In this virtual event panel, host Boaz Fischer welcomes guest Ophir Cohen of Thales and co‑host Sean O'Fear to discuss why organizations often misjudge employee access, especially in the era of massive remote work. Cohen shares his background in defense‑focused cyber security across Israel, India, and Australia, and explains the core purpose of Identity and Access Management (IAM) – to securely enable employees and contractors to access corporate resources without hindering productivity. The conversation highlights several pain points: the rapid shift from ~15% to >80% remote workforce, the inadequacy of simple username/password or VPNs, the rise of credential theft and phishing, and the resulting need for stronger, multi‑factor authentication balanced against user convenience. They explore privilege creep when staff change roles, the importance of classifying and protecting high‑value assets (HR, finance, R&D), and the industry’s move toward a “zero‑trust” mindset that assumes no user or device is inherently trustworthy. Cohen predicts 2021 trends will focus on achieving a balance between heightened security (encryption, layered authentication) and seamless user experience, while organizations must redesign network and IAM architectures to address these challenges.
Chapters
Action.
Action.
Good morning, good afternoon and good evening. I don't care where you're from. Happy for you to join on the virtual event number 11, as far as I know, Sean, My name is Boss Fisher and we have Sean of Fear and we have a special guest ofikohen from Thales. So today's topic is very pertinent to the subject of where we are, about why organizations fail to judge employee access correctly and raise the probability of a data breach.
But before we get into the nitty
gritty of all that ofeer, tell me a little bit about you. I know that you had the identity access management for taos, but give me a little bit of your background and why tell us.
All right, thanks Boaz. So, yeah, I actually moved to Australia just one year ago after spending so many years mainly in the defense and security sphere. I worked both in Israel in the cyber security and I worked and lived four years in India in New Delhi, leading a lot of defense and cyber security government national projects. And then I decided to move down under and move to beautiful Australia and beautiful Sydney just a year ago. And today I'm leading the IAM portfolio Identity and Access management, Cyber security solutions for Thales. And happy to be there.
Beautiful, beautiful. So before we start asking lots of questions, which we love to do, I'll get Sean to set the scene.
Yeah.
So good morning, evening, afternoon to everybody. So today session is all about a very simple statement. If there is no access, there is no business. And so every organization must grant its employees with third party access or third party access to their data and infrastructure in order to operate the business. But that access is a privilege to do what they are tasked to do and not just what they can do. The challenge these days with the remote employment or remote workers is that organizations provide access, but they don't really know how they can verify that their employees do what they should do. And also, what about the remote third parties that they access to organization, infrastructure, Why a simple user and login is not enough, why that became a challenge and what organizations do today to make sure that they can protect their crown jewels. And another question, what about people that shift roles, people that have privilege to do certain role or operate certain systems, but when they shift roles, when they switch roles, in many organizations, they don't really pay attention to the privilege entitlements. They just take their privileges with them sometimes when it's not really relevant. So the question is today, which Ophir will help us to understand how organization manage those privilege, how organization manage the right access and the access rights to the company, infrastructure and ip.
Excellent. Beautiful. So before we dive into further details, let's set an understanding, a baseline of fear. What does identity access management really mean in sort of an industry context?
Yeah, so identity and access management is actually kind of perception, kind of an idea and a method basically for a company on to kind of summarize or put in one place the ability, and to have the ability to have to allow from one hand, in one hand, all of their employees, subcontractors, anyone that actually works in the company, to log in to the company, you know, environments, cloud services, whatever they need securely. And on the other hand, not disturbing their usual day to day job because we want to authenticate them, we want to secure the login, we want to be able to monitor the actual login and authentication that they do. But on the other hand, we don't want to make their life difficult. Because if you put so many barriers and firewalls and authentications, methods and everything, eventually the user and your client, and basically the clients are your employees, you want them to keep on working. You don't want to make their life miserable, you don't want to get them to work too much just to log in. So when you're allowing them to do it easily, you're making their life easy and you allow them to work easily. But on the other hand, and in the same time, you still have control on that. So identity access management, basically a good system will actually allow you to do all of these. I mean, in one hand, authenticate and secure the authentication of employees, and on the other hand, allow the employees to do it easily and swiftly without even noticing they're, they're actually doing something actively. Good.
So what are the current trends that you're seeing today? And let me add another small question to top of what do you see the trends going to be in 2021?
All right, so basically, I mean, what we've experienced in the, in the past year was like a tremendous shift in this sphere because if in 2019 and before that you had only about 15%, more or less employees working completely remotely, like sales guys and stuff like that, and people like that, and usually occasionally people went on vacation and wanted to work remotely, now we're facing almost 80% or even more trying to work remotely. And that completely changed the understanding and the way we work. So that forced that situation, actually forced companies to think differently. So if until a couple months ago we relied on our VPNs or just a username and password to those remote, a couple of employees. Now it's not enough because people are working from home, from their private laptops or even from their work laptop all the time using the same unfortunately username and password that they're using to log into their Facebook, any social media. And that's a huge risk, that's a huge threat. And we saw, and everybody sees, I think, I mean everybody looks in the news and we see all those kind of phishing and hacking attacks, endless amount of attacks. And so companies just started to realize that they need to put and establish higher level of security. But that made a lot of employees life a bit harder because suddenly companies forced them to, to use so many authentication methods like tokens and endless amount of passwords. And now employees are starting to push back. They want an easy task, an easy method. And I think what we'll see in 2021 will be like a balance between a higher authentication level and the ease of use. And that's what all the companies, the OEMs, that makes those kind of systems, identity and access management systems. And on the other hand the buyers, the clients that are that want you to buy and to purchase the best, best of breed. But on the other hand, not to make our life so difficult. So I think in 2021 we'll see, we'll start to see the balance of those two now. So.
But go ahead, no worries, no worries. Look, I just have a very interesting question today. When obviously a lot of people, you know, if it was before the ratio was 90% working in the office, 10% work from home or remotely. I think now it's almost the opposite when they have, when they need to visit their offices in capsules or in groups, while the majority are at home. Now when people are working from home using their, well, I guess not everybody, but most of them are using their own private infrastructure and their home, wi, fi, home Internet, there is not a lot of security and they're using, they're accessing their work using the same infrastructure they're using for their own private actions. Now obviously they have other systems installed and they access private systems or their individual systems that they own. With their access to their private systems, private emails, private services, there is a high chance of identity theft. So what happened when the identity being stolen and those hackers, those criminals are trying to log in and try to take advantage of the data they stole from the user and try to log into yours to the corporate systems? Maybe I'm talking about targeted people, the executives that not always they are really IT and security savvies. How does it work? How does that protect that problem?
Yeah, so exactly. That's exactly the scenario and the use case that basically any kind of good reliable identity and access management system is supposed to deal with. Because that's exactly the hackers point on way to go in once they either they steal your credentials or they steal. I mean it's not only, not all the time, it's only the username and password because sometimes you're using what we call two fa, two factor authentication, something that can be. Those credentials can also be hacked. So you need to put a different layer or additional layers of authentication of securing your access and securing your credentials. You can use a couple of ways of encryption, symmetric or asymmetric encryption to all of your credentials. There are a lot of ways of securing and protecting those credentials. On top of that, in order to secure or to raise the level of security to the company environments you need to be able a company needs to understand that they can actually define several environments that are high vulnerability and also at high risk and high value to the company. Because for example, the HR or the finance environments are probably one of the most important environments for a company or the R and D where logs or expenses, user expenses are less important. Because if you hack them it won't make that effect such effect to the company. So you need to protect, you need to be able to protect those specific environments and not just put a broad protection on the entire company. That makes again the authentication method and working very difficult. So you need to be able to differentiate the layers and the levels of securing and authentication, authenticating the users to the system. So we need to be able to investigate and redesign the way we see how the employees are working, how the system, how the IT manager, the solution architects are designing the network. And like you said, when users are working from home and using their own private WI fi, unsecured WI fi and then trying even there, even if they are trying to log into the VPN credentials. VPN credentials are pretty much easy to hack. Like you said, hackers, hackers can easily hack the Gmail and any social media and steal their credentials. So that's exactly where an IAM solution comes in place. Protecting and securing those credentials and preventing hackers to steal and use. They can maybe steal half of them, but they will never be able to use them unless they have the other parts of the credentials in order to log in.
Excellent. Ofir. So we hear a lot of the news because of the risks that we see and the amount of hacking and credential theft. And so Forth, there's a lot of banter in the industry called zero trust. Shaw and myself talk a lot about from a trust from a human context. But the industry sees it from a system, which means that its relationship with anyone else from a system context. This should be zero trust. I've heard trust no.1 is also as a standard system. Explain it from your context. What does zero trust and how that correlates with identity access management?
Yeah, so zero trust is basically the way of thinking. It's a way of thinking for especially obviously the company in one hand, and we talk about it. I mean, Sabasa is expert in the inside threats. So also, I mean, zero trust, you don't want to trust your employee not to do damage because in one hand there are employees that intentionally wants to damage the company, and on the other hand you have employees that unintentionally hurt damage the company's assets. So you don't want to trust them. You don't want to trust their level of integrity or you don't want to trust their level of professionalism. You just want to have your company work smoothly. You want to use and you want your employees to work as much as in a higher level of professionalism and use and utilize their skills to the best. But on the other hand, you want to keep your company safe. So when your employees actually are trying to start working, you need to have a zero trust in their ability to authenticate themselves. You don't want to trust them to keep their credentials safe. You don't want to trust them that they will change every three months their password. You don't want to trust them to, you know, keep a note on a paper, the password, because they don't want to, they don't want anybody to hack. So zero trust is actually a way of thinking, a way of kind of a methodology to say, okay, guys, we trust you to do your job in the best way you can. But on the other, same time, we don't trust you to keep your credentials safe. We do the job. You don't need to worry about it. I mean, we as a company worry enough. So we do the job for you.
Yeah, look, I think that's the trend anyway in the industry organizations, they are taking more and more accountability and controls and responsibility into the organization. So for example, look at the virtualization today. Instead of having users working with their desktop, organization said, look, you would use a dumb terminal. Well, it's basically coming back 40, 50 years ago. You will use a dumb terminal. We will make sure that you get the operating system. We will make sure that you get all the tools that you need to work. We will maintain them, we will secure them. I think when organization needs to secure its assets and its crown jewels, it's not the job of the employees. They need to be aware, but the responsibility is always about the organization. And the business needs to take care of itself. So you can't send, look, this is a war zone. The cyber world is a war zone. And there are always constant attacks and constant bombings and constant casualties. You can't expect employees to. That they are not qualified as cyber soldiers to go in battle, to go to the battle.
