As the FedEx cybersecurity team reviewed the company’s IAM infrastructure with the goal of simplifying and modernizing it, they also had in the back of their minds the broader goal of rolling out a Zero Trust security model.

“Compromised passwords are typically the first step in the data breach kill chain. It’s how an attacker gains initial access before moving laterally across the network looking to escalate privilege,” says Ray. “Passwords alone are no longer defendable or adequate for authenticating FedEx identities and protecting our digital assets.”

Rather than “trust, but verify,” a Zero Trust approach treats all network traffic, internal and external, as untrusted activity. For FedEx, that means verifying users and devices, evaluating each login situation in context, and using the results to tailor the sign-in experience according to the level of trust assigned to it.

The company’s identity provider is a big part of that Zero Trust strategy, says Ray, which is why choosing the right provider was so important. “The Okta Identity Cloud with the identity-as-a-service model, using Okta Universal Directory and Okta Single Sign-On was the solution for FedEx.”

Okta’s support of modern authentication protocols, such as SAML 2.0 and OpenID Connect means it can support FedEx apps, whether they be SaaS, cloud-native, or legacy applications.

The team is also taking advantage of Okta’s partnership with F5 to bridge the Zero Trust model to legacy on-prem applications. “The F5 BIG-IP Access Policy Manager (APM) performs protocol transformation using modern methods but still sends users back to legacy applications with all the headers or cookies that each application requires,” says Prashanth Karne, cybersecurity principal at FedEx. In this way, the team can secure all HTTP traffic to and from back-office applications without relying on a VPN.

Okta Adaptive Multi-Factor Authentication allows FedEx to add contextual verification requirements for users. The team is currently focused on Okta Verify, but uses older OATH hard tokens for some use cases and is also piloting modern authenticators, such as FIDO U2F, Yubikey, and WebAuthn.

“When I log into the Okta admin interface, I’m able to use Touch ID on my MacBook and it’s very low friction,” says Ray.

Device Trust is the next Zero Trust building block for FedEx—making sure that each device accessing company apps demonstrates a good security and compliance posture. Ray looks forward to exploring Okta Platform Services, which includes the ability to embed Okta on every device and deliver increased visibility, contextual access decisions, and consistent, passwordless user logins.

Using Okta, the FedEx cybersecurity team manages conditional access across the company from a single access policy engine that covers every application in the network. “That’s the brains of the thing,” says Ray. “It helps us tailor the sign-in experience—whether it’s password only, no password at all, or password plus MFA. The engine helps us build those policies and rules and make those access decisions.”

User behavior analytics comprises the final building block of the FedEx Zero Trust strategy. The team uses Splunk and machine learning techniques to mine the rich identity data they collect from Okta, using it to identify suspicious behavior and make proactive policy decisions.