The Security Interviews: Stephen McDermid, Okta

One direction

McDermid mentioned the Okta Secure Identity Commitment, launched in February 2024, which he says lays out the company’s mission, and so not just customers and partners know the direction of the company, but ultimately their own staff know where the company is trying to get to achieve, and what the long-term vision is.

“I think it’s really important you explain ‘the why’ to people regardless of whether they are in security or not, because ultimately that will then allow them to kind of get on board and you bring them along with you, rather than just telling them to do something.”

One example he cited was how using phishing simulations as a training method, in order to determine both preparedness and how it affects the user’s mindset.

“Like any organisation, we do phishing training and we measure phishing success, and we also send out the training and then literally, the next thing they’ll receive is a legitimate email asking them to give us feedback,” he says. “So it’s that mindset of knowing when it’s a good thing and when it’s not.”

Frictionless

He says that an aim of being more frictionless is to not force changes upon people “without them fully understanding it or why you’re doing it or what the end may look like.” This led to the formation of a security culture team, to ensure there is a focus on messaging internally and measure and monitor that culture, as “ultimately, that’s how we’re going to raise and elevate the security bar that we have and continue progressing and making these improvements.”

He admits that the concept of the “department of no” that security is often tarred with, and that often works as that is “often the least riskiest option,” but he admits that attitude doesn’t help the business move forward, and doesn’t help customers either.

“So, the reality is, we have to be in this position where we enable the business and make them aware of what the risks are.” By keeping the staff in tune and on side, they should feel more involved in the security road map and understand where blocks are encountered, it is not about preventing them or slowing them down.

Attacks on others

That point on risks leads me to wonder, how does the CISO of a major cyber security company see the attacks on other companies, and draw learning points from them? McDermid says: “How we respond when we see these incidents in the press; we respond by looking at what happened, look at the threat actor and look at how we would have responded to that. That gives us an ability to think about these threats in a real perspective rather than ‘what if this happened’.“

He also said that there is a period of self-reflection, and think about what the impact on customers would be, and what questions customers would have for Okta. “That gives us a chance ro prepare and analyse our own capabilities, and gives us opportunities to learn – we monitor these things and we can learn from it.”

McDermid says anything which affects customers would be a primary concern, and addressing and dealing with any issues will enable the company to address them immediately – for example if a common vulnerability or exploit was used, or if an attacker was identifying targets in specific verticals.

In an industry as close-knit as cyber security, McDermid says that if an affected company were a partner or customer, he would contact them to offer any assistance, as “even just a second set of ears to bounce something off is appreciated”.

He is keen to stress the point that instances can and should be learned from, and the key for Okta is a need to be transparent, “and that is where you earn trust – what happened, what you’re doing about it, what changes you’re making and I think that’s where I think you can actually learn from other people’s mistakes and then obviously try and elevate your own position.”

Some 12 months on from a well-reported breach of access tokens, Okta is making steps forward in cyber security and is proving that incident did not set it back. In fact, the company is now developing its role as a secure identity provider, and as an enabler of cloud-based services, and its apparent strong core internally serves as part of that journey.