[Music]
oh
hey how's it going great great yay
so i'm excited for so many reasons about
cyprecon uh a stage is nice a microphone
is nice you all are great this is this
is fantastic
another thing
that has never happened to me before
um is is being invited to give two talks
back to back so
hopefully
you guys will survive this and not be
bored
um this is really this is really
exciting to me because
uh i've often times talked about these
talks as being two sides of the same
coin the first one being street cred
which we're going to talk about uh how
to protect credentials and how to
protect the front end of authentication
and where that's going and the second
part is mistaken identity which is okay
now that you've protected those creds
what type of mistakes are your
developers probably making that
undermines everything they talk about in
hour one
so that's it double header i actually do
a workshop on this which is which is
pretty fun
but uh all right so
go with me back in time just a little
bit
go with me back in time to uh to like
the dawn of hacking right before there's
the cool music before there's the kill
murals before there's conferences the
dawn of hacking when the term hacker
first
was defined you guys remember anyone
want to shout out where it was anyone
know
93.
oh mit yes as i said 93 i'm like oh my
god
it was 93.
i remember the dial-up sounds very well
yes mit mit so
this was the computer
the ibm
7094
a glorious piece of machinery
it was it was truly byod and that the
university brought it and that's all you
got
it was
very famous for two reasons one i'll
tell you about halfway through this talk
but the first reason this was famous was
because this was the very first computer
the ibm 1794 in the mit the late 50s
early 60s where the term hacker was
defined the first computer to have a
password
that's exciting right yeah
yeah we're going to share a secret with
the machine people loved it just like
our user loved passwords which is why
footnote this is the machine that had
the very first password breach
at mit
in the 60s when somehow miraculously
surprisingly we don't really know how
lost time someone put all the passwords
on the message of the day file and
printed them out
no one likes passwords
but it started it started this really
interesting cat and mouse right
what do we do we do manned more of the
the human do we have them like remember
a password and it's you know for this
university system and hopefully they
remember it and they share it or rather
they don't share or do we ask more from
the machine
do we ask more for computational maybe
protect it maybe don't store it in the
clear maybe don't accidentally or
intentionally mess it up with the
message of the day file we've had this
back and forth
for 60 years
six decades six decades we've been
fighting this we get better algorithms
the criminals break the agreements we
ask for better lengths and passwords
people write it down this is like given
up i had a
call and they're like wolf tell me what
the latest advice from this is how long
should we make our password something
like this this is giving up eight
characters that's it if you ask anymore
and people are gonna repel like but wait
in eight characters if we use land man
we can get that right away yes yeah you
can and even if we don't use landman if
it's like ntlmv2 we can like crack it in
like a day yes yes you can so why
characters because we've given up
i'm sorry
tell your people 16 characters and when
you you're updating your resume come
find me because my employer is hiring
um oh i should mention that by the way
hi i'm wolfgang i started talking
without even introducing myself
i am an advisor at cso i work with cisco
secure
came out of dual security so i spent a
lot of time thinking about multi-factor
and thinking about identity and access
management and all those sort of things
and so i want to talk today about where
we are on this journey
as we've battled for six decades
to
somehow secure a password to figure out
the right balance between demanding more
of the user i'm demanding more of the
machine
and i'm going to talk about how that may
be translated past or less which i'm
very excited about i'll touch on risk
based off which i think is absolutely
needed
um and you know we'll talk about how
great it is to get a saml assertion or
you know oidc jot
and we'll all go yeah that sounds great
and then you guys can come back at six
o'clock it'll say and then we steal
those jots
and everything is terrible
all right
multi-factor
multi-factor right mount defector is
good we have the password and uh and
passwords are cool right i mean i i
don't know i've got like a nostalgia
about passwords 1993 is what i thought
someone said which is right about the
time i created my first password right
you log in you're excited your parents
say you can create an account i'm like
yes
i will name that account they're like
yeah but not that name that's what are
you 10 i'm like yeah probably all right
no different name but you can create a
password you create this password this
really awesome password that's a shared
secret between you and the machine no
one else knows it but you and the
machine it defines your identity it is
amazing
and then you have to create like
20 more and 30 more and
then it sucks and then they totally have
to rotate it which this has also given
up on congratulations guys
characters don't rotate it it's fine
it's cool no one's going to mess with
that
so
this has been a problem for a long time
we know as human beings human beings are
storytellers
we are poets we are artists we are
stupid and we create passwords everyone
can guess they were cracking the bsd
passwords like the original like the
smartest people that i know right like
ken thompson and eric schmidt and these
geniuses of our world they're cracking
their passwords recently this is from
the 80s
i like this one this is uh ken
thompson's
it's a chess move i think that's clever
of course no one knew he liked chaps
i'm sure no one guessed that another one
is my favorite is eric's it says it's
his wife's name it's wendy that's cute
it's got three exclamation marks which
is secure right special characters he
was ahead of the time
so we've been doing this for a long time
we pick passwords that are very easy to
guess
and a lot of people are like oh yeah
sticky notes sticky notes comes up a lot
of times when i'm talking about this
people like oh yeah that's sticky notes
like when was the last time you saw a
sticky note
but it happens i'm like yeah
in 1993 when we had one or two passwords
no one has a wall of 500 sticky notes
so we write them down and we misplace
them everything so the solution of
course is
multi-factor yes
yes we will take this terrible thing
which might be pretty good if you have
an exclamation mark
and we'll add some strong factor to it
awesome great
but then and this by the way was was
predicted like anyone if you talk to
anyone like five years ago six years ago
um if you ran to alyssa miller she'd be
like defects are going to be terrible
and be like yes you're right if you talk
to someone about passwords they're like
yeah once once there was a multi-factor
they're gonna hack it like no
i figured the bad guys would quit
they're like no they're gonna attack and
that's what we're seeing right sim swap
attacks especially cool if you've got
millions of dollars of cryptocurrency or
nft just let me know what your phone
number is it's fine
um you walk in and there's actually like
salt lawsuits about this which i think
is great you walk into the store you say
hi you know i'm the person who i'm
stealing this com from my phone got
broke and they're like oh man that sucks
i'm so sorry like yeah it really does
can you give me a sim card like yeah bro
okay and then you steal their crypto
worm awesome awesome or any other sort
of swim swap attack ss7s are pretty cool
i was um circle city county and would go
to circle city county and then i was
yeah fun time fun time i took my wife
there when we were first dating and
we're out to
get coffee in the hotel lobby and she's
like why is my phone weird and i pull up
my phone and go oh yeah it's
that's shanghai time
that's that's probably not normal and i
look at the phone it's like oh yeah lte
i said turn your phone off she goes why
just trust me apparently we're in china
now i don't know we're with hackers
that's what hackers do we change the the
you know tower and everything's fine
and uh and surprisingly she still
married me i don't know
i would have thought that would have
been a clue but yeah so you you
compromise this tower which isn't hard
to do and then you do an ss7 attack and
then you get the token awesome um submit
your crypto easy to break duplicate code
generation well that's bad i still have
people i don't know why this happens i
still people go and this i swear to you
two weeks ago before this
and if you see this on the recording i'm
sorry i'm talking about you but i am
talking about you
they're like hey i've got this great
idea i'm gonna roll my own mfa
why because it'll be cheaper and easier
yes
it it will
until you're compromised
but okay anyways so duplicate code
especially prevalent in people who are
rolling their own uh golden salmon
attacks which i will not talk about this
because that's a spoiler for earlier or
later
uh push fishing
or now called brute force
push i think
just especially fun i'm gonna set a push
and uh and this is what one of the
attacks that was described it was one
less something like this person
privileged user should have known better
um had their email account compromised
the password compromised and it kept
getting pushing push attacks saying oh
that's not me not me not me and it just
kept sending him and setting when
setting and sending and sending the
person goes well it's probably me click
okay adversaries in ran a bunch of
scripts uh backdoored his email address
uses email addresses to send a bunch of
other emails to other people including
one with ransomware and then some clicks
it and then spreading throughout the
local subnet i think the entire thing
was like 15 minutes after we clicked yes
meanwhile your stock slash what
8 hours 16 hours 200 days verizon says
anyways
maybe your stock isn't going to catch
that
so that's happening uh evil engine x is
happening where you're thinking you're
logging into account but you're really
logging into something else all sorts of
different ways to go on to things so
you're like okay that's cool
depressed me wolf and i'm saying i'm
sorry i'm sorry but it gets worse
because you may be thinking okay that's
all that's all fine and good
we'll just have everyone use biometrics
yeah
did you guys catch the talos blog where
they 3d printed people's fingerprints
and logged into all the phones
that was cool
so
things are happening things are
happening and one of the questions i get
asked all the time is are these things
possible yeah they're possible i mean if
if you're in cyprus county or circle
city someone's going to mess with the
tower
if you've got a whole bunch of money and
they know your phone number they're
going to sim swap attack you if you got
biometrics they might try and 3d print
them yeah yeah but is it likely no no
thankfully for most of us
i don't worry about it i don't know
about you guys i still have and i hate
to say this in this audience but i still
have sms i'm gonna pay for some things
why not it's easy and for low risk
accounts sure sure
so is it is it gonna happen
soon but probably not now
but this all gets us into thinking about
passiveness right so if you think about
that entire line
of everything going wrong the still the
most terrible part of it is that shared
secret that we're all
coming up with that's probably our pet
name or our wife's name with exclamation
marks
so the whole trick about pastoralists is
to remove that shared secret to get rid
of that shared secret and to move on to
one of those other factors hopefully
multiple factors
why now
um in
early 2000s bill gates stood on the rsa
stage and he said we will kill the
password in two years
and it sounded really cool
and in 2020 at rsa the last rsa is that
i stood in a
not on the main stage uh in a side room
with some reporters and i said with web
authent coming out which i'll talk about
in just a minute with web authentic we
will kill the password in two years
yeah
gates was wrong i was wrong you're
probably like why are you comparing
yourself to gates
not my first time when i dropped out of
school i told my mom but mom bill gates
did it and built his entire company and
she's like
but son you're at community college
and your company is systems integrator
so
uh maybe a little bit of hype but we've
been talking about killing passwords for
a very long time and haven't gotten
anywhere one of the reasons we haven't
got anywhere is because we didn't
necessarily have good sensors right it's
very expensive and we'll come back to
this is one of the the big sticking
points it's very expensive to do
biometric sensors everywhere but
thankfully we'll have phones now which
most of them haven't so we have that
it's very difficult to create protocols
that allow you to log into things um
with web authent and fido 2 and the ctep
workflows which are covering this talk
cool groovy now we've got that ability
so the standards are out there
everything's coming together and we're
able to like bring this together and
make something happen of it still taking
a while i would have thought we would
have been further by now but some of the
things i found kind of makes sense is
yes
smartphones are ubiquitous
except for 13 of the population does not
have a smartphone yes smartphones are
ubiquitous in the workforce except
that's only the white collar workforce
what happens about your hourly employees
your seasonal employees what happens
about your gig workers we start parsing
that out there's so many different
people today who don't have technology
which i would argue is probably a much
bigger conversation
than why can't they log in as
passwordless if we're honest with
ourselves why are we not paying people
better and equipping them better but
simply from an authentication
perspective lots of problems
okay well i can buy that but you said
we've got protocols now like 502. yes
we've also had saml for a while
how many apps right now are single sign
and the problem is that sas apps are
still
surprisingly few in terms of federation
and adoption that protocol so this is
taking some time to to get to that point
but but we're on a good point also
what's kind of cool is that dichotomy of
man versus machine do we make people
remember more things or do we make the
machine work harder computationally more
intensive that actually goes away
because with passwordless it's actually
easier which is very uncommon i did a
research project
uh i want to say five years ago now and
i asked people hey tell me how security
improved your life or made you faster
and once they stopped laughing at me
oftentimes they just stared at me
uncomfortably
and said you're from the office of the
cso aren't you
like i am i'm sorry is there any way
that things got faster like when you go
away
right it's very rare we're like no we
really made your life better but with
passiveness we can do that single sign
there's another thing there's other ways
to do it
so that's cool all right so for this
talk i want to cover like a path to get
to passwordless mfa we'll talk about
we'll talk about authentication
workflows
looking at ways to do the trust right so
if everything breaks like i talked about
earlier with different factors how can
you still have trust in that
authentication and then enabling the
passwords experience and moving to a
toolkit
all right
first do mfa we all should do mfa
everyone should do mfa so the whole idea
of course is pastor listens we just
remove the password and we do mfa
knowing of course that there's a lot of
factors that are still weak and
vulnerable okay so fine we'll do
passwordless but we will remove all the
weak and vulnerable
except for use cases again with hourly
and gig workers and customers we're
going to email them and provide qr codes
and i talked about any of that talk
about strong passwords which is one of
these factors in play
so rather than logging in with our our
username and password we get rid of that
password we're like haha we're good
except there's still some additional
things we want to do we actually want to
make sure
that we are checking things we want to
make sure that we've got two factor
because
auditors are auditors and auditors take
time
and if we go hey mr otter guess what you
know that standard you said about 2fa
like yeah you did pci yeah you know that
standard
yeah that was great when you did it
uh-huh we got rid of that
they won't like that
they will push back and they'll argue
and they'll mock us down and then we'll
have an audit fighting we'll have to
explain to the board or the executive
team why we're no longer compliant but
we are we'll say because it's a stronger
factor no password yes but you need two
including one that's terrible
what's the old joke about multi-factor
it's something that you've forgotten and
something you've lost we need those two
we need those two
so with passiveness to reflect
multi-factor and reflect sort of the
fault tolerance of these different
factors we want to go ahead and move
towards
um still having two steps
but doing it all in one step if that
makes sense
the standard behind all this is 502.
love me some 502. these are the same
guys who brought you 501. surprisingly
enough uh it's the yuba key standards
that we're all used to right one tap to
get in it's an awesome thing they've
collaborated with uh with duo and with
microsoft with google and apple and they
built it in their browsers and built it
into devices and so now we can go ahead
and log in so if we're sitting there and
i've authenticated to my device
and uh and i'm using a strong
authentication to do that i can pass
that on to the application one of the
things that's cool about that is the key
material that it's exchanged with the
application is on a per application
basis
why does that matter well it matters
because
they probably have 200 applications
um 10 of them have probably been
breached i mean if you want to have some
fun go look at your customers who are
logging into your applications today
pull that customer list and run it
against have i been pwned and see how
many of those accounts have been caught
up in compromise i'm betting the number
is 60 to 80 percent
that is a made-up statistic right here
on stage
check your own data
so
that doesn't work if i've got multiple
different um
you know
signals or multiple different factors
for each one of these applications so if
i compromise this application i can't go
ahead and replay very cool also also
rather nice
i'm going to use the url
as a check mechanism so i don't even
pass that material in if someone's used
a weird character or is phishing me or
doing those things pretty cool pretty
cool now
problem with that is it's platform based
with an internal authenticator what that
means is if i'm doing that with my phone
and now i go to my desktop
my desktop is a different device
doesn't have that authenticator for my
phone
that sucks so now i what i log in with
my desktop
maybe i just never use a desktop again
maybe i retire i like that last option
so they've got a different way to do
this which is okay we're going to move
towards
using a factor outside of the device so
my desktop and my other desktop and my
phone can both use this other factor and
that's going to use the ctab protocol or
utf
to go ahead and check this is also
pretty cool our first case um is i it's
my device in my
credential on my device
awesome
all right real world how many people
have like shared devices right you'll go
to the hospital recently
or call a call center or and and and
share devices pretty common for those of
us not in 19 so therefore having a
external authenticator pretty groovy
solves for that problem
we can also move that out
to having a roaming external
third party such as doing a push or
doing something else or doing biometric
so that no matter what device i'm using
i can do something external
now all this is happening through the
front channel which means that all the
first three patterns all happening
through the front channel which means
potentially could get intercepted it
could get messed with
which means
potentially that we've got
threat vectors so another option which
is my preferred one which is the user
logs into the application and the
application behind the scenes rather
than through my computer
does some sort of check with a
authenticator to go ahead and log in so
four different ways of deploying this
all within the protocol also within that
protocol of course is threat models in
different ways that they've figured
people will break this
all right so what this looks like in
practice is i've got my username and
password and i'm logging into the cloud
and logging something on param log into
advice
and away i go and i want to go ahead and
put mfa in there first so that i can
enroll them and make sure that we get
those other factors either utf or push
or something and then get rid of the
password
easy first problem
we need to make sure that they can't
downshift factors this is another
problem that happens in multi-factor oh
you can't log in no problem i'll send
you an email um oh your your super
strong authenticator utf token that
you've enrolled is no longer with you
no problem i'll send you an sms code
so at that point in time what
is the effective stopping power
of that control if you can downshift it
pretty low right it's going to be the
strongest is this the least
strongest factor uh in the downshift or
or in the recovery oh i lost everything
so i'm just going to go ahead and
re-enroll awesome how do you prove your
view
one of the interesting ways side note
one of the interesting things i was
playing with if you guys seen the selfie
uh authentication
this is kind of cool you hold up your
your id to your phone and then you turn
your phone around and take a selfie
and they're like aha you are you turn
your head a little bit so it's not deep
fake okay you're in i love that that's
exciting identity proofing great
solution um
how many people are using that
not many it's usually back to links and
qr codes and driving me nuts so
downshifting first problem
second problem is making sure they're of
course avoiding all those factors in the
downshift
all right so we get people on some
different factors that can log in we get
some place to to beef that up let's talk
about consolidated workflows part of
this problem is goes back to what i said
earlier one of the reasons why this
technology is taking a little bit longer
than i thought
besides the point that for some reason
we've been doing other things the past
couple years
what the hell is that
i think we should be focusing on
authentication under this that's work
from home and that's save lives okay
that's important too but
think about the passwords people
part of it is a lot of these
applications take a real long time sas
applications take a real long time to
support protocols another part of course
is that we've got a lot of passwords a
lot of applications
love looking at my password manager and
seeing the 400 passwords that i've got
in there um again standard made up on
stage i'd encourage you to look at your
own people in their own passwords they
probably have 191 that is not a stat
made up on stage that's a recent uh
recent stat from 2019 i think it was
a lot of passwords a lot of applications
to to handle so rather than doing this
on a one-off what we want to do is think
about ways to like put in place sso so
that i can go ahead and do password
listen to my sso portal my ssl portal
can talk to saml everything else and you
say but wolf you just told me a lot of
applications don't support san juan and
go
i know
passwords are going to take so long to
kill
but that gets us a ways down the path
now how many applications
typical enterprise is running 1400
applications that seems like a lot
how many of those are going to support
salmon probably half how many of those
are going to be worth putting in sample
probably half of that so we're talking
about 200 applications i would estimate
to move into a pass or less which means
1200 probably that are good attack
surface
and that's of course if you're attacking
the ui if you're a pen tester like
yeah 1400 applications let's do the math
that probably translates into 15 000 api
endpoints this data i just saw on dark
reading which blew my mind typical
enterprise 2022 15 000
api endpoints
love that from a red team perspective
how many of those are protected with mfa
or pacifists
i'm going with five i like the number
five
and that's assuming of course modern
tech stack legacy oftentimes comes up
rack up we don't have a good solution
for mainframes uh legacy legacy windows
applications where we're still having to
be on-prem legacy managers who want
workers to come into the office
i suggest replacing the ladder upgrading
the former
um but we also have to figure out what
we're going to do with this legacy
that's going to be like application
proxies and off proxies and everything
bottom line here is
legacy protocols will get us this will
be in a vector that adversaries will go
through microsoft got hit with this
early days
of o365
why because they were supporting my
legacy protocols of course why wouldn't
you
my users still use smtp they loved it
1993 they love it today it is a great
protocol
so microsoft is supporting all these
protocols
and they're allowing you to log in
through all these different endpoints
and you would there is a great attack
where you log in through an unprotected
endpoint and you get a samwell insertion
and you pass that samwell insertion into
sharepoint and sharepoint will go like
yeah that looks groovy come on in
like okay even if sharepoint had mfa
enabled
even if all everything was perfect you
could pass that token around
not cool not cool we're going to still
have that from a legacy protocol
perspective there's going to be a
million and one different opportunities
from an api perspective the api
landscape is still
horribly
unsecured
to get jots and get assertions and pass
them around and it's again assuming we
even know about these applications
when i put that stat on twitter that 15
000 apis according to the survey they're
like oh i must be missing 10 000 apis
someone replied back and i'm thinking
yes
you probably are
and i'm not saying that to be mean um
when when i look at some of the cases
from duo they'll deploy like mfa and
they'll get a device inventory and
they'll think we've got
20 000 devices now deploy in the go
we've got
60 000 devices
when i first moved to cloud i thought i
had 200 apps
and then flooded caspian
it was not 200.
so we need to be aware of these things
and get ahead of these things
all right now we need to talk about
increasing the trust and applications so
in this step of course we've got
username and programming mfa
we need to look at ways
that we can look at device trust which
is probably one of the the predominant
ways today to reduce attack surface
if it is wolf
coming from wolf's house
on wolf's device
with wolf's username
and wolf wolf's
fingerprint
it's probably me
and if it's not
i'm going to 1099 that bastard
i need i need some help
please i'll give you my no i'm just
kidding please do not break in my house
that's not really an invitation
all right um and then the next thing is
once you're in passive device trust
looking for some validation so let's
let's look at the first side of things
this is again putting more of an onus on
the machine this is rules and policy and
correlation uh we could we could talk
about like device identity right if it
really is wolf's device well how do i
know it's wealth device well maybe it's
because i got something in the tpm or
the secure enclave that says this is
wolf's device maybe it's because i've
got certificates which can be just a
oh incredibly frustrating to manage
certificates on the device
fleet right i think anyone's doing that
knows this the device certainly aren't
responding or aren't in the right vault
or don't become available or have
expired a bunch of problems there but
maybe we do that with search base which
i like at least because we're doing a
strong based authentication or maybe we
do it with an agent or mdm
so different ways we can do device
identity but the trick is with web
authen and ctap to tie a user to a
device or in the case of shared devices
to tie user to a roaming authenticator
that can be used to prove to the device
that relates me
groovy
now
um you guys remember the early days of
ransomware
did anyone really think it was like
important or that we all just sort of
like laugh about it
am i the only one who's laughing about
it who thought like ransomware in like
2005 was like remember and to bring us
all back
ransomware 2005 was like your uncle
called you and goes i don't know what
happened but my computer looks weird and
they tell me i need to send
a coin bit
right 2005 ran somewhere they won't take
that it's like
it's the old people i love them i will
help them out right that's what we
thought and then the ransomware guys
went hey we've got money we should go
after the the companies with the big
money and ransom went from like a dollar
to like 7 million
and suddenly it's annoying but it
started off in this consumer space
what i think is really interesting is
another thing that's right now in the
consumer space is remote uh remote fraud
right hi i'm i'm bill gates and i need
to fix your computer and my uncle's like
call bill gates sure help me out
my windows is really slow
and then they like get you on and they
you know they get the password or
something that type of attack right now
is is very much i feel like ransomware
in 2005. it's a consumer thing we're not
taking it seriously when we've really
reduced the attack service to i want to
compromise you i need to compromise your
computer and other things we're going to
see a very big increase
in those types of attacks i believe so
therefore we need to look at more than
just is this the computer we look at the
the os version the browser version we
need to look at what is the state of
that device uh we need to make sure it's
not jailbroken or infected those sort of
things
right away we're into another problem
don't we because
if we've got a device workforce so we've
got union rules if we've got
um
any number of different things depending
on the culture they're gonna be like
yeah no you're not putting anything on
my box or no that's my personal device
if you wanna do that provide me a
corporate device and the cfo's going no
no we're not we're not buying computers
and phones for everybody you're like but
he won't do it like we'll figure out
another way so we are we're gonna run
some issues with this and there's some
different ways to do it like mdm light
and looking at user agent strings and
different different ways to think about
it
all right that is like that is the hard
fast rules right this is the yes no
answers that is the the yes you're
infected or no you're not affected let's
talk next about some of the more
exciting stuff um first i want to go
back to this guy
ibm 1794. i told you there's two
interesting things about right one was
very first password and password preach
second thing was
hal
right the hell 9000 arthur c clarke the
end of space odyssey with all the weird
music at the very end but not the very
end
at the very middle of the very end
hal starts singing as he's being
unplugged and seeing daisy if you guys
remember this this is weird right why
would he be singing daisy that is
ridiculous and i have wondered for every
single minute of every single day since
i found the answer of why that was and
here's the answer the ibm
1794 was the first computer to sing they
taught us thing daisy arthur c clarke
was touring an ibm plant and they made
it sing daisy that is fantastic and they
took ibm and added a couple letters to
hell and had it sync
we've been thinking about smart
computers for a long time but we thought
that we'd be all passwords by now and we
thought by 2001 we'd have half
or at least at least if you're like a
jetsons fan like if you love the gucci
style of the 60s you thought maybe i'd
have at least a rosie right i had this
sassy robot made that would cook for me
and push around the vacuum
so i priced it out
it was like 600 thousand dollars i was
like trying to figure out what it would
take to have like a rosie um and i'm
like yeah and then we could have like a
robot that would push her on a vacuum
and my wife's like
or we could buy a vacuum that just
pushes around itself
okay that's like six hundred dollars
maybe 200 if you get it on sale fine so
a lot of what happens with ai and ml is
it gets hyped up because we think it's
going to be how we think it's going to
be rosy we think it's going to be
amazing we think it's going to solve all
the problems and it won't and it doesn't
and that's stupid what is smart is to
use it where it makes sense where it's
something like a rosie or where it makes
sense where it's doing something very
very well known like again back to
alyssa's talk with the fakes or finding
slide images we were like hey show me
cake and it's like here's all the things
that are cake and you're like
most of those are cakes some of those
are sushi
but that's okay it's good enough
one's a cupcake i don't know i'll think
about it it might be in the bun so
when we use ai that way it makes a lot
of sense when we use data to sort of
figure out
when an attacker is being successful or
not i think that makes sense
um
when we
apply to security we oftentimes run into
these problems where there's high
variability in normal use and attacks
i'm going to look at ai across
everything and use ueba and tell me when
people are abnormal and the little poor
little bot looks and goes everything's
abnormal and then we freak out we block
everything and then
for some reason people get mad
it's much better using these models i
believe to look for very very specific
things i'm very pro aiml when it's
things like tell me when a computer is
doing something weird tell me when
something is abnormal
tell me when
you know
impossible travel or the browser's
changed or it's not even a browser i
thought it was jane at home and it's a
computer from
russia with a headless browser logging
into the bank account that should
probably be stopped and we can see that
very easily with a roomba
so if you think about the pyramid of
pain it's really trying to use
those hard and fast rules to weed out
what we know is bad early on
early on and using the ml
really after that after we removed a lot
of the noise
to highlight any sort of patterns that
may be popping up
because looking at this trying to figure
it out it's just not going to work
especially if you're getting like 10 000
alerts a day which a lot of socks are as
we know
it's much better to run it through get
some contextual awareness and highlight
what those problems are so good data
models
after the rules is really important in
terms of increasing that trust
roomba's not rosie's
purpose build ai
so we've increased the trust by looking
at the device
authentication recognizing that someone
can steal a certain certain go bad or
anything
we've increased the trust by looking at
the state recognizing yes someone may
bypass that or be a good attacker have
some custom malware or all that sort of
stuff
and then we've got some residual risk
that will reduce by running that through
some data science
against a good model against a level of
set of data with some known bad
signatures to go ahead and pop up things
and then block that connection all that
that sort of increased trust side i
think is incredibly important part of
this conversation why again because we
can't trust any factors certainly not
passwords
all right once we're in there
we're going to move everything to
passwordless why not
pick our individual use cases
get rid of the passwords
and use the controls i mentioned earlier
to increase that trust
better devices
for smarter enclaves behavior analytics
running our policies all those sort of
things
because now we're saying i'm not just
trusting
a single factor
to authenticate you i'm trusting a
multitude of different signals to make
sure you really are you and and i
recognize and build my system such that
if you're not you
if there is fraud and there will be and
it will happen that it's a manageable
amount of raw that we can act on and
respond to in a reasonable way
and then we just cycle that again and
again and again in the spring fashion
now
one concern about this is okay that's
cool
um
so i'm gonna do that for my desktops i'm
gonna do that for my phones
do that for my call center i'm gonna do
that for these web apps over there i'm
building something over here i'll do
that for over there i've got customer
use cases i got some b2b use cases
and next thing you know you got like a
dozen different applications and a bunch
of different ways for things to be
misconfigured and broke can go wrong so
another part of that of course is making
sure that as we're stacking this on from
a defense and depth perspective we're
still thinking about economy a mechanism
which is not having a million and one
tools
i love this stat this is from
2019
which was that the more vendors were
used the longer people were down it went
up to uh 17 hours with 50 tools i want
to be the team with 50 tools
don't want to be the team down for 17
hours and first might tell them this is
so weird but then i remembered i had
this outage um
when i was with financial services and i
brought all my team together like fix
this
guest boss i wish that's how it happened
what a real one is what the hell is
going on they're like we don't know i'm
like go and figure it out and so they
all ran to their own consoles and uh i
gave them like i don't know an hour hour
later everyone comes back and the
networking guy like what is it it's like
it's a networking problem i'm like i
knew it
probably dns
ask the server guy i'm like what is the
problem because it's our virtualization
stack the cpu and the memory is
everything like i knew it
should have never virtualized
everything just kept on ibm 1794 we
won't be having these problems right now
and
every single person i swear to you
blamed their stack it was the network it
was the storage it was the compute the
security guy was cheryl's the russians
it was no one could give me a good
answer and so we actually had to get go
back through and figure it out and i
believe this because when we got to that
many tools every single tool is giving
you a different answer and it's just a
complete mess to do higher in the space
so
taking all this
and continuing to federate it out and
moving into more of a passive estate
and integrating the technology so we can
get better results
security outcomes study is a study done
by scientia
in in partnership with cisco
and uh one of the things that they found
was that 41
of companies with highly integrated
systems
reported i'm sorry
let me say that again
organizations with highly integrated
systems reported 41
more
likely
to
have threat detection if something
happened they were more than twice as
likely than their peer group to be able
to find out what happened and
all of it and everything so we've got to
integrate that technology
all right i'm going to conclude
i'll open it for questions
they will
i don't know stop the recording or start
the recording i don't know how that part
works and then i'll start the next part
of this talk
but in conclusion
right
one of the things that i think is very
risky about passer-less has to do
with functional fixedness has to do with
the fact that as a species we're very
bad at recognizing something new
if we're talking about pastorless
authentication we're already defining it
as i'm going to get rid of the password
okay that's cool that's cool
i'm from detroit drove to chicago
yesterday drove to milwaukee today
and uh in detroit 100 years ago what was
high tech
it was the hearthless carriage it was a
carriage without a horse guys this is
great we're going to get rid of the
big horse it'll be awesome
but that entire framing belied all the
increases and comfort and safety and the
changes in our society let me go and one
day to milwaukee to cyphercon right the
horse's carriage is so antiquated now
but yet that's how we think about
pastor's authentication and of course
we've learned our our lesson in in the
automotive we don't ever do the same
mistake again
not going to touch driverless cars this
is just a problem we have right we
always define an innovation by what it's
not so first thing is as we move to
passwordless as we finally as a security
function have something that can provide
a user benefit we have to think about
what do we ask what do they owe us what
can we use this moment in time for to
increase to change to refactor because
we know the bad guys don't stop
as a matter of fact every single
time over the past six decades that
we've stopped we fixed this
right i was talking about hashes earlier
every time we've come up with a better
hashing algorithm
the criminals have defeated it right we
move the criminals move we make another
the criminals make another
and too many controls get put in with
the idea that this
this is the one
i will do caspy and no one will ever
copy and paste again
okay we're just not gonna use your casby
check mate i mean you know
everyone thinks we'll put this
controller and this will be the end but
we should know by now we should
recognize that every time we do
the criminal takes a step forward
everything we do include improves the
the strength of the criminal
so what do we need to do next
um
in terms of street cred in terms of
credentials we have some patches and
some fixes and some things to do
immediately to shore up passwords and
multi-factor we've got to do that we've
got to get more folks on the
multi-factor more folks uh recognizing
that passwords aren't doing it we've got
to put in place better controls when the
multi-factor starts getting attacked
more
all that needs to happen meantime things
like pass or less 502 and whatnot great
for doing pilot programs great for
exploring especially if you're building
an application if anyone in here is in
sas
please support saml and finally support
502 so that we can use this and we can
get off of it
we need to tie our authentication
changes to broader initiatives i like
passwordless as like a user business
case for xero trust or user business
aspect of digital modernization those
sort of things
and along that same lines we need to
take steps to increase trust and
authentication because we know the
adversaries are just going to try and
find ways to work around it
all right
questions
[Music]
yes sir
how have you had conversations
individuals
i heard the first part of that how do i
have what conversations have i had with
users that
because of fourth and fifth amendments
that is another really good example of
what happens so
um
this happens a lot in international
travel i travel internationally i won't
use biometrics on my phone because it's
been the passwords are protected
but i can make the as a police officer
it can make you look at the phone and
now i'm into your devices
so that is a very good thing so one of
the things we can talk about there is
maybe you still have a pin or maybe
yourself something to to provide it or
conversely
maybe you take additional steps like
disabling past or less when you're
traveling or in those situations
similarly we're starting to see a
tiering of security by location my home
office is safe-ish
my corporate office is safe-ish
everywhere else is not
so that's sort of like thinking through
the emotions in different places can
influence that but you're spot on if
if i'm being asked hey
do everything with biometric but yet i
know that someone can force me to do
things i'm going to be very leery with
biometric
touch key is another thing like uh um
keys and things like that would probably
be what i would be pointing people do as
well
yes sir
um privacy uh
the club
so how do you ask them sorry uh this
slide the slide talking about kind of
the future of passwordless uh
it looked like a data set that could be
mined what what are some things that can
uh can mitigate that challenge
so schneier once said that security is
both actual security and perception of
security
so i'm going to address actual security
and then i'm going to tell you why none
of it matters because of perception
one of the things i like about 502 and i
like about these standards is that that
biometric data and that privacy style
data is stored on your device especially
if it's your phone or your personal
device it doesn't leave your device it's
not centralized the only thing that
leaves your device is a derived key so i
use the biometric to unlock my phone and
my phone then has a
key pairing with the application
so i don't necessarily have
privacy concerns now you may say well
wait a minute but the application will
know who you are and i'll say yes it
will but you've logged into the
application so you decided at that point
in time to give up some anonymity
now
all that
is true
but the perception is big brother is
stealing all your passwords and all your
faces and all your fingerprints and i
now have them the reality is is that a
lot of organizations are still running
in corporate culture we're like i don't
trust you to use biometric
i don't trust you at all and you know
frankly i think security people and i.t
people have shot ourselves in the foot
over the past couple decades and there
are reasons that perhaps they should
trust us so there is a technological
answer which we can do immediately
and there is a cultural answer which is
going to be a much longer haul
any other
questions sweet yeah thank you
[Applause]
okay
[Music]
you