Jeff Kroll (15:14)

It's interesting. It's really a wide spectrum, but it's really an area that I think a lot of organizations don't necessarily put as much scrutiny to as they should. So really, when you think about employees, right, they're the ones who have access to almost everything in an organization, right? They're running the organization. They need access to whatever applications you have, whatever systems you have, whatever sharepoints you have. So it's usually, you know, depending on the size of organization, a lot of people and a lot of organizations, I would say, you know, put in processes to add a new user, delete a user, modify access for a user. The scrutiny that's not always there, though, is within all of those processes for changing a user's access is how much access should they have? So it's an interesting area where, you know, in my mind, employee access really goes from the day an employee shows up, or even when you're interviewing them, in some cases, all the way through to when, you know, ultimately they leave the organization. All of the bells and whistles and controls along the way of how somebody gets access, gets granted access, gets moved access, and ultimately loses access is all in that population, as well as, obviously, authentication mechanisms and, you know, how people are authenticated for what they have.

Dave Bittner (16:26)

Well, let's dig into some of the details here. I mean, what would you consider to be best practices?

Jeff Kroll (16:32)

Well, so, you know, real best practice is interesting because, you know, a lot of people these days are talking about zero trust environments, and people, you know, for years before that have talked about least privilege as a concept. Right. And so really, the. The real best practice, in my mind is, and it's easier said than done, making sure employees only have access to the things they need to have access to, contemporaneous with when they need to have that access. Right? So I'll use health care as usually a relatively straightforward example of that. Right. Let's say you have a hospital and you have, you know, a whole bunch of nurses. Should all of the nurses have access to all the floors at every given any given time? Well, probably not, right? Ultimately, you figure those nurses should only have access to, you know, the floor they're working on that day. Right. Or that shift. And maybe even you narrow it down further to say, well, you have a scheduling system. Could you somehow, real time only grant access to the floor to the nurse, to the patients? That nurse is Working with on that floor at that given time sounds great in theory, right? It sounds like, well, yeah, of course, why should the nurse have access to everything? Because if somebody breaks into her account, they have access to everything. If the nurse wants to do something bad, she has access to everything. So if you can limit her access to just those patients, just that floor, just that time, all of a sudden, you've really mitigated the risk of access related to that employee. Right. The challenge with that is obviously when you think through that, without some real heavy duty thought and automation around those things, it's really, really difficult to do. So that's why I really think, even though that I would say is the best practice is to really limit people to what only what they need access to to really get their job done. You have these competing priorities both with regards to operationalizing that and how do you make that actually work in a real life environment and can your technology to support you to be able to do that. You also have challenges sometimes just with management of an organization saying, well, that's great that you only want this nurse to work on this floor at this time, but he or she maybe gets called up to another floor and how am I going to handle that? And it's an emergency situation. And so what happens is sometimes operationally people go to the other end of the spectrum and say, give them access to everything because we don't know what will go on. So there's kind of this interesting balance there that gets really difficult to manage.

Dave Bittner (18:48)

It's really easy for me to imagine the system starting to erode as people get annoyed with it. Right. Somebody needs access to something, they can't get it, they complain, they complain loudly. And the people who are in charge kind of throw up their hands and say, okay, give this person access to this and then it never goes away. Am I speaking about a realistic peril here?

Jeff Kroll (19:14)

You are spot on. That is exactly what happens. And even though people talk about reviewing access, I always say, does do periodic access reviews really get to that deep level? Right. Probably not. Right. So a lot of times what we find is once access is granted, it usually persists. And you know, a lot of times the people making the decisions, I'll call it from an IT department or cybersecurity department, Right. The people who are, you know, a lot of times looking to say, hey, let's limit access, let's keep it tight, they may not be as involved in the business process to always be ready to push back on some of those decisions. Right. When. When somebody in the business is saying, no, our people all need this access. And hey, look, yesterday we had this big problem, and that big problem was because they didn't have access. So go grant some more access. It's sometimes difficult for them, not being necessarily the experts in whatever that business process is, to be able to be like, well, wait a second, I get that happened yesterday, but that's like a once in a year event. And we could probably design some type of, you know, exception process. We could work when that once in a year event happens. But because they're not necessarily in the know, to your point, somebody's screaming, somebody's mad, and all of a sudden access gets expanded beyond what is probably the ideal access.

Dave Bittner (20:26)

I mean, it really strikes me that communication is a real key part of implementing this sort of thing effectively.

Jeff Kroll (20:34)

Yeah, it's absolutely communication. And I think there's an element of buy in a lot of times from the, what I'll call it, the non IT professionals, the business professionals don't always have the mindset that they need to keep access really limited. And so I think that's one of the hurdles a lot of organizations need to overcome is not that they're doing something wrong by asking for the additional access, but rather helping them to understand what the potential risks are of that additional access. Right. Because we all know it's a matter of when, not if, every organization, or almost every organization as some type of cyber event, some type of breach. Right. Well, those breaches get a lot easier if the access that they get into is somebody who has their access really limited. Those breaches get a lot harder when that access is really broad.

Dave Bittner (21:23)

Well, in your experience, do you have any words of wisdom here for how to strike that balance between limiting access but also limiting friction?

Jeff Kroll (21:35)

You know, it's a difficult thing. I think it's really a tone at the top issue, meaning I think, you know, a cyber IT department can work with whatever procurement department. Right. They try and come to a meeting of the minds and that that can obviously happen. But what I find the best controlled organizations from a cyber perspective tend to be the ones where the boardroom cares and, you know, your C suite cares, and they set the message that they really want to be a secure organization and that then starts permeating down. That's really where it needs to come from. And really viewing it not as an IT thing, but as a business risk. Right. Cyber and access is not an IT risk, it's a business risk. And the organizations that view it as a business risk and drive it down through the organization that way, at least in my experience, tend to have a better security posture. Maybe not perfect, but a better security posture than the ones who view it. You know, that the age old saying, you know, that's an IT problem. Those are the ones that tend not to be as well secured.

Dave Bittner (22:40)

What about the folks who tend to have the most access? You know, I, I would hate to be the IT person who has to report to the CEO and say you're not going to be able to access everything whenever you want to. How's that going to fly?

Jeff Kroll (22:53)

Right, so that's a great question. Right. So, and we run into that a lot where some of the higher up executives start asking for more and more access. Generally speaking, not exclusively, but generally speaking, we actually view it as more of a risk when the higher ups have excessive access. Right. Because if you think about a CEO of a company of a large organization, everybody knows the name of that CEO and there's lots of people doing all sorts of, you know, investigation into what that person does, whether they like it or not. Right. There's lots of bad actors out there trying to glean information and figure out, you know, nuances at CEO ways. They could potentially spoof them when they go on vacation, stuff like that. So usually the higher up you are in an organization, the less access you actually want that person to have. You actually want to take that access out of their hands and give it to somebody maybe a little lower down, obviously recognizing sometimes there's sensitive data, things like that that you couldn't do that with. But what I call the rank and file, you know, super user type access, we usually recommend unless there's a really good reason, don't get that in the hands of your C suite. In fact, take information access out of their hands because they're by nature a target of bad actors.

Dave Bittner (24:07)

You know, every organization setting down this path has their own particular starting point here. Do you have any advice for those folks as they're heading down this path to make it as easy for everybody involved as possible?

Jeff Kroll (24:22)

Yeah, the biggest advice I always have is don't try to boil the ocean. Right. There's going to be lots of applications. You're never done with reviewing access. You're never done with trying to get access to where you want it to be. A lot of organizations I do see sometimes get caught up in analysis paralysis. We have 100 applications and we need to find data owners and we need to do this, we need to do that. And while you want to have good processes across the board that are sustainable Usually it's actually better to just say, okay, if we have 100 applications, let's pick one or two, let's knock them out. Let's figure out what works for us as an organization. Get your quick wins, right? Get your quick hey, here's where we were able to limit access and then start working through the other hundred, right? You don't have to get everything done tomorrow. Obviously, the sooner you get it done, the better. But a lot of organizations almost bite off more than they can chew a lot of times in these access control projects. And as a result, because they bite off so much, they actually don't get anything done over a period of time versus trying to, you know, break it into bite sized pieces and say, we're going to go deal with this department for the next three months.

Dave Bittner (25:31)

That's Jeff Kroll, principal and practice leader of Baker Tilly's Cybersecurity practice. And finally, Russia has labeled cybersecurity firm Recorded Future as undesirable, a badge CEO Christopher Alberg cheekily dubbed a rare compliment. The Russian prosecutor general accused the firm of aiding Ukraine in offensive information operations and supporting the West's propaganda campaign. Ahlberg and Team Undeterred probably framed the notice. Recorded Future has actively supported Ukraine since Russia's full scale invasion, providing $10 million in intelligence, cloud access, $20 million in aid in 2023 alone, and collaborating with 16 Ukrainian agencies to protect critical infrastructure and investigate war crimes. Their insect group's research, often spotlighting Russian cyber antics, likely didn't win them any fans in Moscow. Interestingly, they're the first cybersecurity company to make Russia's undesirable list, typically reserved for NGOs and media. Imagine being so effective that an entire country bans you. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com we're privileged that N2K Cyberwire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement enforcement agencies. This episode was produced by Liz Stokes Our mixer is Trey Hester with original music and sound design by Elliot Heltzman. Our executive producer is Jennifer Ibin. Our executive editor is Brandon Karp. Simone Petrella is our president. Peter Kilpe is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here tomor.

Jeff Kroll (28:31)

It.