![\"identiverse](\"https:\/\/solutionsreview.com\/identity-management\/files\/2018\/02\/idv2018.jpg\")
<\/p>\n<\/p>\n
Identiverse<\/a> (formerly the Cloud Identity Summit) will be in Boston, MA, June 24-27 and promises to be the biggest identity event of the year<\/a>! Subjects ranging across the identity security spectrum will be covered in detail in the in-depth presentations, sessions, and fascinating keynotes. <\/span><\/p>\n But what is the current state of identity security? What are the problems facing identity and access management controls? To get a perspective on these issues, we spoke with Richard Bird. Richard is the Client Director of Optiv<\/a>, Inc., and is a former CISO and CIO. He\u2019s an expert in risk management and insider threats. \u00a0<\/span><\/p>\n The following is the partial transcript of our conversation, edited for readability and length. You can read part 2 here<\/a>:<\/span><\/p>\n Ben Canner:<\/b> Today we\u2019re talking about identity security, and how it relates to Identiverse<\/a> (formerly the Cloud Identity Summit). My question to start off with is: where do you see identity and security going in the future<\/a>? And how is that going to be reflected in Identiverse\u2019s content\u2014the sessions, the keynotes, etc.? <\/span><\/p>\n Richard Bird: <\/b>There is starting to finally be a realization that if you don\u2019t get identity right, you\u2019re wasting all your money on your other cybersecurity. Every breach and exploit has shown that, but you still see companies neglect their identity controls and access administration. <\/span><\/p>\n As a brief example: when I took my first identity job, my CIO said \u201cCongratulations! You have the easiest job in the world!\u201d <\/span><\/p>\n I asked him what he meant. He said, \u201cWell, it\u2019s just giving people access. How hard can that be?\u201d <\/span><\/p>\n We\u2019re starting to see some changes there. The keynotes we\u2019ll see this year at Identiverse will really bring focus back to the basics of foundational identity control; the idea that if people are failing to enact basic controls, it doesn\u2019t matter how many flashy cybersecurity solutions you buy. <\/span><\/p>\n One of the things I\u2019ll be speaking about concerns bad actors beating us. Corporations are spending more and more on cybersecurity solutions. But hackers are not hacking us with more expensive tools. They\u2019re hacking us on social engineering, they\u2019re hacking us on people. They\u2019re not spending any extra money. We are. And they\u2019re still beating us. \u00a0<\/span><\/p>\n And it has to come back to the realization that we\u2019re not giving identity the attention due. <\/span><\/p>\n Ben Canner: <\/b>How are we not getting identity<\/a> right? You mentioned the corporate culture issue at play here. Is that the core of it? Or is there something else preventing us from recognizing how important identity is in security? \u00a0\u00a0<\/span><\/p>\n Richard Bird<\/b>: There are so many different layers to this problem. <\/span><\/p>\n First off, there\u2019s the history of access. For a very long time\u2014going back to the 60s and 70s\u2014access was an administration function because it operated in isolation. Mainframes were not connected. There were no direct paths. Servers operated in isolation. Then the internet and e-commerce arrived, but that wasn\u2019t the real gamechanger. Instead, it was exponential technology that sprang from it that basically invalidated all other security measures. <\/span><\/p>\n During a conversation I had the other day, someone said to me, \u201cwe\u2019re spending hundreds and hundreds and hundreds still on firewall technology. Where does the firewall work now? What is the perimeter?\u201d Well, now there is no perimeter. You\u2019re gauging the activities of people that are in secondary, tertiary, IT supplier positions all at once. And that\u2019s fostering all these complications, but we haven\u2019t changed access administration. Instead, we keep going \u201chey, give them access.\u201d \u00a0<\/span><\/p>\n There\u2019s one undeniable fact about business in general\u2014and there are varying degrees of this based upon their culture, history, construction across the countries, etc.\u2014but still to this day the vast majority of companies\u2019 business leaders look at their situation and say \u201cWell you know what? My employees do their jobs. Why would I install security controls? I trust them.\u201d That last part is the killer. \u00a0<\/span><\/p>\n I have this conversation a lot. Trust and hope do not affect security situation. They just don\u2019t. <\/span><\/p>\n The hackers will go immediately to age-obsolete integrated credentials that are sitting on all kinds of corporate systems and they aggregate them to do of their bidding. \u201cJoe\u201d working in such-and-such an area for the past 20 years is given all this access because he\u2019s a great guy. \u00a0We trust him so we didn\u2019t delete all of his accounts. 5 years later, the hackers are able to acquire those accounts. <\/span><\/p>\n We need to be open to other models of secure authorization. Companies try to buy security and everyone screams at them about overhead, client impact, customer impact, employees, etc. In no other place do we make this kind of argument except the digital realm. <\/span><\/p>\n When the cop pulls us over for speeding we don\u2019t say: \u201cyou know, I really have somewhere to be for work. And even though I\u2019ve paid attention that sign for the past ten years, it was really inconvenient this time.\u201d It just doesn\u2019t work that way in the analog world. We don\u2019t have the same kind of efficiency expectations anywhere but in the digital realm. \u00a0<\/span><\/p>\n Ben Canner<\/b>: Is there a compromise for those needs? You mentioned the analogy of the speeding ticket but is there another way we can go about identity to bring the two values of productivity and identity security together? Or is that question reflecting the same culture\u2014of productivity trumping identity security\u2014that is part of the problem you highlighted? <\/span><\/p>\n Richard Bird<\/b>: I\u2019m thankful that in my 20 plus years, I didn\u2019t spend all of them in cybersecurity. I came in from project management. I made my way through the IT ranks through that. My focus was really operation of IT and transactional technology. \u00a0\u00a0<\/span><\/p>\n I used to tell people all the time the reason I was a great CISO and a great security practitioner is because I\u2019m a reformed reprobate. I was the lawbreaker. I was the worst lawbreaker of identity back when I dealt with the production side. The work had to get done. I used to make the same arguments. <\/span><\/p>\n It\u2019s a really interesting problem because when you look at cybersecurity solutions providers today, you\u2019re looking at companies that are making what they believe customers need…without any research into what customers want. \u00a0<\/span><\/p>\n Think about the overhead created either by a security solutions\u2019 processes that require X amount of additional steps for a job. The security solution providers say, \u201cI\u2019m going to give you what you need to secure your environment.\u201d And the buyer says, \u201cthat\u2019s great! But I need you to get me what I want: just a solution that provides this level of security and does not impact my business processes, my customers, or my employees.\u201d<\/span><\/p>\n The problem is a huge number of solution providers, frankly, have never sat in an operations seat before a day in their life. One of my favorite statements is \u201cdon\u2019t tell me you\u2019re going to come in here and solve all my problems because you\u2019re a mercenary.\u201d Applied here, this means that there is a disconnect between the implementation and management of an identity security. <\/span><\/p>\n Companies\u2019 personnel have to run the solution, have to manage it, and in reality not enough security providers\u2014almost none\u2014have ever sat in the seat of having to see all the outcomes and impacts that would cause them to modify their solutions and create better compromises to solve business problems <\/span><\/p>\n They look at security problems. They aren\u2019t solving business problems. That\u2019s the gap. <\/span><\/p>\n Thanks again to Richard Bird of Optiv for his time and expertise! You can read part 2 of our interview on identity security here<\/a>. <\/span><\/i><\/p>\n\t\t\t![\"IAM](\"https:\/\/solutionsreview.com\/identity-management\/files\/2021\/02\/Identity_Suggestion_Engine_Horiz_800.gif\" "\\"\\"")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n