Security Confidential S1 E10 Chris Cazel

Manoj: Welcome everyone to our next episode here on Security Confidential. This week we’re doing something a little different again. We’re joined by Chris Cazel. He is our practice lead for Okta, for all things Okta and a whole bunch of other things, but on this topic, he’s going to focus on Okta.

What we’ve asked Chris to do is provide some insight and guidance over the next several series on what it really takes for an organization to fundamentally become successful with the technology that is provided by Okta and the enablement that’s there. It’s a fairly deep topic we can’t cover in one episode, but we’re going to start today talking about this.

So Chris, welcome to the show. Thanks for being here, man.

Chris Cazel: No problem at all. Thank you for having me, Manoj.

Manoj: So Chris, one thing that we’ve done—I don’t know, I can’t even count anymore how many Okta implementations, but dozens and dozens and dozens over the last many years—and you started from zero with the technology many years ago at Dark Rhino. Your introduction to it was how?

Chris Cazel: Well, I think we were looking for someone to pick up and kind of do implementations here just because Okta was on the rise. There were a lot of tools we were looking at, but Okta was the one that I had the most interest in at the time.

Manoj: And when we started exploring it, one of the big things initially was we’re a managed services provider, so we have to take care of a lot of customers in a lot of complex situations. But in this case, we’re turning back the clock to day zero.

If you recall your experience from day zero to today, what is the right pathway to get someone educated on the technology? I know we did it by the school of hard knocks early on, but how would you suggest that topic be approached if you have an in-house security engineer?

Maybe they’re not even a security engineer; maybe they’re an IT infrastructure person and you want them to get to the level of being able to administer Okta. Let’s just start there. Let’s forget about doing all the complex integrations.

If they just want to administer the environment, what should an organization consider from a person’s background? What should they consider regarding training? What do you think it will take in terms of time? Give us some insights here. What are your thoughts about this topic?

Chris Cazel: Yeah, so I think the first way I learned about it was myself and another engineer here, we took the Okta Essentials training. It was the proprietary one hosted by Okta. That was really my first exposure to it.

I don’t think that was necessarily the best way to go about it because I had no familiarity with the console. Before getting into this line of work, I didn’t really know that single sign-on platforms existed because that’s a technology that operates behind the scenes.

People who we implement it for use it every day, and a lot of employees don’t even necessarily understand what’s going on in the background. It was new to me in that sense. I didn’t really have any experience with them.

I don’t think that route was that helpful at the beginning because even though I was able to walk through the guides that they provided, it didn’t really sink in.

What I found, because we’ve done a couple of trainings to help people prep for the exams, I’ve found it’s a lot simpler to—it’s a weird concept, but you think about day-to-day company operations. What do you do as an administrator day-to-day?

It’s more along the lines of troubleshooting weird problems, like difficulty accessing applications. I think a better approach is to start setting things up from a lab perspective.

One thing we do when we have new people coming in is set up Okta dev tenants, which are free. You just sign up for them, you get a tenant, and then you can go through and get a free trial to some application, create a user, and try and figure out how to link the two.

These are basic concepts of identity access management. Although that stuff is mentioned in these Okta guides and tutorials, unless you go through and show a little bit of proactivity and try to learn it, especially if you have no background in Okta, I found that’s the best way to do it.

Manoj: So you’re suggesting getting a lab environment up and running first.

Chris Cazel: Yeah, I would say so.

Manoj: And playing in that sandbox for a period of time, as opposed to doing the formal training up front, which in your case, you thought was not the most beneficial route to take.

Chris Cazel: Right. I thought it was useful to go back once I’d got my bearings, but at the get-go, it’s kind of an abstract concept how all the SSO stuff works. I didn’t get that much value out of the training at the time.

Manoj: And do you think—you have a fairly technical background—but do you think someone has to have a fairly technical background before they initiate this journey? Or do you think this is someone who has been an IT administrator and maybe has familiarity with IT topics?

Chris Cazel: I see what you’re saying. You’re wondering about someone with no experience versus someone with maybe basic sysadmin experience?

Manoj: Like someone like me who has zero experience with this. Could I do it, or am I… I’ll pick on myself here.

Chris Cazel: I think you’d have a probably more difficult journey because the nature of Okta is that it ties in all IT systems. It’s not really just a cloud thing.

I was lucky enough that I had experience with Active Directory when I came in, and probably 90% of the companies we implement for rely on Active Directory. A lot of Okta’s tools rely on Active Directory.

Luckily, I knew how Active Directory worked and its function, and I was pretty confident with it before I came here. But if you don’t have knowledge of something like that, it’s definitely a more difficult journey. Much more difficult.

Manoj: I took our own—Dark Rhino developed its own training course that you guys put together, and I think it’s an abridged version of the boot camp workshop that Okta does. It really just focuses on key topics that need to be understood.

How do you assign groups, users, and roles? How do you connect a SAML application? I learned in those two days of that class all the lingo, and I learned the fact that the functionalities exist for various things.

But I don’t think I could actually take action today, not because the class is lacking, but because I didn’t do the labs the way that you are talking about. I think that’s critical. Stick time has to go with the study time on the system, plus taking a class.

Because the other people that have taken the class, I know they’ve passed their Okta admin exams. They’ve written to us and passed with flying colors. But I don’t think they were starting from ground zero like I was, as someone that had no clue how Okta worked.

Chris Cazel: There’s a lot of different types of people that use it. Some have had Okta in their organization for a few years, honestly, and just take it to prepare for the tests. They’re pretty familiar with it.

But what you said is more like—I’m sure, Manoj, you could go into Okta and reset passwords and modify users, but the issue with something like Okta is that it’s more about the bigger concept, like how does data flow through all of your infrastructure and how can it be modified and transformed to allow users to access applications?

That’s not really something you learn from a class; that’s more something you have to rig up for yourself and struggle through it sometimes.

Manoj: That’s a very fair point. So anyone that’s starting on this journey, or any organization that’s starting on this journey, they should keep that in mind when evaluating their own team that’s going to have to support the technology.

Of course, a shameless plug here for our own services: they could just outsource to us for 921 dollars per user per month and call it a day, and they don’t have to worry about ever having an Okta engineer.

But we realize that everyone’s not going to be our client, and they will have a journey to go through and make that happen.

I guess the other question is, Okta has three different levels of certification: Professional, Administrator, and then Consultant. Currently, I think they announced recently that they’re going to go through more specialization for workforce, for CIAM, and for Access Gateway, but as of today, they have three levels.

What kind of time frame do you think it would take someone—let’s just assume that they have some AD knowledge, because I think most people going into the environment might have that basic level of understanding—to actually go through and attain the first certification as a Professional, and then as an Admin, and then as a Consultant?

Maybe if you could talk a little bit about what those three different levels are and what’s really required, starting with the Professional level first.

Chris: So the Professional is the easiest of the three, but for someone who’s new to it, they all have their own difficulties. Even though it’s considered the easiest tier of exams, Professional is more about can you navigate the console? Are you familiar with the Okta verbiage? Do you have a basic understanding of how single sign-on works?

I’ve written up quite a few practice tests, but it’s more like you’ll get troubleshooting scenarios, like basic ones: why can’t a user log in? Take a look at these logs and give a recommendation.

It’s that sort of thing. It’s not super specialized, as you said, but you do need to know a good amount of proprietary Okta verbiage that they bring up, which I think is what’s difficult for people.

I can’t think of a good example off the top of my head, but I remember seeing terms all the time, like the Okta Integration Network and things like this. These are all terms that they require you to memorize. That’s more the Professional tier, when you kind of dip your toe into Okta.

Manoj: Can you pass that test without any lab time?

Chris Cazel: I think you probably could, but I think you would need prior knowledge—a decent amount of prior knowledge with an IAM system. The Active Directory stuff is referenced quite a bit. You need to know a bit about single sign-on and the protocols, but again, unless you know the Okta verbiage, I don’t think you can pass it.

There’s even things like the SWA plugin, which is an Okta thing. You’re not going to have prior knowledge of that. So I don’t think you could study for a week and pass that.

Manoj: What about the Admin exam? What’s going on there?

Chris Cazel: The Admin is more about more complex integration. As I mentioned earlier, you need to know the big concepts of how data flows through your infrastructure in terms of identity.

There are a lot more questions around that specifically. It’ll ask you: Company A has Active Directory, and there’s some issue with the way users are being imported, causing Salesforce to break.

It’s more those kinds of questions; they’re more complex than “look at this log, why can’t the user log in?” So that would be the level two test. It’s a lot more fleshed out and specific.

Even if you’re coming from a company that uses Okta and you don’t use Box or Salesforce or O365—if you have a simple IT infrastructure, a lot of the questions are about those applications specifically. It’s much broader than what you might be used to. I don’t think that’s a good one to take without doing lab work.

Manoj: It almost seems like you have to have some real-world stick time from what you just described.

Chris Cazel: Yeah, you do. A long time ago when we were preparing for it, you could get a Dropbox free trial, an O365 free trial, and a Salesforce trial. I set them all up in Okta and kind of struggled through the integration process, enabling the provisioning and all that stuff.

Provisioning is a much bigger focus on the second exam—the lifecycle management features, they call it.

Manoj: And what happens at the final level, the Consultant level? What is entailed there?

Chris Cazel: That one is much more difficult. Whereas the first two are more one-off questions, even though the level two exam is a little more in-depth, the third one is more about—you’ll have a giant page-long scenario of Acme Corporation.

It’ll give you a paragraph on their infrastructure and a paragraph on their challenges. It’s not really a concrete question like “please pick the best answer.” It’s more like, “considering the scenario, what would be your recommendation as a consultant?”

Those questions are very vague, and you have to think about the best practice of how you implement Zscaler or something. You give it your best guess, and then there are maybe 10 questions per scenario that build off the previous ones. It’s actually very difficult; the prep is very difficult for that one.

Manoj: Can you even do that without doing multiple real implementations?

Chris Cazel: Not really, because a lot of the technologies they ask about are impossible to get a trial for, or they’re asking about custom applications that someone wrote and you’re trying to integrate.

Unless you have a background in coding and application development, it’s much more difficult. It’s a lot easier to do the implementations and then help customers set that kind of thing up. Taking what you’ve learned is the only reason I think I was able to pass it.

Manoj: So, let me ask you the ultimate question on this: is there any value to taking these exams whatsoever? If you’re in a 100-person company environment, why bother? This sounds like a lot of work.

For us, it’s a check in the box; we’re an MSSP, so it’s our bread and butter. We have to show the world that we have the certification.

Chris Cazel: From Acme Corporation’s perspective, if they have three guys working on Okta, I don’t think so. But in terms of career development, it’s definitely a good certification to have.

Manoj: Listeners, if you’re looking for a job, that’s what Chris said.

Chris Cazel: I do get quite a few LinkedIn job offers for Okta consultants, so I’m sure…

But outside of career development or for someone like us where it’s a requirement as a partner, I wouldn’t necessarily say so. No, I think if you know how to manage your own environment and have the basic ability to integrate applications, that’s plenty.

Manoj: This is maybe a little difficult of a question, but from what you have seen with our customer base—and for our audience, I want them to know that our customer base typically is sub-2,000 employees—when you compare taking on a managed service where you don’t necessarily spend FTEs on the technology and development, in your mind, is that a more expeditious or efficient path to take?

Or would you say that you should definitely develop your team internally, or is there some kind of hybrid in between?

What has your experience shown you regarding the customer’s ability to support this technology well into the future? We know these implementations are not static; people add applications, and roles change. A lot of things happen.

Chris Cazel: Well, my experience definitely varies; there’s a spectrum. If people are picking up Okta and implementing it from scratch, there’s a ton of work that has to be done at the get-go.

Ideally, once it’s configured properly, you can kind of set it and forget it. That being said, since we offer the MSSP service, we configure it to a place where it’s as automated as possible, and then we’re on the hook to troubleshoot and add applications as time goes on.

I see most companies assign Okta to somebody for whom it’s not their primary job function. I think in a situation like that, moving it to somebody like Dark Rhino would be a better option.

But if somebody was going to hire a full-time employee to implement Okta, having a certificate would be handy.

Manoj: I would agree with that. We have seen that, and by and large, those are the larger organizations with extensive in-house IT teams that have the skill set and talent to deal with it.

Even in those instances, we have taken on a role as an expert consultant for some specialized applications, and then they go ahead and run with it.

But by and large, in the space in which we operate, I think what you described is totally correct. For sub-2,000-employee organizations, someone is getting assigned this task who may not necessarily have this as their primary responsibility.

If you don’t maintain MFA, single sign-on, provisioning, de-provisioning, and all the policy sets, then you’re not getting an optimal security profile or risk reduction out of the system that you should be getting and that you’re paying good money for. Okta is not a cheap technology.

Chris Cazel: Yeah, to build on that, when you see one person get stuck with administering it, it usually gets unorganized and tangled, and that’s when we get brought in to help solve that problem. Even if you go that route, you could usually use a little bit of help.

Manoj: There are a lot of single sign-on technologies out there. In your mind, is there one or two particular things that you have seen where Okta just has excelled at enabling some function within the organization that has material business value to a company relative to the field?

Let’s leave it at that. From your engineer’s perspective, because I know Gartner has their own perspective, but I’m asking from the ground level. What has the real world shown?

Chris Cazel: If you have a very complex environment, I think Okta is much more agnostic than something like Azure. Azure can do single sign-on to cloud apps, but if you have LDAP servers and you have development work that needs to be done on your applications, I think it’s a lot easier to work with Okta.

It’s just much more agnostic; it can slot in really anywhere. Whereas, as I said, Azure is not as flexible. There are some scenarios with Azure where Okta doesn’t work at all, but besides that—especially if you’re thinking about expanding and you have a lot of Linux servers—I just think it’s more agnostic.

Manoj: Well, that is critical, especially as most people have a pretty heterogeneous environment.

Chris Cazel: Yeah, and we’ve seen a big uptick in the number of people who are looking at the CIAM use cases, where people are bringing in external identities. That’s been a theme that’s recurring, and it seems like the technology has done a good job of covering that use case of factoring in external technologies to give them access to services that an organization may provide, which has a direct revenue impact.

The only other thing I’m thinking of now is that if your first point of contact with a new employee is an HR system, Okta can import from that HR system, create the licenses and users in other applications.

It’s possible for it to be so highly automated if configured correctly that it just has an edge over some of the other ones, like AuthAnvil. There’s a plethora of provisioning technologies out there.

Manoj: Getting back to the education topic for a second, are there third-party web-based resources for orienting yourself with Okta? For example, if I want to learn Oracle database, there are a billion YouTube videos. If I want to learn SAP HANA, I can pick that up from a multitude of sources.

Does that ecosystem exist for Okta? Are there groups or support groups for engineers, or YouTube channels? I personally haven’t seen a lot of it, but then I’m not an engineer implementing this on a day-to-day basis.

Chris Cazel: There are not too many good YouTube videos; there are not too many guys talking over and showing you how to do stuff. I think their documentation is okay, but it’s kind of vague at times.

I find myself needing to… with device trust, there’s a guide for Microsoft Intune, but if you’re using another third-party one that it claims it supports, there’s no step-by-step guide. So if you want to be able to answer questions succinctly for a customer, you kind of have to do it yourself.

It’s a bit lackluster in that regard. But if you have a question about integrating any application with Okta, their single sign-on configuration documentation is good; it has screenshots and step-by-step stuff, as long as it’s in the Okta Integration Network, which not every app is. But there are tens of thousands, so I think they do a pretty good job.

Their documentation is okay. Their application SSO config documentation is good. Their user community seems like it’s changed a lot over the last few years; it seems like there’s a lot less information in there.

I don’t search through their forums often, but a lot of the time, you have to figure it out for yourself. If there’s no documentation for something, it’s on our internal wiki.

Manoj: When it comes to education, I think communicating with the end-user community is a big deal in any Okta rollout. Time needs to be allotted for that.

We’re Okta users internally here at Dark Rhino, and whenever something changes, I’m probably the first one to have an issue with it. I put myself in the layman’s category here, so I have to believe that in a much larger organization, there’s going to be a lot more people like me who would be like, “Hey man, what’d you do? What happened here? How do I get into my stuff?”

Communication is the most difficult part about implementing Okta. Doing it without any interruption and maintaining communication is the hardest part.

What have you done for that? I know—we wake up on Monday morning and you’ve got O365, and all of a sudden you can’t get to your Microsoft Outlook. People would probably be kind of ticked off.

Chris Cazel: Yep. That’s a difficult one. You do a lot of planning, but then we honestly enable the SSO late at night on a Friday or something and test it thoroughly.

Manoj: But how do you communicate that to the user? Is there a best practice that you have seen practically work to let the masses know that a big change is coming?

Chris: It comes more for mobile users because when you change O365 to SSO, a lot of people use that Outlook client for their desktop, so there’s not really a change there.

But mobile users need to re-authenticate. Honestly, we just leverage the company’s communication team to send an email that we write up, with some screenshots, saying that you’re going to need to re-login this weekend. We just try to leverage their communications team.

Manoj: Does it usually work?

Chris Cazel: Yeah, I don’t think we’ve ever had any fiascos.

Manoj: I want to give our listeners honest feedback. Is there anything that doesn’t work for sure that you have seen people try in that regard with end-user communication?

Chris Cazel: The only thing I’ve seen is when you’re not on the same page as the company. Obviously, there are tons of things to consider when turning on SSO for something like Office.

We do our best to communicate that to their IT team and their change controls, but if they don’t completely understand and something gets messed up along the way—it’s probably our fault for not communicating it correctly, but again, that hasn’t happened in a long time.

Manoj: Any other parting thoughts you might have on the Okta education and knowledge-building side that you want to leave our listeners with until our next episode?

Chris Cazel: The one tip I would give everyone is: if you go to Okta certification exams online, they have the tiers and study guides for all of them. The study guides are broken down with percentages on the exam.

When I take people through the exams in that training course you mentioned, Manoj, and internally too, I have them do something for each section.

Everything on the study guide is on the test; there’s going to be a question about the topic. Obviously, it doesn’t have the exact questions, but if you can go through the study guide and you’re competent in all the categories, I would say do that before you take them. That would be my advice.

Manoj: Those are good words. On that note, it’s Friday afternoon, almost time to call it a day on this episode. We look forward to seeing you on the next one, and we’ll get deeper into each progressive topic. I’m sure we will, but we’ll try and keep it to where people don’t fall asleep. How about that?

All right, Chris.