Latest / Identity at the Center / #367 - RSM & IDAC Present - The Intersection of Attack Surface Management and Identity

Transcript

#367 - RSM & IDAC Present - The Intersection of Attack Surface Management and Identity · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:12
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Doing great, man.
0:18
Some of the exciting things going on in our industry right
0:20
now, You've got all the stuff that's NH is, you've got all the
0:24
stuff with identity security in general.
0:28
And then you've got this whole AI emergence that's happening
0:32
now. It's going to, I mean, we don't
0:35
even know what it's going to be like in the future.
0:37
So it's just an exciting time to be in this industry.
0:41
I'm excited for the younger folks who have a lot more career
0:46
years ahead of them, decades ahead of them than than we do.
0:51
Excited and a little scared for them that thinks they'll be
0:55
automated away. But I think that the best thing
0:58
you can do at this point is like embrace the fact that a
1:02
technology changes things, incorporate AI, become
1:06
extradited, and then, you know, try to stand, stand out, stand
1:11
apart. What do you think?
1:13
No, I think you, you said it. We've, we've had disruptive
1:16
technologies before. This is just the latest.
1:18
Is it more disruptive or less than others?
1:21
Arguable. I think it's probably more
1:22
disruptive, but we've been here before, right?
1:24
We had indoor plumbing and electricity and the Internet
1:26
and, you know, computers in general.
1:29
So we just have to figure out how it is.
1:30
And you know, I think, you know, today is when open AI launched
1:36
ChatGPT 5, for example. So I have not had a chance to
1:38
play without a new one, but that's supposed to be a a pretty
1:41
good leap forward. And so there's just a lot of
1:43
things going on. But you said it right.
1:45
I feel like we could just stop the recording there and then
1:47
play like the, the more, you know, you know, symbol that goes
1:50
across the screen, you know, what you're watching on TV or
1:52
something like that. But yeah, it's, it's, it's
1:56
really a cool time. I think there's just so much
1:58
going on and we get into these like periods of like, I don't
2:02
know, hyper innovation where it's like, OK, it's been kind of
2:06
ho hum for a while and then boom, like a bunch of new things
2:09
kind of all come out once and then they'll be another, you
2:11
know, kind of through and then boom, some more things will come
2:13
out. So it's super cool.
2:15
I I, I dig it. I'm I'm all in on AI as everyone
2:18
probably at this point is sick of me hearing because we called
2:20
her this AI at the center sometimes.
2:22
Yeah, really. I will say that one thing that
2:26
hasn't been automated away is in person conferences, spending
2:30
time with people, getting to know them.
2:33
But it has created a whole lot more track.
2:35
So I think, you know, over time more and more people are going
2:38
to get brought into the space and hopefully be able to go to
2:41
the conferences as well. You've got a few lined up here
2:44
in the next month or two that you're heading to.
2:47
Yeah, I'm going to be a busy boy here.
2:48
Through August, September, October, September, December,
2:53
I'll be at the cybersecurity summits in Chicago and Philly.
2:56
So this is put on by our friends at Cyber Risk Alliance.
2:58
So we have discount codes, free discount codes, the rare 100%
3:03
off discount code. So head to our website,
3:05
idacpodcast.com. Scroll down.
3:08
I just updated the website the other day with kind of all the
3:10
codes that I know about at the moment.
3:12
We still have all the ones coming out there.
3:13
So those are in September. And then we've got Ideniverse
3:16
happening again in DC. So this is kind of a smaller
3:19
Identiverse event than the one that's in Vegas, but we'll be
3:22
there. At least I'll be there.
3:23
I'm not sure if you'll be there yet, but we're planning on doing
3:26
another kind of game show type thing.
3:27
So I don't know if it'll be a Dennis wobble or this other new
3:29
game show that we're still putting together, but that's
3:33
something that's coming up. And then we've got Gartner as
3:35
well. So Gartner's in December, we are
3:37
doing a game show for that one. So if we there will be a game
3:41
show happening at either of those events and we should have
3:44
a a discount code for Gartner coming up here.
3:47
Probably I think in October time frame is kind of when those get
3:49
released. So check our website for that.
3:51
But hopefully we'll see lots of friendly faces and in any of
3:54
those locations and come up and say hi and that kind of thing.
3:58
Yeah. I think, you know, using the
4:00
discount codes really it helps us from the perspective that the
4:04
folks putting on the conferences know that, hey, people are out
4:07
there listening to the podcast and they are the folks that kind
4:12
of come to the conferences. And you know, that means they
4:16
want us to be at the conference. They want us to do the game
4:20
shows and record podcasts while we're there.
4:23
So, and that's one of the things that I just love doing about the
4:27
podcast is, you know, being at the at the conferences and
4:31
meeting folks. Yeah, get to meet all kinds of
4:33
cool people and there are a lot of cool people in identity,
4:36
which is super neat. One thing I'm very excited and
4:40
is a major milestone for us coming up is we are about to hit
4:43
1,000,000 downloads for this podcast, which is absolutely
4:48
bonkers considering it's just the two of us doing it for six
4:51
years. But we've seen just crazy growth
4:53
the last couple years. And yeah, we're, we're, we're
4:56
getting pretty close to 1,000,000.
4:57
So I'm looking forward to, you know, celebrating that on on
5:00
LinkedIn, which is kind of where I post stuff like that.
5:02
So how many lists do we have at the end of year one, do you
5:06
know? I would have to look it up and
5:08
see but. Like 20,000.
5:10
Maybe yeah, I I don't even think we had that many.
5:13
It's been a slow time. We don't do any advertising.
5:15
So it's all been word of mouth and, you know, definitely, you
5:18
know, people who have listened, supported, you know, guests on
5:21
the show, sponsors, right, all that stuff is definitely
5:24
contribute to it. But definitely appreciate, you
5:26
know, kind of the audience that we've been able to build and,
5:28
you know, hopefully a cool, fun place to where you can be
5:31
edutained about identity is you'd like to say, Jim, how?
5:35
Many listens or downloads have we had on average like per week.
5:41
Well, I think right now we're in 10 to 20,000 I think a week
5:45
right now. So a lot for an identity
5:47
podcast. I mean, it's pretty niche.
5:49
I mean, this is not Kill Tony or Joe Rogan, but you know, we seem
5:52
to be doing OK. But I've known you for a long
5:54
time and you're probably like padding low, right?
5:58
You're coming in. You don't want to, you don't
6:01
want to overestimate the number. So when I hear that I'm taking
6:04
25. No, I'm pretty, I try to be OK
6:07
with it. It's look podcast stats are hard
6:09
to get, especially with all the different players and vendors
6:13
that kind of syndicate it. So things like Apple and Spotify
6:16
and Google all have different ways to do it and all have
6:20
various levels of reporting. The best that I can tell is,
6:23
yeah, we're, you know, we're going to hit 1,000,000
6:25
downloads. And maybe it's more maybe, but
6:28
the minimum number is kind of what I've I've been going with.
6:31
Yeah. Oh, it's pretty cool.
6:32
Yeah. So what are we going to talk
6:35
about today, Jim? This is kind of like a series
6:37
that we started way, way, way back in January of this year.
6:41
Our first guest was Ghazi from our our employers RSM, our day
6:45
jobs and we have this kind of series.
6:48
We talked about the intersection of sort of like X.
6:50
With. Digital identity.
6:52
So what do we have lined up for today?
6:54
Yeah. So we have a, a conversation
6:56
around the intersection of attack service management and
7:00
identity. And I think it's a really cool
7:03
topic because I think we're all, we read the, the breach reports
7:07
and kind of everything, everything seems to be tying
7:10
back to identity. I, I say everything, not
7:12
everything, but it's a very large percentage and it's it's.
7:16
At the center, man, come on. They're like it's in the name.
7:19
Yeah, Yeah, absolutely. So it's definitely a trend that
7:23
is growing and growing. And when you talk about the
7:25
space of identity security, to me, it seems like half the time
7:31
or more than half the time you're talking about a security,
7:34
traditionally an information security or cybersecurity tool
7:39
that now has an identity element.
7:41
And so as identity practitioners, it, you know,
7:46
it's probably not just like an expansion of our duties unless
7:49
you're at a very small firm, but it's, we're playing an important
7:53
role in different aspects of the overall information security or
7:57
cybersecurity program. So it's exciting stuff.
8:00
I do recommend people go back and listen to that episode with
8:04
Ghazi and all these, you know, our entire catalog.
8:07
You can celebrate our entire catalog.
8:10
But I think that was a good one that kind of kicked off this
8:14
mindset, which is if you look at the overall cybersecurity
8:18
landscape, identity is part of it, but there's interconnection
8:22
between identity and all these different areas.
8:24
So we're very fortunate to have a guest on today to help us out
8:28
with that. Yeah.
8:29
These are these are fun things. I'd like to branch out a little
8:31
bit past normal sort of identity talk.
8:34
And I think, you know, it's important to be somewhat low
8:36
rounded to be able to talk through through not just
8:38
identity, but adjacent security topics and the business side of
8:42
things. So let me go ahead and welcome
8:44
to the show for the first time, Dan Loritsen.
8:47
He's a fellow director with us here at RSM.
8:49
He's part of the RSM defense team, which is really our
8:52
managed security team. So welcome to Idea at the
8:55
center, Dan. Good afternoon.
8:57
Thank you for having me. Yeah.
8:59
So thanks for joining us. I, we have a bunch of stuff that
9:02
we want to talk about and I think this is such an
9:04
interesting area. We're going to have a good
9:06
conversation, but we kind of have a tradition here where we
9:09
always like to find out backgrounds of people and kind
9:10
of how they got into normally we'd ask identity.
9:13
I don't know if you consider yourself an identity person,
9:15
Maybe by the end of this conversation you might be, but
9:18
how did you get into the cybersecurity space?
9:22
Yeah, sure, in some ways it was a relatively simplistic
9:25
entrance, but in other ways it took a bit of the long route to
9:28
get here. And funnily enough, I don't
9:31
consider myself an identity practitioner, but in my prior
9:35
company before coming to RSMI was a campus higher and I was in
9:40
the identity practice for roughly 36 hours.
9:43
So I was almost immediately grabbed and pulled over into
9:46
what I do now, which is detection and response and
9:49
security monitoring. But to go back to your question,
9:52
like where did I start coming out of high school kind of
9:56
figuring out what I wanted to do with my life?
9:58
I wasn't the guy that you would necessarily assume would have
10:01
gotten my way into cybersecurity.
10:03
So most of my colleagues in this field, particularly in the
10:06
defense side of things like to like take apart their vacuum
10:10
cleaners and figure out how they worked or they were building
10:12
their own computers or whatever. That was never me.
10:16
But I did join the military after high school and I got some
10:20
good experience in, you know, a broader defense and security
10:26
context and got to serve overseas and things like that.
10:29
So when I was coming back from deployment, trying to figure out
10:32
what I wanted to do with myself, I was originally thinking I
10:34
wanted to go into the FBI, something in international law
10:38
enforcement, something along those lines.
10:40
And I kind of wanted to parlay my military experience into that
10:43
next phase. So I took a history degree,
10:47
probably ill advised because I just needed a degree to get into
10:51
the FBI, but it was my favorite subject.
10:54
Got all the way up to my senior year and said, I don't want to
10:57
do this anymore and I don't want to be a curator or write a book
11:02
or work at a museum. So what am I going to do?
11:06
So I, I jumped into a, you know, I, I, I researched a bit, I
11:09
figured out a career I thought would be interesting to me.
11:11
I jumped into a master's program that was specifically focused on
11:15
cybersecurity, gained some skills, little bit of coding,
11:18
little bit of lightweight red teaming, system internals,
11:21
things of that nature. Got my feet wet and that was
11:24
kind of my springboard. So I jumped into a consulting
11:27
firm to kind of get that broad base of experience.
11:30
A lot of clients, a lot of industries thinking I would then
11:32
jump out. And here I am 13 years later,
11:35
still in consulting, you know, still enjoying it.
11:38
So. We're lucky to have you, lucky
11:40
to have you here today, Tan. So we're going to talk about
11:44
this intersection of a tax service management and identity
11:48
only start off with kind of a simple question of what is a tax
11:51
service management? Sure.
11:53
So attack service management, particularly, particularly
11:57
within the domain of detection and response, which is where I
12:00
sit, is this continuous process of identifying and managing
12:05
assets so that you can protect them, right?
12:08
So you need to continuously identify where things sit that
12:11
you maybe didn't know about. You need to continuously
12:14
fingerprint them so you understand what they are.
12:17
And then you constantly have to assess and analyze them to
12:20
determine where they fit in business operations.
12:23
And if they don't fit, expunge them from the environment.
12:26
And if they do fit, bring them under, you know, under your,
12:29
your security practices, right? And I think I'm sorry, go ahead.
12:34
Yeah. I'm sorry you use the term there
12:36
assets, I'm just kind of wanting to understand like at the very
12:41
basis, what are you talking about with assets?
12:44
Yeah, yeah. But there's, I mean, there's so
12:47
many ways to use that term in different contexts.
12:49
And like in my field, you will often times use that an asset as
12:53
a computing resource that needs to be protected.
12:55
But to me, it's broader than that, right?
12:57
It's it's anything that's got value to the business.
13:00
That could be a system, that could be a specific computing
13:03
resource. I definitely think identities
13:06
fit into that because it's something that has value.
13:09
You know, it drives a business process.
13:11
It's individually identifiable and you can kind of inventory
13:14
it. There are dependencies within
13:16
the system that require those validations and authentications
13:21
to, to make a process happen. So those identities are critical
13:26
assets in my opinion, and you need to really think about it.
13:28
I think a legacy way of thinking about it is that those
13:30
identities that are tied to authentication, that's kind of
13:33
an IT control. It's a static thing.
13:35
I think the modern way to think about it is it's an attack
13:37
surface and those identities kind of live across multiple
13:41
domains. So therefore they should be
13:43
treated as such. Yeah, I see your point there.
13:46
I mean, treating the identities as assets, does that mean that
13:50
if you have just like a identity sprawl, that you have more
13:54
assets and you're just a, a richer company?
13:58
It's kind of tongue in cheek there.
13:59
But I mean, I, I, no, yeah, I've only, I've only you that that
14:05
mess actually had some value. But I'm wondering, do you
14:09
sometimes interface with clients and you're trying to incorporate
14:13
that Intelli identity intelligence into the detection
14:18
and response function? Is it, is that difference
14:22
between somebody who's invested in identity or organization that
14:26
has versus has not? Does that become very apparent
14:29
where it's like, hey, we can't correlate the actions across
14:33
these multiple systems because the identities haven't been tied
14:36
together? Yeah, yeah.
14:39
I mean, that's one of probably multiple ways that identity in
14:44
the management of identity intersects with what we do in
14:47
the detection and response base. And I think in a lot of ways
14:50
this kind of dovetails with a bigger trend in our industry.
14:55
It's not new and quite frankly, it's kind of a buzzword that
14:58
irritates a lot of people on the detection and response
15:01
community. But this whole XDR concept of
15:03
thinking beyond the endpoints or thinking beyond, you know,
15:06
servers, laptops and bringing in more data, right?
15:10
So that could include things like IoT, so like your physical
15:16
building management systems, HVAC, you know, it could be OT.
15:21
So you know, you're going past that border into logic
15:23
controllers and things that are managing control processes for
15:27
production and manufacturing. And it could also, you know,
15:31
cross that boundary into the domain of identity, right?
15:33
So your identity managers unfortunately I find more often
15:38
than not are a little bit siloed off from the people that I
15:41
operate with and you know, the clients that I serve and and
15:45
deal with on a regular basis. And I think that's something
15:47
that definitely should be remedied.
15:49
But I do think that identity, you know, kind of the question
15:53
you was at, you were asking was, you know, how does it tie into
15:56
what we do and and you know, how do we use identity essentially?
16:01
I think one of the key core concepts there and why it's so
16:03
important is are you guys familiar with the concept of the
16:05
kill chain, the cyber kill chain?
16:08
Yes, I am. OK.
16:10
I mean, it's it's kind of like a little bit of a mantra for
16:12
everybody in the detection response base.
16:14
It's a six step process of the things that an attacker will try
16:17
to do to get it into an environment, right.
16:19
So reconnaissance weaponization, which is where they're building
16:22
the exploit or the the weigh in building the breach mechanism
16:26
delivery. So you get it into the target
16:29
systems exploitation, you make it actually do what it's
16:32
supposed to do so you can gain access command and control.
16:35
So you want to remotely manage, you know, whatever you're trying
16:38
to do and then actions on objective, I want to steal
16:40
something, I want to destroy something.
16:42
I want to, you know, free something up using ransomware.
16:46
Well, identity, if you abuse those identities, you can jump
16:49
start right into the exploitation phase, right?
16:52
So you can, you can subvert four of those steps of the kill chain
16:55
and get right in there if you're just like walking in the front
16:58
door with an identity that's legitimate and already has some
17:01
permissions associated with it. So.
17:04
So damn, we're all, we're all sitting here trying to, to
17:07
learn. I mean, there's a practitioner
17:09
podcast from an identity standpoint anyway.
17:12
I don't, I don't know the kill chain very well.
17:15
Is that something you recommend that people do further research
17:18
on and kind of where would someone want to start if they
17:22
want to understand that? And then you're talking about
17:24
some different aspects where identity can can play a role in
17:29
that Kill Jane. I think it contextually seems to
17:32
make sense for identity practitioners to understand
17:36
that. Yeah.
17:38
I mean, it's a, it's a common enough concept at this point
17:41
that I think, I mean, it's niche, right?
17:43
You, you only really need to reference it if you're kind of
17:46
in the business of trying to stop and attack midstream.
17:48
So I'm not surprised if people outside of our community don't
17:52
really know it very well. But if anyone were interested
17:55
enough to, you know, to learn more about it, it's, you know,
17:58
you could easily just just Google and there's a million
18:01
references and resources online about it to at least get the
18:04
core steps, those six that I just enumerated and kind of get
18:07
an understanding of what those are.
18:09
And I'll put a link in our show notes.
18:11
There's a, there's a, you know, like anything else that's on the
18:13
Internet. So I grabbed the Wikipedia kind
18:15
of entry and I'll put in our show notes so that people can
18:17
kind of check that out. I want to follow up something
18:20
around you said around data and the different silos.
18:24
I, you're, I will say you're not wrong that we tend to see like
18:28
identity teams operating separate from maybe other parts
18:31
of security apparatus, or at least not from a, separate from
18:34
a data perspective. And you know, part of the reason
18:37
this show is called Identity Center is because that's, that's
18:40
legacy thinking, not incorporating identity data into
18:44
your operation center to be able to, you know, treat those pieces
18:48
of data as, you know, other indicators, other signals that
18:52
you want to be able to act on or correlate, etcetera.
18:54
Why do you think that isn't? Are you seeing a change where
18:58
people and organizations and stuff like that are starting to
19:01
incorporate more of their identity apparatus into the rest
19:06
of their security operations? Yeah, yeah.
19:09
So I'll try to break your question apart into two parts as
19:11
to as to like why I think that is and then what I'm seeing
19:14
changing presently. So I think it's probably the
19:19
last like dying gasps of kind of a legacy way of thinking about
19:23
the problem. So people can truly only
19:25
specialize in, in it in a certain number of areas or
19:28
domains, right. And in my field, people are
19:34
particularly interested in all the creation use of malware
19:40
tactics and techniques that are used by attackers to get a
19:42
foothold in the environment and where they want to go after the
19:45
fact. So if you get ahold of an e-mail
19:47
and what you're legitimately and you're holding a legitimate
19:50
e-mail, what are you going to do with it?
19:51
Like what inbox roles are you going to create to stay silent,
19:54
hidden? How are you going to spread by
19:56
sending malicious emails out? Like knowing the, the guts of
19:59
how attackers operate is more of what my community has generally
20:04
been interested in. And then how do they stop that
20:06
right? So I don't think that it's a
20:08
lack of curiosity or lack of like legitimate context.
20:13
It's just, you know, you can only focus in so many different
20:16
areas. So what I think is changing to
20:20
answer the second part of your question is I think tooling and
20:26
the the ability to access data has changed so much and there's
20:30
so much ability to automate and, and use, not exactly generative
20:36
AI, but certainly assistive, you know, assistant AI to crawl over
20:40
these massive treasure troves of data in different ways than we
20:43
did before. And those systems like the ITDRS
20:46
of the world are like the, you know, identity management
20:49
systems of the world can actually provide better context
20:53
and provide all that data over to us.
20:55
So now we're not just getting an alert that says, hey, bad thing
20:58
happened or misuse of an identity with no context.
21:00
We have all the data and the system's actually helping us to
21:03
make make hay out of it, you know, getting some context out
21:06
of it that we can plug into all of our core security knowledge
21:10
and say, OK, the system's telling me this is an identity
21:14
that's used in a certain way regularly.
21:17
This is outside of the bounds of that regular in a regular usage.
21:20
OK, I can couple that with a couple of weird process calls,
21:23
you know, and weird accesses of data in the environment, and now
21:27
I can start to tell a story. So piercing all that stuff
21:29
together, that is that XDR concept, right?
21:31
Don't silo, don't think about, you know, just actions on
21:35
objective or just an exploitation of a certain type
21:37
of malware thinking about the broader picture.
21:40
So that's what's changing in my opinion.
21:42
So there's a kind of a movement that's starting to take hold
21:45
right now in the identity space around this concept of
21:48
continuous identity. So shout out to, you know, our
21:51
friend Sean, you know, out there, he's he's did a lot of
21:54
things identity versus kind of around this concept of
21:56
continuous identity management. And the whole concept kind of
21:59
revolves around things like shared signals framework and
22:03
other components like Cape CAP, continuous excess evaluation
22:08
profile. Think you got it right.
22:09
If not a tool, probably slap me next time he sees me, which I
22:11
would totally deserve. But that kind of data, you know,
22:16
first of all, it requires a lot of data and it requires
22:19
applications and systems to be talking to each other.
22:22
So my focus so far on the SSF and sort of that Cape framework,
22:27
shared signals framework is it's been more focused on the
22:30
identity space. But are there similar concepts
22:33
maybe that apply to be able to take, you know, let's say your
22:36
Octo, your Microsoft, your Ping, your sale point, your Cyber Ark,
22:40
your Savient, your Delineia, blah, blah, blah, right?
22:42
All these different identity tools, if they're all speaking
22:45
the same language via something like shared signals framework,
22:49
that theoretically makes it easier to consume that data into
22:53
a larger system. Maybe to be able to do those
22:55
things like machine learning or pattern recognition or, you
22:58
know, behavior analysis. Because I would love to be able
23:01
to take that data. And that was another thing that
23:02
we've always kind of been talking about was like a lot of
23:04
identity teams sit on their data.
23:07
It's like, Oh yeah, we have an identity program and it does
23:10
access reviews and it does on boarding, off boarding and then
23:12
all that data just kind of sits in some database and never gets
23:15
acted on. Those types of things today, you
23:18
know, can feed into what a SoC might seek, right, To be able to
23:21
correlate and and get smarter, better, faster alerts.
23:25
I don't know if you want to comment on that, but that's that
23:27
seems to be a trend that's taking right now.
23:29
I think you're really on to something and and I think that
23:31
the I think that everything that you're talking about with the
23:34
condensation of data into like common formats that could be
23:37
used across the identity space, that could be really powerful If
23:41
you have different use cases in different platforms.
23:45
If you've got your privileged identity being managed through
23:47
cyber Ark, then you've got your core title means management
23:50
being done through something like an Octa or cell punct or
23:53
whatever. And if you've got all that tying
23:55
back to Kate, that's great. And I could see that, you know,
23:57
tremendous value for the identity management teams
24:00
themselves, but we even kind of layer on one additional layer
24:05
because everything that we do from a detection and response
24:08
space has to come back to the data set that's got disparate
24:11
information coming in from multiple different systems.
24:14
So there's a lot of next generation tool sets.
24:17
It I say next generation just because it's such a buzz term,
24:20
But I mean, at this point it's like generation has gone to
24:23
college and is like buying my first house.
24:25
Not necessarily the next generation, but they, you know,
24:29
that that actually have a core common schema on the back end.
24:33
So they say this is, you know, I'm taking this thing in from
24:36
Octa. Well, this is an identity event
24:38
first and foremost. It's of a certain type.
24:41
You know, it's a, it's a suspicious login against the
24:44
baseline, right? And it shows this kind of
24:48
misuse. I'm going to file that away in
24:49
the schema so that my logic in my detection and response system
24:53
can access those things and plug it into a timeline, right?
24:57
So there's XTR platforms like Stellar Cyber or Chronicle or,
25:02
you know, all these different, you know, Google SEC OPS
25:05
platform, all these different platforms that have that common
25:08
schema on the back end. And that's what they're doing.
25:11
So they're taking all those disparate, disparate pieces of
25:14
information and doing that again for the security community to
25:18
use. And it sounds maybe a little bit
25:21
duplicative or it sounds maybe a little bit like, you know, multi
25:24
steps. But we have the horsepower and
25:26
we have the systems that can do it now and can do it seamlessly
25:30
quickly, you know, affordably. So it's, it's great.
25:34
Yeah, I, I, I see that as a massive trend of, you know,
25:38
massive benefit for us. Can you have too much data?
25:43
Yes, yes you can. Yes, you can.
25:48
And the reason why you can have too much data is if there's no
25:53
is for reasons unrelated to necessarily the core mission.
25:58
So if you ask a hardcore data scientist, data engineer or
26:03
security practitioner, they might say, yes, there's, you
26:05
know, there's no such thing as too much data to send it out to
26:08
me. Well, I unfortunately have to
26:10
sit in the intersection of of our clients needs and what our
26:14
service can provide. And there are cloud
26:17
transportation costs, there's storage costs, there's
26:20
processing costs, there's legal and compliance ramifications of
26:25
housing and storing data. So if it's not, if it's not
26:30
necessary for the mission, you don't need it.
26:34
You can take a lot more of it, like a good example of this is
26:38
in our space DNS data like IPS being divvied out or I'm sorry,
26:45
IPS being accessed, you know, the Internet.
26:48
Thousands and thousands and thousands and thousands of
26:50
entries of data used to be impossible to to gather in like
26:53
legacy SIM. Now you can't because of the
26:55
combination of cloud and next generation SIM.
26:57
So yes, it is possible to have too much data, but for unsexy
27:01
reasons. Yeah.
27:02
I, I actually want to add on to that because I thought I spoke
27:06
to another practitioner actually somebody using consulting and he
27:12
worked on a UEBA implementation or it was kind of a discovery
27:18
process number of years ago. And you know with UEBA it was
27:22
about understanding here is normal patterns of access and
27:25
then identifying abnormal access and triggering some kind of
27:30
event. And the problem was the amount
27:34
of log data that was needed to serve that function was
27:41
petabytes of data, though. And you're talking about a
27:43
really large global organization and just the Active Directory
27:47
logs can be just humongous. And they have to the point where
27:52
it's like, we just don't have that much storage.
27:54
We don't want to buy that much storage.
27:57
Yeah, petabytes, petaflops of data plus a long time horizon of
28:01
interest, right? So you have to have it go for
28:04
six months, nine months, a year with minimal, with reduced value
28:10
of the findings because you're going to have to teach it.
28:13
And then you also have to kind of tune it and tweak it based on
28:16
your specific environment. And then you have to factor in,
28:18
what about my third parties that only access things a couple
28:21
times a year? You know, what about my
28:23
transient employees that only log in to check their benefits
28:26
because they're not IT knowledge workers, You know, all these
28:29
things that just make that that much harder to build patterns
28:32
around. So it's a huge investment of
28:34
time, a huge investment of money and a huge investment data to
28:37
get that to work appropriately. Yeah.
28:40
And I think this conversation, Dan, is just so timely because I
28:44
talked about that identity security and it's really like
28:48
all these detection and response type systems that are having an
28:55
identity component that that's really where this industry is
29:00
kind of focused on lately is, you know, not just to managing
29:05
access, but detecting in real time when access is being
29:10
misappropriated, if you will. It makes it to me, it puts a
29:15
finer point on the fact that we can't live in an identity silo.
29:21
We need to collaborate as practitioners with our
29:25
colleagues, our counterparts in the SoC, for example, and, and
29:31
by the way, when I say our colleagues, our counterparts,
29:35
they don't necessarily work for the same company either, right?
29:39
The identity practitioner may work for the firm.
29:42
The SoC may be outsourced, I guess potentially vice versa
29:46
too. But it it all comes down to kind
29:49
of in my book collaborating with those teams to make sure that
29:55
one identity is able to serve that purpose, but also to the
29:59
the dissection response can serve the purposes of identity.
30:03
You have any thoughts there? Yeah, So I.
30:05
I definitely think that there there's a lot of meat on the
30:08
bone, so to speak and, and how we can increase collaboration
30:11
between the identity management teams and the SoC themselves.
30:14
And you know, I think there's probably 3-3 areas that I would
30:19
think would be good, you know, kind of tactical ways that those
30:22
teams can increase their collaboration and get mutual
30:25
benefit out of it. So the first one is probably the
30:28
simplest, which is just increase that bi directional sharing of
30:32
information. So the identity teams should be
30:35
sharing the types of personas that they're managing, the types
30:38
of identities that they're managing, you know, the
30:40
credential use expectations and maybe perhaps most importantly
30:44
the risk score. So which identities and which
30:48
prudential payers had the greatest business impact.
30:51
So that can influence the scoring and the response timing
30:56
of the security operations center, right?
30:58
So that makes this the security mission stronger if we have a
31:02
better idea of the context of the identities that the ID
31:04
teams. On the flip side, the SoC is
31:08
going to be continuous and gathering, alerting relevant to
31:12
relative to identities and identity management.
31:15
So what we can do is we can continue to share the
31:19
investigations themselves, but more specifically the false
31:22
positives that we're seeing. So here's a rule that we have,
31:25
it's triggering on XYZ conditions.
31:28
And we've noticed in the last month, we've escalated 25 of
31:31
these things to you guys. You've shot them all down.
31:33
It's false positives. Help me collaborate better to
31:36
make sure that I'm not sending these to you all the time,
31:38
right? So how do we tune this thing?
31:40
So that bi directional communication, I think it's, you
31:44
know, listen, I'm a realist. It's not going to happen every
31:46
single week. But if you're having quarterly
31:48
meetings that are, you know, between the two groups, between
31:51
leaders of the two groups, that can probably make some positive
31:53
benefit. I think that kind of gracefully
31:57
transitions into the second one, which is mutual playbook
31:59
development. So as I already said, tuning and
32:02
threshold development is one part of that.
32:04
But another part of that is who do I escalate something to?
32:07
If I see an anomalous travel indicator, somebody's logging in
32:10
from outside of the country, who do I escalate that to?
32:13
Is that to like people management?
32:15
Is that to to you guys in the identity office as we live and
32:20
die with our escalation procedures?
32:22
So having identities like input into those is is very helpful,
32:27
right. And then probably the last thing
32:29
I would say is, you know, one of our core missions in the sock is
32:33
to identify shadow orphaned IT to in the the core attack
32:36
surface management mission. A lot of the tools that we have
32:40
now, whether they're attack surface management tools
32:42
themselves or whether they're things like CNAP, which is cloud
32:46
native application protection platforms, they can actually
32:49
identify the misuse of things like secrets like hard coded
32:54
passwords and CIC pipelines, you know, password secrets, API keys
33:00
being stored out on insecure buckets out of the cloud.
33:04
Sometimes they can even that detect misuse across different
33:08
platforms in the cloud for addition, you know, different
33:10
cloud assets or cloud resources. So I think there's a
33:15
collaborative mission there as well to say, hey, we're doing
33:18
this continuous attack service management mission.
33:20
It dovetails what you guys are doing.
33:23
Let's talk about that. Like maybe we can find some
33:25
orphaned identities or some things flowing out there that
33:28
you didn't even know, Rob. It's an opportunity to get
33:31
creative with some of that data they might be collecting.
33:33
And so we, we've solved collaboration, right?
33:36
Talk to each other. We've talked about the
33:38
importance of the data, but now it comes like it's time for the
33:40
tool. And I feel like this is an area
33:42
where like SIM tends to be like the default choice, but we've
33:46
also got a bunch of new tools in his space that are commonly
33:49
called, I guess, ITDR, identity threat Detection and response.
33:52
You've got XDR, which you mentioned, you know, as well.
33:55
There's, you know, other things like UBA user behaviour analysis
33:59
or UEBA user and entity behaviour analysis.
34:02
We just so many acronyms. Where do these tools fit
34:05
together? Is it still what I would call
34:07
like a traditional SIM type approach?
34:09
Is ITDR the new SIM, or is there some middle ground or
34:14
collaborative space where there's room for all of those
34:16
types of tools? We're in an awkward place right
34:19
now in the, you know, in the security tools industry because
34:26
so many of the platforms have grown so much to to cover a lot
34:29
of different ground. So it creates a lot of overlap
34:32
and a lot of difficult conversations that our clients
34:37
particularly have to ask themselves around where they
34:40
want to get certain, you know, capabilities that come along
34:46
with maybe their legacy partner that would have done something
34:50
that that would they were more niche.
34:51
But now they've grown and grown again, right?
34:52
So like a good example probably being Crunch Trake, they would
34:55
have been the gold standard on point tool for a long time.
34:58
They've grown into a lot of their cloud workload protections
35:01
if they've got an ITDR, you know, capability in NASA.
35:05
So I guess it's a it's a kluge way of saying that it's not a
35:10
replacement for SIM, right? SIM as a concept or as a tool,
35:15
particularly in its legacy stage, was get a whole bunch of
35:19
data into a single platform, run some rules to continuously churn
35:25
over it. So you're finding things in real
35:26
time, right? And then do something with it on
35:29
the back end. And that in in its early stages,
35:31
it wasn't really clear what you were going to do on the back end
35:34
of it. Now things have grown and
35:35
evolved, so you're taking that core data engine, but you're
35:39
building a better skin over the top of it of a common data
35:42
schema. You've got a MAIML crawling over
35:45
the top of that, detecting things and and doing things in a
35:47
more intelligent way, you know, with more heuristics.
35:50
You've got all those different plug insurance, you've got the
35:52
cloud plug in, you've got the identity plug, you've got the
35:54
endpoint plug in, right. And all these things are feeding
35:58
back into that same data set. And then and the additional
36:02
layer on top of it, or now there's an automated response
36:04
capability because maybe there's an inbuilt sore or maybe there's
36:07
other, you know, integration capabilities to go out and
36:10
actually touch an identity management system and, and
36:13
sideline something, you know, sandbox a profile or a user or
36:17
whatever. So it's not a replacement.
36:19
Certainly to that part of the question.
36:22
Their legacy platforms just they can't keep up.
36:25
They're they're bad at scaling data.
36:26
In order to clunky to manage, you have to tell it exactly what
36:29
logic you're working for. It doesn't have the AIML
36:31
components that kind of help you in that mission.
36:35
So not a sin, you know, same as a different thing in and of
36:38
itself these new XDR platforms. To the second part of your
36:41
question, ITDR specifically is 1 component of many that all these
36:47
vendors are trying to condense. So it's part of a broader set of
36:52
capabilities that everybody's bringing together into into
36:55
platforms. And the challenge we have now is
37:00
identifying the core capabilities you need and then
37:03
kind of doing a vendor analysis to see who have you had for 10
37:06
years for endpoint and who have you had for identity and who
37:09
have you, who did you deploy five years for cloud and what
37:11
are they totally off for? How do we kind of declutter that
37:15
to kind of stream on vendor management that's it's an
37:19
interesting intersection in the security tool space right now?
37:23
So Dan, I'm thinking about how a tax service management evolves
37:29
into the future. And I also want to make this,
37:32
you know, kind of pragmatic with some takeaways for the
37:35
practitioner. So I'm kind of thinking like,
37:37
what are the what are some of the strategies that we could put
37:41
out there? But I do want to interject
37:42
something first, which is talked about this conversion of
37:46
identity and endpoint threat detection.
37:49
But it seems to me every time we hear about like a really big
37:52
breach usually starts by somebody getting fished or a
37:56
help desk getting socially engineered.
37:59
So it seems to me like no matter what we talk about in terms of
38:03
strategies, it's like we've got to do a better job at like not
38:07
letting that happen because you know, we're talking about
38:11
identity as like the the gate, the door, usually it's they're
38:16
walking through the front door. They're just take in the account
38:19
they got. So I don't know if that
38:20
resonates with you, but then if you can kind of talk about in
38:24
terms of like pragmatic strategies that people can can
38:28
invoke. Yeah, I mean, identities are
38:31
tied to people and you can't patch people, right?
38:34
There's that old like problem between chair and keyboard.
38:36
That's the that's the issue, right?
38:39
So until you figure solve that problem, like we're never going
38:43
to be out of the calling up the help desk and saying, can you
38:46
please just pretty, pretty please reset my password so I
38:49
can get in and having somebody do it for you.
38:53
But having said that, you know, things that you can do.
38:57
I mean, treating identities, like I said at the beginning, as
39:01
an asset that allows you to unlock things across the now
39:05
sprawling multi environmental corporate, you know, bohemus
39:10
that we have, you can take kind of a zero trust approach and and
39:15
not take anything for granted. Reduce permissions as much as
39:19
humanly possible, introduce borders and barriers between
39:23
trust zones, you know, locked down to the even down to like
39:26
the cloud side workload level. You know, you have to
39:29
authenticate in all those different instances.
39:32
Not easy to do, takes a long time, takes a lot of investment
39:36
and in a lot of cases you can't necessarily bolt that on on top.
39:39
You kind of have to refresh your architecture to make that work.
39:43
So that's like the Nirvana state, but very, very few of us
39:47
can get to that Nirvana state, right?
39:49
So I think what you do is, you know, you do the best with what
39:53
you've got. So one thing that I think a lot
39:56
of practitioners fall into the the trap of with in my industry.
40:02
Is they're constantly chasing the next shiny thing that's
40:04
going to make everything work better.
40:07
Just really do that deep thinking around what vendors do
40:10
I have in place what tools do I have in place?
40:12
What value can I get out of it? How do I stretch to the maximum
40:16
value with all those capabilities that, you know,
40:18
that vendor brings to me? And then how do I make my
40:21
processes rock solid? So I'm actually sharing
40:24
information between my sock and my my identity team.
40:27
How am I actually like making sure that I'm putting in the
40:31
hours to have all of my vendors, you know, have the same level of
40:35
rigor as my internal users when it comes to identity?
40:38
Like, it's not, there's no magic, you know, so sexy magic
40:43
bullet that's going to make it all go away, unfortunately.
40:45
Yeah. I mean, you know in the as a
40:49
practitioner too, we get allocated a certain amount of
40:52
funds to go and apply to our program.
40:57
But ultimately usually have to kind of show like, hey, we got
41:02
value out of this, but it's hard with security.
41:05
It's kind of like saying, I started working out at the gym
41:07
and I haven't been robbed in two years.
41:11
It's like, well, maybe you wouldn't have been robbed
41:12
anyway, right? So do you have any
41:16
recommendations there in terms of like trying to tie back the
41:20
value to these investments? Metrics should be few and should
41:25
be, you know, valuable. They should.
41:26
They should, they should enable decision making and they should
41:30
be, you know, coherent, concise. But some of the best security
41:36
metrics from a sock standpoint have to do with coverage and
41:39
devices under management. I think you could do something
41:41
similar with identity, right? So from a foundational
41:45
standpoint, how much has multi factor authentication been
41:50
deployed without the environment and and set some gold standards
41:52
for that. How much privilege account use
41:55
do you have? And if you're really going to
41:57
start a campaign to limit privilege account use or over
42:01
privileged machine accounts, right?
42:03
So like non human accounts that are that are performing back in
42:07
functions. So how much privilege account
42:10
use do you have? How much machine account use do
42:11
you have? And can you drive a trend of
42:14
like my campaign has driven that down right and identity
42:19
inventory, right? So you have X number of
42:23
corporate users, you have wide number of of vendors that should
42:26
track to a certain number of assumed identities and, and
42:30
accounts. And then you know for your
42:32
workloads, how many different permissions, whether they be API
42:36
keys or whether they be, you know, otherwise secrets that you
42:40
need to have to make all those things wrong.
42:42
So like, are you actually identifying them and are you
42:45
actually inventorying them? That's kind of like your
42:46
foundational level level if you want to get into something more
42:49
advanced, like how do you start having trailing indicators to
42:53
show that entitlement creep? So I went through this whole,
42:56
you know, I went through this whole initiative.
42:58
I inventoried and identified all my, you know, all my identities.
43:03
I got a derived A trend for my privileged account use.
43:06
OK, but now I'm starting to see that tick.
43:08
Why is that? You know, what's happening?
43:10
Is that actually legitimate? Another thing is the unneeded or
43:13
non compliant identities that are being found.
43:15
This ties into what I said about using the attack surface
43:18
management and CNAP tools or partnering with this.
43:21
Am I seeing an increase in orphaned accounts?
43:23
Am I seeing an increase in, you know, identities or secrets
43:26
floating out there that I didn't know about before?
43:28
Like that's when you really start getting into the more
43:31
advanced levels of metrics around your identity management
43:34
program. So I think if you do that, if
43:36
you do those things and you can really preach the value of what
43:39
you're doing. So final question from the The
43:43
Great Inquisition of 2025 here. What is the biggest
43:48
misconception that you see when people start to think about, OK,
43:52
here's what my attack surface looks like and how do I start to
43:56
reduce that? Like what is something that
43:58
people maybe can start to do or things that you see people do
44:01
wrong? Like I would not have started
44:03
with that way? Like what's the biggest thing
44:04
from your perspective that people listening to this go out
44:06
and say, OK, here's how I start to tackle this problem?
44:09
Specifically because of the way that you asked the question
44:11
around misconception, I think the biggest misconception would
44:15
be that it has to be a comprehensive program.
44:21
Like all the little singles that you can hit all contribute.
44:25
So like pick a problem today, work on it for a couple months,
44:28
turn your attention to another problem in another couple ones
44:31
right? You're not going to solve like
44:33
the ASM problem in a grand campaign.
44:37
Just identify things, catalog things, get them under wraps,
44:42
move on to something else. Just be iterative.
44:44
And then when you don't take that approach, you never get
44:47
anywhere because you just analysis paralysis.
44:50
And you can't really ever truly solve it right?
44:53
It's really just about getting skinny, getting small small
44:56
target to hit. But it's not like your attack
44:58
surface is over 0. Is that a proper way to think
45:01
about it? Yeah, 100%.
45:03
Yeah. I'd absolutely agree with that.
45:06
Well, Dan, you've been really generous with your time.
45:08
I do want to get into a little bit of your your background.
45:11
And I know you have some military background.
45:12
You've referenced mission several times throughout this
45:14
conversation as well. One of the roles that I saw as I
45:17
was, you know, stalking you on LinkedIn is human intelligence
45:21
collector. So I want to dive into that a
45:24
little bit here to kind of end the show.
45:26
But tell me, what is a human intelligence collector for
45:29
people who aren't familiar with that role?
45:30
And then I want to ask you some follow up questions around it.
45:33
Sure, sure. So human intelligence collector
45:36
is particularly in the Army, which is where I was, is the
45:40
lowest man on the totem pole for the intelligence community.
45:45
So we're the guys out there in in Army uniforms trying to
45:49
trying to get secrets or information that could be
45:51
helpful and then pass people chain.
45:53
But there's kind of two sides to that mission.
45:56
There's the classic like booth interrogation style of
46:01
questioning that everyone would think of it.
46:03
They've seen in movies or you know, I've seen in TV shows
46:06
where somebody is a detainee, they've been captured.
46:09
You've got them for an hour with an interpreter in the room and
46:12
you get to ask them all the questions about, you know,
46:15
whatever topic of interest we have in for.
46:18
Then the other side of the mission is more elicitation on
46:21
what they call source operations, which is more around
46:25
making friends with locals and building connections in a
46:28
community and trying to get people to want to provide
46:31
information for either their own benefit or for the community
46:35
benefit. So I was more on the on the
46:38
source operations and elicitation side of things.
46:42
So that be kind of like a for the people in the US here like
46:45
neighborhood watch, for example, kind of like partnership or kind
46:49
of a band of people who are willing.
46:50
To provide information. So in, in I'm from Chicago.
46:54
So in Chicago there was this program 20 years ago at this
46:58
point that was like it was called CHAPS.
46:59
That was an acronym called CHAPS, but it was, you know,
47:02
Community Action policing. And that's exactly what it was.
47:05
Is they were going to go around and kind of deputize people in
47:08
the community and say, you know, you're a liaison.
47:10
If you see something or, you know, come and say something to
47:13
the police, like let us know what's going on here.
47:16
Similarly, Yeah, you'd say, OK, you're a village elder.
47:19
You know, you're, you know, you have a position at the mosque
47:22
or, you know, position of influence.
47:25
You probably see what's going on.
47:26
You know, everybody in the community, you know, help me
47:28
understand what's going on here. Help me understand the problems
47:30
you guys are chasing. Help me understand who could be
47:33
causing trouble. Yeah, it's that concept.
47:36
So would you consider Jim and I human intelligence collectors by
47:40
way of this podcast or something similar?
47:43
Like how do I how do I get an honorary title on this?
47:47
I'm sure there's been a lot of intelligence collected on your
47:49
podcast, maybe not in the last hour, but in other episodes I'm
47:53
sure that's been the case. I think we'd be the troublemaker
47:57
chef. Somebody would be like, yeah,
47:59
Jimmy, Jeff, this. Guy good trouble.
48:00
Know about them? Good trouble, good trouble.
48:03
Like that's, you know, we're asking questions and, you know,
48:05
eliciting responses. I think, you know, one of the
48:08
things that I, I'd love to hear from your perspective, Dan, is
48:12
what are, what are some tips that maybe Jim and I can take
48:15
away for future conversations because it's too late for this
48:17
one where we can ask better questions.
48:19
Or maybe for people who are listening right out there,
48:22
they're in probably an identity that they can ask their
48:25
stakeholders or, you know, other people that they need to either
48:30
influence or try to get some better information out of other
48:33
tips that you can share with, you know, us peons in that
48:36
space. Oh, too harsh on yourself?
48:40
A couple of things. The first thing I would say is
48:46
conversation is it's easy, it's fluid.
48:49
It's kind of a natural thing everyone does.
48:51
But when you specifically want to get information out of
48:54
someone, whether it's because you're defying a mutual goal or
48:58
you're it's a client situation and you need to know how to
49:00
better serve them, have a plan about the questions you're going
49:03
to ask and how you're going to ask them to get to a certain
49:05
conclusion, right? So plan out your conversations,
49:09
important ones anyway, is the first tip.
49:11
The second tip is definitely ask open-ended questions.
49:15
Far too many people I hear ask a question that ultimately ends up
49:19
in a one word answer or a yes or no and you don't get anything
49:23
out of it. So make sure all of your
49:24
questions are open-ended and force the other person to talk a
49:27
little bit. Gives you more to pin it off of.
49:30
And I think the third thing is it's just like really actively
49:33
listen, right? Because people say so much
49:35
between the lines in the way they see something or the thing
49:39
that they don't say that you would expect them to say that
49:42
tells you that they may be apprehensive about something or
49:44
they're worried. So really become good at
49:48
understanding the people's tics and like paying attention to how
49:52
they talk and what they don't say.
49:55
And that's just good in all walks of life.
49:57
I mean friendships, your family, client relationships.
50:01
Like just you'll be a better communicator.
50:04
Yeah, I've heard the scenario where they say it's how to make
50:10
the person that you're talking to think it was their idea.
50:13
So if you have an idea, Dan, that was a great idea that you
50:18
had. Even though.
50:20
Maybe really it was my idea. Incepted.
50:25
I love that idea. Exception.
50:26
Like, yeah, plant the seed and let them think it's there.
50:29
They're a great idea. That's great.
50:30
That's great. All right, well, this has been a
50:32
fun conversation. I learned a lot.
50:33
I think this is an area, This is why we are very fortunate to
50:36
work with a bunch of people here at our some lots of access to
50:39
the really smart people. So Dan, thank you so much for
50:41
being part of this. I will have links in our show
50:43
notes to your LinkedIn profile. People have questions around
50:46
that want to get, you know, in touch with you.
50:48
I'll have a link to the attack kill chain as well for people
50:51
coming on that spoiler. It's going to be the Wikipedia.
50:54
Like that's the one that's probably the easiest one to go
50:56
for. And yeah, so appreciate you
50:59
being here, part of this. You can find us on the web, IDAC
51:02
podcast.com, like subscribe, help us hit that million and
51:06
then maybe the next two next million after that.
51:08
But appreciate everyone who has supported us.
51:10
And, you know, thank you all for watching and or listening.
51:12
So with that, we'll go ahead and leave it there for this week.
51:15
Thanks. And we'll talk with you all in
51:17
the next one. You've been listening to
51:20
Identity at the Center. We hope you've enjoyed the show.
51:25
Make sure to like, rate and review, and we'll be back soon.
51:29
But in the meantime, hit the website at
51:31
identity@thecenter.com. See you next time on Identity at
51:38
the Center.