Risky Bulletin Podcast Summary: "Sponsored: The Phishing-Resistant Employee"

Release Date: August 10, 2025

In this episode of Risky Bulletin, host Tom Uren engages in a deep-dive conversation with Derek Hansom, the Field CTO of Yubico, to explore the evolving landscape of cybersecurity, particularly focusing on creating phishing-resistant employees. The discussion navigates through the challenges of modern authentication methods, the vulnerabilities within traditional help desk operations, and the emerging role of artificial intelligence in both defending and attacking digital infrastructures.

1. Introduction to Yubico and Its Evolution

Tom Uren introduces Derek Hansom and delves into the genesis of Yubico, a company renowned for its Yubikeys—security keys designed to enhance digital security by acting as a physical authentication factor.

• [00:16] Tom: "When I first learned about them, I thought, oh, this is wonderful. This is a perfect solution for so many problems that we've got."

Derek acknowledges the robustness of Yubikeys but emphasizes that the cybersecurity landscape has grown more intricate since their inception.

• [00:49] Derek: "The Yubikey itself is a really good piece of technology that you could use to really deadbolt the front door... everything that we used to take for granted in a password world is now becoming points of exploit and attack."

2. The Help Desk as a Security Vulnerability

A significant portion of the conversation addresses the vulnerabilities inherent in traditional help desk operations, highlighted by the recent lawsuit between Clorox and its outsourced help desk provider over fraudulent password and MFA resets.

• [02:09] Tom: "Clorox launched a lawsuit against its outsourced help desk provider... because nobody wants to call the help desk."

Derek points out that account recovery remains a critical challenge. He criticizes the lack of secure verification tools for help desks, which often assume legitimacy without robust verification.

• [02:09] Derek: "We've actually haven't provided the tools for the help desk to verify somebody that's called them up... it's a problem of verifying who you're talking to."

He further shares a personal anecdote illustrating how compromised communication channels can lead to fraud, underscoring the necessity for secure and reliable user verification processes.

• [05:14] Derek: "It was fraud... the person's account had been completely taken over... there was no ability for them to actually verify who they're talking to, reissue a strong credential in a trustworthy manner."

3. The Impact of AI on Cybersecurity

The discussion shifts to the role of artificial intelligence, particularly large language models like ChatGPT, in cybersecurity.

• [07:18] Derek: "And there was no tools for them to get back to somebody to really help onboard... those recovery mechanisms are what's being attacked."

• [08:30] Tom: "One of the stories... was the machine got to the 'are you a human?' prompt and just like, yep, I am a human."

Derek expresses concern that attackers currently outpace defenders in leveraging AI for malicious activities. He argues that while new security technologies are being developed, attackers can scale their efforts more rapidly, exploiting vulnerabilities before defenses can adapt.

• [08:30] Derek: "I think the attackers are ahead... it's a scale problem."

He emphasizes the need for comprehensive security measures, such as zero trust architectures and robust user lifecycle management, to counteract sophisticated AI-driven attacks.

• [09:30] Derek: "We need to finish rolling out the zero trust architecture... we're onboarding users in a phishing resistant manner."

4. Advancements in Passkey Technology

A pivotal segment of the episode explores the concept of syncable passkeys—credentials that can be synchronized across multiple devices—and their implications for both security and user convenience.

• [10:52] Tom: "I had thought that pass keys were going to be tied to a device... syncable passkeys seems like that also presents problems."

Derek clarifies that while syncable passkeys introduce new challenges, they are essential tools in a holistic security strategy. He outlines the security risks associated with copying private keys across devices and the necessity of pairing passkeys with strong identity signals, such as Yubikeys, to ensure authenticity.

• [11:33] Derek: "Syncable passkeys... introduced a whole slew of new identity events that we now need to be looking at and analyzing."

He discusses the integration of FIDO’s pseudo-random function (PRF) into passkey synchronization, enhancing security by ensuring that only trusted devices can decrypt and access passkeys.

• [13:00] Derek: "We're getting to a world where the devices that you carry as authenticators and the devices you carry for compute devices pair together to give a good signal that you are the person signing in."

This synergy aims to balance security with usability, ensuring that users can access their credentials seamlessly without compromising on protection.

5. Future Directions and Best Practices

In concluding the discussion, Derek underscores the importance of robust account recovery mechanisms and the limitations of traditional methods. He advocates for more secure and verification-intensive processes for help desks, moving away from easily exploitable avenues like phone numbers or employment history.

• [15:37] Derek: "If organizations that roll out passkeys will do very minimal work at their help desk to actually support account recovery... it's too easy to compromise that avenue for enrolling a credential."

He envisions a future where account recovery processes are tightly integrated with strong authentication signals, minimizing the risk of unauthorized access and enhancing overall security posture.

Key Takeaways

• Enhanced Authentication: Physical security keys like Yubikeys provide robust security but must evolve to address new challenges in the digital landscape.

• Help Desk Vulnerabilities: Traditional help desk operations are significant security weak points that require advanced verification tools to prevent unauthorized access.

• AI in Cybersecurity: While AI offers powerful tools for defenders, attackers are currently leveraging AI at a faster pace, necessitating rapid advancements in security measures.

• Syncable Passkeys: Synchronizing passkeys across devices introduces both convenience and security challenges, which can be mitigated by combining them with strong identity verification methods.

• Zero Trust and User Lifecycle Management: Implementing zero trust architectures and comprehensive user lifecycle management are crucial for minimizing account takeover risks and enhancing overall security.

Conclusion

The episode "Sponsored: The Phishing-Resistant Employee" offers a comprehensive exploration of the current and evolving challenges in cybersecurity, particularly focusing on authentication mechanisms and the critical role of secure account recovery processes. Derek Hansom of Yubico provides valuable insights into how organizations can bolster their defenses against sophisticated phishing attacks and account takeovers by embracing advanced technologies and rethinking traditional security paradigms.