You've got to begin to get your arms around the importance of identity as a fundamental control point, a fundamental lens for understanding security in the organization. It's not to the exclusion of others. You still need firewalls. You still need network security. You still need device security, but you also need identity security. You also need to understand the access privileges and how those map to data and how that either leaves your data protected or exposed.
This is KBcast as a primary target for ransomware campaigns, security and testing and performance risk compat.
Joining me in person is Mark Mcclain, chief executive officer and founder from SailPoint. And today we're discussing driving business momentum with identity as the accelerant. So Mark, lovely to meet you and welcome.
Thank you, Chris. Nice to meet you as well.
So you've been in the game for a while, 35 years and change. Maybe let's start with your view then on the industry and then, you know, what are you sort of seeing now after leaving the US, coming to Australia? Is there anything that sort of stands out for you?
It's a fascinating, you know, it's been a fascinating journey, Chris. I think in many ways identity wasn't even thought of as its own unique space when I first got into this marketplace, and it was more about kind of users, how did users access systems. With the term we used to literally use, the term user management. And I always like to say, by the way, the only two fields in the world where we refer to users are IT and drugs, and that doesn't seem like a good thing, but anyways, we'll leave that for another day. But when you get down to it, identity has transformed in many ways as an important dialogue, particularly in the realm of security, partly because of other fundamental shifts in technology. And the big ones we're all quite familiar with, right, as the rise of the internet to web and now cloud-based computing, mobile computing, it shifted so much of the core structure of the IT industry. When I got in this industry a long time ago, right, big important customers had all their important data and applications on their own proprietary mainframe, running over their own proprietary network to desktops, really at the time terminals that they controlled, right? So, if you think about it, they owned and controlled that entire technology value chain. So, while they cared about the users that were on that value chain using that technology, they didn't really worry about it because it was such a protected path, if you will, right? And over time, what's happened is now in a typical large enterprise, the applications they run are in the cloud. Maybe they control them. Likely they don't because they're from a SaaS vendor. The internet they're running over is the big internet that everybody shares, and the device that's being used to access it is or is not belonging to the company. It's probably a personal device. So, one of the things that's emerged out of that is identity has become kind of the common factor that links that person, or increasingly that non-human entity, to that organization and its important data. And I think if you think about it, that's been the rise of the focus on identity. That plus the attackers have figured out it's their most lucrative and fruitful area of attack. So because it's the place where we can kind of most retain a sense of who is actually accessing the data this organization cares about, and the attackers have figured out if I can compromise identity, I get access to that data. It's put all this focus on it from a security and business value standpoint. And then real quickly at the end, you asked about Australia. I would say thus far in my exposure to the Australian market, I really don't see a lot of uniqueness, and that's actually a good thing. What I mean is I think the Australian government, the Australian business community is looking at this problem pretty similarly to the way large organizations and governments are looking at it everywhere, right? They're trying to control and protect identity and access to data. There's a lot of regulatory backdrop to all of this. And so I think we can kind of talk about various things that are happening globally, and I think it's going to pretty easily map to what I'm seeing in Australia as well.
So over the years, have you, was there any sort of pivotal moment that identities had a big shift? Is there anything that sort of stands out, and do you think we're going through something similar at the moment? Again.
Good question, the second part of that particularly. The first part I'd say there were a few along the way, and I'll date myself a bit. Some of these are older stories, but there was a famous internal breach of a big French bank called Société Générale, which I can't do French very well, but SocGen was the way all of the Americans refer to that. And it was this famous story of an unusual circumstance where a guy had been in the technology organization, had migrated to being an actual trader banker, but still retained access privileges that he used to have in his old job. He started to go rogue. He started to make some risky bets. He started to do things that were not working out well financially, and because he had inappropriate access, he was able to cover his tracks for a long time, and ultimately this thing was hidden for far too long. And then when it was exposed, it literally almost ruined the bank. It was like a $7 billion loss to the bank, and he was able to kind of protect himself from discovery because of poor identity and access management. That was probably one of the first big stories in like the late 2000s, probably that was an '09, '10, somewhere in that range story. The next big one I think, and I know this was in the US, but I think it rippled around the world. There was a significant breach at Target, the big retailer, and ultimately that cost the CISO and the CIO and the CEO their jobs because it was such a clear failure to protect the organization's information. I'd say those were two of the most seminal shifts that kind of highlighted the security risk related to identity and access. Honestly, Chris, the other has been the pandemic and the ripple effects from the pandemic. Because when we suddenly and drastically shoved everybody out of their offices and told them to go work from home, a lot of the protections that security organizations had put in place became not relevant because they assumed you were working from an office on equipment that they had vetted and were sure was protected. And all of a sudden, you're going home, logging in from your kid's laptop, trying to access the corporate systems. And guess what? That wasn't as protected. And all of a sudden, we saw a lot of bad behavior from the evil guys, and just awareness, even if there wasn't a breach or bad behavior, the security professionals literally, I feel like, all around the world woke up and went, 'This is bad. This is not good.' That all these people are now accessing important data from systems we don't understand necessarily or control, and we cannot see, i.e., we don't have the visibility to understand what exactly they're doing. And everybody quickly understood that's risk, that represents significant risk, and that it wasn't a point in time. Chris, I think the last thing I'd point to is the rise of phishing, right? Like clearly the bad guys have figured out that is one of their best attack vectors because ultimately of bad IAM practices. If I can phish you and get you to give me a credential that may not be that important, but like so many people, you use that same password at home for Facebook that you do at work for a bunch of important systems. There's this concept of a blast radius, which is a newer concept in identity. If I compromise this credential, how broad is the blast radius? What kind of damage can I do? And it turns out quite often the blast radius is very large because there's poor practices and people aren't protecting unique authentication methods. And all of a sudden, I compromised you here. Now I can leverage that in a completely different environment and do a lot of damage. So I think those are some of the key points along this journey that have woken everyone up. Is there something, your last part of your question was, is there something today? I think it's this continued rise of the focus on phishing as an attack vector, on identity effectively as an attack vector, and the recognition in large corporations that they are not well prepared to fight this. They don't have the right technology and the visibility to understand who exactly has the right access to the data they care about, and is it well managed and protected.
I want to come back to that point you made, but just before that, you said going rogue. I've been reading a lot of articles lately of a lot of insider threats. Do you think from your experience that we are starting to see more people going rogue now? I think the impetus for this person doing this was because they didn't get a pay rise with all, you know, how much things are going up and the cost of living, and the person went rogue. Do you think that will start to creep in more? Because obviously we want to trust our employees. Of course, you get the occasional rogue player, but will that become more prevalent, would you say, moving forward?
I think it's a great observation. My sense is it will become slightly more prevalent. It will still be dwarfed by compromised identities by bad actors. So today when we use the term insider threat, we sort of have incorporated not only a true insider going rogue, or we used to say sometimes they do something intentionally wrong, quite often they do something unintentionally wrong and break something or accidental deletion of data, whatever. But we kind of today in that umbrella term insider threat wrap in what appears to be an insider which might actually be an outsider, right? Someone's gotten inside, compromised credentials, and now they are behaving as an insider doing bad things. The famous case on this one that we mostly everyone's familiar with, even though it was also a US story, was Edward Snowden, right? Who as a valid military employee had a lot of powerful access and abused that access privilege and did a bunch of bad stuff with that data. Those stories make the headlines and they can be quite disturbing. But from our sense and somewhat data, we have some data on this, we probably don't have full visibility on this. Far more compromises and breaches happen by fake insiders than real insiders going rogue. But I think you're right. Tough economic conditions, organized crime is a bigger factor than it used to be. When I'm a run-of-the-mill employee making moderate income and I get a call from somebody who says, 'Hey, here's $20,000 to give me a key password,' they might consider that. And so you see kind of crime as another factor in this as well.
Yeah. I guess because of just everything that's happening now, it's more enticing for someone. They're not making what they want, a little bit more. It could be a driving factor. But going maybe back towards the compromised credentials. Interesting thing about that is just say I'm the accidental employee and I didn't mean to click on something, a phishing link, compromise the credentials, and then the security team get an alert and say, 'Hey, Chris is dodgy, she's gone rogue.' What then happens? Because obviously you've got to quarantine that person to make sure that they wasn't a, was it an accidental rogue person or was it intentional? How does that then play out? Because that's going to be pretty awkward if I'm getting accused of doing something which was unintentional. So how fast do you sort of see that scenario playing out now?
You're at the crux of some of the most painful parts of this arena, which is on the one hand the trend toward digital transformation and rapid evolution of technology says make it as fast and easy to do things as possible, and then good security says slow down and be careful. Those things are clearly in conflict. So to your point, one of the things that's difficult about this space today is when a security operations center, network operations center sees what appears to be some bad things happening, data being exfiltrated on the network, they're pretty hesitant to just say, 'Shut that down.' Because they don't always know if that's actually a valid actor just doing something unusual, downloading a lot of data for an upcoming meeting or report, or is it a bad actor exporting data in an unhealthy way? And so the downside risk of cutting off access and realizing you just cut off the CFO who's now very angry at you and might fire you causes many people to say, 'I will raise a flag to say that doesn't look good, but I'm not stopping it immediately.' So one of the tensions we have today is that tension. Another, what you just said in your example is, okay, so maybe I really do figure out someone who appears to be Chris seems to be doing something bad. So I'd like to put a stop to that right away. Here's one of the big challenges today. Without good visibility, what we consider the rudiments of our space, which is do you understand everything Chris has access to at any point in time, back to our blast radius point, even if I can shut you down right now because I see you doing something bad, and maybe it's not you, it appears to be you doing something bad on one system, what I really ought to do is simultaneously shut down every access you have just in case you have been compromised. But to do that, I have to know everything you have, and I have to have it kept in one consistent place. That doesn't exist for almost every large organization in the world. There is no single data point in the organization that says, here's Chris. Here's what she does for our organization. She could be an employee. She could be a contractor. She could be an external third party. She could be a non-human identity who's just a program. Right? And ideally I'd like to have in one place every connection point, every data access that you have, so that if I believe you've been compromised, I can either flag it at least and maybe at most just shut it down, cut it off until I can go do some forensics and understand how bad this is, right? That's almost impossible for most large organizations because they don't have that visibility. They don't have a single repository of all the identities they care about and all the access those identities have. That's one of the things that people are freaking out about today in our space is I don't even have that data. So I can't take action to say Chris appears to have been compromised. I better shut down everything she has access to.
So going back to the point of Chris looks suspicious, if she's not, it gets flagged. But then what about that lead time? That could be days, weeks, hours. What if it actually was compromised credentials gets flagged? No one does anything though. Starts to obviously move laterally then throughout the organization. What happens then?
Breaches happen and data gets stolen and people pay. That's what we're all reading about today, right? That is what happens because we aren't currently equipped well with tooling and processes to identify those things quickly, understand the connection points, and ideally shut them down, which is why we have some of the problems we have today. But these are the things we have to get better and better at in the security landscape. One of the big ones, Chris, I know you have a security background, is quite often many of the security tools are what we call identity blind, right? They're network monitoring tools. There's device monitoring tools. Think of vendors like Palo Alto and CrowdStrike and other really competent, great vendors in the realm of security, but quite often they see something that doesn't look right or they see a behavior or something that concerns them. They usually can only connect that to an IP address, a MAC address of a system. They don't know who is doing that, and without that knowledge of who, they are also kind of unsure what to do other than to flag it and escalate it up into a security operations center somewhere, say this doesn't look good, you should figure out what's happening here. And again, most CISOs will say that's when they quickly have to try to map, I guess that's the right term here, map this what appears to be a security problem over to an identity to figure out what exactly is this and do I have a problem right now or do I not.
Would your advice be, so I get flagged for being suspicious, get a human to look at it, but then that depends on lead time. Maybe the guy that looks at it's away on a holiday. You're not going to, you know, how does that all then work? Because you don't know what you know in terms of volatility of the person or potential person you're dealing with or issues. So how does that sort of look then? Because isn't that when, if that lead time is too slow, not long enough to do proper forensics, then you've got a problem. How are people addressing that from your perspective?
Well, you said it, and all kidding aside, I think this is one of the many areas, and there are many, that security vendors in general, SailPoint particularly, other identity vendors are looking at to leverage some of these emerging technologies to do a lot of pattern recognition with large language models that can process reams and reams of data and say, 'Okay, that thing that looked like it might have been Chris, you know, going rogue, well, I've now got maybe patterns over months of your behavior, other people in your similar job roles, behavior, and if I can go look, I'll just make this up. Instead of you being security, you're a financial analyst and you're downloading a bunch of data. Huh, it's the end of the quarter and everybody in your group is downloading a bunch of data because they're preparing financial reporting, right?' You could start to see how the intelligence of understanding patterns of access, patterns of data movement, mapping that against something that maybe a network tool says, 'Hey, this looks like it's a problem.' And somebody and the AI tool could say, 'No, it's not. This is a normal thing.' Another example we used to use all the time, say if you see a bunch of data getting downloaded from a laptop in the middle of the night in China, you might be nervous unless you also had the data that the CFO was on a business trip in Shanghai and it was his laptop, and you'd say that's probably legitimately the CFO. But today, good luck mapping those two pieces of data, right? They're existent. You could literally tap his calendar and tap the data system and tap the network security tool. Just think of the intelligence that kind of potentially exists out there to do things like that. We have nowhere near that today. But you scale, and just those systems aren't all tied together in any typical enterprise. Do you know anybody who ties in Outlook calendar information into security breaches? I don't. But I believe we're going to get to things like that in the not too distant future. So we can start to say how many pieces of information do I have that I can map against this real-time activity that I'm seeing and see if that actually looks like it might be a problem or maybe it's not a problem. I think we're going to get better and better at real time because you started with how long does this go undetected or once it is detected, how long before I take action and what action do I take? I think we're... that's the gap where bad things can happen.
Start things then, I also understand to be like, well, we don't know, we got to take an educated guess. Maybe the person, you know, someone's not there that day and they've missed it, and then we got a problem. But then also I understand that AI is not going to solve world hunger either. So therefore, how does all that work? There still has to be a little bit of gray there.
Yeah, we're still always going to have AI. You know, we've all seen some of these writings, the term augmented intelligence is out there as well as another unpacking of the acronym from artificial. I love that term because I think in many cases that's what we're actually going to see. We're going to see the system and all its data gathering and data analyzing capabilities using AI concepts and machine learning to quickly identify things that could be problematic or look anomalous or whatever. But then we'll probably in many cases insert real intelligent humans who know how to map something or they have some context that maybe the systems haven't yet been made aware of yet. That I think in many cases we'll still see the technology used to escalate and gather more intelligence very rapidly, but not necessarily to make an unaided decision. We still may want to pull a human with great levels of expertise who knows this business well to say, 'Oh, I know what's happening.' Right? Because it's going to be a while before the systems can mimic all the intelligence that a team has that's been working in that organization for years and knows the business cycle, for instance, of that organization. So I think AI is going to solve a lot of problems. We're very bullish on how much AI will accelerate and help us in this arena, but very seriously we don't think, oh, AI is going to solve it all in the next five or ten years. It's not.
Sure, that's fair enough. And then just quickly, as I'm talking to you, Mark, what about privileged account management? Like going back to what level of access people have. I've experienced this myself working in a large enterprise. You get a random email from someone in identity access management saying, 'Hey, you have like very high access for this system. Why is that?' You put a whole business case together about why you have it. How do people handle that? If you've got like 50,000 people and people need certain credentials, people move, get fired, they get demoted, promoted. How does someone handle all of that?
I think we're going to see somewhat of a shift. You asked about trends, and this is one of the ones we think is going to be a bit of a trend. Historically, the way this industry evolved, like privilege became its own specialized area of the technology, right? There was kind of general IAM, identity and access management, all users, all applications and data. And then there was sort of this specialized focus on a set of privileged users. Usually that was things like database administrators or systems administrators, even application administrators who had tremendous power in the technology. So we wanted to be sure we knew exactly who was doing what. That's where things like session recording and, you know, identity vaulting came from. So we could be sure that when Chris logged in as the system admin, I knew it was Chris and I watched every keystroke Chris did so that if something bad happened, I knew exactly where it came from. Right? I think where privilege is headed is going to be far more dynamic than that static. What I mean is, to your point, today we have thought of it traditionally as static. You either are or are not a privileged user on some system. I think where we're going to head over time is privilege will be kind of a, I'll call it a grayscale attribute that can be dialed up or down depending on the person, the system, the data that's being accessed, the context of that access. Right? In an ideal world, back to our CFO example, if you're a financial analyst and you were working in the office on a secure system, secure network, and then COVID hit and I sent you home and you might have logged in from your kid's system, I'd like to escalate the privilege. I'd like to demand greater authentication or higher levels of validation before I let you onto that system because I don't see that I know that laptop. It's not the laptop you usually log in from. So in real time, I would, quote, escalate privilege, right? I think that's just, again, a simple example of privilege as a concept we think is going to be far more dynamic in the coming years. It won't be you are or are not a privileged user or this is or is not a privileged account. It'll be are you in a situation where privileged access is required? And for some systems it will be every time privileged access is required. For many others, I think it'll be contextual, time of day, location, system, other patterns. Again, maybe I have another piece of data that Chris, on a completely different system, appears to be compromised. I'd like to quickly replicate that over and go, 'I'm going to demand a second level of authentication when Chris tries to log in to the Unix server because on Outlook, I think I see some compromise with Chris's account.' Right? Again, today, these are not systems that are even tied together. But if you just think of it as an intelligent security person, you can see where that would be great to know before Chris, or who appears to be Chris, logs in and does this very important thing on a privileged system. If I've seen evidence in some other system that Chris might be compromised, I'd like to quickly map that over here and possibly block it or demand a higher level of authentication. That's where the kinds of things I think we're going to see in privilege. Very real-time, very dynamic, very contextual.
So, just to have this correct, I go home. Then going back to your comment before about dialing up or down. If it's after hours, maybe I'm not allowed to access certain... or maybe you just have to have a second factor of authentication to access that. Maybe you can still access it, but right normally you don't have to give me a thumbprint, but now I want a thumbprint because I want to make sure it's you on the time of the day I'm trying to access it.
That could be a factor. Location could be a factor. The hardware from which you're trying to access it. What if your laptop broke? This might happen all day every day in companies that I know of. Your laptop isn't working. So I get to my iPad, which I don't normally use to access my systems. And I come into the SaaS application, and all of a sudden, the SaaS application goes, 'That looks kind of like Chris, but I'm not used to seeing Chris come from that system. Let me just ask her for another piece of information to verify that it's Chris.' Were you a privileged user at that point, or was I just wanting to verify strongly that it was really you because something was different? I think that's the level of dynamism we're going to see coming.
