Interview with Nishant Kaushik, Oracle

Okay. Mission Calak lead strategist identity and access management at Oracle. You will be giving a keynote this afternoon, where you talk about trust. Yes. What are you going to tell us?

Well, It's not the trust we hear about a lot today in terms of cloud and things like that. What I'm really talking about is the trust you need with your it, the inside thread aspect of your it development in terms of the fact that you are actually turning your business over to your most trusted users, your it admins your highly privileged users. And can you really trust them in an environment which is so dynamic where frequently business doesn't even know what's going on to enable the back backend channel of your business.

So it's sort of quiz custodians, ipso, custodians, who will protect us from the protectors. Exactly. Absolutely. Who's watching the Watchers as they say. Yeah.

It's and, and the challenge really is that systems have gotten so complicated that in the early days where, you know, you just had an admin who would, who knew how to install your network and install your database. It was a little easier to get control over what to do if you felt there was a threat, but now systems are much more complicated. You're dealing with security back doors, and you're dealing with security holes in your enterprise. You didn't with cloud applications in the air of the cloud. Pretty much any enterprise user who has a credit card is now an it administrator.

And so what does that mean in terms of your, your trust framework for your it admin? So, yeah, it's become a lot more complicated now to deal with what is broadly classified as insider attacks and insider threats. Yeah. We at cooking a coal have been watching the P XM space, very closely PX. The X is sort of, you insert your own thing there. It could be privileged administrator management, privileged, user management, privileged access management, which flavor do you prefer?

I prefer privileged account management, cuz you talking about their, the fact that you're talking about accounts that have high levels of privileges associated with them, privileged user, every user is, has privileges. You're talking about highly privileged users there, right? So yeah. Privileged account management, which is typically a P anonymous account in that is not directly associated with that identity. It doesn't say this, this is Han gay or in Gache it says something, this is root.

So you didn't even know the user behind that account And you could conceivably have multiple, multiple users using one account. Exactly. So shared accounts is a common problem. And so again, when you're talking about inside attacks, how do, how can you even detect and figure out the, the source of attack, if you actually can't trace the account back to the user that's using it. So Of course, on the other hand, these are our most trusted employees or else they wouldn't be privileged users. Yes. How do you protect against these guys?

Presumably they will be the same people who are installing the systems. Well, I think we've gotten sophisticated enough with that's good security to the point where you can actually start separating some of these things. So it is no longer necessary for the DBA who is managing the database and installing the database and setting up the privileges to actually need full privileges on the database. You can actually have them manage a database systems, performance and tables, and this scheme cetera, without actually being able to look at the data, for example.

So I think with fine grade authorization, with a lot of tools like privilege account management tools, cetera, we've gotta the point where we can actually start separating the fact that these users are responsible, administering the systems from giving them user privileges that they can abuse in the system. So separation is now becoming much easier. Do you think this is going to be a simple problem to solve? Will it be essentially taken care of by next year?

No, I don't think so. The biggest challenge right now is just understanding the thread. I think that's the biggest misconception, which is people view it as, oh, this can never happen to me. And because it is a trusted environment as you're pointing out. So the challenge there is until the enterprise actually understands what constitution, insider threat, how it can occur, what are the vulnerabilities? They have specifically innovation to insider effects, which is a little different from your regular user inside attacks.

They will not be able to put controls in place and therefore not be able to manage it. So, and the controls have to be multi, multi multilayered. There's multiple levels of it.

So yeah, it's gonna take some time.