CSO Conversations: Matt Immler, Regional CSO of Americas East

CSO Conversations is a blog series interviewing Okta’s Regional CSOs supporting David Bradbury, Okta’s Chief Security Officer in providing the best service for our customers. Okta’s Regional CSOs are integral to Okta’s Security Trust and Culture team, building and strengthening trusted advisor relationships with global security thought leadership.

What motivated your career pursuit in cybersecurity?

I originally got my degree in Computer Science and went to work straight out of college at the US DoD. In that world, security is at the forefront of all projects and quickly became more interesting to me than the actual coding I was doing at the time.

How has your previous experience shaped your approach to cybersecurity today?

During my time in government, I worked on both offensive and defensive security teams. Having a chance to work on both sides of the aisle gave me a unique perspective from both the attacker and defender’s point of view. This allows me to look at a particular defensive technique and draw upon my own experience in the offensive role to determine if and how I could circumvent the control.

Are there any existing or emerging threats of particular interest to you?

Modern platforms are providing us with more and more capabilities, and along with that a wealth of settings with near limitless potential for misconfiguration. Many security issues I have encountered in the past have not necessarily been the result of the actual software or platform, but the way in which it is configured. I see the need for a balance in providing the greatest level of freedom to the user, while ensuring the appropriate guardrails are in place to balance risk.

What trends are you seeing in cybersecurity relating to your region?

The cybersecurity conversation is expanding from what we would conventionally think of being part of that field. The overall resilience of the system is coming up more often in the security context of the conversation than in previous years. More focus is being given to the organization's ability to withstand, recover from, and adapt to security events, and not just merely to prevent them from occurring in the first place.

If you could provide a few short cybersecurity words of wisdom to Okta customers, what would they be?

Be sure to review and apply any published best practices. While core documentation will make sure you can get the job done, the best practice guides ensure that you’re using it the recommended way, which in Okta’s case, takes a security approach when determining those best practices. The identity landscape is evolving quickly with new capabilities entering the mainstream every year, but those changes take time and many older protocols or methods must be necessarily supported to bridge the gap for adoption. Just because an implementation works, doesn’t always mean it’s the most secure option available.

What is the most significant change you’ve seen in the cybersecurity industry in your career to-date?

I hate buzzwords, but this question is going to make me go down that road. I've avoided it until now, but we all know the answer: It starts with  ‘A’ and ends with ‘I’ – its new, full capabilities are not well understood, and it poses unknown threats that are testing the efficacy of existing defenses and prompting swift development of new mitigation strategies. I think a bulk of upcoming security initiatives are going to be heavily influenced by the new things we learn every day about AI and what it could be capable of doing, and at the very least will be a frustrating new addition to threat models everywhere. 

From your perspective, what is the impact of cybersecurity awareness in today’s organizations?

Cybersecurity awareness is a critical function in any organization, but has long needed to evolve from simply sending a quarterly mock phishing email and routine annual training to something more comprehensive. Anyone who has ever worked in this field knows that the same 10% of employees are going to click that phishing email every time, and if your numbers are that low, you’re lucky. Intelligent threat actors are going to craft quality phishing emails, and it only takes one click to be successful. Okta has heavily invested in our security awareness program in order to make it more frequent, interesting, and engaging to our employees, e.g., incentivising the identification and reporting of even the most minor security concerns to help employees feel like they are part of the program and not just being lectured. 

How do you employ Okta’s corporate values in your day to day?

Personally, in my role as a Regional CSO, I spend a lot of time with Okta’s customers, and am particularly fond of our “Love our Customers” value. Many companies are closed off when it comes to security, and there can be merit to this, because you never want to tip your hand or expose potential areas of weakness publicly before you’re ready. However, this does not mean security should be a black box. When there is information that should be made public, it is best to be loud and on the verge of oversharing. What good is releasing information to mitigate a vulnerability if you bury it deep in the release notes somewhere? When a security team is putting the time and effort into identifying risk and providing mitigations to customers, every effort should be made to be transparent. 

Oktane on the Road brings Oktane to those who couldn’t attend in Las Vegas, can you share some of your experiences?

Having done Oktane on the Road events in the past, I would say it brings tremendous value to our customers. Cost cutting and tight budgets are prevalent right now, and many times, the first thing to go is travel and conference money. The customers I have interacted with at these events are appreciative of the local engagement allowing them to hear about the latest and greatest from Okta and interact with Okta employees, while not having to break the bank on travel. 

In your opinion, what is the best part of your Regional CSO role?

Building relationships with our customers. I speak to our customers on a regular basis across the entire US. In my role, I am afforded the ability to have very transparent conversations on issues relevant to their security teams. Having this level of engagement with our customers throughout every industry lets me hear and understand the differences in the experiences and what threats each individual industry might be facing. Retail and Hospitality have different concerns than large banks and financial institutions, but I often find commonalities and am able to bring different perspectives to these conversations by being able to reference an experience or a solution from another industry that might not have been considered otherwise.

Matt Immler was recently featured at Oktane24 in Lessons learned from the Okta frontlines in addition to a live news desk session on Okta’s Secure Identity Commitment (OSIC). Matt also participated in a Fireside Chat on Security Outcomes Powered by Identity.