The Security Interviews: Mark McClain, SailPoint Technologies

The story continues

Through the 2000s, a second wave of change manifested as an increase in complexity introduced by new compliance requirements, driven by regulations such as Sarbanes-Oxley and high-profile corporate failures and scandals such as the Enron affair.

This wave added validation to the picture in addition to user management, as organisations found they not only needed to manage multiple identities but ensure their behaviour was appropriate. SailPoint, incidentally, was founded in the midst of this evolution in 2005.

Then, from around 2010 onwards, the arrival of software-as-a-service (SaaS) applications, mobile computing, and the degradation of traditional forms of computing, also brought radical change to the picture.

“All of a sudden you had a situation where everything had opened up. As a corporation, through the 60s, 70s, 80s and 90s, you owned the compute, the network, the device. By the 2010s, you didn’t own any of that,” says McClain.

It was at this point that that identity management and cyber security started to run towards one another at full tilt.

“The thing that began to emerge as a control point was identity, which is also why I think the bad guys began to attack that as a way to get into organisations,” says McClain. “It’s one thing to break through the firewall to try to get to the data, but it’s way easier if I can get your credentials naturally.

“So it’s those two things together that conspired to make this such an interesting area, because identity had always had aspects of operational efficiency and enablement, but all of a sudden it had a deep security component.

“In some ways, Covid exposed a lot of insufficiencies in the security arena and now they couldn’t unsee that”

Mark McClain, SailPoint

“We developed SailPoint initially for the compliance piece, and ultimately incorporated all of that in our first decade, and then the security part really escalated in the past decade.

“Now that we’re almost 20 years in, I don’t think any of us could have predicted how identity would become such a centralised point of dialogue inside the enterprise.”

Then, in the past four years, the Covid-19 pandemic also had a profound influence on the evolution of identity into a security play, the implications of which are still playing out.

“Nothing new got introduced necessarily during Covid, but the rate and pace of change dramatically increased because – though people worked remotely before Covid – the rate of all that also escalated,” says McClain.

“It’s kind of like when you’re in your house and you have a flashlight and you shine it and see a bunch of cobwebs. It’s very difficult to just turn the light away and say, ‘I will ignore these cobwebs’. In some ways, Covid exposed a lot of insufficiencies in the security arena and now they can’t unsee that,” he says.

Identity proliferation

But not every change and evolution in the technology industry is always entirely down to Covid. In this corner of the cyber world, it is the sheer proliferation of identities – in which Covid was certainly a factor – that is now driving change.

“At its core, identity is about who has access to what. That’s the nature of this industry – who are these identities?” says McClain.

“The ‘who’ has generally been people. The ‘what’ has been mostly applications – can you access SAP, or can you access WorkDay, or whatever? The nature of our space has been [to ask] how you make that efficient through provisioning and lifecycle management? How do you validate it’s correct and compliant?”

What has now happened, says McClain, is that volumes of whos and whats are both exploding. In the first instance, the number of people needing to be identified expands to include not just employees, but contractors and employees of organisations in the supply or distribution chains.

In the second, the number of things needing to be identified is also skyrocketing as more and more data moves across more surfaces, from app to app, from email, through SharePoint, Dropbox, or myriad other tools that are at best poorly managed, and usually not managed much at all.

Both of these growth curves are serving to grow the attack surface and increase the risk to identities.

“That’s driving people to say, ‘I must have intelligence and automation or I will never keep up with this problem’,” says McClain.

“So, the investments in AI [and] the investments in automation that we’re driving are about getting people to recognise your problem is not a 10,000-person organisation with 400 applications; you might have in that 10,000-person organisation 150,000 identities you care about and access to data that is four orders of magnitude larger than that application environment.

“There’s no way you’re going to manage that with spreadsheets and email and routing around for approvals – you’re hopelessly behind the game if you don’t start to automate this and use a lot of AI [artificial intelligence] and machine learning to understand patterns and risk profiles,” says McClain.

“We’re one of those industries where AI has not become this new topic in the last year and a half – it’s been on our radar for six or seven years because we knew it would be the only chance to keep up with this volume explosion.”

New opportunities, new threats

But as he thinks about AI, McClain is also acutely aware of the threat to identities that it poses. In a world where text, video images and voice prints can now be easily manipulated to spoof a trusted identity, all bets would seem to be off.

McClain can claim some experience of having his identify spoofed by an AI himself, albeit in a controlled, test environment with no cyber criminals involved.

He explains: “We used an AI tool to sample my voice from podcasts, talks I’ve done and so on, and we gave it a script to read and then I read a script about the very important issue of my favourite cookie.

“It turns out I really like oatmeal and raisin, but the AI went with a more traditional chocolate chip. So, we ran both – and people knew it was a test – but a third of them got it wrong. The fake was so good that a third of our own people thought the fake was me.”

McClain foresees further rapid evolution in this regard as AI-enabled cyber criminals are able to leap more of these identity hurdles with ease. “I think it’s about to escalate,” he says.

A good example of an incoming problem could be in financial services, where machines are already doing a lot of heavy lifting processing loan applications on behalf of humans. But in an era when human identities can be readily spoofed by an AI, how do you stop the machines being fooled by the machines?

“There are some really hard programming problems that are emerging if you’re using bots to service accounts and intelligent devices to replace what was formerly done by humans, and now identity is an attack vector, how do we set up protective capabilities around non-humans like we have around people? How does it validate?

“We’ve done all this training to try to enable people to combat people-based attacks. How do you take that into the world of non-human identity?” he says.

Identity is still a developing discipline, says McClain, and he believes SailPoint’s evolutionary history puts it in an interesting position when it comes to future developments.

“It’s almost impossible to talk about something that doesn’t come into that purview [of identity and data management],” he says. “What in your enterprise does not relate to identity or data? In that sense, our purview is incredibly large.

“We can’t solve all of these problems, of course, but we can be well-positioned to be a single source of truth,” he concludes.