Table of Contents
Jim Routh has served as CISO six times over, co-founded Health-ISAC, and served on the board of FS-ISAC. Long before “external identity” had a name, he was driving to executives’ homes to fix router passwords to keep their families safe from cyber-attacks related to the enterprise.
The cybersecurity landscape and related attack surface for the enterprise have evolved over time. When innovation in IT inevitably occurred in the past, the attack surface increased, prompting threat actors to adjust their tactics and take advantage of the opportunity. When enterprise controls matured, it forced threat actors to adjust their tactics. CISOs have historically focused their efforts on enterprise protection more than individual protection. We often ignored the personal use of technology devices by family members when adjusting factory issued passwords on routers in executive’s homes. The boundary between the personal use of devices and commercial or enterprise use has become more blurred over time.
Threat actors don’t differentiate between a corporate identity and a personal or external identity. External identity data is public and/or readily available, and it’s about an executive, an employee, a spouse, or a kid. Enterprise controls don’t address the digital attack surface of external identity. This is a different category of problem, and most security leaders are still trying to solve it with conventional IT asset-management thinking.
A decade or more ago, I’d go into an executive’s home to fix their router configuration and make sure the password wasn’t still set to “admin.” They wanted the convenience of working from their home at night and on weekends. My focus was on protecting enterprise data, not personal data. Senior executive’s remote work experience changed dramatically with the pandemic, increasing the attack surface that threat actors could exploit from their external identity.
AI continues to change how people live, not just how they work. Threat actors never cared about the line to begin with. They look at it as a constant attack surface, and they’ll exploit whatever advantage they have.
That leaves a control-design issue that has no written playbook. What do you instrument when you can’t remove the exposure? Who’s accountable when the asset is a person instead of a system? And how do you get budget for a surface that’s never shown up in any inventory you’ve run?
The Asset You Can’t Patch
Security has historically been built around assets you can act on, including rotating a credential, patching a system, and pulling a device off the network. External identity gives you none of that. The data that sits on the dark web or that brokers sell is already public, and the volume available to anyone has grown enormously over the last decade, well before AI entered the picture. Pair the two and the resulting social engineering gets sharply better and much quicker.
Humans believe they can discern between real and fake. But the technology has advanced so quickly that the human ability to detect synthetic audio and video is going down. It’s hovering right around 50 percent, and it’s declining. The fakes people spotted on social media a few years ago are nothing like the quality of deepfake technology available to criminals today.
Most controls assume a person can tell real from fake, but that assumption is expiring fast. The question becomes “how do we reduce what’s exposed, or shrink the attack surface, and how fast can we identify when it’s used against someone?”
Who Owns A Person As An Asset?
Identity and access management (IAM) was built for letting humans manage the access for other humans. That model and the infrastructure designed to support it are now fundamentally obsolete due to the explosive growth of non-human identities with access to the enterprise systems. Non-human identities, service accounts, and autonomous agents now outnumber people inside most enterprises, and that gap is about to widen by an order of magnitude. Identity security is what the discipline has to become: access management for machines, digital identity protection for the lifecycle of agents, plus a job it never had before, covering the exposed external identity data of the humans the enterprise depends on.
That job doesn’t have an owner yet in the enterprise. An employee’s personal device isn’t technically an IT asset if the company didn’t issue it and doesn’t control it. But the enterprise has spent two decades building precedent for protecting an executive’s physical safety and has built almost none for protecting the personal digital identity of everyone in the workforce. If I were an active CISO today, I’d be looking at every choice and option I have from a technology standpoint to extend identity protection coverage to senior executives, and to all employees beyond the enterprise firewalls. The pervasive use of personal technology (devices, AI models, agents, etc.) today requires a different perspective on the attack surface.
Budget For A Surface That Isn’t In Your Inventory
Attack-surface management was built to catalog domains, IPs, and cloud resources. A person doesn’t fit those categories, so the line item was never there. Meanwhile, the economics have shifted. Reinforcement learning matured faster than almost anyone in AI expected, and the providers building the most capable AI models are uncertain of their ability to contain and manage what they build.
Expecting the federal government to put a regulatory framework in place that provides governance in the near term is wishful thinking. Laws are created through a legislative process that is like making sausage, and it takes time, potentially years. The result often differs from the original intent anyway. Then regulatory agencies must figure out how to enforce the law with specific controls, and that also takes time. Legal enforcement requires legal precedent, which also takes years.
The people building the capability are the ones responsible for controlling it, for now and probably for a while. For a CISO, that changes the pitch. It’s not “this threat is growing,” but that the cost of turning public data about a specific person into a working attack has dropped by an order of magnitude.
What To Do This Quarter
This quarter: put your high-risk employees and related family exposure on your existing top risk list instead of starting a separate program. I ran every spending decision through a top-ten exercise with my CEO’s direct reports, and digital attacks on exposed identity earned a spot on that list with the proliferation of data brokers offering personal data to potential criminals.
Next quarter: decide (in writing) who owns a personal device’s configuration when the device belongs to an employee but the risk is shared with the company. Don’t wait for legal to hand you precedent. There isn’t any yet.
Within twelve months: extend whatever protection you build for senior executives down to the people with the most exposure. A family member with no formal enterprise role can become the point of entry. I’ve seen a digital stalking pattern against an executive’s family member escalate into a physical one, and the only reason that person was targeted was their relationship to the executive.
What Happens If You Wait
The providers building the most powerful AI models are already asking for outside help containing it, which tells you the problem is real and unsolved even by the people closest to it. I don’t expect a regulatory fix on any useful timeline. What I expect is the divide between what a person exposes publicly and what an attacker can do with it to keep closing, faster than most budgets can keep up. CISOs who treat this as a line item now will have an easier conversation in two years than the ones waiting for a framework to tell them it’s safe to start.
About this series: Inside the External Identity Attack Surface is VanishID’s ongoing conversation with security practitioners, researchers, and professionals about how exposed external identity data, the data about executives, employees, and their families that lives outside any enterprise control, becomes enterprise risk. Each volume features one guest, interviewed about a specific way attackers exploit that exposure, written up and published under their own name. This is Volume 1. New conversations publish monthly.
