12 Cybersecurity Conversations Spanning Identity, Privilege and the Evolving Landscape

December 28, 2021 CyberArk Blog Team

cybersecurity conversations identity privilege

When this year comes to a close (which is just about a blink away now), cyber crime damages will have cost the world $6 trillion, and ransomware attacks rose 148% during the rush to adapt to a largely remote/distributed workforce for the first time in history. Never has it been more incumbent upon the cybersecurity industry to do more than just try and stay a step ahead.

This year, CyberArk partnered with Cybercrime Magazine on a series of podcasts called “CyberTalk with CyberArk,” with the goal of thinking beyond the next step or the next attack to create systems and philosophies that work in our current reality. Taken as a whole, these conversations provide more than just a glimpse into the minds of the people working to define cybersecurity, apart from just patches and passwords. They reveal an industry that is constantly evolving and innovating, changing how we approach concepts like “identity” and “access” — and working tirelessly to embed security into every phase of project and product development.

With the last of episodes having just rolled out, here’s a look back at 12 conversations from 2021. Hear how members of the CyberArk organization, from Founder and CEO Udi Mokady to Chief Customer Officer Shahar Layani — along with executives from outside the company — view the evolving cybersecurity landscape and what the future may hold.

EPISODE 1: “Why and How Organizations Need to Implement Identity Security, With CyberArk CEO Udi Mokady”

At the top of his conversation, Mokady touches upon a key theme that will carry throughout the series: “Identity is the new perimeter. It is the new battleground.” COVID eradicated the old perimeters, and the idea that identity is solely human quickly became a thing of the past as well. Machine identity is growing, and it’s becoming more and more important to acknowledge that as apps and devices spread out and become integral to our personal and professional lives.

In this grounding episode, Mokady discusses how the notion of Zero Trust was nascent in the earliest days of CyberArk and how cybersecurity has evolved from building walls to developing and sharing best practices, so organizations and individuals can protect what matters most. “Every organization under the sun can be a target because almost every company in some way, shape or form is a software company,” he says. “It’s applicable to all levels and industries.”

EPISODE 2: “Identity Access Management and Ransomware, with Andy Thompson, CyberArk Technical Evangelist”

Understanding the new battleground is the first step, and Technical Evangelist Andy Thompson picks up that ball and runs with it in this episode. Here, the focus is on thinking like an attacker, not just to prevent breaches (which is becoming less and less possible) but also to mitigate their damage by limiting what an attacker can access and where they can go.

Thompson walks us through recent major ransomware attacks and spotlights the primary lesson that connects them all: compromised identity used to gain access to privileged credentials. He shares how he and his CyberArk Labs team pour over millions of past ransomware attacks and how doing so helps them fortify and evolve the team’s proven mitigation techniques.

EPISODE 3: “Cyber Espionage Puts Supply Chains and Infrastructure at Risk, with Lavi Lazarovitz, CyberArk Senior Director of Cyber Research”

Senior Director of Cyber Research Lavi Lazarovitz echoes Mokady’s “every organization under the sun can be a target” comments in Episode One by digging into recent high-profile breaches. Lazarovitz breaks down how attackers use whatever’s needed to get to the code, database and data they’re after — and expresses concern that it’s particularly difficult to monitor and control automatic updates, and emerging technology can be difficult to monitor.

In the end, Lazarovitz suggests that companies can protect themselves by creating visibility. They need to see exactly what’s coming inbound, the level of privileges, what versions of programs are running, what kind of code is being pulled from libraries — as well as the many tools for cloud and container environments.

EPISODE 4: “Why Higher Education Needs a Cybersecurity Program, with CyberArk Senior Director – Public Sector Matt Kenslea”

CyberArk’s Senior Director – Public Sector Matt Kenslea shifts the focus of the series slightly in his podcast conversation by turning to the world of higher education. One of the most surprising takeaways from his episode is the fact that the FBI rates higher education institutions as being at a greater risk of ransomware attack than even financial institutions. Universities are built to be open, to foster sharing and collaboration. Bad actors know how to exploit that.

Kenslea goes on to offer some solutions for privilege and protection for these institutions, and they must include Zero Trust architecture that limits privilege. Schools must see everyone as a potential threat. They need to secure high-value targets with session isolation, lock down common platforms and make sure to give the least privilege for endpoint protection.

EPISODE 5: “What MFA Means for Your Organization, with Shay Nahari, VP of Red Team Services at CyberArk”

One of the key themes emerging from the podcast series has been how individuals and organizations need to find ways to enhance security without slowing their ability to operate or live their daily lives. Enter Shay Nahari with a detailed discussion on Multi-Factor Authentication (MFA).

Nahari digs into the increasing supply chain woes that have been exacerbated by the pandemic, and he explains how companies need to realize they cannot control everything in their supply chains, so they must assume they will get breached.

MFA can help mitigate the risk and alert organizations to malicious activity, but it’s not about prevention; instead, it’s about limitation, he says. Successfully integrated MFA is all about a balance between security and operation.

EPISODE 6: “The Cybersecurity Customer Experience, with CyberArk Chief Customer Officer Shahar Layani”

Security controls are only as good as their adoption, which is stressed by CyberArk CCO Shahar Layani in this installment. He explains the CyberArk Blueprint alluded to by Udi Mokady, which helps organizations and individuals understand their own journeys and how security measures can be implemented and maintained effectively along each step.

In one of the conversation’s most insightful moments, Layani explains how security is a team game, and it’s important for customers to understand that concept from the start.

EPISODE 7: “Cybersecurity Insurance What it Entails and Why It’s Important, with CyberAcuView CEO Mark Camillo”

Despite the dramatic shift in our technological landscape and its immediate impact on our working and personal lives, cybersecurity still isn’t a top-of-mind topic for many people. So, it stands to reason that cyber insurance is even less of a priority. And in this episode, CyberAcuView CEO Mark Camillo is here to talk us through it and why it’s been such a hot industry topic in 2021.

Camillo discusses how the concept of cybersecurity insurance has evolved over the years and how insurers review the cybersecurity measures taken by companies to help prevent attacks as part of their initial assessments. MFA, for example, can help reduce the cost of insurance. Camillo also talks about his belief that we’ll see more partnerships between tech and insurance companies going forward.

EPISODE 8: “Home Networks and Enterprise Security, with Bryan Murphy, Director of Consulting Services and Leader of CyberArk’s Remediation Services”

With decentralized workforces (and IT departments), the new normal must include educating individuals on how to protect their homes and personal devices, as if they are extensions of their offices. Because, says Bryan Murphy, Director of Consulting Services and Leader of CyberArk’s Remediation Services, they are.

Murphy explains how he teaches and trains employees to recognize security threats when working remotely — like being able to spot phishing emails and to be more careful when entering credentials.

He explains his “Back to Basics” as an important approach for security: Don’t assume spam filters will catch all threats; be careful when using outdated equipment, outdated routers and firmware; and use guest networks for friends and family to mitigate some threats while at home. And reset passwords. All of these are simple but effective ways to mitigate attack threats.

EPISODE 9: “Security Issues with Serverless Functions, with CyberArk’s Tal Kandel”

Cloud technology has been adopted by a larger majority than ever before, due to the new ubiquity of working from home. It makes sense, right? Employees need to access their work infrastructure away from the office. But with the convenience and flexibility of the cloud comes, of course, added vulnerabilities and new forms of attack.

Innovation Business Senior Director at CyberArk Tal Kandel explores these challenges in this episode in a discussion that covers the unique particularities of using serverless functions like the cloud and how to manage it to provide security for a remote workforce. Each entity, Kandel explains — whether human or machine — should only be offered the least privilege because any unnecessary entitlements can potentially be abused by malicious motives.

EPISODE 10: “Creating a Cybersecurity Culture, with Highmark Health CISO Omar Khawaja”

Cybersecurity isn’t a piece of software; it’s a lifestyle. Arguable hyperbole aside, Highmark Health CISO Omar Khawaja spends this episode detailing the need for what he refers to as the “human element” in all cybersecurity protocols.

Khawaja explains that, even now, 84% of security issues still involve human beings. Training is hard because people don’t always pay attention to the details of everything they encounter — they’re rushed or maybe not all that cyber-savvy to begin with — and the ultimate goal is to change behavior. Most security programs excel at the things they can do themselves, he says, but the vulnerabilities lie in the human risk factor. As Khawaja goes on to explain, organizational change management principles and tools are the secret sauce to how you can change how humans behave.

EPISODE 11: “The Future of PAM and Identity Security, with CyberArk Senior VP Barak Feldman”

Calling back to the first episode with Udi Mokady, CyberArk Senior Vice President Barak Feldman ponders the shifting landscape of Identity Security in his CyberTalk conversation and discusses how innovation in the security space must be as swift and creative as those seeking to undermine those efforts.

The focus of his discussion, of course, centers around Privileged Access Management (PAM). And Feldman sounds similar refrains to those of Mokady and others in the podcast series: Companies need to assume breach, use a Zero Trust model and utilize MFA and privilege controls. New guidelines from the U.S. and other governments throughout the world in the public sector are creating new and useful guidelines, he says, but CyberArk must always think about the user experience while also considering emerging tech and protection.

EPISODE 12: “Why DevSecOps is Key to Cybersecurity Initiatives, with CyberArk DevSecOps GM Kurt Sand

Who better than CyberArk’s resident DevSecOps evangelist Kurt Sand to, well, evangelize about the need for DevSecOps in robust and dynamic cybersecurity initiatives? Sand explains the importance of integrating security earlier in the production timeline of any program or application and making thinking about security almost second nature — not just for those tasked with overseeing it but with everyone along the production pipeline.

Sand discusses the “Shift Left” idea as a security approach to development — the principle of testing early for bugs and defects is being applied to security because it’s expensive to remediate. Exploring vulnerabilities early on in development will save money and time in the long run. Organizations, Sand says, need to realize DevSecOps is a never-ending process — they need to understand they are building an ongoing program. And it must be made a regular part of their ongoing processes as soon as possible. Sand puts it bluntly: “Procrastination isn’t in your favor — get started.”

You can listen to all of series’ episodes HERE, or you can find them wherever you stream or download your favorite podcasts.

Previous Article
Top Identity Security Blog Posts of 2021
Top Identity Security Blog Posts of 2021

2021 marked year two of our pandemic-driven, decentralized reality. While digital transformation initiative...

Next Article
Log4j: What to Know. What to Do. And How to Stay Ahead
Log4j: What to Know. What to Do. And How to Stay Ahead

In December 2020, a series of network breaches was reported in rapid succession — the beginning of what soo...