Why IAM is Dead and ICAM is Alive and Well with Bassam Al-Khalidi

This is Textron tv. Hey, everyone. We're back here on Techron tv.

You know, I'm excited to have this next gentleman on. He is the founder and chief innovation officer at a, a company called Axion that you may not know about, but you're going to, if you listen in here. Let me introduce you to Besam El Kdi.

Uh, BAAM. Welcome to Text Drunk tv. How are you?

I'm doing well. A thank you for having me on today. I appreciate it.

Ah, it's a pleasure, man. So, Besam, we, as I said, we're going to get into AxD. We'll introduce it to the audience and they'll find out all about it.

But I wanted to spend a minute or two talking about you, right? Mm-hmm. Uh, what did you do before you founded Ard, before you achieved innovation Officer here?

Give us a sense of your journey. Yeah, so, uh, always my journey has always been within security. You know, it's, it's what I enjoyed.

It's what I like, started in the, kind of, in the biometric field, uh, with biometric authentication. Uh, and then really had an, an amazing opportunity to work on a couple of the biggest, the most complex programs global, uh, which is the, uh, department of Defense common Access card, uh, the US government, uh, PIV card, right under the, uh, under HS PD 12 directive from the, from the president at the time. Uh, and really those, uh, were a, a big turning point in my career and learning what proper global real security truly meant.

I remember those days, you know, back back, one of the companies I co-founders was called, still Secure. We did a lot of business with, uh, DOD, tech d the agencies and so forth, and we, we did what? They had a knack, if you remember back in those days, network access control.

You get a call one day that, uh, if we could detect if the USB ports on laptops have been disabled, you know, using that test, we could detect that pretty easily. But why would you want to disable all your USB ports? Don't worry about that.

We just wanna make sure they're disabled. And, uh, of course, later we found out, you know, mm-hmm. Chinese had of course put USB, uh, you know, uh, plugs in the parking lot and people were just plugging them in.

Mm. But it was around that time that the cards came out, right? That you couldn't log in to just any, any, you know, DOD laptop without your, your identity card.

And it, it was a huge, it was a huge deal. That's a huge deal, right? It kinda was game changing in some ways.

Um, so you, you were doing that, and I guess that kind of introduced you to the whole world of identity and access management, huh? Absolutely. Absolutely.

And, and it was, uh, it was interesting, right? Because, you know, working on, on, on global pros like that and had the opportunity to work on other global programs in Europe and in Asia, what was interesting is those were all, uh, government funded, right? So, um, before starting axed, right?

What was brewing is in, in my head, is this is amazing what, uh, what these programs do and how they secure, how they secure the nation, but how does enterprise tackle this? Really, that was the brewing question. And why does enterprise do something like this?

Right? And it came down to really two really simple cornerstones. One, no one has the, the, the massive budget to spend.

That's one. And even if you go to, you know, the Fortune 500, the global, uh, 2000, which could spend a, a significant amount of funds, they don't have the personnel, uh, to lead this, right? From an experienced perspective, uh, from a global presence, right?

So it, these two challenges were the heart of why organizations can't do this at a pretty large scale. And I'm talking 20 years ago, right? So that the, the, you know, going back in time now, things have evolved a lot with, uh, with a lot of the cloud computing and a lot.

But between 25 years ago, uh, that was a, a big hurdle, uh, for organizations. Absolutely. And, um, look, it's interesting that just the interview before this, I was talking to someone who did a, the part of a, a report.

Only 37% of companies are using multifactor Yeah. Right? And again, it comes down to two really simple thing, uh, you know, complexity and costs, right?

So when I started Axio, we, we had a simple goal, or a simple vision that we wanted to achieve, which is we wanna make identity security simple, effective, and real right? Now, easier said than done. When we, when we started this journey, and, and we looked at it and we're like, well, how are we gonna make this happen?

How are we gonna take these complex global program, make them turnkey and simple for the enterprise to be able to deploy and digest? Uh, and again, I'm going back almost 15 years ago, uh, the challenge was big, uh, and we looked at how can we do that? And we, we, we innovated in a way, um, where we are able to miniaturize these kind of similar kind of programs or similar concepts, leveraging best practice, the same security standards, uh, leverage the same security protocols, right?

As, uh, as the DOD and the federal government did. And now we have a turnkey simple platform for organizations to be able to do this on a global scale. But back to your original question, if we look at from kind of a password perspective, uh, passwords are, are, are free, like a puppy, right?

Uh, you know, you deploy passwords and, and you're like, well, it doesn't cost me anything, right? It's, it's, uh, I just tell my users to select their password and, and, and then they, then they go off on their way. But the, the cost element to it, and then we'll get to the security vulnerability, but just the cost element of it, you know, if you're doing it, you have to increase password complexity.

You have to force your users to change the password over time. You need password reset tools. You're, you're overloading your, um, uh, your help desk with, with all this password management.

And then, you know, you, you talked about the percentage that is still doing password. I'm curious, uh, from your last, uh, interview, how many are doing MFA, Right? No, they said 37% responded that they are, so 63, not so, look, I, I've been saying this for a long time, right?

I, I've been a big fan of biometrics for as long as there's been biometrics in security. I, I think passwords. And I've used the password manager forever.

I, I was hacked at Black Hat in 2005. I was stupid enough. This is when iPhones automatically connected to wifi networks that had the same SSID they connected to before.

Big mistake, obviously. This is maybe iPhone three, something like that. And I got hacked and I learned my lesson with passwords, and I've used the password manager ever since, you know, with complex passwords.

But you wanna know the truth, it's still too much of a pain in the butt for people. Mm-hmm. Mm-hmm.

The average person has 150 passwords or more or More, more. And you're not allowed to repeat 'em. They can't be similar.

I need a unique one, and I've gotta have a capital and a number and two special characters, but not those special characters. And I gotta change it as, you know, the, the drill Besam, we need to move off of passwords. That, that's my personal thing.

We only got 15 minutes here though. I wanna bring us back. Talk to me about founding ard.

Yeah, so as I mentioned, right, we, we, we really looked at that journey and, and, and how can we simplify the authentication journey from both perspectives. One, the organization, how can we make it, uh, how can we make security simple for 'em? Uh, and then from an end user, how do we make it effective?

And, and, and real? What does that effective and real mean? It means the user experience has to be extremely simple from everything from creating your authenticator to using your authenticator to managing the lifecycle of the authenticator.

So if we look at that journey, what Axia does it, it we can provide a, a turnkey platform that allows organizations to let users self-manage that authenticator. Well, what does that authenticator look like? Again, piggybacking off standards from, uh, from what the federal government and the DOD did back in the day based on certificate based authentication, uh, PKI, and then combining that with kind of forward, uh, looking protocols, like Fi O2, combining the two of them really gives you the best world, the best of both worlds.

And making it turnkey in a platform is, is really that criticality Axio can give you that platform. It, it's up and running in less than 45 minutes. You have a dedicated virtual private cloud that has all the necessary elements for you to have that passwordless secure, simple authentication.

So the question becomes, why did we go down this route? You know, as you mentioned, there's, there's no shortage of, uh, of passwords that the user needs to know to authenticate to all these different applications. Password manager was, was the way to go when a lot of these applications were on prem, then when a applications become more web-based, right?

That was the birth of IEM, identity access management, right? IEM came with a simple promise, right? Authenticate to the IM and that it will act in a really simple way.

It will act as the SSO, uh, to all these different applications. One pathway to rule 'em all. Yeah, exactly.

And I'm really simplifying the, the IEM story. We can sit here and talk about IM for hours, right? Because I am also provides directory services, et cetera, et cetera.

But I just wanna, uh, for the audience, right? I just want to focus on the authentication journey. Uh, a part of I am, so I think I am really helped that story of, okay, I have all these web AppSec, right?

Uh, and I have all these online resources. Now, I, I have a way from my end user to authenticate to the IM and then the i m's acting as the SSO slash broker to all these different applications. So what do we do?

We move the risk from the application. We moved it to the IM, the IEM became the risk point, right? If I'm an attacker, if I'm a hacker, if I get access to the user's IM right?

Guess what? Now I have access to all their applications behind the scenes because I've logged on similar to a password manager. If somebody gets your main password to your password manager, now they have access to all your accounts, right?

Uh, and, and that, and, and, and that, that's why we see today with all the different IM all the, the, the hundreds of millions of dollars that are being spent or, or close to over a billion dollars is spent in IAM attacks. You still see them, uh, breaches. You still hear about them, uh, and the news is flooded with this information.

Absolutely. You know, and that, look, to be fair, you're right, IAM with the birth of the cloud and prominence of the cloud, IAM became sort of the killer app of cloud security, right? Because we didn't have the remote, we didn't have the perimeter, we didn't have the molten castle kind of, you know, traditional network security stuff.

But like everything else, it, it's been around now a while, and, and we see, we see the gaps mm-hmm. In the coverage, we, we see the issues. So you guys have something new you're calling ica.

Honestly, it's not something new. It's taking a page out of the, you know, what we did back in the day from the, from the DOD, what we're, what we're advocating for is, is really focusing on, on going beyond the, the traditional IAM story to really start looking at, I I icam. So what is, what is icam, what is different than i a, uh, I'm the, it's identity credential access management.

So why the credential? Why does the credential be, be, become a cornerstone for security within the organization? Now, now you have, if we, if we step back a little bit on the IEM journey, right?

Uh, as I do, as an, as an organization, yes, you have all these cloud applications. Everyone thought we, we'd be a hundred percent cloud by now, but that's still not the case. There's a lot of companies out there that still have legacy applications, whether they're in the financial sector, healthcare, um, aerospace and defense, uh, oil and gas.

They still have applications that are still on-prem that still need access for on-prem, and they're not web applications. They're still within your, uh, environment. So you have this still this mix of authentication of some applications on-prem, some cloud.

And then on top of that, what we've seen is even deploying MFA, uh, or let's call it traditional multifactor. So like, for example, you know, uh, I'm sure you've, you've used in your career kind of having the one-time password or the, the code that would, you know, on a, whether it's on a, a little token, whether it's on a mobile app, whether you get the SMS or whether you get it through your email, that has proven to unfortunately to be not secure and not because the hacker has to hack the backend, which is protected by, you know, your intrusion detection systems, your wife, your, your VPN, your proxy. No, by simply phishing the user to provide that information.

So MFA is, is losing, is, uh, is effectiveness because hackers have shifted their attack vector from attacking the AppSec directly to really focusing on attacking the user, because phishing, the user is a lot easier and a lot simpler. And with AI helping, uh, you know, with all the AI tools out there to really has made phishing is on the rise at an alarming rate. I wanna be very clear to everyone that's listening to this.

Anything's better than username and password anything, right? But if you are going to deploy something, I think it's important to look at part of your ICAM strategy is how do we move to phishing, resisting authentication? So that phishing resistant authentication is really clear.

Um, we're really grateful from organizations like NIST and CISA that clearly define what is phishing resistant, what authenticator, so that there's no ambiguity. So that when you look at, uh, solutions out there and how to protect your organization from these threats, it, there's a clear roadmap and, and in a clear definition, uh, I think is the better term of what is phish and resistant authentication. So from an exit perspective, we really focus on bringing organ organiz, uh, organizations, uh, bringing a simple path from security and usability.

We don't believe in, in the perfect intersect between the two. On the contrary, we think both of 'em should run in parallel. You need maximum security with maximum usability all the time, every time.

And we, we use phish and resistant authenticators that are, uh, as defined and approved by cisa and Desk so that you can have your cake and eat it. Two, uh, authenticate to your local AppSec, authenticate to your cloud AppSec, leverage ICAM standards, and leverage government and military grade standards with a really simple way to use it and get rid of passwords completely. I love it.

I love it. Hey, you know what? We didn't tell people though.

How can they contact and, and get on board with Axia? Oh, yeah, absolutely. com, you can go to our website, uh, and there's a lot of great information there.

Um, A-X-I-A-D if you were wondering how it's spelled. Okay. Yes.

Thank you. Thank you, Alan. I appreciate that.

I, I take you for granted sometimes. Uh, obviously because, uh, I of, I, I started accident back in 2010, uh, and, and, and for me, it's, uh, it, it's, it's like another kid, obviously. Uhhuh.

I get it. I get it. You gotta remember though, they're cattle, not pets as someone who's founded a bunch of companies.

They're cattle's, not pets. com Yes, sir. And, and people can get started right there.

Yeah. com for fishing resistant, please. When you go there, we have, uh, we focus on a couple of, uh, of products, right?

One of 'em is, is really focused around phishing, phishing resistant authentication. com, you can look at it under our conductor type of, uh, conductor product line. Uh, we also have identity, uh, uh, identity risk, uh, that's under our axed mesh.

And Alan, that's for us for another conversation, hopefully one day. Well, anytime you want, just reach out to us. Baam, we're about outta time.

Thank you for joining us today here on Tech Trunk TV and telling us a little bit about icam. And it was a, I think it was a good, you know, we built and, and built up to it, so it was a good conversation. Best of luck with Axia.

Come back and tell us about identity mesh next time. Sounds like a good one. Absolutely.

Love to. Thank you, Alan Alrightyy. We're gonna take a break here on Text Drug tv.

We've got more coming at you today, so stay tuned.