Latest / Identity at the Center / #404 - Sponsor Spotlight - Bravura Security

Transcript

#404 - Sponsor Spotlight - Bravura Security · Identity at the Center

0:04
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. I'm doing great.
0:17
I'm really excited about today's episode.
0:20
Not too often that we find a company that's been in I am
0:24
longer than we have, but I think we have one of those today.
0:28
Also we have a fantastic guest from that company.
0:30
Some we we met at Identverse DC. So I'm telling you, that
0:35
Identverse DC conference was well worth our time.
0:40
Yeah, it was a lot of fun and I, and I don't have it in front of
0:43
me right now, but I do have a Rivera Security IDAC custom
0:48
Tumblr or mug, whatever it is. So I definitely appreciate that.
0:51
But yeah, let's get into it today.
0:53
This is a sponsor spotlight episode, so this is where we
0:55
find out, you know, perspectives and opinions on the identity
0:57
space from the people who make this podcast possible.
1:00
So we definitely appreciate that today we've got Rivera Security.
1:03
You can find more. Find out more about them at
1:06
riverasecurity.com/I DAC. That's BRAVURA security.com/I
1:14
DAC and I want to Welcome to the show Bart Allen.
1:16
He's a general manager with Rivera.
1:18
Welcome to the show, Bart. Thanks, Jeff.
1:21
Great to be here. Excited to kind of see the
1:24
inside of how this is all made and comes together.
1:27
Yeah. So you're seeing the remote
1:28
version. I think you probably saw us
1:30
doing some live episodes at the identifiers DC there, sort of
1:33
the tail end of 2025. So you can see the sausage being
1:37
made, the the chaos slash mess that is happening, but for
1:41
whatever reason, people tune into that.
1:43
Let's find out more about your background.
1:45
My first question anytime that I meet some of the first time on
1:47
the podcast is really kind of learn more about their
1:50
background in identity and security.
1:52
So let's start there. Bart, how did you get into the
1:55
identity space? Yeah.
1:57
I mean, it's been a little bit over a decade since I started my
2:02
journey in identity. Before that, I was in kind of an
2:06
adjacent space, enterprise content management, controlling
2:10
who has access to what and surfacing the right information,
2:13
but really from a different angle.
2:15
So I actually started at almost 11 years ago in our consulting
2:20
space helping customers solve identity problems and, you know,
2:25
figuring out how to improve their security posture.
2:30
And then, you know, through the years, kind of grew into more of
2:33
a leadership role, spent a lot of time trying to figure out how
2:37
we can make identity an easier problem to solve.
2:43
So many, you know, difficult projects, long implementations,
2:47
et cetera. And I think, you know, that's
2:50
something that I've really brought to the leadership role
2:53
as well as, you know, paying attention to our customers,
2:56
prospects in the industry. But it's also what anchors me
2:59
here. I think I love the fact that
3:02
this is a space where the problem I was solving yesterday
3:05
is different than the problem I'm going to be solving
3:08
tomorrow. I mean, we've seen it in the
3:10
past, you know, 12 months with the evolution of agentic
3:13
identities. And I'm sure we're going to see
3:15
another evolution here shortly. So, you know, that's, that's
3:19
what got me into it. I don't necessarily know that it
3:21
was a path I chose or if it chose me, but I'm here.
3:24
I do enjoy it and look forward to talking more about it.
3:30
Yeah, I feel like I Denny's one of those things like just when
3:32
you've got it figured out, oh, here comes something new and
3:34
interesting and you kind of have to restart and kind of figure
3:36
things out and tap that background to try and say, OK,
3:39
how do we address this problem? So I'm with you totally on that.
3:43
For people who are not familiar with Brivera, why don't you give
3:46
a sort of like the the rundown on, on who you guys are because
3:49
you actually go way back, even before it was called Brivera,
3:52
right? Yeah.
3:54
So we were founded in 92. Back in the day, we really
3:59
focused just on password management.
4:01
I think our first product launched in 1997, which was just
4:05
a self-service password reset tool.
4:08
We've been through a number of different acquisitions and
4:10
rebrands. So in the 20 tens we became part
4:14
of Hitachi. A lot of people will know us as
4:16
Hitachi ID systems. And then in twenty 20s and 2022
4:21
specifically, we took on the name Rivera Security.
4:25
So you know who we are and what we do.
4:29
I mean we've been around for so long that password management
4:32
actually started to evolve into identity management.
4:35
We're managing, you know, passwords on Active Directory,
4:38
unique systems, mainframes, AS4, hundreds, you name it.
4:43
And at some point somebody thought, well, could we also
4:46
start to create accounts? Could we start to deprovision
4:49
accounts? Could we start to handle the
4:50
identity life cycle? And so we started to do that.
4:54
We were probably one of the first vendors in the space.
4:57
I don't think, you know, it was something that we, it wasn't a
5:01
space that existed at the time I guess.
5:04
And then similarly fell into the problem of privileged access
5:08
management had a couple of customers who were already using
5:11
our password solution to reset passwords programmatically on a
5:16
scheduled basis to secure privilege and so started to
5:20
develop a solution around that. And that's evolved into kind of
5:24
the company we are today. I describe ourselves as like an
5:27
end to end identity security provider.
5:29
We're one of the only players in the industry with a native
5:32
platform and I think it gives us a unique advantage.
5:36
Plus, these three decades of experience definitely can't
5:38
hurt. So talk about tapping at history
5:41
just to make sure you're doing right by the future.
5:44
I almost curious how names of companies come to be.
5:47
So tell me about the name Rivera.
5:49
How did you and the rest of the people there kind of come up
5:52
with the name Rivera for the organization?
5:55
Yeah. So you know in 22, we knew that
5:59
an acquisition was kind of nearing.
6:02
We took the opportunity to do a bit of a product rebrand in
6:05
advance of the company rebrand because we knew that was going
6:07
to be very quick leaving the Hitachi ecosystem that we had to
6:11
leave that name behind as well, which is, you know, a very
6:15
trusted brand. It revolves around, you know,
6:17
quality and everything like that.
6:20
So when we're thinking about it, you know, one of the things that
6:22
came to light is our deep technical expertise.
6:26
We have people who are still here today, who've been here for
6:30
almost 25 years. 25 years ago, the identity space didn't really
6:34
exist. So it really comes from the root
6:37
of, you know, a word that describes technical brilliance
6:41
or expertise in a specific space.
6:43
And we thought it was kind of fitting, differentiates us from
6:46
some of the others so. I love hearing stories like
6:49
that. It's like, all right, it's
6:50
already interesting. So that's like an Easter egg.
6:52
If somebody reaches out to Bart, it's like, hey, I know where the
6:54
name Rivera came from. Now that was the friendly
6:57
question. Now I'm going to put my jaded
6:58
CSO hat on because I feel like there's so many different
7:00
products in this space and, and, and identity at large just has,
7:04
you know, hundreds, if not thousands of products.
7:07
So I'm going to ask you the question like, what is it that
7:10
you think makes Provera unique? Like what do you bring to the
7:13
table that people should be thinking about?
7:15
It's like, oh, maybe I haven't quite seen that before.
7:17
Or what do you think is like that special sauce?
7:20
You know, our special sauce is the fact that we built this up
7:24
natively across 3 decades. So that means we have a unified
7:29
set of connectors for identity privilege pass or password reset
7:34
and we can do things that require a lot of integration in
7:39
other scenarios, right? You might pick a best of breed
7:41
identity tool and a best privileged access tool.
7:44
And then you're posed with the question, well, where does
7:46
privilege identity management happen?
7:48
Does it happen in the identity tool?
7:50
Does it happen in the privilege tool?
7:52
And then if we want to go certify those things or, you
7:55
know, do deeper analysis, you know, where does all of that
7:58
happen? And often times we find
8:00
customers say, well, it happens in, you know, service now or
8:03
some other platform where, you know, we're not truly managing
8:08
these things. So that's really, you know, the
8:11
core of the secret sauce. I think, you know, what we're
8:14
going to talk a little bit about today is, is again, another one
8:17
of those solutions that arises from having this native suite,
8:22
right? We can, you know, not only
8:26
manage password resets, but we can maybe shift the paradigm on
8:30
that as well. So.
8:33
I'm going to steal Jeff's jaded C so hat I'm going to put it on
8:37
backwards and I'm going to ask you this question.
8:39
I mean, I'll be honest with you most of the episode, we've had
8:43
way more episodes about the password dying and going away
8:48
than we've had about how to manage passwords better, how to
8:51
have a a tool and a methodology and approach.
8:55
So one, I want to ask you, you know, why is there still a need
8:58
for a password manager? And then #2 I guess I'm going to
9:03
help you out a little bit with this one, which is, look, as
9:07
much as we might want to say the password is dead.
9:09
And I think the first person to declare that, or at least the
9:12
one that we've made fun of the most, that Bill Gates said it in
9:15
like 2006, the password is dead. And like I think he was before
9:19
even the Crest of the importance of the password, right?
9:22
That probably happened a few years later at least.
9:27
But you know, it's 2025 or 2026, it's 2025 and previous years.
9:34
It's like breach after breach tied back to passwords, either
9:40
fish passwords or socially engineered passwords or password
9:45
spraying. I mean, it keeps coming back to
9:47
passwords, right? So I guess that's my my question
9:51
is like, why is a password manager important now?
9:54
And then why does this keep happening?
9:58
Yeah, I mean, I think password manager alone is important, but
10:02
talking about like, why passwords?
10:05
You know, I, I think the uncomfortable truth about
10:09
passwords, in my opinion, is we've been trying to get rid of
10:12
them for the better part of a decade, probably even closer to
10:16
a decade and 1/2 through one way or another.
10:21
And we love talking about all of the things that are going to
10:24
replace passwords. But I feel like that story
10:26
continues to change and evolve, which is good.
10:28
The industry does too. But I think we often ignore all
10:33
of the things that are going to use passwords for the next
10:35
decade or maybe even longer, right?
10:37
There's legacy systems, there's platforms that don't support
10:41
single sign on flows or don't support standards based single
10:45
sign on at least. And you know, when we talked to
10:50
organizations, a lot of them might get 80% of the way there,
10:54
right. You know, 80% of their systems
10:56
are newer, modern enough to support some sort of single sign
11:01
on flow or standard, which is great.
11:04
Then you can eliminate the passwords there.
11:07
But then what about the 20%? And I think where organizations
11:11
get stuck is in this last 20% where you don't really reap the
11:16
benefit of being password less and being, you know, breach
11:20
proof. If you can even say that until
11:24
you actually eliminate the user in the password flow or in the
11:28
credential flow, which is what you know, pass keys and password
11:31
lists are really aiming to do. I think it aims to solve the
11:34
problem of humans are bad at forgetting passwords, setting
11:38
passwords and remembering to reset them when they need to.
11:42
So you know, our on that is really well, there's multiple
11:47
ways to solve that problem. And so if we think about using a
11:50
password manager that's connected to your other systems
11:54
and can automatically have passwords distributed that are
11:57
very similar to how we would tackle privileged access
12:00
management, then you're removing the user from that journey.
12:04
They don't have to reset it, they don't have to set it
12:07
initially and they're not going to set a bad one that can be
12:09
breached. So.
12:12
Yeah, I think that's a really good answer.
12:13
I mean, I use the password manager because even though I
12:17
have passkeys available for certain applications that I use
12:22
throughout through applications that don't have passkeys, they
12:26
still rely on passwords, right? So I don't know my to do this
12:29
passwords writing down the notepad or just reset my
12:33
password every time. Obviously we haven't the
12:36
password is not dead. Even if we've beaten it to a
12:40
bloody pulp, it's not dead, right?
12:42
So that makes sense to me. You know, I'm just kind of like
12:46
thinking back through my experience.
12:48
And I think the password manager I have, I've always thought of
12:53
termed as like a personal password manager.
12:55
And then there's enterprise password managers.
12:58
I'm wondering if you could for audience explain the difference
13:02
between the two and then tell us what Pervora's solution is.
13:09
Yeah. I mean, for me, the difference
13:10
between a personal password manager and enterprise password
13:13
managers really the paradigm of who has control over what's in
13:17
that. You know, I think a lot of
13:20
employees, staff contractors are using personal password managers
13:25
for their business passwords, which creates an additional
13:29
layer of business risk. And so an enterprise password
13:32
managers, really just one that is geared towards an enterprise
13:36
where they want to be able to maintain control of the
13:39
credentials that are in that vault, even after that employee
13:45
may have left and be assured that, you know, they're not
13:47
getting leaked and have some ability to audit and see where
13:52
they're used, what they're for. You know, I, I like to think of
13:55
it as like the last mile to password list, right?
13:58
So you, you hit this 80% adoption and you're like, OK,
14:02
great. So what are we going to do with
14:03
the rest of this 20%? And I think a lot of companies
14:07
go down this complex digital transformation journey where all
14:11
these systems are going to have to be upgraded or modified at
14:14
some point, which is great, but that takes time.
14:17
What they can do today is start to put those in a password
14:21
vault. And then what our solution does
14:24
that is a bit unique in the market as far as we can tell is
14:28
from our lineage in managing self-service password reset,
14:32
integrating with hundreds of different applications including
14:34
legacy mainframes, etcetera. We can actually treat these
14:38
credentials like we treated in privileged access management and
14:41
we can rotate them nightly, every week, every 6090 days and
14:47
we get to set them. So it gives IT the control of
14:51
the password back and they no longer have to really be
14:54
worried. The other thing that comes up a
14:57
lot is, you know, we get in these scenarios where a company
15:01
has a breach and they have to go reset hundreds or thousands of
15:05
passwords. And that's really hard to do.
15:08
It's a lot easier to do when you can do it programmatically and
15:13
then you have a mechanism for distribution.
15:15
Because while you might be able to write, you know, a PowerShell
15:18
script or whatever that goes and resets all the passwords and
15:20
enter ID, then you have the problem of, OK, well, how do I
15:24
get Jeff and Jim their passwords?
15:26
You know, how do I make sure that they are actually who they
15:29
say they are and I'm not just letting bad actors back into the
15:32
system. So.
15:34
You know what you kind of described there is almost like a
15:36
quasi password less type approach where you know you're
15:39
letting you're letting the the wallet, the vault, whatever you
15:43
want to call it, right? Manage that for you and me as a
15:46
user. I don't have to know that, but I
15:48
guess the, there's a little bit of a, of a, of a split here
15:52
though, because a lot of organizations are spending and,
15:56
and rightly so, money and time to get on to things like single
15:59
sign on, you know, get MFA, get identity platforms in place,
16:03
right, things like that. So the idea is like, hey, let's
16:04
get everything centralized. Let's use one strong credential.
16:08
But you talk there about sort of that last mile and I think
16:11
that's where a lot of the operational reality still comes
16:14
into it. Can you talk a bit more about
16:16
what that breakdown is like? OK, great.
16:18
We got 80%. What about the other 20%?
16:21
Like that's, that's still the key part of it that you're
16:23
looking to address, right? Yeah, exactly.
16:26
I mean, I think you know again I'll, I'll kind of reassert the
16:30
passwords not gone until you're not using it anywhere.
16:34
We talked to an organization recently, I think had a
16:37
identifiers DC who was doing exactly this and they took a
16:42
different approach to it, which was they required people to
16:46
reset their password in order to get access to their password,
16:50
which is not super user friendly.
16:53
But when when you talk about kind of the breakdown of
16:55
systems, right, there's a lot of legacy technology.
16:59
I mean, you know, there's still mainframes in existence.
17:02
There probably will be for, you know, God knows how long until
17:05
IBM stops manufacturing them perhaps and selling them.
17:09
But you know, that's not going away as quickly as we need to
17:14
address the security problem, right?
17:16
And so I think this is like a pragmatic approach to, okay,
17:21
well, look, we're still going to go on this path and this
17:24
journey, which by the way, we believe in as well, right?
17:27
Which is you want to eliminate passwords, you want to eliminate
17:30
the human in them. But you know, what do we do in
17:33
the meantime, right. So in the meantime, while we
17:36
have a secure way to deal with them, the other piece of that
17:39
breakdown that enterprises really don't think about is, OK,
17:42
I've got these 150 applications in my ecosystem that I'm going
17:46
to manage access to. Well, what about the 150 to 500
17:52
applications that your staff are using for business purposes or
17:55
otherwise where they're still setting bad passwords because
18:00
those systems haven't evolved to use pass keys or the users
18:03
aren't comfortable with them? You know, I think about, we
18:05
talked about Identiversity C, right?
18:07
All these events you go to, you create an account on some
18:10
platform, be it like, you know, Cvent or something else.
18:14
And it's just the proliferation of more and more accounts.
18:18
I think the last time I checked in my vault for work, I have
18:22
about, you know, 11:50 managed credentials, ID things that are
18:26
like really truly owned by the business.
18:29
But I have over 300 items in my vault that are work related.
18:34
And you know, I might be in a unique role, but those roles
18:37
exist everywhere, you know, marketing or people who are in
18:40
consulting with access to customer systems, etcetera.
18:44
So I think there's a lot more to it than what we actually see at
18:48
the surface. Yeah, that's what I was thinking
18:51
too. As you were talking.
18:52
I'm thinking like, OK, talk about like your GitHub password
18:56
and things like that. That's in that 300 where the
19:01
work related with their personal accounts, if you will, that I
19:08
think an enterprise identity person might say here might be
19:12
the challenge that you would get.
19:14
It's like, well, we've got tools we've got, I'm going to pick on
19:17
Octa even though I'm not picking on Octa.
19:19
It can save these passwords, It can store the password.
19:25
Is that enough storing the password?
19:30
You know, I would say no, because you're not taking the
19:33
human element out of creation, right?
19:37
And what do I mean by that? Right.
19:39
We look at passwords and we look at the password dumps and we
19:45
look at all the spreadsheets that people store their
19:46
passwords in. And what you inevitably find is
19:50
a pattern. You know, it's not uncommon to
19:53
see like my dog's name, 2026 or, you know, 78 because it's the
20:00
78th password they've set in their lifetime at that company.
20:05
And so I think. One of the issues is that we use
20:09
these passwords, and we use these patterns as humans because
20:12
they're easy to remember. But we don't just use them at
20:16
work. We use them in other platforms.
20:17
And those other platforms occasionally get breached and,
20:20
you know, password hashes get dumped in places.
20:23
But once we can figure out what somebody's pattern might be,
20:26
it's not all that hard to run a very targeted, you know,
20:30
stuffing attempt to say, OK, great.
20:32
I know that, you know, this person uses the password and
20:35
it's their dog's name, Fluffy. And, you know, they've probably
20:39
been there for, you know, 50 password change cycles.
20:42
So let's try everything from 25 to 75, right?
20:45
It creates a very targeted way to attack individuals.
20:48
And so I think active management is really the only way to
20:53
address that. So when you can reset it and
20:57
also actively manage it, that's kind of the Nirvana I think.
21:01
Yeah, that's the same part I think is pretty important.
21:04
So that's what you had mentioned earlier that kind of triggered
21:07
me was so you have the ability to go in and manage the
21:13
password, reset the password on a periodic basis, things like
21:16
that. Is that what I'm hearing?
21:19
Exactly. Yeah.
21:20
I mean, we treat it basically like you would treat it in
21:23
privileged access management. So you talk about passwords
21:29
being breached and you know, I think social engineering is
21:32
another way that people get into accounts.
21:34
You know, service does have issues with validating colors,
21:37
right? All kinds of stuff like that.
21:38
And what I go back my, my background and identity is I am
21:43
operations taking phone calls from people on January 1st, well
21:47
probably January 2nd. We forgot their passwords over
21:50
the holiday break, right? And you're trying to really get
21:55
them in. And you know, back then it
21:58
really wasn't security. It was just like a process you
22:01
followed and it was like customer service versus a
22:05
security control. And I'm curious, do you still
22:08
see that taking place today and what are your thoughts and sort
22:11
of that approach? You know, I think help desks are
22:15
evolving, but they're evolving out of pure necessity and based
22:19
on what's happening in the market, right?
22:22
It feels like 50% of the attacks, and this is not an
22:25
actual statistic, are helped desk social engineering related.
22:31
In kind of the ones that I've investigated or looked at, you
22:35
know, thinking of like Caesars and MGM, that was help desk
22:40
engineering. There was another one, you know,
22:43
locally here that was also help desk social engineering.
22:46
Again, it's kind of like, you know, the human element is the
22:51
risk, right? And so if you give, you know,
22:54
admin rights, even delegated admin rights to your help desk
22:58
to be able to go reset passwords, I mean that again,
23:00
they're following a process with the best of intention.
23:03
But if there's nothing in the middle kind of enforcing that,
23:07
you know, we actually validated through like an IDV, for
23:11
example, which is identity verification software that you
23:15
know, this person is who they say they are or like a simple
23:18
push notification or something like that, then helped us are
23:22
going to continually fall fall to kind of those attempts.
23:28
And so, you know, again, thinking about the solution,
23:32
right, if we can have a situation where users no longer
23:37
have to forget their password because it's just stored
23:40
somewhere for them, which is probably what they should be
23:42
doing anyways, is using a password manager.
23:47
But if we can get them there, then, you know, a lot of the
23:51
help desk problem goes away. Not all of it.
23:53
I mean, you're still going to have first login scenarios and
23:56
other situations where, hey, you know, I, I lost my phone on a
24:00
beach in Hawaii and I no longer have access to anything, you
24:03
know, my MFA devices swept into the ocean.
24:07
But, you know, if you can kind of put controls in place that
24:11
technically, you know, validate that the user is who they say
24:14
they are before distributing access to their vault or their
24:18
credential. And I think you can eliminate a
24:21
lot of that social engineering issue that we're seeing.
24:25
Right. And so it really comes down to
24:27
removing the human from the problem, you know?
24:32
Yeah. Yeah, Yeah, I think so.
24:35
I'm writing a book, by the way, and one of it's a book of short
24:39
stories about identity practitioners in the trenches,
24:43
right. And so one of the stories is
24:45
about a scatter spider type breach, right, where they call
24:50
the help desk and more or less socially engineer the help desk
24:55
person. And the, the moral of the story
24:58
is that they, the identity verification or the process
25:05
wasn't designed to kind of think about that type of scenario
25:09
where the person on the other end of the phone is saying,
25:12
look, if I don't get access, I'm going to be fired.
25:16
I, I think from a governance standpoint, we need to think
25:20
like that. It's almost like putting
25:21
together a disaster recovery plan.
25:23
Like nobody wants to think about like these awful disasters
25:27
taking place and taking out your infrastructure.
25:29
But, you know, it's part of what we're paid to do, frankly.
25:34
But I think, you know, in a scenario like that, you know,
25:38
having a password management tool seems like it could make a
25:44
lot of sense. Yeah, I mean, even just kind of
25:50
thinking of more basic scenarios, right?
25:52
Maybe your phone doesn't get swept away in the ocean, but it
25:55
came up on its two year term and you traded it in for a new phone
25:59
without thinking about, you know, Oh my, my MFA
26:03
authenticator is on there, which is something we see a lot of.
26:06
I think you can see it in the data patterns in the cycles.
26:09
But yeah, I mean, having a password manager in those cases,
26:14
I think really addresses not only, you know, forgotten
26:18
passwords, but password strength.
26:22
The other aspect of that you talk about scattered spider,
26:25
right? And I mean, these things are
26:28
always maybe not always hopefully one day not going to
26:31
happen, but that seems kind of unlikely.
26:34
So if we accept that we're going to, you know, have to deal with
26:37
these. I think you talked about
26:38
building resilience and thinking about this as like a disaster
26:42
recovery plan. I think when you engineer your
26:46
help desk processes, you need to be able to accommodate for the
26:49
what ifs, right? It's hey, you know, I can't
26:51
authenticate them by push. I can't authenticate them by,
26:55
you know, XY or Z, you know, what are the fall back options?
26:59
And we see a lot of companies now looking at identity
27:03
verification as one technique for that, you know, doing, you
27:06
know, driver's license or passport recognition with
27:10
liveliness checks, which I think is generally a good practice.
27:13
TBD on whether AI allows us to break that.
27:17
But it seems like, you know, those two are evolving in
27:21
tandem, sort of, you know, one step ahead of each other
27:24
perhaps. At least until AI has driving
27:27
license, driver's licenses, and then and then we've got
27:29
problems, maybe driverless cars, I don't know.
27:31
That's, that's a whole different probably topic.
27:35
I want to go back to what you said earlier about password
27:37
vaults. And I'm thinking, and I'm
27:39
sitting here and I'm like, OK, I've got a password vault.
27:41
Jim, you mentioned you've got a password vault.
27:42
I'm sure Bart, you've got one. But I feel like we're still in
27:45
the minority. Like for whatever reason, a lot
27:48
of people don't use password vaults.
27:51
Why do you think that is? Like is it, is it like a user
27:54
experience thing? Like how do we, how do we
27:57
educate people say, hey, you really should be using a
28:01
password vault and here's why And what is how do we, how do we
28:05
help communicate that out there, I guess is what I'm saying.
28:09
Yeah. I mean, I think part of it is
28:13
education. Part of it is, you know, people
28:17
do what they're used to. And you, you know, you saw this
28:21
a lot like 20 years ago in terms of how people would manage their
28:24
like, personal PCs at home very differently than how they did
28:29
things at work. But, you know, as things
28:31
evolved, it was more common for like home users to have any
28:34
virus. And so I think, you know, one of
28:38
the approaches really is enterprise password managers are
28:42
not all that common across enterprises either.
28:45
I think there's still kind of a slow adoption there as
28:49
practitioners. I think recommending that or
28:52
looking at, you know, how that can plug a gap is 1 important
28:57
piece. I think also just dispelling the
29:00
myth that it makes things harder, right?
29:02
Like I can't think of a world where I don't have a password
29:06
manager on every device. Like, you know, remembering that
29:10
I used some unique thing for this website, maybe some pseudo
29:15
algorithm to figure out a a solid password, Just yeah, I
29:21
don't think I could ever do that.
29:22
So I think some of it is awareness, others is, you know,
29:26
adoption. I think once we see adoption in
29:28
enterprise and it becomes a more common day-to-day use case for
29:33
people, then it becomes easier. The other thing we're seeing as
29:37
kind of a, a side effect of doing what we're talking about
29:41
and taking your entry ID, your ACTA or your AD credential and
29:47
actively managing it is that we're building a habit.
29:50
We're building the habit that you'd never know your your
29:52
password and you're constantly going to your safe to get it.
29:56
And then, you know, people naturally start to put other
30:00
things in there because they get used to that workflow.
30:02
So I think a lot of it is familiarity.
30:04
I mean, as with anything changes a scary topic for people talking
30:09
about, you know, we're going to change the way people log in.
30:11
I think you know when password list was opt in, a lot of people
30:17
opted out until they realized that it made their lives easier
30:19
and they could just scan their fingerprint or look at their
30:22
camera, right? Jeff, I think I have the answer
30:27
for you. So if politics comes up the
30:31
Thanksgiving dinner table, bring up password management.
30:35
You will never see the divide get worse, right?
30:38
Of course it's the identity people who care about good
30:41
password hygiene and good practices.
30:44
But everybody else? You really.
30:45
I'm so sick of changing my password.
30:47
If there's something that ruins lives, it's having to keep up
30:52
with passwords. And you'll meet total strangers
30:55
and they will unload on you when they find out what you do.
31:00
Yeah, you're the reason why I have to change my password.
31:02
That's what I get from like my Barber and other people say,
31:04
what do you do? Yeah, sorry about that, but
31:07
we're trying to make it better, I swear.
31:09
We're trying to make it better. That's the the best answer you
31:12
can give Bart, help me out with my book here, man.
31:17
So I'm I'm trying to put myself in the mindset of that
31:23
operations team, right? And Joe from the health desk
31:28
unfortunately just potentially gave out the password to the
31:33
scatter spiker people, right? So we we now know like, hey, we
31:37
may have a compromise credential on our hands.
31:40
Hopefully he didn't give like the domain administrator away or
31:43
something like that, but he just coughed up a credential.
31:50
Talk to us about this first few hours.
31:51
What is happening? Yeah.
31:56
I mean, I describe it as like the fog of war sets in and then
32:00
you just all of a sudden lose sight of a lot of things.
32:06
But I think a lot of teams get bogged down in the first couple
32:10
of hours simply because they have a lack of visibility.
32:13
And to your point earlier, they've never done this.
32:17
They don't have a process for this.
32:20
They don't even know, you know, whether they should disable all
32:23
accounts, a specific few, because hopefully they have some
32:27
visibility tools or whether they should reset them or you know
32:32
what, where to start, I guess. And so I think a large part of
32:37
that is, you know, making sure that you have tools which allow
32:41
you to actually have good visibility into your
32:44
environment. Understanding that, you know,
32:48
user X was potentially compromised.
32:50
Yes, they have logged in using that new password.
32:53
Yeah, it does look like they're logging in from, you know, X
32:57
country instead of, you know, Canada or the United States
33:00
where they're they usually reside.
33:03
But then also being able to understand what that person has
33:06
access to. You said, you know, hopefully
33:08
not a domain administrator account, but I'll play devil's
33:11
advocate. What if it was because I think
33:13
in one of the scenarios that I was thinking of in my head, it,
33:17
it wasn't immediate access to a domain administrator account,
33:20
but it was access to an IAM practitioner account, which
33:26
didn't directly have domain admin, but they weren't far off.
33:30
And that's what they ended up getting.
33:32
But so when you get into that situation and you need to, you
33:36
know, potentially disable or reset those hundreds or
33:40
thousands of accounts and in your directory, I mean, then
33:43
what? Right.
33:44
A lot of companies we see you get to that point and then
33:49
they're like, OK, well, you know, we can reset them.
33:51
That's maybe the easy part. I said this earlier, right?
33:54
You can write the PowerShell script.
33:56
It's probably only a few lines if you do it efficiently.
34:00
But then what? What is the rest of the process
34:02
look like? You know, if you're at a, you
34:05
know, fifty person organization and you're in person, yeah, OK,
34:09
fine. You know, hand it out on
34:11
hopefully not sticky notes, but you know what I mean, right?
34:14
It's easier to distribute it because you're going to have
34:16
that personal relationship and you can vet that everybody is
34:19
who they say they are. But even if you're a small
34:23
organization that's remote, how do you know that, you know,
34:29
somebody from finance is actually who they say they are
34:32
and Oh yeah, they need to reset their password because we reset
34:35
everybody's password. So what we think of is actually
34:40
kind of closing that again. You know, the last mile metaphor
34:44
to breach recovery as well is something that you can do with
34:47
this kind of unique combination. We can look at, you know,
34:52
resetting hundreds or thousands of accounts, not only on a
34:55
scheduled basis, but on like an event by event basis.
34:59
You, you have a breach. OK, great.
35:01
Go reset all of the accounts you know and make sure that they no
35:06
longer have potential breach credentials or that you're at
35:10
least trying to walk out threat actors.
35:13
But I'm kind of coming to the conclusion hearing you talk that
35:20
we might be going and pitching a solution for password lists
35:26
where pass keys cross the enterprise, but we're still
35:30
going to have that final mile for the 20%, let's call it 20%.
35:34
It might be more or less depending on your situation, but
35:39
there's it's going to be something where you can't do
35:42
that. And I what, what, where do we
35:49
stand then? Like do we put forward a
35:52
solution then? Is password manager really like
35:56
the only viable option at that point?
36:02
I mean, you can take different approaches.
36:04
Like I said, there was one organization who was forcing
36:07
their users to go to like their password reset tool and reset
36:11
their password, you know, every couple of days when they needed
36:14
access to those 20% of systems that actually required a
36:18
password for a login. That sounds terrible, yeah.
36:23
I agree you could build your own.
36:25
I talked to another business who built their own.
36:27
I mean it, if it were me, I wouldn't really want to build my
36:31
own because it's kind of sensitive and you know, how to
36:34
how do I know that it's actually been built properly and so.
36:37
You're not trying to jam this down anyone's throat, but
36:39
basically the answer is like, this is the only sensible
36:43
solution, right? I think it's the only solution
36:47
on the market right now that tackles the entire problem.
36:51
You can bring in a password manager, and there's a lot of
36:54
good password managers on the market and you can encourage
36:58
credential hygiene. But I think until you can
37:02
actually, you know, control user behavior or push user behavior
37:07
in a certain direction, that's really where those solutions
37:12
lack, right? You're never going to get 100%
37:14
of adoption of a password manager solution unless you
37:17
force the user to go into the password manager to get their
37:19
password. I mean, we did this two years
37:23
ago now, and I have no idea what any of my passwords are, and I
37:27
haven't for a long time. And, you know, it took us a
37:31
while to get everybody on board, but immediately we saw adoption
37:36
of the pastor management tool really uptick quite quickly.
37:39
So, yeah, I think it's a good solution to a problem that the
37:46
alternative is to wait years, maybe another decade, until
37:51
everything universally supports pass keys or Fido or some good
37:57
appropriate standard. And by the way, I mean, pastor
38:01
managers solve another problem with pass keys, which is
38:04
portability, right? And so I think whether we see
38:08
them now in the enterprise OR in five years in the enterprise, I
38:12
think they're still coming. And it's a necessity.
38:15
But it might be from a different angle of, you know, a pass key
38:19
manager rather than a password manager.
38:23
I'm glad you brought that up because, you know, I think it
38:25
was probably five years ago, I didn't see a future for password
38:28
managers because it's like, oh, password was here, we're not
38:30
going to need that. But you're absolutely right.
38:32
Like you need to be able to have a cross-platform sort of vendor
38:36
neutral wallet of some sort, vault, whatever you want to call
38:40
it, right? It's all kind of the same thing.
38:41
And that's where pass keys are really powerful was if you can
38:45
sync it from 1 device to another and still retain control from a
38:50
management standpoint, right? Because obviously you don't want
38:53
to sync work credentials with private credentials and you know
38:57
that mess. But if you've got a way to solve
38:58
for that, there is absolutely a place I see for, you know, bolts
39:02
and wallets and managers and things like that to be able to
39:05
do that pass key synchronization and and that portability.
39:08
So I'm glad you brought that up. Yeah, yeah.
39:10
I mean, I think it's like A, it's a, you know, I hope
39:14
passwords go away in the next decade, but I think the reality
39:18
in the data shows that they probably won't.
39:20
I think I looked at a report earlier today that said we're
39:23
only at 20% adoption of pass keys and that's probably mostly
39:28
B to C applications, not within the enterprise.
39:32
It's probably much lower. So I think we're going to have
39:35
passwords around for a while, but we can still encourage users
39:39
to do the most secure thing, and I think that's ultimately what
39:42
we want to do. So let's talk about deployment
39:46
here if we can for a second, because you've got a lot of
39:48
experience in this space. I think you've highlighted some
39:52
of the usability challenges around this.
39:54
There's people probably think of it as like, yeah, I'd love to to
39:56
roll out a password vault, you know, for my users.
40:00
What are some tips or some guidance to make life easier for
40:06
for us to to help with that? Yeah.
40:10
You know, I think part of it is, you know, not trying to do this
40:15
perfectly. And probably I scared a lot of
40:19
practitioners off saying, oh, my God, but it's got to be
40:22
seamless. It's got to work for everybody
40:24
all the time. But I think, you know, setting a
40:27
benchmark to improve your governance through that
40:30
deployment is, you know, Step 1. So getting by and from a
40:33
stakeholder in terms of practical implementation, start
40:38
small. Start with the teams that are
40:40
probably already using a password manager, but it's
40:43
probably their personal one, right?
40:45
So, yeah, I'm talking about people like us, the identity
40:49
practitioners, the folks that are in cybersecurity or the
40:53
folks that are in IT more broadly.
40:56
Start with those folks who probably want this anyways, and
41:01
then move into some of the departments where there's solid
41:04
use case, right? So we see, you know, a lot of
41:08
use cases in marketing. They've got access to, you know,
41:12
way more tools than the average knowledge worker does a lot of
41:16
times. And many of those platforms go
41:19
unintegrated because, you know, it's only 1% or less of the
41:23
organization's employees who are accessing those tools.
41:25
So marketing is good second stop.
41:29
And, you know, creating a good education program, we saw one
41:33
organization who actually started to gamify it.
41:38
So gamification is always a good option.
41:41
It'll definitely accelerate your early adopters and kind of that
41:45
middle pack. And then you know, eventually
41:49
you're going to get to those people who are slow to change.
41:53
Those people take a little bit more work, a little bit more
41:56
coaching. Sometimes they need the stick,
41:58
right? And one of the tools that this
42:01
gives you, not saying you should always use it as once you start
42:05
to put managed credentials in the safe and actually start to
42:10
actively rotate them, then you create a need, a necessity for
42:13
people to start to use it. But the nice part I think about
42:18
this is that you can go on this kind of journey of maturity and
42:23
meet people where they're at for the most part until you get to
42:26
the very end. That last, you know, 5 to 10%
42:29
can always be tricky, but I think it's just, it's really as
42:33
with any project in the identity space, you know, change
42:37
management is a critical part of it.
42:40
Training people on how to use it, helping them understand why
42:43
it's going to make their job easier so.
42:47
So how do you measure success for something like this?
42:51
Because I think I was like, is it like number of vaults
42:54
deployed actively being used? Is it number of credentials
42:58
being managed by the password manager?
43:01
Like what are some of the ways that you've seen people sort of
43:04
measure like, yes, hey, we made an investment in Rivera and
43:08
we're getting, you know what, what we what we hoped out of it.
43:14
Yeah. OK.
43:14
So when we're coming at this from like a, you're an
43:17
organization is on this password, this journey, we've
43:20
got 80%, but we're missing this 20%.
43:23
We'll always look at OK, well, what are those 20%?
43:26
Right. And that's one of the key
43:28
measurements we look at for success is to say, OK, you know,
43:32
by the end of this six month journey, there's not a whole lot
43:37
of project work that goes into it.
43:38
But at the end of this 6 to 12 month journey, you should have,
43:42
you know, 100% of your applications either covered by a
43:45
password list sign on mechanism or they should be managed by a
43:51
tool like ours where you know, the users aren't having to set
43:54
the passwords, reset the passwords, etcetera.
43:58
There's a bunch of other metrics you can look at as well.
44:00
I mean, this goes back to traditional like self-service
44:04
password metrics, which is like look at your help desk call
44:07
volume. How many password resets are
44:09
they processing on a daily basis?
44:12
You know, survey on like lockouts, how many people
44:15
actually forgot their password and locked themselves out?
44:19
So there's a lot of metrics that you can use, but I think really,
44:23
you know, the core ones from a cybersecurity standpoint are
44:27
really, you know, are you getting 100% coverage?
44:31
The other nicety that you get with even just a house for
44:35
manager, regardless of managing credentials is you can get
44:37
insight into what else people are logging into.
44:40
It's kind of the whole shadow IT problem.
44:43
And then you can start to address those as well slowly.
44:46
Maybe it's, you know, that one team in finance is using some
44:51
tax solution nobody's ever heard of, and you had no idea that,
44:55
you know, you've got 500 people in that department using that
44:58
system, so can also help with that.
45:01
And that can be another metric for success.
45:04
That never happens. People using tools that aren't
45:06
the IT standard. Come on, Bart, you're crazy.
45:10
Yeah. Never right?
45:12
This has been a pretty fascinating conversation and and
45:14
you know, my mind has shifted on this quite a bit over the years.
45:17
You know, I, I mentioned like I just didn't see a future for
45:20
this type of space because you know, web auth N and and
45:23
password list was going to solve all the problems.
45:26
Here we are. And now something like this is
45:29
absolutely vital to making sure that I have a good experience
45:31
just as an end user. So if this gives me capability
45:35
as AI am leader or security leader, say hey, now I can
45:38
manage these credentials in a more secure but a a win from a
45:44
usability standpoint, I think it it makes a lot of sense to look
45:47
at. For sure agreed.
45:51
So let's end the conversation here on a lighter note.
45:55
You talked a little bit about risk management and it was kind
45:58
of getting to know you before we hit record.
45:59
And I'll kick down the 4th wall a little bit.
46:02
Carolyn was on the call. We're kind of talking about
46:04
you're being very modest about some of the risks that you've
46:06
taken. And you mentioned that you like
46:10
climbing mountain, you know, mountain climbing, skiing.
46:14
You're up in the Calgary area, so you've got access to plenty
46:16
of that stuff. I'm curious if you have any
46:20
harrowing stories or things that are like, you know, for the,
46:25
for, for someone like me who's an indoor cat, I'm not about
46:29
going outdoors and climbing and and doing all that kind of
46:31
stuff. Scare the heck out of me.
46:33
Like, what's something that's like, Oh my gosh, can't believe.
46:35
Like, you're here to tell that story, Bart.
46:39
Yeah, I mean, I'm definitely an outdoor cat.
46:41
I think like it comes naturally living in Calgary.
46:44
We have, I like to say we have two seasons, We have summer that
46:48
lasts about two months, and then we have winter.
46:51
So if you can't get outside during the winter and actually
46:54
enjoy everything that we have around us, I mean, we're just 45
46:57
minutes from bands from like Louise, the Rockies, etcetera,
47:02
then I think you're going to be very bored living in Gagri.
47:06
So yeah, I do all the fun things that involve a lot of risk
47:10
management because I apparently don't get enough of that during
47:13
the day. One of those stories.
47:16
So we were up in the Rogers Pass Beautiful place.
47:21
There's a cabin up. It's like 2100 meters above sea
47:26
level. For those of the viewers that
47:28
are going to be in US, you'll have to convert that into feet.
47:31
I don't do the conversion, but I think it's somewhere around 8000
47:33
feet. And on the way into this cabin
47:38
we were skiing in an area that's lovingly referred to as the most
47:44
trap. And that's because there's a
47:47
bunch of these different slopes that all funnel into this kind
47:50
of Creek bed. And it's somewhat dangerous to
47:55
be in there in the winter. But it, it's a risk management
47:59
exercise. So you, you know, do all the
48:01
right things and you space each other apart.
48:04
You you have the training, you have the gear, etcetera going in
48:08
one year we actually had a situation where one of my skiing
48:13
partners was actually behind me. I think I was in the lead and we
48:19
had we call them like tree bombs.
48:22
So basically just want a tree branch gets heavy enough with
48:24
snow usually cuz it's melting and a piece of snow comes off of
48:28
it. And I triggered this like little
48:29
mini avalanche. It wasn't huge, but it was big
48:33
enough to bring my partner up to his neck.
48:37
And I heard all sorts of screaming behind me and I look
48:40
back and I did not see my ski partner is like, oh, that's a
48:43
problem. And then I quickly spotted him
48:45
kind of breed next to a tree head above.
48:48
But no no injuries. Everybody was fine.
48:51
We all continued on and enjoyed the weekend but definitely a
48:56
moment that had my heart palpating or racing a little bit
48:59
faster than normal so. Mine's going a little bit now.
49:02
Just hearing you describe that. I can't think of anything worse
49:05
than be like being on the side of a mountain in the cold and
49:08
being buried under the snow. Even if it's, you know, if I
49:11
don't care, if it's just up to my knees, like I'm good, you say
49:14
to your neck. It's like, OK, so like, how
49:16
quickly does that event occur? Like I can, I can understand
49:20
snow coming off the, you know, off the branch, but then how
49:25
much time does it take to that turn into your friend, you know,
49:29
buried neck deep in snow? Curious how quick that was.
49:33
Yeah, it's so quick. I mean, if you look at like any
49:36
footage of avalanches, the speed at which they move is
49:39
astonishing. It's kind of like it's described
49:42
like a, a mattress on like steel rollers.
49:46
It just like slides without friction basically.
49:49
So yeah, probably all told from, you know, the time little bit of
49:54
snow dropped off the tree branch to the time that I look back was
49:58
probably 1015 seconds at most. But, you know, then you have the
50:04
training and the instincts kick in, and I don't think I've ever
50:07
skied backwards so fast in my life to get back and unpack my
50:11
shovel and start digging him out.
50:13
And I mean, all was good. So happy to talk about the story
50:17
and reflect on it. But yeah, yeah.
50:20
We probably wouldn't bring it up on on a podcast if things turned
50:23
out they wouldn't. Be a Ledger note.
50:25
Right. Yeah, exactly.
50:28
Jim, you're, I know you're a little bit of outdoorsy guy.
50:30
You've done some cool stuff. Any heroin stories?
50:33
I had my day. Yeah.
50:34
So we started talking about this.
50:37
I thought of a time whereas backpacking and Yosemite.
50:42
So there's this area called Tuolumne Creek.
50:45
It's like 15 miles from the Yosemite Valley, which is what
50:49
everybody thinks of, but it was like a 15 mile hike.
50:54
But it's there's so much up and down and you're, you started
50:58
like a 10,000 foot elevation. I think the high point might be
51:02
12,000. It's really high.
51:04
There's not a lot of not the same level of oxygen up there,
51:07
let's put it that way. And anyway, so you you hike
51:12
about halfway and then you backpack or you set up camp
51:17
somewhere. So we set up camp is in the
51:20
woods. And it was like everything was
51:22
bone dry. I mean, is what I would call
51:26
like, I think the term tinderbox would fit this appropriately,
51:30
right? Like there was no outdoor like
51:33
no setting up a campfire. You have to be real careful with
51:37
how you cooked everything like that.
51:40
And so anyway, sun goes down, we're in our tent, and it's just
51:49
like static electricity everywhere.
51:52
Like you move your arm and like, you see these giant sparks
51:55
arcing across the tent. And I'm like, I've never seen
51:58
anything like this. And it was not raining, but
52:01
there's a lightning storm all around us.
52:04
I don't know. Usually now I see why people get
52:07
struck by lightning. I'm not worried about bears
52:09
attacking anymore. I'm worried about getting struck
52:11
by lightning or this whole place going up in flames and us being
52:17
in like, not a good place. So fortunately, none of that
52:22
happened. That's why I can talk about it
52:24
later. But yeah, it was really scary.
52:30
But you guys have sufficiently not convinced me to go outside
52:34
for either of these types of activities.
52:36
Jimmy, you talked about like cooking and not be able to like
52:38
have a fire. I mean the answer to that is
52:40
simple. Just DoorDash something out into
52:42
the OH. Yeah, sure, that would have
52:44
worked perfectly. All right, let's go ahead and
52:47
wrap up this conversation. Bart, it's been great getting to
52:50
know you here and and what Provera brings to the table.
52:53
Any final words you want to put out there for the audience
52:55
that's listening? Yeah.
52:58
I mean, I think as practitioners we often look for like the
53:03
perfect silver bullet solution. I think a lot of the real world
53:09
operational implementation is a lot less than a silver bullet,
53:15
maybe a few. And so I'd really kind of
53:18
encourage folks who are maybe on the password this journey to
53:20
think, you know, OK, well what problem are we actually trying
53:23
to solve? And, you know, there's multiple
53:26
ways to slice and dice it and to still get the same net effect
53:30
where you're increasing your, you know, cybersecurity posture.
53:35
So I think that's what I'd leave them with.
53:38
Don't be. Perfect.
53:40
Yeah, meaning it's OK to get smarter, it's OK to get better.
53:44
Doesn't have to be all in one jump.
53:46
I'll have links in our show notes for people to connect with
53:48
you on linkedincanfindoutmoreaboutriverathereyoucanalsofindoutmoreaboutrivera@riverasecurity.com/I
53:54
DAC. Again, BRAVURA
53:58
security.com/idac, reach out to Bart on LinkedIn, make the
54:02
connection, you know, maybe share mousetrap stories from
54:05
Rogers Pass. I think I got that right, you
54:07
know, or, you know, commiserate with Jim and his static
54:10
electricity stories or me, as you know, an indoor person who
54:14
is probably by the fire with strong Wi-Fi and, or air
54:17
conditioning. So we'll go ahead and leave it
54:20
there for this week. I want to thank everyone for
54:22
watching, listening. Thanks to Rivera for sponsoring
54:24
this episode. Find us on the web, IDC
54:26
podcast.com and we'll leave it there.
54:29
So thanks everyone for watching and listening, and we'll talk to
54:31
you all in the next one. You've been listening to
54:36
Identity at the Center. We hope you've enjoyed the show.
54:40
Make sure to like, rate and review, and we'll be back soon.
54:44
But in the meantime, hit the website at
54:46
identity@thecenter.com.