Show Notes
Vlad Shapiro, a distinguished mathematician turned identity management expert, articulates his transformative journey in this episode, offering profound insights into the intersection of identity and business. He elucidates how the realm of identity has evolved into a critical pillar for organizational functionality, emphasizing that without effective identity management, business operations may falter. Our discussion delves into the implications of this evolution, particularly the necessity for board members to prioritize identity governance alongside traditional business strategies. Furthermore, we explore the pressing gaps within the current identity landscape, including the challenges posed by a lack of standardization and the imperative for innovative thinking to navigate an increasingly complex digital environment. Shapiro's reflections not only highlight the significance of identity management in contemporary business but also underscore the need for a collaborative approach that integrates technological advancements with ethical considerations for future generations. In this episode of the Security by Default podcast, host Joe Carson engages with Vladislav Shapiro, who shares his journey from a mathematician to an identity management expert. They discuss the evolution of identity management, its growing importance in business, and the innovations shaping the future of identity technology. The conversation emphasizes the need for a business-oriented approach to identity, the gaps in current practices, and the ethical considerations in technology development. In this conversation, Joseph Carson and Vladislav Shapiro explore the complexities of AI governance, drawing parallels with nuclear energy management. They discuss the importance of control mechanisms, the role of identity in AI, and the emerging threats related to computational workload theft. The conversation emphasizes the need for continuous learning in a rapidly evolving technological landscape and the significance of visibility in understanding both good and bad actors in the AI space. The dialogue between Joe Carson and Vlad Shapiro unfolds a captivating narrative that chronicles Vlad's evolution from an accomplished mathematician to a distinguished identity management expert. Vlad's journey is steeped in serendipity and introspection, illustrating the transformative power of career shifts propelled by the dynamics of professional landscapes and personal revelations. As he delves into his past, Vlad reflects on his academic pursuits in Ukraine and his subsequent migration to the United States, where he initially aspired to teach mathematics at a university level. However, as he navigated the academic landscape and its stark contrasts to European standards, he pivoted towards industry, seeking avenues to apply his analytical skills in a pragmatic context. The discussion transitions into a broader exploration of the identity management sector, a field that has burgeoned in significance over recent years. Vlad articulates the paradigm shift that identity management has undergone, now recognized as a critical business function rather than merely an IT concern. The conversation delves into the intricacies of identity governance, emphasizing the need for organizations to reconsider how they manage identity in a world increasingly reliant on digital interactions. Vlad's insights on the intersection of identity management and business strategy underscore the imperative for organizations to engage with this evolving landscape, reflecting on how identity impacts operational efficiency and risk management. As the episode progresses, Vlad shares his perspectives on contemporary challenges within the identity management domain, notably the importance of interoperability among diverse systems and the necessity for organizations to adapt to a rapidly evolving technological environment. His reflections on the ethical dimensions of identity management, particularly concerning
More from Security by Default
It's Cybersecurity Awareness Month, and Joe Carson is joined by Erich Kron of KnowBe4 to ask whether the classic messages — strong passwords, phishing awareness, MFA, and patching — still hold up. Spoiler: they do, but attackers have upgraded the wrapper. Erich explains why users should ignore deepfake "tells" and focus on emotion, urgency and the request itself, how phishing has moved into Teams, WhatsApp and SMS, and why agentic AI is exploding the number of non-human identities we already struggle to manage. They also cover email bombing, MFA fatigue, mitigation before patches, deepfakes in the courtroom, and the shift from ransomware encryption to data extortion.
We assert that agentic AI constitutes a profound and immediate threat to passwords, passkeys, and credential stewardship when such agents are afforded unfettered operational or contractual authority without deterministic guardrails. I describe, with technical specificity, how agents that hold passkeys or password-manager access can act autonomously to transact, alter accounts, or execute legally binding operations, and we categorize those risks into task-level, operational, and contractual modes of delegation. We argue that the remediation imperative involves explicit delegation models, ephemeral and auditable identities, and cryptographic assertions that bind an agent’s scope of action to a human owner. I counsel continued adoption of hardened password practices and password managers, combined with resilient offline backups and dual-control or deterministic controls layered atop probabilistic AI systems. We further insist that security-by-default, mandatory auditability, and standards for AI skill and supply-chain review are prerequisites to any safe integration of AI with authentication systems. Finally, I exhort practitioners to prioritize availability, integrity, and accountability alongside confidentiality so that credential resilience endures in an era of accelerating AI capability. We offer clear, practical guidance for individuals and organizations to protect credentials in the age of AI. I recommend using a zero-knowledge password manager and enabling secure backups. Evil Mog affirms that printed or offline copies of critical credentials are valid resilience measures when they are managed and backed up properly. We advise random and unique passwords of appropriate length, routine backups of vaults, and giving trusted delegates access via documented procedures rather than ad hoc sharing. For family and estate planning, we explain how offline copies or delegated access can help manage accounts after death. We also recommend operational controls when using agents. Always run agents with least privilege. Use ephemeral tokens for short-lived tasks. Maintain strong audit logs that tie agent actions back to an owner. Keep humans in the loop for operational and contractual actions. We advise treating AI as an assistant for tasks and threat detection, not as a trusted keeper of passwords without deterministic guardrails. Finally, we remind security teams to prioritize availability and integrity alongside confidentiality and to make secure defaults easy to use so users do not bypass protections. Takeaways: I explain three agent categories: task, operational, and contractual, each requiring different controls and audit. We caution against giving probabilistic AI full control of password managers without deterministic guardrails. I recommend using zero knowledge password managers, backing them up, and keeping an offline printed copy. We note that passkeys can be compromised if they are not bound to secure hardware or secure elements. I urge clear delegation, ephemeral identities, and auditable signatures when agents act on our behalf to ensure accountability. We advise keeping humans in the loop for high risk operational actions and verifying AI outputs before execution. I emphasize secure by default design, reducing friction without disabling protections, to prevent users from bypassing security.
I discuss with Lukas Hlavicka how ordinary security incidents can escalate into full-blown crises when organizations lack preparation, reliable backups, and secure deployment pipelines. We share stark war stories, from backups that were never actually taken to compromised software deployment systems and a ransomware attack that exposed six months of bank fraud. Lukas draws on over a decade of incident response experience, including leadership of a national CSIRT and work in the private sector. We describe common failure points: unknown assets and third‑party links, intertwined IT and OT systems, missing evidence, unclear roles for decision and containment, and compromised CI/CD. We stress clear, practical steps: maintain offline incident plans and backups, map assets and dependencies, secure and monitor deployment pipelines, and practice response with defined authorities. This episode targets any organization that thinks “it won’t happen to us” and seeks concrete lessons to prevent incidents from becoming crises.
Navigating the intricate landscape of identity security has evolved dramatically over the past two decades. Once characterized by a mere username and password, the contemporary environment demands that employees manage an astonishing array of digital identities—approximately one hundred per individual, not accounting for the emerging complexities introduced by agentic AI.
Daniel Raines, a luminary in the realm of electronic security, shares his extensive journey through the intricate landscape of physical security and digital access. With three decades of experience, he has transitioned from hands-on installation of access control systems to software development, addressing vulnerabilities and enhancing security measures. Our discourse delves into the convergence of physical and digital security, exploring the nuances of vulnerability disclosure and the industry's response to emerging threats. Raines elucidates the complexities of hard-coded encryption keys and the imperative for robust security practices, particularly as the industry shifts towards mobile credentials and biometric solutions. This episode serves as a profound exploration of security's evolving nature, emphasizing the significance of adapting to technological advancements and fostering a culture of continuous learning and improvement.