Welcome to the Sage Goops podcast series on IT modernization in government under written this week by Opta. I'm your host Wyatt Cash, and in today's episode, we're talking about how modern identity and access solutions can help agencies mitigate instances of fraud. Joining us to talk about that is Rob Forbes, cloud architect at Opta, which specializes in identity management and IT security solutions. Rob brings more than 30 years of information technology experience to today's discussion, having worked with Fortune 500 companies as well as government organizations on a wide range of IT and security programs.
Rob, thanks so much for joining us, and welcome to the program. Thanks for having me. Appreciate it. Well, one of the recurring security themes we've heard over the past few months, particularly at state and local agencies, is the fact that in the rush to support remote workers and deploy cloud-based services, agencies and their employees have also become more vulnerable to security risks, including instances of fraud.
So let me start by asking, agencies obviously want to offer more cloud-based services to improve service delivery. Why is it so crucial for agencies to also use modern identity and authentication tools as they build out these services? Sure, so as they're pushing to get all these services out, they're granting access to funds and cash and money, and needing access to people's information to verify them and identify them. So the minute money becomes employee, the risk of fraud goes up, people are going to start attempting to try and get services and resources they're not entitled to.
So they're pushing and they're trying to get their systems out. Things get overlooked or old systems are being retooled or being patchworked into service to support the uptick in the demand, their workloads have doubled and tripled in some cases. So that's going to drive up and uptick in fraud attempts and actions, especially around the identity theft for people looking to take advantage of the situation. It creates big problems from the organization standpoint, it also creates problems from the citizen standpoint.
I'm unemployed and I'm trying to get my unemployment benefits. I log in, I want to find out that someone else has logged in and applied for and got my benefits. And now I can't get the funds I need to pay my rent, pay for my groceries, gas, my insurance, whatever I need to do. So the impact on the citizens is very large as well.
And then there's a big shift on the workload to the organization as they try and deal with the fraud. The latest updated numbers are up to $20 billion in fraud in California alone. So they're trying to sift through and deal with all these requests and they're doing so with older systems and older tools that weren't built to service the level of people or the risks associated around those systems on getting those people into them. Well, agency employees obviously will still need to be working from home for the foreseeable future in many cases, which complicates the security measures that agencies traditionally deployed.
Can you discuss modern authentication controls from an employee standpoint and what agencies stand to gain from making that investment? Absolutely. So the number one target is typically administrators. The administrators of the systems have, the highest level of access.
They've got access to the backend databases. They've got access to the systems that do authorizations. They've got access to the systems that have all the personal information they're using to verify systems with. So those administrators and those folks that run the systems are not working from home.
A number one target when it comes to these fraud attempts. So you want to make sure that you've got tools in place to make sure that is who they say they are. So that you have a multi-factor and a rapid multi-factor authentication solutions in place so that you can look and see that, you know, I really am Rob Forbes and I'm logging in from California. I'm not Rob Forbes and I'm trying to log in from New York when I just logged in from California a little bit ago.
So putting in authentication and authorization tool sets that are modern and can deal with things like risk and adaptive authentication really help the organizations prevent that fraud, you know, attacks on those administrators and on those backend systems. That's the Lynch panel and the critical point that the threat actors are going to go after. Well, you mentioned earlier about the potential frustration citizens can experience. Let's talk about that a little.
Citizens are obviously accessing services through new platforms and they also need identity credentials. And there's still are many shortcomings with simply setting up a username and password. What are some of the benefits and challenges to implementing citizen facing authentication tools? Yeah, absolutely.
The citizens have the same risk for greater risk than the employees do because they're trying to get the services and trying to get the resources they need to get to but it needs to be seamless for them. It can't be something that takes them hours on into utilized or used. You need to be able to make sure that the people who are applying for them are the appropriate persons. Again, if I'm connecting in from Florida and I'm trying to get unemployment in California, maybe that's not quite correct or if I'm connecting in from Europe or Africa, why am I connecting into a system?
I mean, it's possible I'm traveling or something along those lines but it increases the risk and it's something to consider when you're granting the people access or you're vetting them for who they are. So between our system and partner systems out there, there are tools out there that let you vet users identify these in multiple fashions. We've all seen the answer to three questions. Did you have a loan for this or did you live at this address or which city did you live in?
There are various tools out there that can be leveraged and tied into the systems when users register to make this seamless and smooth for them without having to make it burdensome but at the same time reducing that risk of the fraud from the threat actors. Well, Rob, I know you work with a lot of state and local agencies. Talk to us a little bit about what the greatest gaps in security that state and local leaders should be focusing on now as they move into 2021. Yeah, so the biggest problem we see with state and local governments and the biggest complaint we hear from them is they're dealing with older systems that have been placed for, you know, 15, 20 years.
Some of them were homegrown systems that they built 10, 15, 20 years ago and the person had created them, they're not there any longer. So modernizing these to become a big part of the problem. How do I get the data out of those? How do I use this system to grant access when it was meant to be internal and meant to be done at the office but now I need to do it over the internet.
How do I securely grant the access to that in a quick fashion without increasing my risk or the threat to those back and systems? How do I put multi-factor authentication on some of these systems that weren't designed for multi-factor? These systems were designed 20 years ago and we asked for a cookie and handed off a cookie and okay, y'all who you say, y'all, we use that cookie 10 places and that application doesn't know the concept of multi-factor. So how do I handle that?
How do I adapt that and make that easy for people to do that? At the same time, there's more and more requests for more and more applications for the citizens. It's not just my request for unemployment. People are looking for how do I get my permits for my bar?
How do I get my permits for my shop to round or how do I get my permits for my elevators? These types of things weren't offered online in a lot of cases. They were things that you still went to the building and tax people. Still went to those offices on a large scale versus doing these types of things online.
So I need to lift and shift a lot of these tools to put them out there, but then how do I secure them and lock them down? What are my options for securing it? Modern authentication options to make sure, again, that the people that are filling out this information or requesting this information or submitting this information are the people who they say they are, so that the agencies have the visibility and the certainty that the services they're granting or the information they're passing back and forth is with the correct person, the individuals they are presenting to be. When we look at it, we don't look at it just with one single organization.
Octave has been deployed with multiple states and multiple companies around the world and we see these access attempts from around the world and we start seeing these trends and it ties into our infrastructure and we're able to look at these things and say, you know what, you're on the forbidden list. We see you failing logins in this state and we see you failing logins on that state and we see you failing logins to these financial institutions. We're gonna go ahead and put you on our bad actors list and we're not gonna allow you to do that. We had one state agency that we block half a million attempts fraudulent logins, just blocking it.
And never even get to the system because we knew that those were coming from addresses and sources that were very high risk and likely fraudulent ones. Well Rob, can you share some practical examples of how you're seeing agencies benefit from modernizing their identity and authentication tools and maybe how that's also helping them drive down some of their costs? Absolutely, so when you start getting these tools modernized, you start streamlining the processes behind them. So what used to take three days or five days to get somebody access to the appropriate systems can now be done in minutes.
I'm not spending all kinds of time digging through logs and trying to manually go back and retroactively deal with bad logins, bad actors getting into access systems, going up back and cleaning up. Just think of the effort that goes in. If I log in as you and I get your unemployment benefits and then the state goes and says, okay, we just got verification that you are actually employed and you got unemployment benefits. Now I've got to go back and we've got to talk to you and say, hey, you owe us this money because we paid you and you've got to say, no, I never applied for those.
And then they have to go back and forth the logs and processing systems and try and verify what bank accounts were funds paid to and stuff. So the workload from the fraud is not just on the, oh, we've lost money. It's all the back and forth that did you were getting you and how do we know you did and how do we know you didn't and how do we remit those funds. And if you actually do need those funds and it wasn't because you go and apply and you find out that I applied for you, you still need to get your funds.
And how do we get that taken care and resolved? And the workload that puts on these agencies is a lot of manual effort and a lot of manual hours. So can you start modernizing your access and with a central modern identity solution, these logs are easy to process. It's easier for folks to go and see these things.
You can automate the access, the provisioning of the user rights to the system, taking away the access. That's another thing. When I start seeing this fraud, how do I go take away the access? If it's one of my administrators that's been compromised and he's logging into 15 systems, how long does it take me to respond to that and stop that problem from happening?
So I'm able to streamline that with a modern identity solution, make that fast or make that quicker. So it cuts down the risk window, it cuts down the workload that folks are doing on, things that should be automated. Now they can go focus on things like updating applications and finding modern solutions and replacing those solution sets. And take them out of this cycle of constantly chasing the squeaky wheel in these older systems.
Now we're able to start working on higher value things that I'm doing from a day to day basis. Well, lastly, Rob, can you share some recommendations with our listeners about what they should be looking for in pretty much a state of the art, modern identity and access platform that's also still affordable for them to deploy? Absolutely. So number one is security.
I think if your data is not secure, if the organization that you're or the platform you're looking at doesn't have the security controls and requirements that are multi-level and in-depth to be able to secure your data and make you comfortable that the data for your employees and for your citizens is secure, that's a problem. So you want to take a very hard look at the security of the infrastructure, the security of the processes, and then the procedures inside the organization. What are the checks and balances inside the organization to make sure that, hey, our data is encrypted, but where are the keys that protect the data that's encrypted? We're on a modern platform, but is it a multi-tenitive platform?
Are those 10 segmented from each other? How are those 10 at segmented from each other so that we know our data's not commingling? Or if another tenant gets compromised, we're not compromised? So you want to take a strong look at the security on the platform.
Additionally, what is the availability of that platform? How is it managed and maintained? Because you can't take outages every weekend for updates and maintenance and stuff. When citizens are needing to be able to get access to those systems, you can't tell them, you can't get to that Friday night at midnight through Sunday at one in the afternoon because we're doing maintenance.
These citizens need this access. It needs to be 24, 7, 365. So I need to have a platform that's available and scalable enough to be able to support that and make sure they're there, and then that it can take care of all the people that can make a request. Organizations are seeing three, five to 10 times the volume of requests for services online that they were seeing pre-pandemic.
And that's one of the other things the legacy system's there to deal with is they weren't built to handle these loads. So when you start working in a modern system, you want to make sure that they have that capability to scale and be available across the platform so that they can get to the services and your administrators can get to the services and resources and your employees. You don't want them to not be able to go check on something like winded Rob login and where do they log in from to request these services? Well, our system's down right now.
I can't tell you that. So you've got to wait a little bit or it's slow right now because you've got too many people coming in. You want to be able to respond to your constituents and your users in a very timely fashion. I would look at those three main things.
The security, the availability, the scalability or the three critical factors that people need to consider in my opinion when they're looking at platform. Well, those are some great points. Rob, for us, thanks so much for joining us to talk about some of the ways modern identity and access management tools can really help state and local CIOs mitigate fraud. Thank you for having me.
And thanks, of course, to Octa for underwriting today's episode. Look for more of our coverage of IT modernization in government on statesgroup.com and our states group radio channels on Apple Podcast, Spotify, Google Play Stitcher and TuneIn. This is why I cash. Thanks for tuning in.