Trusted Enterprise Security: A Conversation Among Leaders

It's like we know what we signed up for in the cyber business, right? There's the threat actors are coming at us, they're trying to attack this valuable information we all have. And I think what we've seen from the identity management perspective is really an evolution from social engineering. Attacks at the user trick me into giving up my email or password or being phished as a user to really going up the identity chain. So when the account is registered, so when an employee or a customer is being onboarded into the system, how do you phish that? How do you social engineer that?

Welcome. Thanks for joining. I'm Brad Arkin. I'm the chief Trust officer here at Salesforce and I've got my friends Mike and Todd visiting from CrowdStrike and Okta. Thanks for coming, guys.

Thanks for having me.

Yeah, great to be here.

So let's talk about shared responsibility. This is a phrase that gets bandied about a lot. And I think the original idea is that there's things I need as a SaaS publisher, there's things my customers need to do as our customer, and together we're going to deliver the secure outcome. And I think in the real world it gets a little more complicated. And so this is something that you're dealing with at Okta. I know at CrowdStrike you see a lot of this happening. What are some of the places where you see challenges with shared responsibility and how do you interpret it for your business at Okta?

Well, I can answer this from two perspectives. One is as CEO of a company that's trying to be one of the most secure organizations in the world internally. So one of the things that has been really eyeopening for us over the last few years is the power and capabilities of these platforms we run and their ability to be configured for secure outcomes. Salesforce is a good example. Salesforce has almost limitless ability to customize and configure it to be completely locked down. And that's true on many services. The challenge is that they all work a little differently and there's some problems with standardization and consistency there. But really trying to run a secure shop, you have to look into the capabilities of your tools and applications and make sure you take advantage of the security capabilities they provide. Second perspective is as someone that is building a product and platform for companies, we take the mindset that we have to make it of course, configurable to be secure, but really secure by default. It's upon us to make sure that it gets delivered in a way today and in the Future that the great security outcomes are as easy to surface and are as default as possible. That's really how we see it from a provider perspective.

What I've heard is it's a lot of times it's possible to do it the right way now and we want to make it really hard to do it the wrong way. And that is a really big leap.

And I think that's part of the responsibility we're taking on as vendors now is that we have to help guide you through that process and don't assume that the user is going to do it the right way. And so just like we just partnered to release the Falcon Shield for Salesforce to be able to help take the security people and the Salesforce admin and have them work hand in hand at, you know, getting that best outcome for configurability because there is a lot of complexity, it's a powerful platform and people want to set it up the way they want to. But you know, help them find that best practice without having to.

And this is something when we're talking about like the right defaults are a big part of the story, but getting it from 98% adoption to 100% adoption that a lot of times there's a lot of work in that last 2%. So maybe you could share some anecdotes about that.

Well, I think there's times when you have to make it compulsory, it's not optional and you got to do the work in product and engineering and change, manage it to make it required. Good example for us is a couple years ago it was possible to have the Okta admin console not have multi factor authentication in front of it. Wasn't common but it was possible. So we did the work to make that not possible. So every Okta customer in the world now has a multi factor authentication on their admin console. That was a lot of work because you could imagine people have dependencies on it where they have service accounts calling it and they have business processes and tenant to tenant relationships that require it to be not locked down on mfa. But that was the thing we just did the work in engineering to make it absolutely required. So I think you're going to have those situations as well because sometimes stakes are so high you can't leave it up to the customers.

Yeah, and going to a customer who has something working and telling them we're going to create work for you because we need you to uplevel your security environment, that is a tough conversation to have. But when you're trying to partner with them. And back to the shared responsibility. This is what we know about the risks that they may not be hip to. And we need to partner with them, to educate them and say this is no longer a tenable setup. It's something that we have to partner with you on in order to lift it up. And that last mile can be really tough. Yeah.

And part of this is a cultural challenge with companies because sometimes the people managing the applications or the teams managing the applications and the security teams are, are in pretty different worlds. You know, there's network teams, there's endpoint teams, there's security teams. And a lot of times the applications teams are pretty separate and so trying to affect change on the applications teams under the name of security, those teams receive it as. That's the security group's job. We just do apps.

Yeah.

So this, I think what people are learning now is a lot of these things are commingling and like a lot of things, people have to work together for these outcomes. So when you talk about shared responsibility, it's like, whose responsibility? It can't just be the apps teams, it's got to be the apps teams and the IT team and the security team working together to put that policy in place around the products that's going to have the secure outcomes that they want.

Yeah. And I think that it's vendors and customers working together, it's security team and app owners working together. Like there's a lot of cross functional requirements that are in there and getting all the right people blending in and then bringing in security vendors. There's a lot of different places moving pieces here.

Yeah. The more automated we can make it turnkey, we can make it in the sea of apps that people are adopting. That has to happen.

So the world is crazy right now. What are you seeing out there? I feel like social engineering and the innovations there are really happening.

Yeah. It's like we know what we signed up for in the cyber business. Right. There's the threat actors are coming at us. They're trying to attack this valuable information we all have. And I think what we've seen from the identity management perspective is really an evolution from social engineering. Attacks at the user trick me into giving up my email or password or being phished as a user to really going up the identity chain. So when the account is registered, so when an employee or customer is being onboarded into the system, how do you phish that? How do you social engineer that? Or when a credential is being recycled at the help desk, how do you fish that and how do they take advantage of these tough positions IT folks are put in where you're manning the help desk and a lot of times the help desk for organizations, it's not even the organization, it's outsourced third party call center. And that threat actor has taken advantage of that poor person running that help desk that just wants to help the user. And you listen to these calls and they sound exactly like real users that are desperate to get their work done, desperate to get into their applications and get their job done. And it's like the weakest link sometimes as a human. And that support desk person kind of goes around the protocol and gives out the, gives out the credential. So that's a real evolution, I'd say in the last year or so. And we all have to respond appropriately.

That's what I've seen that the excited new employee posts on LinkedIn, I just got a new job, I'm starting a company X. And then the attackers start calling in, pretending to be that user, saying like, I can't get connected, I've got this new laptop in the box. How do I set it up?

Yeah, especially and on LinkedIn too, they put what they're doing.

Yeah.

So if they're going to go to work in the IT help desk, if they're going to go to work as a systems reliability engineer, there's a target in terms of maybe how the attacker could compromise them and move laterally. So it's a pretty important thing to lock down.

And it's all in the name help desk. Like those folks are in the job because they want to close tickets, they want to help people get productive and occasionally it's like the bad guy. And that's what's happening in the real world. So what are you seeing at Cross Journey?

Yeah, very much the same thing. Adversaries take the path of least resistance. And social engineering, as we harden a lot of the environments is that, you know, soft target. And the other thing we're seeing is an acceleration of AI adoption to use that as a tool because, you know.

Hang on, AI adoption by the bad guys or the defenders.

Yeah, by the bad guys. Because, you know, the days where you can recognize a fish, you know, by having a trained eye is, are probably over. Right. They can write a fish and it's really, you know, making their high fidelity social engineering at scale because the language barrier is no longer an issue and you can use AI to craft the perfect chart.

And what I see happening is it's the deep fake audio clips that people attach to WhatsApp messages combined with the screenshot and then sometimes they'll use prose or written text that's in the style of. But all of this is usually targeting our employees outside of the corporate stack. And so it's the personal cell phone. WhatsApp seems to be the vector that we're seeing.

Yeah, I mean we've seen everything from that to people trying to get legitimate jobs, impersonating employees using deepfakes and resume assistants and answering questions live using AI. So there are some very sophisticated nation state style attacks out there. But yeah, it's a force multiplier for every cybercriminal.

Yeah, I think the answer here is the first instinct a lot of people have is we got to train our way out of this. We have to teach people how to defeat these attacks and be vigilant, which I understand the thinking there's. But I think it's a losing game. I think we have to have systems and processes and technology in place so that you can't be phished, you can't be socially engineered. It's a hard goal to achieve, especially when the attackers are seeing what we're doing and then going to the parts that aren't guarded yet. But a simple example is we know the answer for individual users is a phishing resistant biometric credential. We know that if you have those, you it's very hard to be phished with. No matter, you don't have to identify URLs, you don't have to worry about is this page real. If you have to do a biometric every time, that's a process and a technology way to defend against this. So now the threat actors are going to move up the chain. They're going to go to registration, they're going to go to account reset. So we have to think about ways to build the process and build the technology. It's as simple as if you're talking about a high value transaction, financial transaction, and the CEO is there's a deep fake and the CEO is calling the finance team to make it happen. You have to put a process in there or technology in there to defend against that. You can't anymore rely on the fact that no one will be able to spoof the CEO's voice. So it's like don't rely on that. And I think when we try to train and we try to educate, while those are laudable goals, it's kind of a losing game.

Yeah, and you're using a lot of fancy words there. Phishing resistant biometric we're talking Touch id, face id, the equivalence for Android, for Windows. And so the technology is already deployed, deployed in the hands of our employees. We just need to figure out how do you wire everything up. And so this was a big win for us. When I joined Salesforce, we did the final mile of that implementation and we're using Okta Verify is the stack that we use, but basically being able to connect the Touch ID on a Mac laptop all the way up. So there's a secret inside of the secure enclave on the laptop that the user doesn't know. So it doesn't matter how much you trick me or scam me, I can't give it up because it's inside the laptop. And so that's like success for us. But that's only one scenario. Like you said, when you register the new device, that's now the weak point. And how do we get in there as the attacker? And that's what we have to defend against. So what are some of the things that you think like as a defender are cause for optimism, like what's going to help here?

Yeah, I mean, at the end of the day, there's always something that they're going to use to scale up these operations. Right. And so whenever that happens, that's an opportunity to defeat the operation. So for example, in that scenario where they're trying to get jobs at a company and they do succeed, they end up deploying a laptop farm to be able to do the job that in itself is infrastructure that we can incriminate. And so every time they seek scale, there's actually, it's good news for the defender. We can kind of shut down those operations and help you. The hard part is very opaque to the end user.

Right.

And so you need that kind of balance of security and IT to work on this together.

You said something interesting about the last mile. I think that's like a lot of things in technology and life, that's really the hard part, the last mile, and especially what's happening now. We talked a little bit about AI as a tool for threat actors to do better deep fakes or attack more effectively. I'm seeing AI have a little bit of a different role, which is everyone is so motivated to adopt AI. Boards of directors and CEOs are saying, adopt AI, more tools, more capabilities. We don't want to get left behind. So what that's leading to is even more variety and more heterogeneity in all these environments, which makes that last mile problem even harder. So what we don't want is to get the phishing resistant biometrics hooked up everywhere and then you get a bunch of AI tools. So now it's not hooked up to 10% of your stuff because guess where all the data is going? Probably into the new tool. So it's like as an industry we have to get the basics right, but we also have to have this environment that can expand and adapt as the technological landscape. With this innovations in AI get even richer and richer and more heterogeneous.

Yeah. So CrowdStrike, what do you guys have coming next? What's going to help in this area?

Yeah, I mean, I think we look at a lot of things. So the first thing is to give IT and security a way to wrap your arms around the problem. So like the inventory or discovery of this is the first thing. And so with a lot of our products like SaaS, security posture management, as well as identity security and even exposure management, they're looking at ways to first kind of what's in scope. Right. What do I have? And so that's the first battle because you can't defend what you don't know you have. And so that really helps drive the policy and the controls around things because not every environment is completely locked down. There's lots of different places. Companies grow in inorganic ways. And so even if most of environments are there, there's parts and enclaves of environments that aren't there. Then the other thing that we see a lot is security leaders are kind of between a rock and a hard place. They're not saying no to AI. AI is a mandate. Right. And so they have to adopt these kinds of new applications for the business to stay competitive. And so now they're having to kind of like write policy on the back end. So security teams are definitely on the back foot. We're giving them a lot of tools to do that inventory, to do that assessment and to give them that kind of first line of defense with controls and give them some guidance, hold their hand through how to write the right configurations, how to write good policies. Because the average security person is managing hundreds of security tools and IT applications that need to be secured. And so that complexity is where we see our ability to deliver.

Yeah. And when I think about so every big company I've been the security leader at has been an Okta customer. And so the only way that we can answer the question, what does our third party landscape look like? Is we look at the Okta integrations. And so it's 2200, it's 4000, 500 third party SaaS apps and there's this long tail of stuff with like less than 30 users and nobody knows or remembers how it came to be. But at least because it's tied up to Okta, we now have a governance opportunity to dig into it and understand do we still need it, is it configured correctly, whatever. And so I think that inventory aspect of it is the starting point. And then you go and look at what are the most active connections that are happening and how do you go and study the configurations of the ones that matter most and then you can do like data prioritization exercises and things like that.

Can I tell you a funny story?

I want to hear it.

So over the last three years, as you know, Okta has been on this journey to be one of the most secure companies in the world ourself and also do everything we can to elevate the entire industry against these identity based attacks. So two years ago we actually took an inventory of all of our own internal applications and found that many of them weren't connected to single sign on.

Really? How did you know they existed?

The cobbler's children. Right.

Were they in the Okta instances?

No. 90% of them were, but not all of them were. So part of the exercise was actually cleaning that up. Yeah, so that's really, really was a eye opening moment. If it's hard for us to do it, we have to make the industry have a better way, we have to standardize more, we have to make it better. And so that's, you know, talk about the cobbler's children.

Yeah, well this is the thing, I think as a SaaS provider, often you'll talk about like if you do it this way you're in good shape. IP allow list, like that's a good control. But then you say, well, how many of our users or customers have set it up correctly where they get the benefit of that feature? And then it's like far too few. Less than 10%, less than 5%. Okay, maybe the feature isn't where it needs to be because we've created something which might work, but it doesn't lend itself to easy deployment. And so we need something that either it's on by default or it auto configs or there's something in order to get people. So now you guys at Okta have a lot of innovation and cool new ideas, but you've got a lot of customers who have something that works today and then you show up with a new idea. So how do you decide? When do you impose change on Your customers or you create the opportunity, but they're too busy to take advantage of it and they don't want to mess with something that already works. So how do you thread that needle?

Well, part of our secure identity commitment is we are changing the products to be more secure by default.

Okay, so it's. So there's no.

They're not optional. Ten years ago it's not optional.

Okay, so you're reaching in and changing it.

A simple example is two years ago it was actually possible to have an Okta admin console without MFA on it.

Okay.

Very rarely done, but it was possible. So we made that not possible.

Okay.

Now that has actually, as you know, that's. To get that 98% done is doable. To get it 100% done takes a lot of work. People are relying on systems, accounts and machine to machine and they have inter tenant dependencies and that last mile is very hard to change. But that's the kind of stuff we committed to do and we did. So it's secure by default, more so than it was before, which is a, a great position to be in because there's a lot of complexity and there is a lot of people are trying to do a lot of different things and the products have to go in there in a way that's secure by default.

And this is the, I think the big challenge that I've encountered is that secure by default, but the defaults are changing as you get smarter and you have a better product. But the customers that got deployed, they don't want to have to change because they've got something functional, they got other priorities. And that's one of the biggest challenges that we've had. And particularly a lot of people in the ecosystem, you know, they're in there to like sell new uplift, they want to get new products, new SKUs into the hands of customers and going back and monkeying around with stuff that's like working and not bothering anybody, that is not where the excitement is. And so you've got to overcome all of that if you want to drive the security outcomes.

I think this is the biggest opportunity for AI to make a difference, right in security. You know, we just don't have enough people to drive the helicopter that we build. Right. And so I think, you know, we saw this coming a long time because there's been a, you know, a skill gap, then there's a labor gap, and now adversaries are moving so fast we see a speed gap. And so AI was kind of inevitable. And so, you know, we've been investing in ways to kind of create that agentic workforce for people and that will cross over into the IT boundary because it's not just about the visibility and finding the bad thing. It's about how do I remediate and give the person on the other side, the sysadmin or it, everything they need with a bow on it to know that that's what they have to do. So I think that's the promise. You know, we talk a lot about the scary parts of AI, but I think it does help automate some of these high complexity, you know, high leverage problems, especially around key configurations.

Yeah, we've got some things that we're prototyping where you'll do a security health check of your Salesforce configuration and it'll list out whatever the opportunities are to do better. And in the old days then we say, okay, have at it. And you'd have to click 800 times to get everything just right. And so now we've got an easy button where you can click in and say, do you want to have us apply all these for you? And you can just hit yes. And it doesn't naively just flip everything to on, but it'll go through and it's smart enough to be able to figure out, well, if we change this, given this, you introduce complexity and so it'll save the really tricky stuff for human review, but all the freebies and easy stuff, it'll just auto populate. So is this something with an AI revolution that you see opportunities within the Okta administration or deployment opportunities?

Absolutely. And I think like CrowdStrike and like Salesforce, we're thinking about how we can have agentic workflows that make the process of administering Okta easier and setting up Okta easier. I think it's really a industry shift or a culture shift that I think companies that instead of saying, hey, it's the customer's responsibility, whatever they do, it's up to them and have the culture of taking that on themselves. Whether it's Salesforce or Okta or CrowdStrike, say, hey, it's our responsibility to make sure the customer does it right. We're not going to build a product and throw it over the wall and say like, good luck figuring it out. I think that cultural shift is what's going to lead to better security outcomes. And I think companies that have that brand, frankly are going to be more valuable and seen as trusted partners better than companies that maybe do it the old way, which is like, hey, we're doing a bunch of stuff. But if you set it up wrong or you don't do the right security posture, you know, hey, mutual responsibility, right? It's your problem that's not going to fly.

I don't think that goes very far these days.

Well, this has been a lot of fun. We've had six weeks of good content, talking about security trusted enterprise. How can our Salesforce admins and Salesforce operators make the most of the platform as it is today? And today, talking about the emerging threats and the things that we need to do as defenders to stay ahead of these new capabilities that the bad guys are constantly innovating with. I've had a lot of fun on this journey. Todd, Mike, thank you so much for joining me for this wrap up. And thanks for watching. It's been a lot of fun having you here.