Latest / Identity at the Center / #294 - Navigating Privileged Access Management with Michiel Stoop

Transcript

#294 - Navigating Privileged Access Management with Michiel Stoop · Identity at the Center

0:00
But the first thing what I always do is check if the salt
0:04
is closed because you really want to prevent that.
0:07
There is a blast radius of attack of salt of course on your
0:10
when you meet our foods. And yeah, that's also of course
0:15
with previous access management. You cannot prevent that your
0:19
data gets stolen, but you at least can minimize the risk.
0:23
And that is limited data gets stolen because those so-called
0:27
bad guys, maybe they're already in your environment, but at
0:30
least if they steal certain credentials or whatever, do you
0:33
want to minimize that attack? And therefore, again, it's
0:37
really important that you have your maturity model also defined
0:40
properly and your capabilities, which you want to have.
0:43
So it's also, you need to be clear what are your requirements
0:46
in your organization. And I think also important is
0:49
how do you sell this to your organization, of course.
0:53
I can't think anything worse than being assaulted.
0:56
Oh, terrible fun, I know. This is identity at the center
1:07
if it has anything to do with IAM.
1:10
This is the go to podcast now your hosts Jim McDonald and Jeff
1:17
Stedman. Welcome to the Identity at the
1:19
Center podcast. I'm Jeff, and that's Jim.
1:21
Hey, Jim. Hey, Jeff, how are you?
1:23
Not so bad yourself. Doing great.
1:25
And we're sitting here in the middle of the summer and we had
1:27
a meeting earlier today to talk about conferences and all the
1:31
conferences that are coming up. And I'm like, how are we going
1:34
to get into actual work done if we go to all these conferences?
1:38
Well, that's the thing, right? I think I, I'm, I'm always
1:41
surprised at how good of a job you and I have done of
1:45
separating our work life from this podcast.
1:48
People don't know we actually have real jobs.
1:50
We are identity consultants during the day.
1:53
We're for a large company named RSM, and that's what we do,
1:56
right? The podcast is like the separate
1:57
thing and yeah, there is work that needs to get done, plus the
2:01
podcasts, which is the separate thing, plus like conference
2:04
attendance and stuff like that. So we are very busy boys
2:08
basically throughout the year. Yeah.
2:10
I mean, you know, we're very busy and I think it's good that
2:14
you pointed that out because I don't think many people either
2:17
realize that maybe they think we do the podcast full time.
2:21
That would be great. But that probably won't happen
2:23
until like because we retire from our day jobs.
2:27
But I, I think the podcast is getting to the point of almost
2:31
being like a second, you know, job like moonlighting, because
2:35
most of the time we're recording sessions after the US business
2:40
day, unless we are lucky enough to get a guest like we have
2:43
today who is based in across the pond in Europe or elsewhere in
2:48
the world. And we have to kind of have some
2:51
kind of realistic time that works for both parties.
2:54
Yeah, exactly. And we're going to get some heel
2:56
in a second. I want to talk about those
2:58
conferences though, so we can kind of take care of business
3:00
before we get started with our main topic on privilege access.
3:03
But you mentioned conferences. We got a bunch coming up.
3:06
We've got Identity Week. I'm at Danny Week, America,
3:09
September 11th and 12th, you and I are gonna be there.
3:12
We've got Asia, which is October 22nd, 23rd.
3:15
I'm not planning on being there. I don't know if you are,
3:17
probably not either. But unfortunately not this year.
3:20
Yeah, I'd love to go. I've never been.
3:21
So I'm always happy to go any pretty much anywhere at least
3:24
once I'll travel to. But we've got a discount code
3:27
IDAC 30, IDAC 30 that gets you 30% off of your registration for
3:32
both the Washington, DC America conference as well as the
3:37
Singapore conference in Asia. So you can use that code
3:40
interchangeably for both of those or, or both.
3:42
And if if you end up going to both.
3:44
So that's the one conference that we'll be AT.
3:46
And then we just finally got our discount code thanks to the our
3:49
friends over at Fido. So shout out to Adrian.
3:51
The authenticate conference that's October 14th through 16th
3:54
that's in Carlsbad, CA Super cool location as it was last
3:59
year. Definitely recommended any
4:01
anytime you can go to a conference that has like a good,
4:03
you know, vibe and location that's like just like puts it
4:06
over the top. It's like a work vacation then.
4:09
It is kind of, but it's a great spot, kind of a resort golf
4:13
course type things. There's plenty of things to do
4:15
IDAC 1/5 that gets you 15% off your registration for that one
4:19
as well. I'll have all those codes and
4:21
stuff in our show notes so people can check that out and
4:25
we'll have them on our website and I already put put them on
4:27
our home page. So if you just go to
4:28
idacpodcast.com and Scroll down just a little bit, depending on
4:31
your minor resolution, you should see how the code's there
4:33
and stuff like that. So hopefully we'll see people
4:35
there. What else we've got, you know,
4:37
Gartner's coming up with this year?
4:38
I think you and I are trying to figure out if we're gonna make
4:40
it out for that one. Identiverse has their regional
4:43
events coming up in November. So there's one in Chicago,
4:45
there's one in New York City looking at, you know, one or
4:49
both of those as well to be at. But yeah, busy boys.
4:53
So that's the conference stuff. Yeah.
4:55
Well, and if you're out there listening, you're like mention
4:58
my conference, reach out to us, Jim at IDAK podcast or Jeff at
5:02
IDAK podcast or both, but give us a discount code so we can
5:06
share it with our listeners. You know, everybody's looking to
5:10
save some money these days and all days people want to save
5:15
some money. But yeah, we we are the home for
5:18
getting this information out there and helping people save
5:21
money on attending conferences. Again, like from even from my
5:25
own standpoint, I can't go to all the conferences.
5:27
I want to day job. Yeah.
5:30
Well, why don't we talk about privileged access management?
5:33
And to that end, very excited that we have Mihiel Stope.
5:36
He's the director of Identity management at Phillips, joining
5:38
us all the way from the Netherlands.
5:40
Welcome to the show. Thanks Jim and Jeff for the
5:44
introduction and I'm looking forward to be a guest in your
5:48
Identity at the Center Show podcast.
5:51
Well, thanks for joining us. I want to take care of some
5:54
downer business right up front. I know that you were cheering
5:57
for the Netherlands against England in the Euro 24 match
6:01
that took place recently. I, I, you and I had a little bit
6:04
of a bet going. Well, at least that kind of
6:06
sounds like Jim usually starts off with something negative.
6:09
And so that was like our inside joke.
6:10
And so I was like, all right, well, you know, just listen, see
6:12
if it happens. I don't think today was super
6:14
negative. I think it was great.
6:15
So kudos to Jim for keeping on the positive note, but I'm the
6:17
one who's going to drop it down a little bit.
6:19
Unfortunately, not the ones lost in the last minute to England.
6:22
How are you feeling? Yeah, it's, it's a, it's a sad
6:27
loss of course, but as Gary Lineker always said from the
6:32
England, the game is 19 minutes and always the Germans will win
6:36
at the end, but this time it's already 2 matches in a row.
6:40
It's like exactly for England. So they won't let a game in the
6:43
19 in the last 19 minutes or they won the game.
6:47
So except for the Netherlands, but luckily for the England.
6:53
And in either case, identity and access management goes on.
6:56
I mentioned when I introduced you that you're a director of
6:58
identity management for Phillips.
7:00
Tell us a little bit about your journey into this field of
7:03
digital identity or identity and access management or or maybe
7:06
both. How did you get into the space?
7:08
Is it something that you chose or did it choose you?
7:12
No. So my journey at the Identity
7:15
Nexus Management started after I graduated my Master of
7:19
Information Management at the university.
7:22
So just posted my resume on the Internet and hopefully some
7:28
recruiters would reach out to me and then one of the companies
7:32
would reach out to me was a consultancy firm in the identity
7:35
and access management space. And yeah, I, I really like the
7:39
conversation. So I joined it and from there
7:42
onwards, I'm only in identity and access management.
7:45
But looking back, I think I already had some background in
7:49
identity and access management because I started as a System
7:53
Administrator, network administrator when I was a
7:55
student. So they also needed to do
7:58
account management and ensure that the people had the right
8:01
access, the right time. And so now you're with Phillips.
8:06
Tell us I, I feel like, I know like maybe what part of what
8:09
Phillips does kind of everywhere, but what is it that
8:13
Phillips does for people who aren't aware of that?
8:16
Yeah, Phillips is a company that has been founded more than 130
8:20
years ago and since then, of course we are improving people's
8:23
lives with steady flow, ground breaking innovations.
8:27
But as technology comes and go, the same applies for company.
8:31
So in the last decade Philips transforms as a company in a
8:35
health technology company. So we only held technology
8:40
focused with a lot of brands, licensed companies.
8:43
So the light bulbs are not from Philips anymore, that's
8:46
different company. And the same is for the kitchen
8:48
appliance and the television. So nowadays we are really
8:51
focusing only on the health technology.
8:54
And at the center of the Philips health journey is then of course
8:57
that's we want to ensure that people are living healthy.
9:00
So we want to prevent that you get diseases.
9:02
So we have products there, but in case you need to go to the
9:04
hospital, for example, then we supply products for the health
9:09
professionals. So they can also do some
9:13
diagnosis threats. You help you with treatment, not
9:17
a treat because it's something else.
9:21
And of course, if you are recovering from, you need to
9:25
recover. We also have products there, so
9:27
we can monitor you from 1:00. So I'm always curious about the
9:31
sort of the day-to-day jobs that people have when it comes to
9:34
identity. You know, Jim and I mentioned we
9:35
do kind of consulting that kind of we do consulting during the
9:38
day, right? We talk identity all day.
9:40
Tell me about about your day-to-day.
9:41
What's it like to be a director of, you know, identity
9:44
management? Help people understand what that
9:46
means? Yeah.
9:48
So I need to ensure in Phillips that we define our strategy
9:52
division and the road map. So and also ensure that we get
9:57
the buy in from the management and get funding of course to get
10:01
the things implemented to improve our security.
10:03
And then I'm leading A-Team who is like a product owner subject
10:07
matter experts who are doing the actual implementation.
10:12
So Mahila, I'd like to transition to our topic for the
10:15
day privilege access management. I'm going to start real simple,
10:19
like how do you define it? Which simple question, but maybe
10:23
a complex answer because when you think about privilege,
10:27
obviously I think we all think domain administrators privilege,
10:30
right? But if somebody can make a
10:33
journal entry or there are power users that privilege, I want to
10:37
know how you define or how Phillips defines.
10:41
Maybe less about Phillips, but in your mind, how do you define
10:44
privilege access management? Yeah, yeah.
10:46
From me Privilege access management is an umbrella
10:50
terminology which consists of multiple let's say capabilities
10:57
to manage the elevated non restrictive access of on the
11:04
accounts in the application layers or platform or
11:06
infrastructure layer. Yeah.
11:09
And so kind of thinking, one of the areas that I always kind of
11:15
start my thinking when it comes to privilege access management
11:18
is your policy framework. So having good policies around
11:23
what is privilege? So what types of access do all
11:27
these rules that we're going to lay out apply to?
11:31
And then what are the rules? So, but then it goes beyond
11:34
that, right? If you get the, the foundation
11:37
of the policies, right? You talked about this, right?
11:41
So the way we we got introduced was you're doing some
11:45
presentation on privileged access management.
11:48
You have a kind of a story and one of the parts that you talk
11:52
about is kind of the framework for how you look at kind of
11:56
initial maturity up to more mature in terms of privileged
12:01
access management. So given that, can you kind of
12:04
talk about that framework a little bit?
12:07
Yep. So it's really important, of
12:10
course, that you also first understand the risk in your
12:12
organization. So you need to have a risk
12:14
register. So there you will define all the
12:17
observations which you have in the organization.
12:19
You will the observations you will link to the to the risk.
12:22
Then you will define your mitigation actions, of course,
12:24
and your road map items. And the second thing is indeed
12:27
what is really important to show maturity and you need to define
12:31
a maturity model in your organization to understand where
12:34
are you today and where do we want to be in the future.
12:38
So what what do you want to achieve now?
12:42
What does that then look like? I think do you want to zoom into
12:45
that, Jim? Yeah, let's zoom in.
12:47
Let's get get right into this. The Identity at the Center
12:49
podcast, man, we're all about this.
12:52
Perfect. So yeah, if you're looking at
12:53
the maturity, you will. No, OK.
12:57
Everybody knows when maybe what a maturity is, but we define our
13:00
maturity metal from level one to level 5.
13:03
And that's based on the, let's say from the analyst companies.
13:10
Yeah, from the analyst companies like Gardner, Copernicul or
13:13
Forrester, they also provide a framework which you can use and
13:17
then vendors as well. A framework.
13:21
Yeah, that's nice guidance. But within Philips, we defined
13:25
our own maturity model that's applicable across multiple
13:30
domains, not only for the identity and access management
13:33
domains, because my peers, for example, are responsible for
13:36
trend management or data protection.
13:39
So we have a standard model defined across these domains.
13:43
Now, if you're looking into what does it look like to have
13:45
capabilities, what I explained on the left side, then you have
13:48
your functions defined and the functions really like from level
13:51
12345 S think about session recording, faulting or whatever.
13:58
And these relink capabilities will link to controls and
14:02
controls. You need to think about the
14:03
standards which are existing around the globe is like the sys
14:07
controls, the NISH controls or the ISO.
14:10
And these controls we have defined in, in our security
14:14
management framework. And then we link these controls
14:17
to the threats and that's defined in the Metra track
14:21
framework. So then you understand really
14:23
the risks which you have in your organization, you link them to
14:26
the controls and the capabilities.
14:28
And then with the matrix, you can define, OK, where are we
14:31
today? And it gives you a very clear
14:34
overview where you are in your organization and what you need
14:37
to do in the next coming year. So first, I want to acknowledge
14:41
what you just said there around framework thinking.
14:44
And I think this is something as a consultant, I learned very
14:48
early on, but I think for our the practitioner community,
14:52
which I consider myself part of, you know, being able to talk in
14:57
terms of industry frameworks makes you sound well prepared,
15:01
not just sound well prepared, but be well prepared and tapping
15:05
into, you know, some of these industry defined frameworks like
15:10
you mentioned, like NIST and ISO and ITIL and being able to say,
15:14
OK, this is what the industry's doing.
15:18
But then being able to make it make sense for your
15:22
organization, I think is a very proper way to communicate, you
15:30
know, what the expectations are to your organization.
15:33
Because let's face it, when we're talking about privileged
15:35
access management, you're not just you're not defining the the
15:40
policies and rolling out the tools and then implementing the
15:44
controls and then doing the work, right?
15:47
These are you're setting up tools for other people to use to
15:50
securely manage access. And so being able to come up
15:56
with a proper program and then communicate that in terms of a
16:04
framework, I think is is very key.
16:07
But you also brought something else up.
16:09
And so I'm going to shift the conversation to that, which is
16:12
the importance of privileged access management relative to
16:15
securing the organizational's IT assets, right?
16:19
And so I think a big part of what privileged access
16:25
management. So I think privileged access
16:27
management we think of as the lane of like controlling the
16:30
accounts and controlling the entitlements, maybe check in and
16:33
check out. But it's more than that, right?
16:35
It also taps into areas like all manual controls.
16:39
It taps into areas like governance, but it also taps
16:47
into some areas like, OK, how do you shrink your scope, shrink
16:53
your attack surface as much as possible so you have the least
16:58
amount of area surface area that you need to protect.
17:05
And so my question to you is like what is your approach when
17:09
it comes to minimizing that attack surface or that blast
17:14
radius that's sometimes called? Yep.
17:17
So I use always an example. I also explained it one time to
17:21
Jeff. So about the example of a salt.
17:24
So I was we're attending a conference and was sitting on
17:31
the table and had a conversation.
17:33
And of course, if you have to get your food served on the
17:36
table, maybe you want to have more little bit more salty or
17:39
whatever you saw and you take the salt.
17:41
So and then you want to put the salt of course on your these
17:45
potatoes or whatever. But the first thing what I
17:48
always do is check if the salt is closed because you really
17:53
want to prevent that. There is a blast radius of
17:56
attack of salt of course on your when you meet our food.
18:00
And yeah, that's also of course with previous access management.
18:05
You cannot prevent that your data gets stolen, but you at
18:08
least can minimize the risk. And that is limited data gets
18:13
stolen because those so-called bad guys, maybe they're already
18:16
in your environment, but at least if they steal certain
18:19
credentials or whatever, do you want to minimize that attack?
18:23
And therefore, again, it's really important that you have
18:26
your maturity model also defined properly and your capabilities
18:30
which you want to have. So it's also you need to be
18:32
clear what are your requirements in your organization.
18:35
And I think also important is how do you sell this to your
18:39
organization, of course. I can't think anything worse
18:43
than being assaulted. Oh, terrible fun.
18:45
I know. I was thinking of the analogy
18:49
and male you and I were talking about this the other day of kind
18:51
of like a submarine, right? If there is like a, you have
18:55
these little doors throughout and they can, if one park gets
18:58
flooded, close the door and sort of prevent the rest of the of
19:01
the boat going down. Your example is way more
19:04
positive than mine, so we'll stick with yours.
19:07
You mentioned there briefly about getting support for
19:10
privileged access management. Now that we kind of understand,
19:12
right, We have definition of what it is and why it's
19:14
important. This is the next step in my mind
19:17
is how do you get support to actually do something about it?
19:20
It's like, OK, at some point we have to like stop talking and
19:23
start doing something to better secure lower risk, maybe make
19:28
maybe make people's lives easier.
19:29
I'm not sure. But how do you work through that
19:32
process of selling the Pam program or the Pam project or
19:37
initiative, whatever you want to call it to your organization to
19:41
say, OK, yes, we've got buy in now.
19:44
Here's the funding or the resources to go get it.
19:47
Yeah, yeah. I think that's the hardest thing
19:50
of course, because it's not really visible for everyone
19:54
because I'm just, it's only limited.
19:56
So it's really that only to the IT department from a lot of
19:59
people I think. But it's not only limited to
20:01
your own IT, maybe it's also to manufacturing your OT or your
20:05
R&D. But yeah, that's the hardest
20:07
point of course, in previous action, man.
20:09
How do you, how do you sell it? Because it is not really fancy
20:13
or whatever. It's like maybe you need to see
20:16
it like your electricity or water, it's working.
20:19
So why should I invest something which is working?
20:22
Because their services are running fine so.
20:25
Why should I do it? And I think from my perspective,
20:27
from my own platform or application or infrastructure
20:31
perspective, I have the feeling that I'm really well controlled
20:34
because here there has been an audit done and according to this
20:37
audit to this, it's fine. So you never should treat this
20:41
individually per application. So you'll need to look at the
20:44
bigger picture. And I think it's important if
20:47
you look at the bigger picture that you sit together with your
20:51
compliance and audit department and that you have clearly
20:54
defined, OK, what do we want to measure?
20:56
What do we what, what do we want to have as a result of looking
21:00
into these audit reports? Because there's, there are a lot
21:02
of findings in it. And then also explain that to
21:05
your management, make that visible.
21:06
So just as an examples, like just look into how many of the
21:12
software using are using the default accounts which are
21:15
provided by the vendor. So the audit reports will give
21:18
you this data or how do you deal with access review even its
21:22
privileged access, Do you review these access rights?
21:25
Who has access to it when it's revoked for the last time or
21:28
already elevated access revoked or whatever.
21:31
So you need to look at all these kind of things and get that data
21:34
that will help you. And then it's going back to your
21:37
risk register again because that helps you with your observations
21:39
which you have to provide the evidence.
21:42
And if you have this, then yeah, you can show to your management
21:46
what the risks are in your organization or why they should
21:48
invest in it. Do you find that your message
21:52
changes context based on who you're talking to?
21:55
I would assume you'd have to, you know, talk one language
21:57
maybe to more technical crowd versus less technical language
22:01
to a different crowd. How do you manage that context
22:04
switching to make sure that your message is being communicated
22:08
effectively to whoever your target is?
22:11
And maybe there's examples like if you're talking to, you know,
22:13
maybe a, let's call it, you know, CIO or ACEO versus maybe a
22:18
manager in another area or maybe even someone from the business.
22:21
How do you how do you approach those conversations to get that
22:23
buy in and get that support? Yeah, that's a very quick
22:26
question, Jeff saw. So yeah, first of all, first to
22:31
get the buy in from your own management because try to sell
22:34
the story to your own management which you have because I think
22:37
if you convince them, then it's all they will also guide you how
22:40
you can convince other people. And then you can sell it as
22:43
well. For example, your CEO or CEO or
22:45
the Avenue organization can also sell it to to the CIO where it's
22:48
needed or they can help you to tell your story to the CEO and
22:53
get the challenge. Of course, that's different than
22:55
if you're talking to a service manager, because a service
22:57
manager, it's always looking from their perspective.
23:00
So they always will get the questions like what's in it for
23:04
me? So why?
23:06
Why should I do that? I'm fine.
23:08
So yeah, maybe my colleague is not fine, but I'm fine.
23:11
So and there you need to use a different approach of course
23:15
always and explain what the benefits are.
23:17
So, Mahil, I wanted to talk a little bit about running a
23:24
privileged access management program within your
23:26
organization. And I want to start at the very
23:30
top in terms of, you know, kind of the approach to governing the
23:37
program. And my question is, you know, do
23:41
you see privileged access management as being its own
23:44
program or part of the identity program?
23:49
And I'm talking about in terms of philosophically speaking, but
23:53
also in terms of actually like do you have separate steering
23:57
committees for the two? Because I do see them as to a a
24:02
large extent being a different audience.
24:06
What? What are your thoughts?
24:08
Yeah, Yeah. First of all, it's always
24:10
related to of course to your company strategy.
24:12
So you have company strategy and you have security strategy and
24:15
then you have your IM strategy. But indeed, what just you
24:18
mentioned you have for let's say identity next management
24:22
umbrella terminal. So you have separate domains and
24:24
one is then the privileged access management.
24:26
So you have different stakeholders there.
24:28
So you need to do stakeholder management.
24:30
So you need to identify who are you stakeholders are.
24:34
Then also per stakeholder, you need to define, it's like, OK,
24:37
should keep them informed, should I manage them closely or
24:41
etcetera. So that's what you'll need to do
24:43
with your stakeholder management.
24:46
Yeah. Now, OK, so let's take it down a
24:48
level. So when you get you're talking
24:50
about kind of is organization dependent, maybe that's the
24:54
answer for all these. But I'd also like to get kind of
24:58
like a hot take on some of this. So in terms of like operations,
25:02
you know, building out privilege access management capabilities,
25:07
running them on a day-to-day basis.
25:09
So let's take an example of password vault.
25:14
So you're deploying a password vault.
25:16
Who does that deployment? Is that the identity team?
25:20
Is that the system engineers who are going to use the identity
25:25
vault? And then in terms of operations,
25:28
who owns and runs that thing after it's deployed?
25:32
You know, you get that, that 3:00 somebody, 3:00 in the
25:35
morning, somebody's working on a server and the password vault is
25:40
down. Do they call the identity team
25:43
or do they call the vendor and fix it within their their group?
25:47
Or how does that work it work best?
25:50
I think there are three models and it depends on your company.
25:53
So you have maybe a central model, Federated model I call or
25:59
decentralized. If your organization using a
26:01
central model, then you are defining the strategy, you're
26:05
doing the implementation, you're defined, apologies, you have
26:08
everything in control sensory. You can also use a Federated
26:12
model and then the Federated model dare you define your
26:16
policies, the processes you do, the actual deployment, but the
26:20
responsibility is then in the business because the business
26:24
needs to make sure that they comply to your policies and
26:27
everything. So they need to support you with
26:29
doing the actual implementation and the decentrally.
26:33
Then everybody is has their own responsibility and we are using
26:36
a Federated model in the organization.
26:38
So we drive everything centrally.
26:40
But the business is, in the in the end, of course, responsible
26:42
and accountable for that. Do you have a a rule of thumb in
26:48
terms of like if you have the central model or the decentral
26:52
model, how many people you need on your digital identity team to
26:57
support those models? If you're looking into the
27:02
number of FTE in Philips, we have a lot of outsourced say
27:08
like that. So we have like one SME product
27:10
owner who is responsible for that and then we outsource
27:14
everything to a managed service park provider or an
27:17
implementation partner. Yeah, it depends on how pick you
27:21
are as a company and what you want to achieve of course with
27:24
you during your deployment. So if you want to and how many
27:27
servers you have in your organization and what that's so
27:30
there's a lot of dependencies. So to the size of of that
27:33
varies. And then you have of course an
27:35
operation team who manage the platform.
27:37
We also outsource that in the company.
27:40
So it could be in house outsourced or whatever.
27:43
So we have it outsourced in our organization.
27:46
So if you're looking into the number of people who are
27:49
currently involved in that entire privileged access
27:52
management area, then I think we have around 15 people.
27:56
OK. Well, that's pretty.
28:00
I, I think those rules of thumb are just helpful for the
28:03
listeners in terms of when they think of standing up a program
28:06
like this. I think the other interesting
28:09
aspect is like everybody's coming into this at a different
28:12
point. I think a lot of what we talked
28:16
about probably it's easy to picture from like an on Prem, we
28:22
run the data center kind of model and that's how privileged
28:26
access management was designed from the beginning.
28:29
Then you had this thing called cloud spin up, right.
28:32
And it's, I don't know if it's going to be around, I don't know
28:36
if it's going to make it, but this cloud concept, it seems to
28:40
have created a lot of privileged access management use cases,
28:44
scenarios that put things on its head.
28:47
And not only that, I think developers tended to be the ones
28:53
to kind of lead the charge or developers, not the security
28:57
department led the charge to stand up clouds.
29:02
And then the security department had to come along and, and
29:05
figure out how to secure it. And so I'm wondering, do you
29:09
kind of share that perspective and have you any techniques to
29:14
share with our listeners in terms of how to take an
29:19
environment that's spun up that maybe doesn't have all the
29:22
controls that you would want or maybe a, you know, a nuance set
29:28
of products that differs from kind of the approach that you
29:31
had to date? So just using the example from
29:37
us, so we started with the program in 2018, now it's
29:40
already 2024. So back then we had like
29:45
physical data centers, for example.
29:47
So we want to implement a password for to manage the
29:49
credentials of in the physical data centre on the platform
29:54
layers. But in the meantime, the world
29:56
was of course changing because cloud came there, which you also
29:59
mentioned. So you need to adopt your
30:01
strategy after well and change it.
30:03
So it's not just like, hey, I define like this now, maybe
30:06
because the world is constantly changing, you also need to look
30:08
again at your risk. So yes, you set your North star
30:12
or whether or whatever on the horizon, but there's never a
30:16
straight line. So it will always go like this.
30:18
So you need to adapt to that as well.
30:20
So it's like, OK, maybe there's some other risk are no more
30:23
important than that we thought of.
30:25
So yeah, then adapt your strategy.
30:28
I can excel that story to your management why you need to make
30:31
these changes, Why? Why there is a higher risk, why
30:34
we should invest there? Because now so also you see with
30:38
there's like capability for cloud infrastructure entitlement
30:41
management. Now we were not aware of that,
30:43
of course, a couple of years ago.
30:44
But there's something which is now important because if those
30:49
hackers get access to the OR the bad guys get access to these
30:51
environments, yeah, then they get their access to a lot of
30:54
information, of course, or maybe they can shut down your business
30:57
even if they get the wrong credentials.
30:59
So you, yeah. So you need to adapt your
31:02
strategy. Wow.
31:03
And it's a challenge because there, but you also mentioned at
31:06
the introduction, there are so many credentials.
31:08
So think about SSH keys. Yeah, if your API credentials
31:12
you have like your domain admin accounts, there are so many.
31:15
So where you will start. So yeah, you need to define
31:18
really where the risks are and accept that also that there are
31:23
other risks and you cannot do everything in Mongo.
31:26
So I feel like this is go ahead. I feel like this is an area
31:31
where, you know, policy and process only take you so far and
31:35
it's one of the areas where it's like you really need technology
31:39
to have this be effectively controlled and managed and so
31:42
forth. Would you agree with that
31:46
statement that this is really something that you do need
31:49
technology, whereas maybe something like an identity
31:51
governance, you could always sort of brute force the
31:55
provisioning or deprovisioning of things.
31:57
But if you really want to effectively manage SSH keys, you
32:01
know certificates, you know APIs, you need to have some
32:06
technology there to effectively do that.
32:09
Yeah, I fully agree with you. So it's nice to have your soft
32:12
controls defined in your framework.
32:14
But yeah, soft controls, never a heart control, so you cannot
32:18
enforce it really. So you really need to have
32:20
technology in place to enforce these controls.
32:25
So let's talk a little bit about that technology because they
32:27
think this is an area where there's a lot of good choices
32:30
that are out there. You know, it's, it's kind of
32:33
like the, the, the, the, the pro and the con, right?
32:35
Great news is there's a solution out there that will probably fit
32:38
your needs and there's lots of solutions that you can be
32:41
successful with. The trick is always finding the
32:43
right solution that's the right fit for your use cases, You
32:47
know, your company, those sorts of things.
32:49
How what's a, you know, what's a methodology or a framework that
32:53
people can use to think about to say, OK, how do I go about this?
32:56
Do I try to find, you know, one privileged access management
33:00
project that kind of does it all?
33:01
You mentioned cloud infrastructure, time, memory.
33:03
That's kind of a growing space that has its own dedicated tool
33:06
set. And sometimes it's a dedicated
33:08
tool and sometimes it's part of another tool.
33:10
Walk me through how you select you know the right product or
33:14
right mix of products to better secure your organization.
33:19
Yeah. So, yeah.
33:20
And also the market is a little changing of course, Jeff.
33:23
So there you see a lot of vendors are now investing in
33:27
other companies and spend buying so, and there's a little merging
33:31
of companies to say like that. So the, the, the privileged
33:34
access management is really changing in the market there as
33:37
well. So I think it's important that
33:40
you go back to your maturity model where you define your
33:43
capabilities and your functionalities, because that
33:45
also gives you already good understanding on the
33:47
requirements which you have. Sometimes you need to detail out
33:50
a little bit more the requirements because the
33:52
maturity in that level is off to a high level.
33:54
So you need to define your use cases and and then use these use
33:59
cases requirements which you defines.
34:02
Go for example, to Garner and also to the Copernico Law
34:05
Forrester and then do a mapping on your requirements, what they
34:09
product vendors offer to define your shortlist, for example, and
34:14
to get an understanding, but also have conversations with the
34:16
analysts choose like, OK, do we did we properly define our
34:22
requirements? What do we overlook or what do
34:24
you see changing in the market? So I think that's really
34:28
important to do to see. Also listen to your peers.
34:31
So in other companies, what they are doing, learn from them to
34:35
ensure that you make the right product selection for your
34:38
company or multiple products maybe I need to see, I mean.
34:42
This is definitely an area where you can talk with other people,
34:44
right? You're, you're probably not the
34:46
first person to do it. So, you know, why not get that
34:49
knowledge? You know, maybe it's yeah, at a
34:51
conference or maybe maybe it's a local network or or things like
34:54
that for sure. Oh, go ahead, Jim.
34:58
No, I'd like to throw in there, I think the that's the two sided
35:01
coin, right? I think we should tap into our
35:05
peer network to learn, but you also have to be willing to be on
35:10
the other side and tap into your peer network and educate.
35:15
You've got to be willing to share.
35:16
Like that's one of the things that Jeff and I really wanted to
35:20
do with the podcast was make this a community of sharing
35:24
information. So you can't only take you've
35:26
got to give as well. That's the only point that I
35:29
wanted to make. Yeah, I fully agree.
35:31
And that's the reason I loved your introduction about the
35:33
upcoming conferences because they're this where you need to
35:36
share your knowledge and experience and learn from each
35:39
other because what Jeff also mentioned, you're not alone.
35:42
So other people have faced these challenges as well.
35:44
So please reach out to your peer, share also your knowledge
35:47
because we can also learn from it.
35:49
So forever, a lot of people, things are new, so the best ways
35:53
to team up with each other and in the end, we all have the same
35:57
goal to improve the security of your organization.
36:00
Yeah, For most of us, security is not secret sauce to the
36:03
success of the organization. That's other things.
36:06
I get it right. There's security vendors and
36:07
things like that. Of course it is.
36:09
But for the most part, we're kind of all in it together as a
36:11
community from a digital identity perspective.
36:15
Let's I want to kind of close out the conversation by you
36:18
putting on your future looking baseball hat to say what is a
36:25
upcoming feature of or capability or something in this
36:29
privileged access management space that you get really
36:32
interested in Like, oh, that could be something that could
36:34
really kind of change the game. Is there anything like that that
36:36
you've seen? Yeah, I hope that the Signal
36:40
framework will help because the big challenge currently in the
36:44
privileged access management areas, there's still, we are
36:47
everybody saying we need to have zero trust and 0 standing
36:51
privileges. But you're still depending on
36:53
technology from application platform, infrastructure layer,
36:56
but also what the vendors offer. So now you need to find the
36:59
right balance between these privileges and 0 standing
37:04
privileges, and I think the Signal framework can also help
37:07
you with that. So I'm putting my hope there
37:11
that it will solve a lot of privilege access management
37:14
challenges. Yeah, and I'm that's totally
37:18
unprompted. That reminds me of the panel
37:20
that I did at Identiverse with my friends Tool and, and Sean
37:24
talking about that shared signals framework and being able
37:27
to adapt and use, right, the same kind of parlance to be able
37:30
to have security events going through there for whatever it
37:34
may be, right? Whether it's continuous
37:35
authentication or evaluation or whatever it may be.
37:37
Or even just having a, a pipeline that we can all agree,
37:40
like here's the language we're speaking and have those data
37:44
signals, you know, work through and take advantage of the data
37:46
that we're already collecting. Jim, you got thoughts on this?
37:50
Yeah. I mean, I think that the Signal
37:52
framework is a great proactive preventative control.
37:57
I'm also just thinking on the detective side that you need to
38:00
be monitoring your environment. You need to look for the unusual
38:05
activity at the identity layer to say, OK, well, this person is
38:10
in our environment and switching identities, and that's an
38:14
abnormal behavior. And then taking a proactive step
38:19
to maybe disable those accounts. You know, another word, stop the
38:24
threat in its tracks. And today we call itdri don't
38:28
know what we'll call it five years from now when maybe it's
38:31
just everybody's doing it. But I think, I think that's
38:36
probably in my mind, potentially the most important thing about
38:41
privileged access management is being able to detect when the
38:47
wrong actor is using Pam. I think recording it, I think,
38:54
you know, sharing or storing credentials, I think the signal
38:59
framework, all those things have huge benefit.
39:02
But I think that they're, you know, you, you, I'm not going to
39:07
call them point solutions, but they solve a problem at a
39:09
certain point, whereas monitoring should be an umbrella
39:13
that looks at everything. It's not completely true either.
39:18
It has to integrate points, but that could be the fall back and
39:22
you have to do you have to do monitoring anyway.
39:26
So that's my my input. I think that's a good spot where
39:31
we can probably close up the conversation.
39:35
I do want to end on a later note, as usual.
39:38
Mikhail, I've never been to the Netherlands.
39:42
What is something that I should do my first time there?
39:45
Like any activities, food locations, like what should I do
39:50
as a first timer? And then I'm going to compare
39:52
that against Jim 'cause I think you've been to the Netherlands
39:55
before, and see if we're on the same page.
39:59
OK, yeah, I'm from the South of the Netherlands.
40:03
So I would recommend to go, for example, to a city that's called
40:06
Certovan Boss. It's a medieval city which is
40:09
really, really nice. And then it's you.
40:13
It was said about food it possible so that's like.
40:17
Whipped cream inside with chocolate on top of it.
40:20
It's really like a bump. But if you eat, it's really
40:22
nice. So that's I really recommend to
40:24
go to to eat and also visit the city because it is a beautiful
40:28
city, Yeah. OK, you had me at whipped cream
40:32
and chocolate for sure. Jim, what is something that
40:36
you'd recommend that I would do having been there?
40:38
So I'd been there and I was there for work.
40:41
So fortunately I have to go and have all my bills paid for on
40:46
the weekend. I wound up staying in a town by
40:50
the North Sea. So it was a beach area.
40:53
I mean, it was fantastic. And I will say that there was a
40:57
vendor outside of the beach and they were selling, I think it
41:01
was sandwiches with like raw fish or maybe fish that was like
41:06
pickled. I didn't try that.
41:08
All right, so that's not my food recommendation, but North Sea I
41:13
definitely recommend. I was staying in a city called
41:15
Leiden during the week and my food recommendation is not
41:20
really a surprise anymore. So I had never heard of shrimp
41:23
waffles prior to going to Holland.
41:25
And basically they're like a cookie with like a waffle
41:30
looking cookie and there's caramel in between and you put
41:34
it on top of your coffee and it was heated up and oh, it was
41:39
like a gooey, wonderful thing. Now McDonald's started mixing
41:43
them in with with their Mcflurries.
41:45
So now everybody, there's no surprise for everybody, but wow,
41:49
fantastic. And you get them on United
41:51
Airlines too. Like that used to be like one of
41:53
the things they do in the morning.
41:54
Are Stroop waffles a thing? Or is that something that we've
41:58
taken to America and like turned it into like something that
42:00
isn't really our thing? I don't know.
42:04
Mahil is that like is are stir waffles something there?
42:07
From typical from the Netherlands, indeed.
42:09
Yeah. So, so Jim is right.
42:11
And I think it's indeed one of the nice things in the
42:13
Netherlands which you need to try.
42:15
But yeah, you already had it from the United States and you
42:17
shut in the during your flights, so.
42:19
Yeah. I can't imagine the United
42:22
Airlines version of a Stroop waffle is like the Creme de la
42:25
Creme, the tip top. Like if I'm going to have a
42:28
Stroop waffle, like what? Where should I go for a Stroop
42:30
waffle? Yeah, volume fresh on the
42:32
market. So if you're visiting a market
42:34
or whatever, there's always you can buy a stroke waffle and then
42:37
they're really nice. OK, all right.
42:40
Sold. I think I need to make a fact
42:42
finding mission to go get some Stroop waffles.
42:43
Thanks for setting me up for that one, Jim, because I, I, I'm
42:46
a big fan of strip waffles. I'd never heard of it until, you
42:49
know, a few years back when, when United started giving them
42:52
out like, what is this delicious treat?
42:55
Very good. I got hooked on them.
42:57
OK, let's go ahead and wrap it up for this week.
42:59
Neil, thank you so much for being part of this conversation.
43:02
We'll have a link in our show notes to your LinkedIn if you're
43:05
comfortable with sharing that so that people can reach out with
43:07
questions or concerns or strip waffle locations that people
43:12
should be checking out. You know, we'll have the links
43:15
for Jim and I as well as LinkedIn.
43:17
We always love to hear from folks who have ideas for shows
43:19
or questions or comments or concerns or heck, if you want to
43:22
high risk, if you want any consulting that too.
43:24
We're on the web, idacpodcast.com.
43:26
We're on X Twitter or whatever it's called.
43:29
By the time this gets to your ears or face at IDAC podcasts.
43:33
I did set up our DNS entry. So now we have idacpodcast.tv.
43:39
We'll take you right to our YouTube channel.
43:41
We are trying to grow this, so please don't hesitate to like
43:45
subscribe to all that fun, you know, YouTube stuff to help us
43:48
grow this channel and get the community built out even
43:50
further. And let's see what else masted
43:53
on at IDC podcast at infosec dot exchange.
43:56
And yeah, I think that's it. So with that, we'll go ahead and
44:00
leave it for this week. Thanks everyone for watching and
44:03
or listening and we'll talk with you all in the next one.
44:08
You've been listening to Identity at the Center.
44:11
We hope you've enjoyed the show. Make sure to like, rate and
44:15
review, and we'll be back soon. But in the meantime, hit the
44:19
website at identity@thecenter.com.
44:23
See you next time on Identity at the Center.