you know for example protected users security group that's a great way to mitigate that prior attack that I was talking about.
However what that happens is now when the auditors also say do you have multi factor on your network switches well guess what that breaks.
And so that's where the PAM solution then comes right back into play saying we can put in this proper security controls.
To support both the network infrastructure and multi factor as well as removing local admin it helps maintain the internal compliance and your auditors and it's a really phenomenal tool and then going back to Todd's point about the least privilege is that
you only have to grant elevated permissions to the particular process or application that's trying to run. So installing a new printer driver installing a new driver update for your Wi Fi card anything like that right is you can let the tool get out of the way while still providing the same security value or even maturing the organization at the same time.
Yeah the maturing the organization is a great point and we've talked about it about banks in the past anyway but it's a really good point just because occasionally we will see banks will be somewhat reluctant to put some tools in place and there's reasons for it.
But the majority of it is they're on a maturity path and it is what it is and so a lot of times a bank will go well why am I forced to do all of these things I'm not well as far ago I'm not US Bank and quite frankly they are often held to those types of standards.
And while the examiners may not come to them and say why I expect you to act exactly like Wells the compliance that they're going through does apply.
And so when you run into some of those issues and concerns of do I really need to do this. Well at some point the examiners are going to ask but in the case where privilege access management comes into play there is another reference back to our SMB episode.
It's required for insurance to you're starting to really see that come into play a lot as well so banks still do their cyber security insurance as well it's still part of their playbooks when they do their incident response plans as well.
And so it is something that we're starting to see being asked and it's not even an ask so much anymore starting to quickly become a requirement.
Yeah. I think one thing I might just toss into the mix as well and then I can tell that the marketing team probably wants to ask a question so the last thing I'd maybe add out is.
I should probably also call out the term application whitelisting and so they go hand in hand so application whitelisting is the concept of only allowing software to run if it's previously approved.
And then what that does is it also pairs in with the privilege access management saying if I need to install something that's not approved or I need to run one of the existing applications with elevated permissions then you can apply different policies on there but application whitelisting is really really critical to the banks as well and they do pair together.
And the reason why is you know this is fairly old now but Zeus was a famous banking Trojan so it's been used and adapted many many times over the years but essentially what that was doing was.
Someone clicks on something malicious you know in an email or downloads an attachment with a malicious payload from there there's a Zeus Trojan which would then intentionally watch web pages and try and scrape sensitive data.
As the tellers and everyone was inputting this sensitive info where the application whitelisting comes into play is if that wasn't previously approved or signed for by an already approved vendor.
That has no chance to run in the environment therefore now you're protecting the customer data as well.
And so I just wanted to call out Zeus because it is by far the most famous piece of malware that's ever hit the financial industry.
And it's all part of the same tool to protect it.
Yeah so a lot of the tools out there are multifaceted they have a lot of functions and you know as typical and we talk about these things there are tools that we know of we'd be happy to talk about them further if you've got questions about it which will make a small plug of letting us know if you got questions.
But there are some that are really really good and they do provide a lot of additional functionality and you get a lot of bang for your buck in the white listing or in some cases it's called ring fencing those tools will come into play as well and they are very important especially when it comes to your defense and depth strategies that a lot of the banks are employing.
So I was kind of waiting for the questions I'm sorry go ahead.
I saw Ariel go off mute at the same time I was like do you mind if I throw one out to them. Yeah for sure. Sweet.
So just as you guys are talking through it I know previously we've had discussions a little bit about right you're sold on it. You understand technology everything's all good.
You go to implement it. Is this something A that you can implement yourself and what does that look like what are the pros and cons there or B is this one of the tools that you go. Yeah you don't even want to get in the weeds there just have somebody else installed for you.
Yes.
Yeah I was gonna say it's depending on what solution you're looking for right and so this is where I'm going to try and be really agnostic to whatever solution you're looking for right but there's the free solutions.
So Microsoft has the Apple locker right they provide that for free that is part of their application right listing they've now introduced another privilege access management solution that's.
A license that you can buy from Microsoft there so you have some cost but.
With a solution like Apple locker you're likely having a lot of that internal manual labor so if you have the team that can support it you can go through all of your devices start inventorying and start building those policies to apply all these different permissions.
That's a one option. There's other ones that you know Todd mentioned the UAC prompt so when you're trying to elevate all it's doing is.
Intercepting that.
To where you would normally put in administrative username and password.
That's a little bit less. Labor intensive but now you might be looking at continually having to approve every request that comes through even if it's a common update and then it doesn't really look across the entire organization.
If anyone else previously had that installed.
Then at the some of the upper echelons of these types of tools you have tools that will automatically scan an inventory and then you can.
Put in all these.
Fancy policies saying maybe I only want to allow that policy to run for one hour and then just get rid of the rule right the tool will have a lot of automation built in there as well.
So it's really a trade off right is as you start moving that direction.
You're going to either start paying for.
Instead of labor and no licensing into licensing and no labor.
Or potentially you're even looking at a solution where maybe you don't even want to do the approval request. You need to have a first pass on that with another vendor like CIT.
There are solutions like that where we can be the first line of.
Defense on those approvals saying we know that this is potentially malicious or we know it's a common application such as zoom or teams or WebEx.
That we can just get in there and approve it more at the global level to ensure that it doesn't impact you right off the bat because.
If you do use a tool that's managed by another service provider like CIT.
We do see. Many many many different networks and so we can say well we saw customer a requested this yesterday.
Let's approve it up at the global level because it's not malicious.
Therefore when your team tries to do it it's already approved and the impact is mitigated.
Yeah I was going to echo that last piece as well as to answer the question about as simply as I could do it is it does depend on on your wherewithal on your bandwidth and what you're willing to take on.
So they can be relatively easy and they can also be incredibly complex.
The part where Nate got into someone like a CIT is we work with a lot of banks and it's probably no surprise that the banks will say well what do you typically see.
And that that's where you'll see a lot of value come in or we can go here's your quote unquote checklist that we can help you through.
We know X Y and Z.
We're just going to go ahead and allow you to do the Adobe suite because we know it's fine right.
We know that you're going to potentially if you're using the Maui app it's going to act like this so we can kind of preempt a lot of those things and just streamline it.
And then yeah there are some tools that have some great automation on them as well.
So I think we focused a lot on banks and if somebody is listening to this and they work for a different kind of like financial institution.
Is there any different kinds of challenges or best practices for them or is it just kind of same across the board.
Same across the board for the most part.
I mean some of the biggest differences that you see in banks is they are heavily regulated.
So there are compliance reasons why one way or another they quote unquote get forced down a certain path.
It's as I mentioned we're asking wells to do this you get to do it too.
That being said in case anybody doesn't know you want I'm sure you do if you're in a financial industry you're aware of it.
But whether you're being regulated by the FTC because you're doing personal loans or whatever the requirements are still the same and the protections are still the same.
You just need to be not having the screws held to you in the same manner that the banks are.
But all of the requirements all more or less end up being the same.
So we talk about this fairly often in this meeting too or meeting.
Sorry in the podcast where we talk about how there are different types of compliance.
There's FTC there's CMMC there's the FDI C etc etc.
They're all getting to the same thing and the intent is to guarantee the CIA triad confidentiality integrity and availability of your data and your customers right.
So the whole point of everything is based on that.
And so it doesn't really matter which one of those compliance is you're under they're all getting to the same things.
And so a lot of times the tools and the reasoning and the methodology is the same.
Yeah I'd say probably the major differences it would mainly be which applications are even allow right.
So we know that as you remove local admin permissions you're still going to need some type of elevated access to run driver updates or you know new printers and stuff like that.
So that is widely consistent.
It's just like Todd mentioned who's regulating you and then for those that aren't regulated we still say find one that fits.
So whether or not it's like the NIST cybersecurity framework.
There's a ton of ones out there that you can follow but you know NIST cybersecurity framework says maybe a decent one to at least start on because it's fairly easy to understand as well.
But if you don't have something you should still be pushing towards the same security standards as everyone else because a lot of these organizations are saying or you know regulations and sorry not maybe not regulations but standards that are coming out are saying do you hold your vendors to the same standards as your own company.
So for example if a bank is working with an organization that doesn't have great security standards you'd be listed as a high risk to the bank and therefore they may not want to do business with you.
So everyone collectively over time is starting to hold each other accountable to these security standards and so we see that with some of the manufacturing right is manufacturing was historically fairly slow to adopt new technology.
That's different with technology and you know IOT all of that is rapidly increasing but you have to have the same security standards because you know your customers you know if you're delivering to someone like a general contractor they want to building still within four months.
If your networks are down you might not be able to deliver on that so they might hold you to the same standard.
Yeah I get one tiny little thing I wanted to add on there because it made me give me an aha that if you are a subcontractor of a bank when they flag the high risk component if you're in a bank you already know this but if anybody else is just listening along.
Banks are required to have an exit strategy for all their vendors so if you are falling into that high risk category just be aware that there is an exit strategy that they're already working on and it does behoove you to pay attention and make sure that you're crossing your T's and dotting your eyes.
I was just going to say kind of along those lines of any of our past podcasts we've talked about you know MFA and EDR of that multi-layer approach for security and so in kind of talking today and we're talking about banks so if they have MFA, EDR and now PAM like summarize that a little bit that's just another layer of that you know approach and ensuring that their landscape is kind of covered.
So I want to kind of know a little bit more about that of just that layered piece.
Hi.
This is going to be me nerding out here and so for those that aren't on video I'm going to hold up a book.
Because I love the book and I do this all the time but I've got a book called the cyber defense matrix.
So this is a great book if you're ever trying to figure out if your tools are overlapped or you know why on earth should I throw another security tool into my security stack right and so it.
I talked already about the NISI security framework so there's a couple pillars of it.
It's in a revision so you might see an update soon on that but the first two stages of it are.
Identify what you have right and then the next one is protect what you have so you can't protect what you don't know that you already have and then the goal is to really focus on protecting the assets because the next stage is detect so that's post security incident right so all of sorry not all but most of the effort should be.
Heavily heavily focused on identifying the resources and data that you have and how to protect it.
There and then there are different categories so for example how do we protect our devices how do we protect the data how do we protect the network traffic how do we protect our user accounts.
Multi-factor might only protect the user accounts it doesn't necessarily do anything for network traffic or the applications that are running in the environment.
We have things like EDR or MDR XDR whatever acronyms you want you can go back and listen to all the acronyms on the previous podcast there but.
Those are protecting more the devices and some of the applications where we start getting into the Pam is protecting elevated sessions protecting the applications that are installed on the devices before you have to rely on your EDR because again that's already post security incident so.
That's my deep dive but cyber defense matrix I've read this book many many times and not sponsored but I should maybe seek out a sponsorship so and you can find it on Amazon.
Anywhere that books are sold near you.
Yeah to answer your question unfortunately it isn't as simple as if I do these three things I'm good to go when it comes to banks and banks know this which actually leads to a really good kind of segue if you will to another potential question of how do you keep up on all this.
There are plenty of people out there this podcast it's a great resource obviously in our opinion because hey it's us but we did the answer is obviously that that just is not enough there's so many components of cyber security unfortunately.
But but Nate nailed it right I mean that was a great overview it's not as simple as I put in a tool and I'm good to go it's I gotta protect the users by training them I gotta talk to my customers and make sure that they are aware that.
I'm never going to just send them a note that says I changed your a C H account and that stuff is it's really in depth and there's all kinds of it reality is fraudsters are incredibly clever and they're going to do everything they can to get your money.
For sure so I mean I I kind of thought in my head oh if we could you know kind of order these in in what's most important but I'm going to cross the board they're working together and it's so important to have all of these pieces together.
If you had it just for a future podcast idea if you had to add another piece so we got the MFA we got the EDR and now we're talking about Pam.
What's kind of the next alphabet piece yeah it depends it depends it depends.
Unfortunately I would say it does depend because everybody's in a different space and I mean everybody there is not one bank that I've said you are exactly like this other bank so everybody is in their own space and they're at their own portion of the journey and so everybody's in a different spot but you know same as way up there.
I may can throw in some other acronyms to so yeah I don't have my acronym dictionary up let me see if I can pull it up real quick.
I don't know what's next year but the my answer for that one is probably great you got multi factor you got EDR you got Pam there's still a lot of fundamentals where if you don't have it.
You have to tackle the fundamentals first because that is the stuff that's the most easily exploited so I could start talking about backups and you know everything like that if I was to look a little more of what's the future look like is it's going to be.
And I'm not going to I hate this term at times but the zero trust model right and trying to remove the trust that's built from you know maybe it's branch to branch right so maybe you have a.
Minneapolis office and you have a Chicago office or you know that stuff.
Oftentimes banks start putting VPNs between the two so their software can interact with each other.
I don't love that approach right if one branch gets compromised you can move over to the next one compromise that one and just further the attack there so.
One of the things that CIT has placed very very heavily focused even here at our organization and this is where the acronym comes in is sassy this is a phenomenal thing that's been coming out for the last.
I mean it's been out for a long time maybe 10 years but really starting to gain traction on the last two or three and.
This is bringing a zero trust approach to all the web traffic that you have the interconnections between your sites how are the sites connecting to your critical data right and it's not just a simple VPN tunnel it can check do I have each other.
Is that user authorized you know are they maybe paired with some type of certificate for additional trust.
That would be the future.
A lot of places aren't there yet.
Today start with the blocky and tackling of the basics.
Love it.
Love it basics fundamentals most important things a web we used together and.
If you have questions or you want to talk to somebody about Pam or EDR or MFA I'll make sure all of our podcasts are linked in this description but definitely reach out to us at info at CIT dash net dot com or head out to our website at CIT dash net dot com slash podcast.
Thank you Todd and Nate for joining us today and we'll be back next week with an all new episode.