From Vulnerabilities to Victories: Automate Security Operations With Okta Workflows With Emily Ann Clemons at AIE 2024

Hi everyone. Thanks for tuning in today. My name is Emily Ann Clemens.

I'm a product marketing manager here at Okta for our Okta workflows product, so our no code, automation and orchestration solution. Thanks for tuning in. Welcome to this webinar where today we're really excited to talk about how you can use automation to solve some of your most common security challenges with Okta workflows.

Today's agenda looks like this. First, we'll be covering a high level overview of what Okta workflows is, what the platform looks like, and some of the really neat creativity we've seen from our customers to date of how they're leveraging workflows. Then we'll showcase some of our innovation on the platform over the last year with some top security use cases and new security solution packs to get started easily.

And finally, we'll get into a bit of a roadmap and what you can look forward to for, uh, new security features that are coming. As I go through the content today, I really invite you to think about, um, what security operations and tasks you want to automate in your business. Where are you having pain points and where do you think workflows could really fit in automating and helping make your your organization more secure?

Of course, we have to show our safe harbor slide. This is just to remind you that, um, some of the content today will be forward looking. So, um, please keep that in mind when making purchasing decisions.

Alright, so let's set the scene a little bit. I don't think this comes as a surprise to anyone here today. Uh, we know that everyone is working to deliver the best, most secure and frictionless experiences, not just for your customers, but also for your employees, your partners, your contractors and vendors, everyone in your ecosystem.

And we're all doing this in an economy and in a market that's changing quite literally every day. There's also this pressure and this need to cut costs. And it's not just cutting costs, it's, it's doing that while also, you know, having to continue to innovate and grow and scale.

And then underpinning all of that, that need is making sure that your organization and your employees and your customers are staying secure, that you're not getting, um, attacked or having a security reach, uh, underway and succeeding in this really complex landscape that we're talking about. Not only requires having a really solid identity platform, but at Okta we think about automation really being the answer to keep up with all of these demands that we just talked about. Um, by eliminating the manual work, IT teams can really scale and innovate and keep things secure.

Employees can get faster access to what they need and companies can maintain that right security and compliance posture that's so important today. However, again, not as a surprise to anyone here. This is a lot easier said than done, and that's because there's a lot of complexity when trying to build a safe and a secure identity solution.

And there's so many different touch points, right? There's different users apps, those different users have different roles and permission needs. There's multiple systems and not only do you have all of this technology, but there's the different user types to manage.

There's full-time employees, there's vendors, there's contractors, and now everyone is working in a remote workforce. So there's a lot to get right, not just with identity, but making sure that it's done in a really secure way. And what we also know is that getting this right is incredibly critical to every organization today, more important than ever.

So you'll see the stats here, 82% of breaches involve a human element. So whether it's the use of stolen credentials, phishing attacks, slow responses to security threats, or even just manual errors, this has huge business implications. And then the financial impact with the average cost of data breaches costing companies millions of dollars on average, over $4 million.

This really goes to show the importance of getting identity and security with identity right today with these stakes being so high. So this is why we're excited to talk about Okta workflows with today's challenges, needing to do more with less delivering on those great customer and employee experiences, all while keeping it secure. This is where Okta workflows comes into play.

This no code identity, automation and orchestration platform built for it at Okta. We think about automation, of course, being tied to identity and managing the complex system with automated responses and triggers so that your teams can manage tasks without writing code, saving time and keeping things secure. Workflows is the automation and orchestration platform that leverages, as you can see here, this no code drag and drop interface.

And our customers really love this product because they're accelerating their time to market. They're using templates and prebuilt connectors. They're bolstering and improving their security posture.

So whether you're using today's scripts and custom code or PowerShell, you know, those things are really error prone and are, we're seeing a lot of success with customers that are automating their security operations and triggers from apps and systems being really critical to their success. Customers also love workflows because it's helping them reduce costs. It's helping them automate these manual tasks that may have taken developer resources, um, extra time and extra days, and it's really saving them a lot of time.

So let's take a minute to look at how workflows actually runs. Workflows is based on simple. If this then not logic, and here you can see an example of what that looks like.

So previously this simple flow may have been done with scripts or code, and here you can see that. Now this process is automated with workflows. So in this example, um, this is for a new employee.

They have joined the sales team and of course they need access to Salesforce, but with workflows you can make even smarter, uh, take even smarter actions. So you'll note that the user, the new employee is in emea and you want to assign their territory in quota based on where they are geographically. And then you want to add that user to the correct email and distribution lists so they get the appropriate updates for their new team.

And then you wanna slack them a message within, um, within Slack or maybe an email that lets them know when they've joined that they now have these, uh, things set up in Slack, excuse me, they have, uh, this set up in Salesforce for their quota and they can get started just out the gate. This is just one very simple example of how workflows helps automate these everyday simple tasks without writing code and puts more time back in it's hands. And it's done with security built in on every step along the way.

So, you know, we've watched thousands of customers leverage, uh, Okta workflows from different industries and segments and adopt this tool over the last several years that has really helped them be successful. And they love telling us about the benefits that it brings to their organizations. So whether that's Slack that's saving hundreds of hours a year for their IT teams, Peloton who's cutting their account management ticket time in half, and Windham hotels, uh, reducing cost of development labor by 85%, again, giving more time back to that developer to focus on high value work.

And it's really neat to see how these teams have been able to scale and, and become even more efficient and secure with workflows. And on that note, I'd like to take a moment to highlight a company with a very specific security use case. So here I want to tell you about how a global industrial company in the energy business who conducts business across 30 different countries and covers end-to-end energy supply chain from production to, uh, transport, storage and delivery, they're leveraging workflows at scale to improve their security posture.

So this company harnessed and expanded, expanded the power of workflows to drive unmatched visibility and security with workflows. They deliver IT services to over 120 users, both employees and contractors, and they really rely on IT teams around the world to deliver and support services. So you can imagine this brings a number of, of challenges and complexities to their organization.

They have more than 65 Okta orgs representing over a thousand applications, 120 employees, over 30,000 partners and a hundred, uh, and 10 million customers. So there's really a lot on the line here to, um, keep my identity secure. So what did this, uh, global industrial energy business do?

So was M ms MFA phishing attacks on the rise. They really wanted to educate their employees on what MFA phishing attacks look like, how to respond, how real they can look, um, and how easy it is to accidentally uh, click, click on malicious links. So they created four real MFA phishing attacks using the workflows connector builder, they created two custom action cards, one for sending a push notification and another to verify the push factor.

So you can even see in the example here how real the, did you just sign in, image looks and their goal of reproducing what a real attack would look like. And educating employees how to respond when an attack happens was really successful. It helped improve their security posture.

They saw around 5% of people were clicking on the link and provided them data to continue to have more sophisticated test attacks in the future to educate their their employee base. This is an example of just one way workflows can be leveraged to strengthen security posture at scale. And we can't wait to see what else this company, uh, continues to innovate on to educate and, uh, strengthen their security posture.

Alright, now I'd like to take a moment to highlight another way. Workflows is being used to bolster security with Okta identity threat protection and Okta AI identity Threat protection is Okta's threat assessment and response platform that helps enhance security posture and enable proactive identification and mitigation of potential login threats before they escalate. So here where workflows comes into play, workflows empowers customers to enhance and extend ITP and provide the flexibility to tailor their risk responses unique to their needs after ITP and Okta AI detect a risk.

So think about the multiple responses to behaviors and policies and detections in ITP workflows comes to the rescue to automate the res those responses from notifying your SOC team to creating tickets in ServiceNow, in Jira, maybe moving users into quarantine groups or suspending them if needed. And even figuring different flows and workflows for different risk scenarios based on your unique company requirements. So with workflows, you can kind of automate the next steps, uh, after risks are detected and keep security tight at every level.

Before we dive into a few more security use cases, I'd like to take a moment to talk about the range of use cases that Okta workflows covers. So we won't cover all of these today. Um, but just to give a quick snapshot, initially, workflows was used to help solve lifecycle management processes or joiner mover lever processes as well as some use cases around B2B and business partner apps.

But ever since then, you can see it has really grown and workflows has greatly expanded. We've seen customers leverage it in so many creative ways with use cases specific to governance and security, expanding into our customer identity products, and now looking at federal use cases and ITP identity threat protection like we were just talking about. So with that, let's move on to some common use cases when it comes to improving overall security posture and what that looks like using workflows.

So like we discussed the rise in security breaches and data breaches has huge financial impacts from on average costing companies over $4 million and, you know, really big hits to productivity of it and the business at large when these things happen. So there's really a strong need for automation to come into play here and manage the security inputs and responses to not only prevent, but uh, detect and then respond when things happen. So with prebuilt templates for some of these top use cases, a popular way that workflows is used is to, uh, in the security context, it's to prevent account takeovers.

So think about when a user seems suspicious they've attempted five times in the same minute to reset their MFA factor and they want to reset their password. This is, you know, really risky behavior that can be addressed with workflows and you can take action on that quickly, move those users into a table that's under watch, you're monitoring the user within that table at a certain timeframe, and then from they're able to take action, if those users continue other suspicious act actions and activities you can revoke, uh, revoke their their session, you can force them to sign in and send a notification to, to your security team, letting them know that this has happened. So that full end-to-end response and then alert internally to your team to help bolster the security posture.

Other security use cases around, uh, support or are around support and prevention, uh, protecting against internal risk factors. So this could be you have a user or maybe a disgruntled employee and you may need to lock them out, uh, or prevent them from using their company laptop. This could also be used for an off-boarding scenario.

So if a user has, or if a user has reported, um, a device that's being lost or stolen workflows gives you a quick way, an automated way to quickly, quickly lock access and prevent any further security concerns, uh, with, with those users. Another one is using workflows as a response layer. So we see customers who really are looking for an orchestration solution across all of their existing applications, and they want some sort of way to integrate across apps and take automatic responses based on certain triggers.

So this could be responding to risk signals like suspicious users, uh, suspicious email behavior and having that automatically alerted to their security team so that they can take action. So again, creating that response layer with workflows as, um, kind of like your preliminary, uh, security, security response there to cover a few other basic, uh, ways that workflows is used beyond just security. As we mentioned, um, you know, lifecycle management or LCM is really where workflows started.

So we always like to highlight these simple ways that that workflows is used by several of our customers today. So if you're unfamiliar with lifecycle management makes it really easy to automate account credentials. So if you think about join or move or leaver processes or using skim protocol, um, the, the system for cross domain identity management or s Im is really a provisioning protocol to create, retrieve, update and deactivate users and groups between Okta and downstream applications and directories.

So if we're simplifying LCM, it really provides two things. First, lifecycle management offers a prescriptive joiner mover lever path, and secondly, lifecycle management makes it really easy to provision accounts to certain applications. And so the value, uh, for our customers is that it's really prescriptive, it's incredibly easy to use, right?

However, where workflows comes into play, customers want more flexibility to handle, uh, more of those provisioning needs that are more accustomed to their specific business requirements. So organizations want to go further than just those joiner mover lever processes and perform deeper actions within provisioning across the lifecycle, triggering granular actions along the way. The main difference here between LCM and workflows is that workflows really is delivering more flexibility, more functionality that that ability to do those deeper granular actions across different identity scenarios.

And so let's just take a moment to look at, uh, a snapshot of, of what this use case looks like in action, looking at granular actions during on and offboarding through provisioning across multiple apps. So here you can see in one of these examples, we're adding workflows on top of joiner mover lever actions and creating a Salesforce account, assigning a license, looking up a user team in Okta, and then assigning a territory in Salesforce. Kind of like that first example we gave in the beginning, the final step is to create a Slack account where a user is automatically added to their appropriate and relevant Slack channel and sent a welcome message.

So in the case of deprovisioning, the action starts with suspending the user, looking up the user's manager, transferring the folders and permissions in, in, in the system where their, uh, where their information lives and making sure that the manager has access to that before the employee is gone, and then automatically deleting that user from whatever our system they were part of. So this is really important when thinking about how you still need access to some of those important data and files and they'll just want to immediately cut off a user without taking the appropriate steps in a secure fashion to transfer the necessary information. So we've covered several security specific and LCM use cases today.

Hopefully you've seen how workflows can significantly help boost com, your company's, uh, security posture, reducing costs. You've also seen how workflows helps automate basic LCM uh, use cases like we just talked about. And to help kickstart your journey, automating security operations, uh, there are several prebuilt security solution packs for these top use cases like protecting company data.

So that may look like notifying users when password changes are made. There's also a bucket of this, this solution pack for responding to risk signals. So reporting suspicious activity in Slack or PagerDuty, quarantining Okta users when necessary, managing the end user's de devices like we talked about, what if you need to lock or suspend a user or prevent, prevent access to a device.

And then the last one here is about extending security audit and reporting. So identifying inactive Okta users or mana inactive users in in Okta, or managing access to GitHub repo based on certain assessment statuses. So by automating security tasks and enhancing the identity infrastructure organizations can really reduce the risk of security breaches and improve that overall security posture.

Alright, so now let's talk about what's new and upcoming for workflows. The team has been really hard at work on some new features that help with some of these, uh, security and visibility, uh, use cases that we were talking about throughout today's today's time. So here, this is one we're really excited about.

This is role-based access control or RAC and the team's been really hard at looking for ways to, uh, work on more granular access control. So this will enable more people to safely build on the workflows platform. It will also enable admins to lock down sensitive flows like those related to security or hr.

Along with this, we will also be introducing sub folders, which not only help with configuring access, uh, access management, but also generally with organizing the large number of flows you may have in your workflows console. So you'll be able to manage permissions in the Okta admin console using both out of the box and custom roles and generally just get, uh, more control over who can build and manage workflows, uh, adding that extra layer of security. Next feature that we're excited about that's upcoming is execution log streaming.

This enables customers to consume execution logs in a downstream SIM tool. Um, so the benefits here are really helping customers audit execution history and monitor performance across all workflows at one time and all learning, uh, when sensitive errors or issues may arise. And last but not least, uh, this is just one of the new things coming, um, but this is the execution history inspector.

So again, looking for ways to provide more visibility and observability into the, the workflows execution, uh, performance and helping customers better troubleshoot errors and really understand what's happening in their flows as, uh, after they've been executed. And, uh, figuring out ways to iterate on those to make them more powerful, more secure, um, perform in the ways that they want them, want them to be. Alright, so we talked about a lot today.

Let's just cover a quick summary and talk about what we ser saw and heard. So hopefully everyone is walking away with a really solid understanding of how workflows can help automate critical security tasks for your IT team. Uh, we learned that this is more important than ever before.

With the rise of breaches, the financial impacts that on average over $4 million, it costs a company to, uh, respond to these, uh, respond to these attacks. We also learned that, you know, workflows not only automates, uh, lifecycle management, but uh, security operations and really key critical security tasks like account takeovers and responding to suspicious activity in a quickly fashion. We hope you're also inspired by how customers are innovating with workflows.

We saw how, um, this Global Energy company is leveraging the workflows connector builder and building things like kind of fake but real MSA phishing attacks to educate their employees on how to take action and what an attack really looks like. And lastly, you all can take action today and, and learn more about workflows with, uh, the QR code here and taking advantage of, uh, the, the security solution packs that are available and a lot of the prebuilt templates and resources that will help you get started easily discovering how workflows unlocks value for, for your business, automating critical security tasks. With that, thank you so much for tuning in and I hope you have a great rest of your day.