Hey, Mike. Good afternoon. How you doing, man?
Andres, I'm doing well, man. I've been watching
some basketball without the March Madness. I
can tell. What is that? Well, this is a Cisco
official basketball that I've got here to represent,
you know, March Madness and basketball that's
going on right now. Got a couple teams left and
it's been fun to watch. Make sure you get it
signed by Chuck. Oh, geez. Great call. I'm so
glad you said that. Nice, man. So yes, it's been
a while, I guess, like a month and a half or
so. And, and then I guess, you know, with this
new episode that we have going today, it is,
it is going to be interesting because it's going
to be on, on identity, which is, and from my
side, it's a lot of the conversations that we've
been having with customers. I've been hearing
this, this term that it's the identity is the
new perimeter. And it is not like a fun term
anymore or. I don't know if it became like a
marketing thing at this point, but yeah, we'll
be hearing about from customers about this. What
have you heard about it? OK, so big thing for
me, but I wasn't super shocked when I heard the
following. But when I saw that identity is now
the number one threat vector. So it used to be
what email protect your email? Well, obviously,
that's still super critical. But identity truly
is statistically the number one most likely way.
for an organization to get hacked right now.
And I know today we're going to talk a little
bit about identity and just how important that
really is. Yeah, yeah. And some of like, we're
going to make sure that we put some some of the
findings and some of things that we've been looking
into. Just to create the episode, we see a lot
of articles created with some metrics, some information,
some studies that have happened in the backend.
And then I guess the main thing is this thing
like the old network perimeter is gone and now
the identity is the control plane. So that is
resonating with a lot of people out there and
that is something that we hear from many customers.
We also hear... Credential sessions and tokens
and those are the things that the attackers want
just to make sure that they have the option to
unlock your apps data and even domain access.
You know one of the terms that we keep hearing
is IGA and for anybody listening in like you're
going to hear about now that we've said it identity
governance and administration. So that's become
more critical than it ever has been and Identity
governance and administration, just so everyone's
on the same page here. It's not like a product,
but that's really like a framework for how an
organization is managing all the username, username,
well, the user identities. And it's like the
policy of those users and what they can access
in terms of, Hey, this user group has access
to these devices or these applications. but it's
how an organization manages the identities and
how you can be compliant with your organizational
standards. So IG, Identity, Governance and Administration
have a lot to say, but it has become really critical.
I want to read into it. I was going to say that
it sounds like another security person doing
policies and creating procedures for a lot of
the things that we help our customers with. So
yeah, I'll make sure that I read on it, we'll
make sure that we add it to the show notes just
so you can see exactly what it means. And then
we will get over that at some point. Mike, another
thing, trusted network. So we hear this from
many of the products that we talk to about here
at Cisco. And then, you know, there's one thing
that, you know, MFA, MFA is the thing, MFA is
what you're supposed to have, but user is authenticated,
then what? What do we do? Like, what's the next
step? What do you think? This has become like,
you know, security is always staying one step
ahead or at least in line with the attackers.
So in terms of a trusted network, it used to
be, well, let's just make sure you are a trusted
person on a trusted device. Great. Now we turn
off our visibility. If you get hacked, after
that point that your trust was given, that's
a serious problem. No one's keeping an eye on
what your device is doing or the traffic. So
we get into this concept of like continuous verification,
continuous identity verification, periodic checks
to make sure that your originally trusted session
was not compromised. So yeah, to your point,
I mean, a trusted network is still important.
But I think security teams need to make sure
that they are continuously verifying the trust
level even after you gain that initial access.
Yeah, yeah. And that is one thing that we keep
seeing on those documents that we base the whole
episode on today. There is another term, another
thing that I've heard also, and it's called phishing
resistant MFA. And then I'm going to kind of
read some of the things that we have here is
based on device trust, policy -based access,
instead on just relying on password strength
alone. And I know we do talk about a product
in a daily basis here at Cisco. And I don't know
if you want to talk about it a little bit, Mike,
if you've heard it. Yeah, I mean, of course you're
referring to Cisco Duo. So Duo, you know, originally
being an MFA product, it's so much more than
MFA. You know, neither of us are here to sell
Duo on the call, but just to use Duo as an example
of how a security product should be keeping up
with more advanced threats. If we think about
evolving from Duo Duo's MFA capabilities to its
capability to look at the device as well. So
the health of the device, is this a device that's
a corporate asset? And, you know, Duo can do
that. Duo can say, look, I'm going to check your
identity, but also the device you're on. Like,
you know, part of this identity governance and
administration is your identity, but also the
device you're on. It's kind of like holistic.
Passwordless is like a newish thing as well.
So as attackers attack passwords, passwordless
has become a great way to evolve with these attacks.
So if you don't have a password, you can't really
be vulnerable to a weak password in that case.
So passwordless is, I'm sure we'll talk about
more with. with using other alternative methods
other than remembering your password is really
important. And with any security solution, you
got to keep up with the times. And if you think
about even Cisco Duo, like back in the day, having
MFA alone was great and would stop most identity
-based attacks. But you want to take a touch
on maybe what we call push fatigue, like MFA
push fatigue. And that is some of the modern
identity attacks. We started seeing, and this
is when we started seeing here at Cisco as an
employee, that we didn't have to just accept
a push notification and that was it. We started
seeing like a verified push with a code that
we had to enter in the computer. And it just
evolved into something else right now that it
is not only verifying that push it is also verifying
that like the passkey that you have in your computer
like your fingerprint i guess windows does it
with this thing called windows hello which is
your face or biometric print as well but it is
it is just the response from the security products
on that alert fatigue like craziness that you
know and and i'm seeing it the other day i started
seeing like a bunch of my personal email bunch
of hey somebody's trying to log into your account
you want to accept it and then they have a number
and you know i don't even know what the number
they're seeing is the number that i that i have
here so you know in my case what i've been doing
for those and gosh i still get them for from
time to time like at least one a day I just denied
that the login, it just makes me feel a little
better. You know, probably I have to probably
change it again, but, but I'll feel like more
secure just because I have that security piece
in place. Yeah. When you get that message that's,
Hey, someone's trying to log in. Is this you?
And you're like, I'm not trying to log in. It's,
it's scary, especially if it's your bank account
or something like that. But it's also like. I
get the feeling of, I am so glad I have the MFA
on for this, you know? Yeah, I've been talking
to my dad the other day. I was talking to him
and I was like, hey, I'm getting hacked. And
he's like, oh, we're like, let's go to a computer.
Let's go fix it. Well, whatever, whatever you
need to do. And I'm like, no, no, I'm fine. You
know, it's they cannot access from from whatever
they are. You know, the verify, you know, in
our parents and their parents, those are the
people most vulnerable as well. I mean, for one,
if you just have basic MFA on there, that's susceptible,
but they might not have MFA on at all. You know,
they're used to, oh, I need to quickly change
my passwords. My password got hacked. But, you
know, when you've got that multi factor, that
additional step, that's really key here. Hey,
you know, have you heard of or have you looked
into the blue low low energy Bluetooth push that
Biro does now? I guess I think I've heard a little
bit about it, but don't Be honest with you don't
know much, but, but it looks like, like a really,
really, really nice technology. You know, it
just picks up that your device is close. I think
is what it is. Right? Exactly. Yeah. So basically,
you know, you log into a website, you know, your
username and password is correct. The duo push
essentially, you know, the presence of your phone,
your, your, your multifactor device. physically
close to the computer that made the request of
the website is really what's happening there.
So if you're an attacker, you're like, that's,
it's immediately going to block that because
they don't, unless they also have your phone
right by the computer. I like solutions like
that because it's very simple, like to the user,
you know, so I don't even need to be involved
with this. with this process if I'm being attacked.
I mean, the attacker is on the other side of
the world. I don't, you know, I'm not even, don't
even have to mess with this. And then when I'm
the real person going to the website, cool, it
just seamlessly work. Just like my phone right
here. Yeah, that's pretty cool. I kind of knew
a little bit on a high level what it would do,
but that's pretty cool. That's pretty cool that
we can do that. Another, like, I want to like,
I know we have like three bullet points on some
modern identity attacks but I'll probably take
one and just group them all like we see token
theft and this is whenever an attacker makes
your steals your token or your session And in
this case, and I've been seeing this a lot in
Instagram and TikTok and a bunch of other places
that they may be able to bypass MFA entirely.
So this is one of things to be aware of that
it's happening. I think on the same wavelength,
we also see the odd abuse. And this is just adversaries
or they just legitimately use old workflows to
just... get into applications and get consent
from the user just to get some persistent access
into whatever they're after. And then the other
thing that is like very close to the same thing
is the session hijacker and hijacking. And this
is just, you know, attackers stealing those cookies
and replay the tokens just to make sure that
they are authenticated into your session. I know
I've seen a little bit of things about that but
that seems you know very complex from what the
attackers are doing so from from the sense of
defenders or practitioners this is one thing
to keep in mind that there are some things that
are happening in the world there are some ways
that we're getting attacked and we just have
to be you know smarter on how do we protect our
assets I guess. These types of attacks like session
hijack hijacking, you know, token theft, things
like that. Those are things that a user should
not have to be thinking about. And it's confusing.
Like what, what does that mean? My, my token
is being stolen. So anyone listening, regardless
of whether you're using Duo or not, you need
a security product that again, going back to
our original point is able to continuously verify.
Because if you do have something happen with
like a session getting stolen, that attack can
persist across multiple devices and multiple
systems. It won't be checked because that trust
was granted initially, then it got stolen, now
it's being reused. But if we have continuous
verification, we can kind of like recheck. that
we detected with that session was stolen as being
reused. So when you're looking at an identity
security solution, make sure it's not just doing
that initial access. That's a really, really
good point, Mike. And then another thing that
also happens just before we move into the next
section is it's the privilege escalation. Like
we see just attackers stealing identity, stealing
user names, passwords, and They just try multiple
things. They just go into those computers, see
if they can gain any access to the domain. They
can enumerate the actual users that are in the
system. They can see maybe this user that it's
called admin. Maybe it's an administrator or
domain admin. Then they can start messing around
with things. So that's very, very interesting.
And of course, what you mentioned, like authorizing
a user once doesn't mean that the user should
be authorized to access everything, unless we
do some sort of verifications every few hours
or whenever we see like... I'm probably sitting
here on my computer today, here in my house with
the dogs, everything. And then I'm just going
to go to the next Starbucks and go drink a coffee.
I think there should be like, you know, I'm changing
networks. I'm changing my IPs. I'm changing everything.
So, you know, it's more than acceptable just
to make sure that I get re -authenticated or
some way of knowing that, you know, it's me and
that Starbucks. Well, so first thing I think
about is I love drinking coffee with you I probably
had over a thousand coffees with you in person
at different events So we do need to keep that
in mind. We're always going to different places
to have coffee Yes, absolutely. And I'll touch
on you mentioned like the admin accounts like
the attacker I mean if they get a hold of an
admin account, that's outstanding for them. It's
gonna have more access and You know, that's really
what we mean by privileged access or privileged
escalation. We're talking about getting access
to one of these accounts that does have pretty
broad reach and can get into the really important
devices and applications on our network. That's
going to mean more money for the attacker if
I can get access to like your precious data.
And I'll tell you this, going back to our previous
episode, if you guys haven't listened to the
episode one of season three on zero trust, all
of this really ties in well with zero trust.
Cause like your admin access, for example, you
really want to limit the scope of what your user
roles are doing ads. And again, admins should
have access to the things and resources admins
need to be an admin. That's going to be different
from like your call center people or your contractors.
So make sure that, uh, you know, zero trust being
like a larger topic. But, you know, fundamental
thing there is once you do verify that identity
of that user, make sure you're only giving them
access to the things that user should have access
to and nothing more. Exactly. Exactly. Now, here's
another maybe controversial section that we have
here for everybody that is listening and watching
this. Mike, and now give back to you on this
one and just, you know, start with the question
of where do you see most organizations fail when
we're talking about securing their identity,
securing how people are authenticated into the
system and what do you see that happening? That's
a good question because there are so many ways
attackers steal identity. Okay, I'm not even
going to say that it's because you don't have
MFA because everyone should have MFA. And I'll
tell you this, if you weren't aware of this,
speaking to the audience, The attackers are assuming
you do have MFA at this point. When we started
the show three years ago, we were talking about,
hey, get MFA in place. Make sure MFA is in place.
At this point, they are assuming you have an
MFA. And the attacks they are running are assuming
that you have MFA in place, and they're looking
for ways to bypass it. I would say, me personally,
the push fatigue is a big one. Just push fatigue.
And then another one I want to talk about is
social engineered attacks related to identity,
but push fatigue. I mean, it's, it's, it's great
for an attacker who can say, Hey, look, you,
you have MFA and I'm just going to create a bot
that just tries to log into this application
and sends you an MFA push to your phone every
10 seconds. And a lot of these attacks. happen
at nighttime. They happen at nighttime and when
people are the most busy. And attackers know
you are statistically more likely to go ahead
and approve a push. Like, what is this that keeps
happening? I need to deal with this later. I'm
sitting down to dinner with more colleagues or
my family. Those are the times that people are
most likely to just approve it. and figure it
out later, okay? It's not the right answer for
a user to do that, but statistically they're
more likely to do that. So these attackers know
that. And the other thing is the social engineering.
That's a big one. Like if I can call you and
say, look, it's me, I'm the person you know and
trust. And I can trick you into thinking I'm
someone and say, you're about to get a push to
your phone. It's coming from me. I need you to
approve that. well some of the biggest attacks
i have seen are that exactly so you literally
get the person to go ahead and push it anyway
yeah yeah you know now you talk about that i
i was i was reading the other day and i was like
looking at some stuff on on ransomware and and
they they do have this thing that they get access
into the system, they compromise an identity,
and then they start doing recon, and then they
get an admin account. For whatever reason, they're
successful with that. Of course, they deploy
ransomware, they start encrypting a bunch of
files, and they start doing a bunch of things
as well. But then, at the same time when that
is happening and I know and this goes along with
what you mentioned like you know people having
dinner at night and maybe I get this thing and
they're like you know let me just approve this
thing probably you know some application that
I have running on the backend and what happens
is that the attackers are also pushing DDoS attacks
just to make sure that the IT team or the security
team is like freaking out about the DDoS attack
while the encryption is happening. So it is a
distraction. Like they're hiding their tracks.
The classic thing of like, I need to sneak in.
Let me make a disturbance over here. So you look
over there and then I'll sneak in. Yeah. Yeah.
That sounds pretty crazy. And that is something
that is also happening a lot. I was reading just
about it the other day. But yeah, interesting.
Now, Mike, we went over Some of our organizations
failed. I think we, you know, at the end of that
section we said Just make sure you know you have
your securities up you have you know you either
if you use dual if you use Microsoft MFA or any
other MFA product that you know you continuously
trust or Continuously verify trust for the device
and the user now what else what else can we do?
What else can we do? You know going to the other
section to start defending the identity like
we talked about the issues we talked about how
we're getting attacked, why companies are failing,
but how companies can do can do this. Like how
can they protect themselves? Yeah, the like now
we're into the part of the conversation where
it's like the action items. We've talked about
how people get attacked, why, how difficult it
is just to be a user trying to do your job and
align with company policy, not push that. that
accept when you're under an attack. In terms
of action items for defending identity, obviously
MFA in place. The first thing I would throw out
there is, again, the reminder that the attackers
assume you have MFA in place at this point. It
is 2026. They know that all the big organizations
of the world, most of the medium and ideally
everyone, has MFA in place to protect your precious
resources and your users. So don't be fooled
into, well, I should just say, be aware when
you are evaluating an MFA solution, regardless
of vendor, and it says free MFA, okay? MFA is
a baseline. Be aware of when you're evaluating
a solution of if an attacker knows I have MFA,
What are the additional security layers, identity
specific, that are protecting me here? One of
the simplest, again, like the resistant MFA,
the phishing resistant MFA. So as you said earlier,
a good example, Andres, is typing in a code on
your phone. Like the attacker going to log into
your company's OneDrive account, they stole your
credentials. They're the final step, which is
MFA. They are looking at a code that says 1596.
And that code needs to be typed in on the user's
phone. The user's phone, they're sitting down
to dinner with their family. They don't know
what that code is. So that attack never happened.
But like those is an example. What is it beyond
just having MFA that's in place? So I would say
the first thing is evaluate. the beyond basic
MFA considerations. Be aware of social engineering
attacks. Like, do you have something in place,
maybe like to prevent that? Biometrics is a big
one here, Andres. Duo has a cool new integration
with company. Have you heard of like the Duo
persona integration, which is really pretty new?
Yeah, I know. Yeah. So persona, for anyone listening
in here, just just look at persona. P -E -R -S
-O -N -A, just like it sounds. You'll see reports
on like Forrest, they're in the Gartner Quadrant
and all that. But this is a company leading the
way in passwordless verification. So to defend
myself as an action item, I'm thinking about
use cases that commonly... are used to override
and override basic MFA. As an example, there
was a major company, everyone knows this one,
it's in Vegas, that got hacked for a password
reset that was protected by MFA, but the attacker
called in, was able to convince the person working
at the company that, I need a password reset,
it really is me, I need to reset my password,
they were able to bypass MFA. Persona is an integration
with Cisco Duo that says, we're not going to
involve passwords at all to reset your identity,
to reset your access. And it's very nice. It's
going to take an image of your face and ask you
to turn left and right and verify that it truly
is you. And it can compare that to a government
-issued device to perform that password reset.
So there's no password involved. Password attacks
are gone. I'm able to reset my access, proving
my identity without having to give anyone a password
or re -enter a password. But things like that
are the action items that customers should be
thinking about when they are overcoming these
ever -growing threats, a lot of them, again,
being social engineering attacks. That's pretty
cool. I was going to say, and this sounds probably
like a, like a offline type of procedure. Whenever
you get a call from a help desk, I was also reading
this the other day that like an offline procedure,
let's say, you know, somebody's calling you from
the IT department or somebody's calling the IT
department to reset that password. Like how do
you make sure that the person that it's calling
is the right person and how do you authenticate
them offline? So this is really, really, really
good. I like it. I think I saw it and that was
pretty cool. I don't remember it was called Persona,
but we'll make sure that we add it to the show
notes as well. Because we always talk about the
users have always been the weakest link in the
security chain, not by their own fault. It's
difficult to keep up with. Think of your example,
training that person at the help desk. on the
conditions in which they should authorize a reset.
Like that can be a lot. And if you're under a
social engineering attack, the person trying
to get the reset is going to be putting serious
pressure on you and talking about all the money
that is being lost and how they're the CEO of
the company and you could lose your job if you
don't quickly reset this password. So there's
a lot going on. So have been a way to safely
and securely reset someone's identity quickly
and without user friction, without violating
any compliance is so critical. Yeah. That's pretty
cool. And I know we have other things we have.
You mentioned about the conditional access. There's
also the identity behavior analytics for impossible
travel, abnormal authentication. unusual token
usage and just suspicious admin activity as another
one we get to hear from from a lot of customers
about privilege access controls and this is nothing
more than flipping the firewall on people or
in this case flipping the zero trust on people
and it's just making sure that Provide the access
that that person needs, you know, make sure that
you isolate some of the administration workflows
and of course require that stronger authentication
for high risk actions. Like, you know, for those
things that you mentioned, I think that is that
is something that should be in everybody's mind
today just to defend their identity. And what
else can we add to that, Mike? I mean, I think
just fundamentally attackers are have just changed
the way they are doing their attacks. Like it
used to be sophisticated attacks to sneak through
a firewall. Like very difficult attacks. Now,
I mean, why would an attacker need to do that
if they can simply steal your identity and escalate
their privilege? Like, again, if I can convince
you to hit that MFA push, man, I just, I mean.
i just i'm going yeah so somebody's calling you
with a baby crying next to him and adding pressure
to that like please unlock this i only have 15
minutes i'm meeting with the ceo and i've got
my baby here and i'm not that's some serious
pressure i mean there's a lot of like these attacks
have a lot of fear involved too and like pressure
that humans are designed to feel you know like
Fear I might lose my job if I don't do this fear
that I might lose money fear that the person
who is requesting my help might get harmed or
They might lose their job. I don't reset this
for them This is why the your opening point the
identity is the new perimeter if you can get
that privileged identity I mean, that's that's
the crown jewel now. Yeah. Yeah, it's it's insane.
It's insane been in We get amazed, but these
are things that are happening. So Mike, just
to wrap up, I guess, we talked about a lot of
things. We talked about how the identity governance
and administration, that's a pretty cool term
that I want to start looking up. Some of the
attacks that we see, some of our customers also
receiving those and seeing those out in the wild.
Things that companies are doing just... where
they they're failing and and how we can you know
companies can defend their identity and what
what would you what would you add as you know
probably your closing thoughts just making sure
that we wrap this one up about identity my closing
thoughts here would be please put on basic mfa
if you've not at this point and if you have mfa
in place look into hardening that mfa just Google
phishing resistant MFA or like do a basic Google
search if you're listening into this of most
common ways people get hacked when MFA is already
implemented. That's what your attackers are doing.
It's again, we say this with security. It's not
an if, it's a when that you're gonna get hacked.
So be aware that identity really needs focus.
That's a place customers need to invest. their
time and their resources. Cause I mean, look
at password lists. Just be aware that your customer,
your attackers, again, they're expecting you
to have them in that phase. So be ready for it.
Talk to someone who is a trusted security person.
Andres would be a good example myself or whoever
it may be to figure out the updated threat landscape
when it comes to identity. Maybe another Google
search. Look into that identity governance and
administration. Start looking at ways to make
sure your user identities are safeguarded. Come
up with your worst case scenario. Maybe it's
that help desk tick or the someone getting up
resetting their password. Make sure that these
worst -case scenarios, like you have a way to
protect yourself from them. Yeah, yeah, that's
definitely right. I guess my closing thoughts
on this one are going to be very similar. Just
recommending customers out there just to make
sure that they implement not only that MFAS you
mentioned, Mike, and just keep continuing verifying
the trust of the devices, of the users. One thing
that that resonates a lot with me is that whenever
a credential is stolen, and an attacker goes
into your system, logs in, you're not going to
get any alerts. That person is already in there.
That's it. It's just a regular process, something
that was supposed to happen. Of course, stealing
of the credentials is not, but that attacker
has your username, your password, and your credentials,
and it's already in. How do you know? What a
powerful statement that is, and something to
think about. Like someone with your username
and password, I mean, your organization would
essentially have no idea theoretically unless
you put safeguards like this. Exactly. It's a
regular event. Yeah, just that's a good way to
think about that. That's not even an event, an
alert that would generate without proper controls
in place. Exactly. Well, this was Really awesome,
Mike. I hope everybody that, you know, everyone
that it's going to listen the episode, watch
the episode. Hopefully it resonates with them.
I am not sure if we're, what do we have on the
pipeline for the next episode that we're. Real
quick right here. And this is probably, and we're
thinking about, I'm looking at it. It's. It's
an episode three. Yes. It's on probably ransomware.
Like ransomware. Oh my gosh. Yeah. This would
be, this is going to be a good conversation here.
Oh, you want to tell everybody about the new
domain? Oh yes. So yeah, we, we, we have security
in 45 .com. There's already a website built for
it. It is pretty cool. One of the nice things
about what happens with the website is that Every
episode gets like the player. So people don't
have to go to Apple if they don't want to go
to Apple Podcasts and downloaders, Spotify or
whatever the case is. So we're going to be in
a lot of places. We see a website, the website
has a player and the show notes are a little
bit expanded with the help of AI. So it looks
pretty cool. If you have the opportunity, go
check it out. securityin45 .com. I love that
you got, I know people consume the show in different
ways, like watching it through YouTube, but I
think a lot of people are, I mean, obviously
using like the podcast format of it, just while
you're on a walk through the neighborhood or
at the gym or just to listen in. So all of those
links, I love that you put them all from the
single website, securityin45 .com. Well done.
Damn, no. to do that man so this was fun i guess
we'll see you again during the weekend and for
the next episode man thank you thank you so much