security

Oktane18

Reading Time: 4 minutes

Last month was Oktane18 (Okta’s security conference in Las Vegas).  I have to tell you that it was a great conference to attend.  For those that aren’t familiar with Okta, they are an Identity Provider, which is a fancy way of saying that they manager user accounts and they help facilitate things like single sign on, OAuth, token creation and revocation, multi-factor authentication, etc.  In short they do all the heavy lifting for a users security so you can focus on building your apps.

In our scenarios, we are using Okta to centralize a users authentication (access) to our custom applications.  We’re still managing a users authorization (what they can see and do within the app) via a users settings managed within the application but you can also do that through Okta’s portals (if you choose to do so).

Going into the conference I had a pretty good working knowledge of what Okta can do and I spent some time on a few PoC’s prior to going.  However, being there with their instructors and developers really gave me a nice look behind the curtain, so to speak.  I was able to do hands on labs that pertained not only to be as developer but also from the DevOps / Administrative side.  The event was Tues evening – Thursday for the main conference and for an additional cost you could attend classes on Monday & Tuesday, followed up by certification test (if you were so inclined).  While, I would have loved to attended the official classes, I didn’t :(.  However, I was able to pick and choose lectures or hands on labs that were offered to conference attendees, which was totally worth it.  I’m guessing some were scaled down versions of the official class room instructions but none the less they were fantastic.

This year there theme was “Beyond”, as in Go Beyond Expectations, which was meant for the event as well as their business model and I have to say they are achieving that goal.  For event here’s a break down of what I did:

Day 1

  • Registration
    • The general registration & swag bag pickup.
  • Expo
    • Tons of 3rd party services who are either security providers or even consumers of the security services.
  • Welcome Reception (in the Expo area)
    • Tons of food and spirits, which gave you a chance to get to know the other attendees.

Day 2

  • Breakfast (in the Expo area)
  • Keynote Speakers
    • Todd McKinnon (Technical & Business Speaker)
      • Half life of technological advancement
        • Technology and people, and their complexity continue to expand
        • Calling for nexus that connects and removes friction
      • Identity as the crisis of our technological age
        • Okta Integration Network and Network Effects
        • Abstraction of the problem of Identity in the cloud
    • Aimee Mullins (Inspirational / Motivational Speaker)
      • Athlete, actress (Stranger Things), Fashion Model
      • Challenge the unthinkable (takes medals at the Olympics with wooden legs)
      • Overcome adversity (breaks records for long jump without “good foot to jump off of”)
  • Breakout Sessions: Tons of Labs (with hands on tutorials) or Tech Talks
    • I choose the following:
    • Lab: Protect your Modern App w/ Okta API Access Management
    • Tech Talk w/ Open Q& A: Personalize Your Okta Org Sign-in Page, Email Domain, and URL
  • AWS Tips and Tricks Seminar
    • Adam Fitzgerald, Head, Worldwide Developer Marketing, Amazon Web Services
    • Cloud services provide lower cost implementation and management that scales
    • How do we think about security, especially with respect to hosted services
      • AWS takes a lot of responsibility in security, but can’t know all customers’ needs
      • Client is responsible for utilizing tools available in meeting security needs
      • Okta provides security needs and integrates with AWS (is an AWS Customer as well)
    • Application structure
      • Monolith – Waterfall, dedicated business objects handle identity, which is pervasive though entire system (can’t easily decouple identity solution)
      • Micro Service – Agile, mesh of individual services, separately scalable, better recovery, quicker iterations and decoupling, containers and move towards virtualization (why reinvent the wheel, rely on existing services like IDP/SSO w/ Okta)
      • AWS Lambda/Functions – further break down Micro Services into chained functions that are event driven
  • Ending Keynote Speaker
    • President Barack Obama
      • 44th President of the United States
  • Ending of the Day (Oktane 18 Party at Drais)
    • Food & Spirits
    • Entertainment: a DJ followed up with Walk off the Earth

Day 3

  • Networking Breakfast
  • Keynote Speakers
    • Frederic Kerrest
      • Co-founder and Chief Operating Officer Okta
    • Krista Anderson-Copperman
      • Chief Customer Officer Okta
    • Rich Dandliker
      • Vice President of Product Management Okta
    • Alex Salazar
      • Vice President, Product, Developer, and Integrations Ecosystem Okta
    • Erin Baudo Felter
      • Executive Director of Okta for Good Okta
    • Patty Morrison
      • Executive Vice President of Customer Support Services and Chief Information Officer Cardinal Health
    • Eash Sundaram
      • Executive Vice President, Chief Digital & Technology Officer JetBlue
    • Scott Harrison
      • Founder and Chief Executive Officer charity:water
    • Declan Morris
      • Chief Information Officer Splunk
    • Melody Hildebrandt
      • Global Chief Information Security Officer 21st Century Fox
  • Labs
    • Automate Identity-Driven Requests and Incident Response with Okta and ServiceNow
    • Integrate Amazon Web Services with Okta
  • Okta Security Roadmap
    • Alex Bovee, Directive of Product Management (Security) & Sami Laine, Director of Technical Marketing
    •  Protect, detect, respond (making smarter security decisions)
    • Abstracting Security
      • How does a CAPTCHA work to identify a user from a machine?
      • Current systems like MFA (multi-factor authentication)
        • Push authentication (E.g. code pushed to mobile device/email), biometrics, radius based (context for origination of request, E.g. from a trusted work network), certificates, Passwords
    • Implement password-less authentication
    • Use context to build up authentication profiles
      • GPS/Location, IPs, Machine data,
      • Authentication rules and conditional logic
      • Network Effects of global-cloud black/whitelisting
  • Closing Keynote Speaker
    • Dr. Mae C. Jemison Physician & Astronaut United States
      • Rethinking the scope of our problem-domains
      • Challenge ourselves to reevaluate what we think we know
      • Work together as a species to solve greater problems
      • Look Up (http://www.lookup.dreamhosters.com/)

Overall:

This was a fantastic conference.  Tons of interesting Labs and Tech Talks and Okta really knows how to take care of their attendees.  My only complaint would be the length, I wish it was longer.  I would have loved to attended all the Labs and Tech Talks, but they were running in parallel you had to pick and choose.  Luckily there were a few people there from my company so at the end we were able to compare notes.

President Obama:

I guess I should have sat a little closer 🙁

Drais Nightclub Las Vegas