Phishing-Resistant and Passwordless Solutions – Alvina Antar, Okta

This is Techstrong tv. Hey everyone. Welcome back here to Techstrong tv.

You know this, this next woman, I think she's spoken with, maybe Mike Ard and some of our Tech strong editorial team, but I've never had her on my segments here on Techstrong tv. So I'm really happy to introduce you to Vena Antar. Vena is with Okta and Vena, welcome to Text Drunk tv.

Thank you so much for having me, Alan. Yeah, no, it's our pleasure. So Vena, let's start a little bit with the Vena story, right?

To tell our audience about you. Well, thanks for asking. Uh, so I, I have been in it my entire career over 25 years.

I started as an engineer at Dell, uh, as my first gig. I spent 17 years there. Wow.

And my last couple of years I was running mergers and acquisitions as Dell was extremely in acquisitive during that time. And then I, I then left Dell and joined a startup called Zuora. And, and, and actually was there for six years as their first time c i o first ever.

C i o, um, was able to take them public. That was an incredible experience. And then I've joined Okta now for the last three years as their c I O.

That's great. What a great, what a great ride. When you were at Dell, is that when they were kind of expanding into services as well?

Yeah. I mean, it was through the Perot acquisition and then, yeah. And then, and then there was, uh, significant acquisitions of Software, quest, SonicWall, case Boomi, uh, so all those acquisitions as Dell was pivoting from a hardware company to a software Solution company, to a software company company.

Yep. Those are exciting times. Exciting times.

So now you're c i o at Okta. And look, I think most of our audience is familiar with Okta, one of the leaders in the whole I I A m space and identity, et cetera. But there might be some folks who are not, you know, a hundred percent dialed in.

Why don't we, why don't we help them? And, and by just kinda giving them a little bit of the Okta story. Of course.

Uh, well, Okta, our vision is to free everyone to safely use any technology. And, and we believe identity is the foundation for cloud adoption, best of breed cloud adoption for digital transformation, and for zero trust strategy. And, and we, we, we also believe in neutrality, neutrality identity and, and, and, and ensuring neutrality across, across all applications, infrastructure platforms is required to drive that, that level of transformation and, and, and, and hardening our security posture.

And so, um, that's our, that's our story. We have what, over 18,000 customers, um, at, at, and, and we have over 200 million user identities. And, and so just the power of identity and the power of, of the data within, within identity in, in, in, in, in, in, in driving both our customer experiences as well as our employee experiences, creating a more seamless and secure experience is what we're all about.

Excellent. So I, I wanna come back to you just for a second. So in your role at c i o at Okta, right, so for instance, we have CTOs, uh, numerous companies who, you know, they're very forward facing, let's say, right?

They're, they're, they're doing a lot of the marketing and stuff like that day to day. What, what do you, you know, what, what's your role at Okta as c I o? I've got a, I've got a, a, a, a definite role, uh, significant role in running our shop, right?

So, so I mean, it, it's, it's, you know, as a c I o it's, it's, it's, and I'm just blessed with an incredible team, uh, that spans enterprise product. So we call ourselves a, a, a internal product and engineering organization, right? So mm-hmm.

So, so it's, it's, it's it's business technology for the enterprise. So we have an enterprise product organization that, that has deep insights into all of the business strategies across marketing, sales, finance, every part of the organization. We have an enterprise engineering organization that spans architecture and is thinking, think, thinking long term as our multi-year strategy and, and what is needed to be able to drive, drive our, our, our, our vision.

Uh, and within that, within that function, uh, that also includes our Okta and Okta program, which I'm hoping to talk more about. Uh, 'cause that's something that I'm extremely passionate about. We also have an enterprise data organization.

And, and that is, is really building a data-driven culture at Okta and driving insights, uh, to allow us to, to, to make, to make better decisions through data, um, and a focus on AI within that organization. And then an infrastructure and operations, which is corporate it, but really, um, expanded to be able to drive, you know, the infrastructure and enterprise security that is required for our growth and scale. So I guess what you're telling us is you're really not that busy, huh?

But yeah, it sounds like a lot on there. So look, if you're passionate about something, I want to hear about it because I think, I mean, speaking for our audience, nothing comes across like passionate. So let's hear why about what you're passionate and why you're passionate about it.

It's Okta, on Okta you mentioned, right? Yeah. Well, I mean, it's, it's, it's, you know, there's nothing more powerful than being a best and first customer of your product, especially in a technology organization that spans and supports every customer across every industry, every size of organization.

And so being in a position where we can build deep, deep expertise within our product, uh, internally, and then, and then, and then build strong, strong relationships with our product and engineering organization that can actually push our products forward, provide feedback in terms of capabilities that are needed, not just features and functions that we expect as an enterprise customer, but also deployment requirements to be able to ease the actual deployment and implementation of our product so that our customers experience the most optimal experience when they're deploying our product. And so we really pride ourselves in being a first and best customer. And then, and then, you know, organically we're in a position to showcase that we're in a position to share with our customers, practitioner to practitioner what our experience is, like, the good, the bad, the ugly.

And so it builds a extremely trusted, meaningful relationship with our customers. And, you know, one of the highlights of this is also, you know, not just our implementation of Okta, but with identity at the core and at the foundation of our security strategy and, and our, of our cloud strategy. We're also being in a, in a position to be able to share our deep integrations with our ecosystem, with companies like CrowdStrike and Zscaler, Workday, ServiceNow, and Jams and many others.

Mm-hmm. And so we're, we're able to share how, you know, together we are able to, to, to, to actually, um, you know, get, you know, build a stronger, stronger partnership and and I, and, and, and really drive increased innovation across all of our products as an, as an ecosystem. Sure, sure.

You know, a lot of the companies you mentioned are companies of course, that we cover here. Um, what, what's interesting to me is, you know, the whole I A M and identity space is something I, I'm really have covered and, and dug in on fruit a long time because I think I've been around forever in the it, right? And, and when we had this sort of moten castle and everyone kind of came in through the land, you know, back at the office, even if you were working from home, we didn't, not too many people worked from home then.

Um, but, you know, it was, identity was one thing. You could set up your ad because we all ran Microsoft, and it was exchange and ad and, and we could do that. And, and we kind of controlled all the apps, lived in the server closet, right?

We didn't go anywhere, you know, electronically today, of course, we go everywhere. We, we do anything from anywhere at any time, right? Our apps live, who knows where our apps live, frankly, right?

They're SaaS apps, they're hosted by the SaaS providers. We have assets in multiple clouds and some, you know, back in, in third party data centers we work from home, the beach and office or whatever. And so That old style identity, you know, like the Bob Seger song, it, it, it's, you know, it's just, it doesn't work anymore.

We need a new, a new identity infrastructure for a new day. And, and that's what we've seen, I think over the last 5, 6, 7, 8 years. Right.

We, we've really seen this. But the, the, the Achilles heel of all of it though, Vener is still, we still rely so much on damn passwords, right? And, and, you know, at least password managers have become much more standardized, even though we've seen them have breach multiple breaches, some of the biggest password managers having multiple breaches in the last year or so.

You know, and, and we've had this like, uh, hope, you know, the, the, what is it for the cup, uh, of a passwordless future of, of getting away finally from passwords. And we, you know, there's been a lot of contenders, biometrics mm-hmm. Uh, two factor authentication, you know, all of these things.

But a lot of times it just sneaks one password out the front door for another password in the back door. I know this is something Okta really try to address. Tell us progress.

How are we doing? What, what, what can we do? Well, you know, I I I think one of the biggest problems actually, what you touched on is, is that people don't think it's a problem.

I think we're just, it's, it's this inertia. It's, it's, people are just used to passwords and used to managing, you know, and all the friction and, and all the, the, the, the, you know, all, all that's created by, by having passwords. And so, you know, the, the reality is, I, I think that's actually one of our biggest challenges is, is realizing that it's time for it's time to change and Passwordless is ready, ready for prime time.

Like we are, this is not nirvana. This is not like we're 10 years, we're, we're 10 years away from creating a passwordless experience. Like, you know, we, we feel confident and, and actually, you know, the program that I was mentioning around Okta and Okta, one of the things that we have focused on this year is our passwordless journey internally at Okta.

And it's been incredible. I mean, it's, it's, you know, we have, we have been in a, in a, in a position where we have been able to adopt our Okta identity engine and FastPass capabilities, which many of our customers, you know, are, are, have migrated to our, our latest and greatest capabilities. But being able to actually adopt the FastPass and, and be in a position where you can truly embrace passwordless technology and, and, um, and, and, and be in a position where, where, you know, you're, you're, you're, you're actually creating phishing resistant factors across every authentication.

And I mean, it's a journey. It's a heavy lift in terms of the level of engagement with, with security, uh, you know, to, to, to, to ensure that you identify the applications and, and, and, and, and have, and actually, you know, plan, plan a, a, a strategy in, in, in terms of your fishing resistant journey. But, but I mean, one of the things that, that, what that, that I'm proud of is that we are, we are in a place, when we started it, we were at 50% and now we're at over 95% Wow.

Is ruthless, um, within Okta. That's great. And, and we are in a place where we are able to share our journey, the experience of what it took to actually drive phishing resistant factors across all of our authentication.

And, and, um, and, and the level of, and, and, and, and, and not only what it's done in terms of savings. I mean, if you think about the password re reset requests, and, you know, a lot of us, my peers are focused on driving efficiencies, focused on software rationalization, um, driving automation, uh, you know, to drive efficiencies, well start with passwords. Start with the number of people that you have maintaining password resets and, and, and, and, and what is needed to be able to drive automation, not just from a cost perspective, but from a security perspective.

The level of, you know, insecurity that comes with, with, with passwords. And then also from an experience employees that live anywhere, as you mentioned on the beach and, and anywhere globally, you know, are are, are in a situation where they're having to wait for, for someone to, to, to reset passwords. When in reality, at this day and age, you know, we shouldn't even have a password.

And, you know, biometric authentication is here and not, and phishing resistant factors is, is, is here. And, and, and, and we should embrace this technology, um, you know, for for both experience and for security. Agreed.

Agreed. A hundred percent. I want to dig in a little bit.

When you say, uh, Okta and Okta, 95% of, of your users not using password, is that just to log on to the Okta infrastructure? Or is, or are they basically, you know, once you're logged on Okta, that kind of gets you into all of these third party places that you gotta go to anyway, so you really just totally getting rid of passwords. It's for all of the applications that run our business, right?

Yeah. It's not just to log on to our Okta portal. It's, it's, it's to access everything that is needed to be able for, for an employee to do their job.

That's big. So let's dive in, you know, make sure we're not, as I said before, getting rid of passwords in the front door, but sneaking them in the back door. How does the Okta password list and, and don't give up anything that's gonna get us in trouble, please.

But how does the Okta password list kind of solution do away with passwords? What are we doing to verify one's identity? Well, with phishing resistant factors, you don't need the username or the password.

And that's why we, we talk about passwordless equating to username list mm-hmm. As well. And that's an important thing.

So Something like a pass Yeah. For something. Yeah.

No, I wanna make sure people understand. Yeah. Password list is username list too.

It's not, I still have a username, I just don't type my password in, but I'm sorry, I interrupted you go. No, no, exactly. That's exact.

I mean, it, it's, it's, we're eliminating the username and the password and, and you know, with phishing resistant factors, you don't need the username or your password for something like a pass key or web auth. And each account is actually stored in the authenticator, which represents the private key assigned to the Fido two authenticator, you know, so, so the username becomes ous to this in this arrangement. And, and so as far, at least as far as a user needing to recall their username in order to sign in, you wouldn't, you, you don't, you don't actually necessarily need, need that username.

And, and there's this universally unique identifier that ties the public key to the local app account. Uh, and, and so that's what, you know, what, what ultimately what's solely focusing on phishing resistant factors, it it ultimately removes the need to be able to, to, to have the username or the password. Now, do you need to have sort of an authenticator app on your phone watch or machine for this to work?

It's, it's, it's the same. It's, it's, it's using FastPass and so and so today, um, that is the, the, the, the authenticator, whether it's on, on any device that you have. Mm-hmm.

And that works on any device Exactly. Virtually any device including Of, of course, including mobile devices. Very cool.

And, um, you know, one of the, and I'm not naming names, but one of the big password managers who had several breaches this past year, the fear was not only did they get my password, let's say for Okta, but man, they broke into the bank, into the vault, if you will. And they, you know, it may be hashed and they, they're gonna have to, you know, decrypt it, but they have the mother load of all of my passwords. Is this kind of a, a scenario that could play out in, in this type of solution?

Absolutely not. I mean, that, and that is, and that is what we're looking to prevent. It's, you know, all too often we've seen this time and time again, and we know the stories, right.

And which is why we, you know, this inertia is shocking to me, right? That, that in many of the conversations that I have, it's, it's, it's, you know, we need to think about and be proactive and not wait for a breach to drive, you know, a and not wait for our board or our executive team to force us to drive phishing resistant factors. It's, it's, you know, we should be in a position where we're proactive and, and, and, and really thinking ahead in advance of, of, of, of, of having to be reactive to, to, to this level of, of, of vulnerability.

Yeah. I mean, you know, the inertia kind of, because no one will raise their hand and say, I like remembering 195 different passwords, or the, you know, who has 195 different passwords? Most people are using two or three passwords with variations and reusing 'em.

And when one's bad, the whole damn thing goes to, you know, hell in a hand basket. But, um, so people don't want passwords. They don't want all these passwords.

They want simpler, secure sign on. But I, I, I think it's just they can't imagine a world without it almost. Right?

I mean, they're just so conditioned that, you know, that this is how it works, that they just, you know, they don't, they don't believe it. They Just don't. Yeah.

And that's, and that's, and that's, that's what we're, what, what what we're looking to, to ensure that our customers, you know, we, we are partnering with our customers to actually realize this vision, right? And, and, and this is something that, that spans, you know, both our customer experience and our employee experience, right? It's, it's, it's realizing a vision that, that, you know, the password is, is, is no longer needed your username.

I mean, think about your experience. You know, you, you may, you may, you may not only forget your password, but you forget your username and you request for a username, uh, you know, notification. And, and so that experience, the friction, the level of insecurity is, is, is something that, you know, we're really looking to eliminate and The time wasted.

And I'm excited, you know, to, I'm excited to be able to share our journey, the, and, and the details behind our journey, um, on what it takes because it's an investment. It takes an investment Sure. Is.

And, you know, across it, across security and across the entire organization. And one of the things that I wanted to share is, you know, I had an, I had thought that we would receive friction from the 7,000 plus cut employees at Okta as we were going through this journey, because it is a change. Mm-hmm.

But what I saw is, is huge, huge appetite and excitement, you know, to, to be a part of this journey. You know, feeling a level of innovation that we were driving real change and innovation and, and their experience, you know, now they're able to share that story with, with our customers and partners. So it's, it's, it's been an exciting time for us.

Absolutely. Again, I don't think anyone raises their hand and says, I love having 195 passwords. Yeah, exactly.

And, you know, and, and every 90 days good hygiene is every 90 days I gotta change it. And I can't use the same password I've used for the last six times. Do you many How many times I've been through that exercise.

I used to have hair on my head. Um, you know, it's crazy. But anyway, you know what, we're running a little low on time Vena for people who want to maybe find out more about the Okta journey.

The Okta on Okta journey. We're on the website or anywhere on the web. Can they go?

Maybe dig in there. Well, thanks for asking. We, we, we are, we, this is, this is new and something that we have just recently posted blogs.

com. We actually have, um, a, a at our annual conference octane that I hope mm-hmm. That, that, that you all will be a part of.

Um, it's October 3rd through the fifth. But that in, in that, in our annual conference, we have dedicated sessions, a hub for customers and partners to come and speak to the Octa, Okta team and hear and see for themselves the details behind our journey. And so that's all happening in the next month.

Absolutely. Let's jump in on Octane a sec. So it's in San Francisco.

Is, is it at Moscone or where is it at? It's, it's at Moscone Center. Is there a virtual for people who can't get there?

There's yes. There, there, there will be. Um, many of the keynotes and many sessions streamed.

And then you guys are also doing a city tour as well? Yeah, we, we, we do city tours across the globe, uh, throughout the year. Octane in San Francisco is our, is our, is our main flagship.

Flagship. Right. Um, and then we take that, we take that all over the world.

com and look for that? Yes. And we have, you know, a dedicated site, Octa, uh, you know, focused on on Octane.

Can you, I just wanna make sure, 'cause I know how it's spelled, but I wanna make sure our people get it. Can you spell that out for folks so they'll know where To go? Yes.

It's okta com slash octane. O k t a N E. So it's octane like Octa, right?

Not octane, like gasoline. Um, okay. Listen, Avi, I want to thank you so much for coming up on Text Drunk TV with us today.

It was a pleasure. Hopefully maybe between now and Octane we'll have you back on and we can do a little bit maybe of a preview Awesome, awesome. Of some of the main sessions there and, um, you know, keep fighting the good fight because you're on the right side of this.

I, I will tell you, we have to go passwordless and user nameless. Um, it'll just, it it'll make life easier and better for everyone. Thank you so much.

Yeah. I'd love to have our customers actually share their story and their journey Anytime you want. I mean, hey, we do our tech strong learnings, we will talk.

Alright, but for now, I gotta end this vena and tar, right? Uh, c i o a doctor here on Textron tv. We're gonna take a break.

We'll be back in a minute with some more.