Well, Dan, thanks for that intro. And you know, I was thinking about it when I was looking at the agenda. Hey, you're speaking at a non-human identity conference. I likened it to speaking at a buffer overflow conference in 1998 or speaking at a SQL injection conference in 2003. You kind of wish we did those conferences to prepare for what was about to hit us and about to follow in cybersecurity. So, I thank everybody for listening in on this. I look forward to your questions. But I want to begin by just saying cybersecurity's never been more important than right now. And I've been able to say that sentence for about 30 years. And then inside of cybersecurity as a discipline, identity security's never been more important than right now. And then when you go and drill down into identity security, the time is now for non-human identity security. So I'm going to give you a little history first. You know, I started my career at the Pentagon in 1993 doing what we called then computer security. And in reality, what I did was identity. I was a person that would provision accounts for new folks joining the seventh communications group and give them their Unix accounts or give them their mainframe accounts. And at that time frame, we used to just track who had access to what. But it was back in the dumb terminal days, you know, there wasn't a whole lot of people walking around with PCs at the time. But I realized my whole career to some extent has always touched identity security even starting in '93. Responded to my first computer security incident in 1995. And really ever since that day, right up till now, so I guess it's been about 30 years, myself or people I've worked with have responded to breaches figuring out what happened and what to do about it. So today I'm going to share with you some lessons learned during those breaches. But I wanted to give you my conclusion first and then come back to it. And the reason why I say non-human identities have never been more important than now is because we're all living through transitions or transformations to cloud, to AI, to automation, to remote workforces, to SaaS applications, and it's a race. Like all these things are happening at a speed where non-human identities are just proliferating far faster than our ability to hire humans and provision for humans. So, it's never been more important. But I'm going to take you back in time right now and talk about a couple cases and work my way right up to the current threat. You know, the first breach that I ever responded to that was at a global scale was in 1995, in the summer of 1995. And I responded on the West Coast at a university that back then gave us consent to monitor. And get this, ports 21, 23, remote shell, remote login. I forget what ports those were. I think it was 514 and 513. And then ports 21 and 23. So we had FTP. And long story made short, identity then and access then was Telnet, FTP, all in the clear protocols. And that's I'm setting this up to let you know how far we've actually come. Back then, all you had to do to steal a credential is if you get access to a Unix machine, the infamous cat /etc/passwd or cat /etc/shadow, grab the hash and crack them. And I responded to a case in 1995 where the automated security incident measurement logs, or the ASIM logs as we called them, that was a network monitoring capability, libpcap capability developed by the Department of Energy that the Air Force used. We were responding to a log file that showed somebody telnetting into an Air Force base and chaining together between 20 to 30 consecutive valid telnet sessions, meaning somebody was validating user accounts and passphrases. They would telnet into an Air Force base. As soon as they got a command prompt, meaning the telnet worked, they went right into the next one. And already identity, when you were looking at it from an offensive perspective, already there was division of labor by the adversaries. This particular attack in 1995 came straight out of Beijing, straight to a US university. They were using an account from a foreign national from China. They were logging into his account then logging into dozens of military bases every day. They already had the passwords. They already had the accounts, and they had already had division of labor because they weren't doing anything but validating the accounts. And then later a different individual would come in and do operations. Literally 1995. Fast forward to 1998.
I'm still starting to respond to intrusions now with a team as a consultant, not as law enforcement. And we were recognizing the importance of identity security because all lateral movement, every time we saw lateral movement after initial access, it was the credential theft. It was basically lateral movement with stolen credentials, and the provisioning of identity was always handled by an IT staff that was far less familiar with the security threats and what they were up against than the security staff of the day. We had tools like John the Ripper out there, Cain and Abel, L0phtCrack, Hydra, pwdump, samdump. And back then, all you had to do as an attacker between '98 and, you know, late 2010-ish is get the SAM file, get the NTDS.dit file off the, you know, Active Directory, and the game was over. And later on we had to kind of evolve and deal with Mimikatz when it came out maybe 2010 or 2011. We had to deal with Kerberoasting attacks, pass-the-hash attacks, and all these different things. But where this came into play is from 1998 to approximately 2020 we were writing the same remediation plans all the time. Every time we responded to a breach, and over time at my company we were responding to over a thousand security breaches a year, we would recognize our remediation plan had to address three ways into the victim networks. First, we had to address, hey, there might have been a vulnerability on the internet. We got to patch a system and make sure the vulnerabilities are all patched up. B, there's backdoors on all these victim companies. We had to do forensics on the endpoints, find the backdoors, and kind of what we always called it, give them the Mike Tyson uppercut. We had to go dark and pull all the backdoors simultaneously so we didn't have a cascading impact to the remediation where the attacker maintained access. So we take all the backdoors offline. But the third part of the remediation was always the hardest to implement, and that part was the part that addressed all the stolen credentials. And what we had to do in every remediation plan that I kind of read from Mandiant folks for decades was you have to go to a known secure domain because if somebody got to the Active Directory, the domain controller, and took your NTDS file, you had to assume all user accounts and passphrases for both system accounts on there and user accounts. So we had to do what's called migrate to a known secure state, and we had to do that all the time. And we started recommending over the years very few pieces of software, but CyberArk was something, you know, we started doing the password vaulting somewhere around 2008-ish. We'd recommend CyberArk and we'd recommend that migration to known secure domain. Unbelievably complicated, real easy to say in a remediation plan, really hard to do in practice. Then I want to forward to 2020 because I was a CEO at that time at a company called FireEye. And we were compromised by a foreign intelligence service because we were running SolarWinds software that had an implant on it. So I know how frustrating it is firsthand to live through the remediation when you have a breach that compromises your entire identity architecture. We were running an on-premise ADFS server, but we lost our token signing to an intruder when they went straight from the SolarWinds backdoor. They went straight from SolarWinds right to our ADFS server and got our token signing certificate. To the best of my recollection, I remember thinking, well, how the heck did we have an in-the-clear token signing cert on our ADFS server? And I remember going to Microsoft and kind of looking at a website on how do you secure these things, and it was just a dozen steps or more. So I can see why hundreds of companies, if not more than that, had a challenge with securing ADFS. But when we recognized that we had lost our token signing and intruders were accessing various emails without ever touching our identity architecture, we knew we had to do something about it. And the first thing we did kind of is looked at it. What is our identity security management? What are we doing? And when we looked at our human identity, we actually had better than an ad hoc plan. You know, we had Workday that told us who our employees were. Our employees were joiners. They joined the company and got onboarded. They were workers. They needed a certain level of access in Active Directory. And they were leavers. They had to be, you know, offboarded. And we knew how to see a human, monitor a human. We had a SIEM that looked at all human activities. We had hundreds of rules looking for lateral movement of our human identity. We had MFA because it was during COVID and we made sure we bolstered our pipes, had our VPN. We had Duo Mobile on our phones. We had workforce inventory. We had centralized management of it to some extent. I could go to our CIO. And when you look at all this, we could handle the human identity side of things. And you know, we even had what we ended up having, by the way, is human identity compromised by multifactor bypass where the intruder had registered a new phone into our Duo Mobile system. But anyway, I turned our attention at that time in 2020 to what are we doing about the non-human identities? And at that time, FireEye, you know, when they started in really 2004, from 2004 to like 2014, FireEye had a 10-year run of being an appliance company. And like many other companies, they had to transform to cloud. And we are taking our email security, our endpoint security, our intel, all these different software and services that we had to protect our customers, we're putting them in the cloud. And what that created during rapid innovation was an unbelievable amount of service accounts and non-human identity, and they were all stored on our, at the time, our Thycotic Secret Server. I think Delinea owns that now. And I remember going, "Hey, let's take a look at our NHI and let's clean it up." Did we have an inventory? No. Did we have centralized control of non-human identity? Didn't seem like it to me. Did we have logging? Not really. Did we have monitoring? Didn't see it. We had decentralized management. We had R&D teams doing whatever they needed to do to work together to create the most effective security software, but they're doing so in what I would consider an ad hoc fashion. When we went through our Secret Server and we looked at what we had, what I saw was an unbelievable hesitation by the staff to decommission anything. It was, we don't know what's going to happen if we decommission this account or that account. We lacked context. We lacked governance. We lacked planned rotation. These are all things in my opinion we probably did better than I thought we did. You know, I was a cup-half-empty guy at the time when I looked at it. But here's what I would tell you. Everybody did. Every company that we were responding to when we looked at non-human identity and how it was managed and governed, everybody didn't have the inventory, didn't have a way to audit it, didn't have automated governance. And then I'll leave you one other thing I learned during that incident when it comes to the management of identity, that identity is one of, you know, when you think of endpoint security, you have a security team that does it, sometimes the desktop team does it, but sometimes that's not the case. The second thing, when you think of network security, you have network security monitoring and that gets done, but then you get the identity and that's by security professionals, but then you get the identity and it's the IT team doing it, but if it's non-human ID, it's the R&D team doing it and they bowed down to the gods of innovation and speed. So I, as a result of the security breach, looked at the management of identity and actually ended up making the CIO reporting to the CISO, literally made a personnel change because identity security mattered so much at that point. So the identity risk right up to 2020, you know, really were human identities more than anything else. And I would argue the non-human identity really erupts with AWS and Azure and Google Cloud and IBM and Oracle and everybody going to the cloud, but it's really become important now. I want to tell you that since 2020, probably the biggest identity risks, I got four of them and I want to share them with you and they're not all non-human identity, but there's a link here to non-human identity. But first and foremost, looking at the actions of a bold and brazen Scattered Spider, the identity risk number one, in my opinion, still reading our forensic reports, is still human identity compromise via credential theft. And that credential theft is either someone buying, meaning the threat actor is buying the credentials somewhere in a marketplace or based on some access brokers. They're either texting or smishing to get credentials or they're social engineering help desks with very brazen scripts to get help desk to literally provide them credentials to a user account and to bypass multifactor authentication. There are bypassing of multifactor authentication techniques when one-time passphrases are in use. There's SIM swapping and I do not know a fix for the SIM swap. There's push fatigue, there's phishing attacks with redirects to legitimate or copied websites where you can get your one-time passphrase codes and copy them. And again, there's just social engineering or buying access from insiders. And then the last thing that we were victim of is an alternative MFA option because somebody registered a new device. But it's, we're seeing an identity, the initial access phase of a breach is more often than not human identity. In fact, number one, it's actual exploitation now. Then it's human identity. But there's still secrets being exposed out on the internet based on GitHub exposure or some other type of exposure that could allow non-human access. The second biggest risk we see in identity is lateral movement by service accounts and this is by a mile. It's backups that are on every single system. When we look at the propagation of ransomware, the number one account used to propagate ransomware is usually a database backup or a backup account, but it's some kind of service account that runs everywhere and works everywhere. Third risk is just unmanaged resources. There's nothing you can do. If you don't know about a resource, you can't secure it. And then fourth, lateral movement by non-human identities. So it's on the list, but it is the fastest growing risk. And the best example I have of that is the Storm-0558 compromise of Microsoft that happened in May and June of 2023. And then the Cyber Safety Review Board did a great report on it that came out March 20th of 2024. And I recommend everybody listening to this should read that report. And it shows that the threat actor compromised an individual first and found on that individual system a token signing or it was a key that Microsoft had created in 2016. That key could create tokens to access the consumer Outlook web access. But it turns out that stolen key from 2016 allowed a Chinese threat crew, Storm-0558, to mint their own tokens and access the enterprise email applications at Microsoft. So the State Department discovered this intrusion and this is absolutely non-human identity compromise. And they found it using a rule they called the yellow, I think it was called Big Yellow Taxi, and it looked at the mail items accessed and they were monitoring the O365 access and they could see every single email that was accessed after authentication and they saw some anomalies that led to identifying this. So in short, what you saw is Microsoft getting breached and the threat actor is using a Microsoft signing key to issue tokens that it was a key from 2016 that still worked to mint valid tokens in 2023 and the threat actor was using consumer keys to access the enterprise. And if it can happen to Microsoft, it can happen anywhere. You know, when you're really paying attention to this, when you look at what the Cyber Safety Review Board concluded there, they came up with, hey, if you're a cloud service provider with non-human identities, you have to have automated key rotation. And it's amazing how many companies still do that manually. You have to have safe storage of keys in like a hardware security module or at least encrypted in memory as well so that nobody can get access to it. You need stateful token validation. You need a limited scope of the key. Imagine a key that can only access one service or three services and they can't do a whole bunch of activities. And then you need to watermark your token generation somehow so you can easily detect forgeries. And these are things that the CSPs are all transitioning to do. And then when you look at the enterprises, I'll leave you with this. So based on my own experiences and then looking at what CSPs do, I would state enterprises even need to do the basics when it comes to non-human identities. We need a way to reliably discover where is our non-human identity? Where are our secrets? And once we find them, what's the context for them? Like who created them? Why did they create them? That was one of the hardest things for me in my own breach is really trying to find who's the person who owns the non-human identity. It's really hard to find that unless you do great rigor and discipline with your people being trained sometimes. So that when you are creating code and creating in a continuous development cycle cloud-based apps that change all the time, you need to have your R&D folks really tracking what they need when they need it and rotate it accordingly. You need visibility what you have out there. You need the ability to monitor those NHI activities and do detection and response for it and automate the governance as much as possible. And we are right in the middle. And you know, I'm looking at products being created by folks to do these sort of things that literally didn't exist four years ago. You know, when I had to deal with my breach, we looked into any identity security option at the time. And we would have bought anything and we did. We put a lot of people on the challenge. But there just wasn't the awareness yet or even if there was the awareness, there was a lag in the software available to really help. So I'll conclude very quickly and then take some questions. There's no question non-human identity is a growing challenge. It's decentrally managed at many companies still. I've seen polls where companies have asked a whole bunch of CISOs, how do you feel about it? And I'm shocked that some people think, oh, we've got a handle on this. I think when you're multicloud and you're a little bit older and you have hybrid environments and you're porting a lot of things, you probably don't have as much visibility as you think. There's a high volume of use of NHIs. They're hard to govern. It's like herding cats. They're over-permissioned. We know that NHI is going to be the lateral movement vector of the future. It's the lateral movement vector of today once an attacker gets initial access. The threat actors are going to increasingly deploy. They're taking advantage and exploiting NHI or non-human identities. And we're seeing greater cloud capabilities and SaaS understanding by threat actors. So I'll leave you with this. Never been a better time to talk about this issue. It's a great time to try to solve the problems. And ultimately, the best identity security in the future is the ability for an organization to literally get their arms around all human identity, all non-human identity, all third-party identity, all vendor identity, and be able to manage all that risk. And right now, we're still piecemealing a lot of that together. So, with that, Dan, I'll turn it back to you.
