Latest / Identity at the Center / #288 - Identiverse 2024: Ian Glazer & Alex Bovee & Lance Peterman

Transcript

#288 - Identiverse 2024: Ian Glazer & Alex Bovee & Lance Peterman · Identity at the Center

0:00
Lance is in an outage, you know, ticket TVD, give him global
0:06
admin in your tenant so that he can do what he needs to do, but
0:10
it's going to expire in two hours or I have to request to
0:13
renew it. I'm there.
0:14
I, I, I think that's eminently doable.
0:16
And in many respects, it's already kind of happening today.
0:20
Getting organizations to the maturity level that they can
0:22
support that. I think that's where we're
0:24
struggling quite yet. I agree there's a maturity curve
0:28
here. And I think, I think I just
0:31
don't want anyone to, to listen to this and, and feel like they
0:34
can't get started. Because I think, you know,
0:38
sometimes we, I mean, we as professionals and identity and
0:43
security kind of see the future problems of how do we share
0:48
signals and better policy, you know, those things.
0:51
And just as a a practitioner who sells software that people
0:55
implement, I also see a lot of times people are struggling with
0:58
like the basics. This is identity at the center
1:08
if it has anything to do with IAM.
1:11
This is the go to podcast now your hosts Jim McDonald and Jeff
1:18
Stedman. Welcome to the Identity Center
1:26
Podcast. I'm Jeff, and that's Jim.
1:27
Hey, Jim. Hey, Jeff, how are you?
1:29
Not so bad yourself. Doing good, but I am kind of
1:32
like. Fading, yeah.
1:34
But now's a good time for fading.
1:36
But let's get through the episode.
1:38
And then maybe a coffee and. Or a beverage and I don't drink
1:43
coffee. We're we're trying to be
1:44
beverage inclusive, if you remember.
1:46
Do nap. I do nap.
1:48
Yeah. All right.
1:48
Well, no, start there. All right?
1:50
OK. Yeah, it's the end of
1:52
Identiverse for us, at least from a recording perspective.
1:55
And you've been here longer than I have.
1:56
You came in a few days early for like.
1:58
Yeah, as usual. That's a big.
2:02
Well, you know, it's Vegas, you had some fun, you got to go to
2:04
Sphere, we got to have a lot of good hallway conversations,
2:06
stuff like that. But yeah, we're ending on a on a
2:09
high note. We're going out with another
2:11
panel discussion, which is becoming a theme here at
2:13
Identverse for us, but and no particular order, we've got Alex
2:17
Bovi. He's the CEO and Co founder at
2:19
Conductor One. We've got Ian Glazer, founder
2:22
and president of Weave Identity and Lance Peterman, first time
2:25
on the show for Lance identity lead at Dick's Sporting Goods
2:28
and professor at UNC Charlotte. Not too far away actually from
2:31
me in real life. So maybe at some point we can
2:34
share a beer or something and dodge bears between Asheville
2:39
and Charlotte. I would love that.
2:41
I'm not going to make Ian and Alex go through their Orson
2:44
stories. You've heard it before.
2:46
If you haven't, go back to listen to the episodes.
2:48
Alex's first time with us was episode 257.
2:51
Ian, you go all the way back to episode 76, as evidenced by the
2:54
Gray in the beard that we've both accumulated over the years.
2:58
But. Lance, that's wisdom right
2:59
there. Identity wisdom just flowing,
3:02
you know, from your face, literally.
3:06
Lance, first time on the show, how did you get into identity?
3:09
Is it something that you chose or did hit choose you?
3:14
Kind of neither. I I evolved into it.
3:16
I I'm old enough in this profession that, that, you know,
3:19
the old saying that they didn't call it identity when I was
3:22
doing it applies. But I did get a tap on the
3:27
shoulder where they said, hey, we've heard about this thing
3:29
called identity management. I was like, oh, yeah, that's
3:31
kind of what I'm already doing. Well, we want you to stand it up
3:34
formally. I was like, OK, that's cool.
3:36
So do I get any more money, you know, to like, go buy things?
3:40
No. Do I get any more resources?
3:42
You know, are there more people that can work with me?
3:44
No. OK, well, you can guess how that
3:46
went. So, yeah.
3:48
But I, I always enjoyed being at that stage in the software
3:54
development stages and being in the middle of everything was
3:59
just a lot of fun. And then I started to fall in
4:00
love with the problems in identity and that has really
4:05
created a career ever since. You're the first person to ever
4:07
answer neither. 288 episodes. And most people I found in my
4:13
very scientific research is that most people fell into it.
4:16
They didn't choose it, just kind of.
4:18
But I've never heard anyone saying neither.
4:20
Very interesting. He is a professor after all.
4:24
Yeah. I can't give you a simple
4:26
answer. Well, tell me about being a
4:28
professor. I mean, are you teaching what
4:29
like what are you instructing on?
4:31
And sure, how does I does that have any volume to that at all?
4:34
It absolutely does. It did not start that way.
4:38
I got a call back in 2015, a little earlier than I
4:42
anticipated. Teaching had always been on my
4:46
horizon, but I wasn't quite ready yet.
4:49
And they called and said we have an opening for software
4:51
architecture and design course, would you be interested in
4:54
teaching it? And I had background in that
4:56
area, so I was like, sure. And so for several semesters,
5:00
that was the only class I taught.
5:02
And then the university asked if I would be willing to teach an
5:06
introduction to Cybersecurity and Privacy course again, kind
5:09
of my bailiwick. So I'm like, sure, I'll go that
5:13
route as well and had a lot of fun doing it.
5:16
And then I met up with Ian back in 2017 when ID Pro was created.
5:25
And as my experience as being a member of the board grew, I knew
5:31
pretty quickly what I wanted the next stage to be for me.
5:34
And that was I want to help create the next generation of
5:37
identity professionals. And so I identified a gap that,
5:41
as it turns out, wasn't just at UNC Charlotte, but other
5:44
universities. They don't teach identity
5:46
management or access management, at least not in full form for
5:52
any particular course. And so I was there long enough
5:56
that I could pitch my department chair.
5:58
I said, hey, we did this, I think people might be
6:01
interested. And he's like, sure, go for it.
6:03
And so I'm fortunate enough this fall I'm going to be teaching
6:07
the second version V2 of a special topics course on
6:12
identity management, and it's going to be a hybrid with
6:15
undergraduates and graduates. And I'm super excited about it.
6:19
Sounds really interesting, yeah. What changed between B1 and B2?
6:22
Were. Lessons learned.
6:23
They were like, oh, we need to adjust.
6:25
OV1 I was flying by the seat of my fans.
6:28
Just like this podcast? Yeah.
6:30
It's it was a challenge because even though I had the summer to
6:33
work on it, you know, you always think you have time and then all
6:36
of a sudden it's August and it's like, Oh yeah.
6:39
So we, we were literally, you know, as the proverbial saying
6:43
goes, you know, we were laying the track as the, the train was
6:46
coming out of the station. So did the best we could.
6:50
It went fairly well. Very, very solid feedback from
6:53
the students. It was delightfully small.
6:56
There was only a total of 17 students in it.
6:58
So that really helped keeping it intimate.
7:01
This semester it's going to be 40 students evenly split between
7:04
graduates and undergraduates. So that will make for an
7:07
interesting part of it. But but.
7:10
It shows with the man there if you've doubled, basically.
7:13
It, it definitely got better advertising.
7:15
And I think that's, I, I made a mental note after that situation
7:20
of probably my next RFP response is going to be, you know, how do
7:24
we market identity better, not just obviously at higher Ed, but
7:27
in general, because I think there's, there's lessons to be
7:30
had there. Yeah, that's right on.
7:32
So we pulled this panel of experts together.
7:36
I think we're all members of ID Pro.
7:38
I've said for a long time that the biggest benefit of ID Pro is
7:43
the Slack channel. So you can agree or disagree,
7:46
but that's why I love the most and there's so much on there.
7:50
But every once in a while you get a topic that just like
7:54
breaks the Internet and this particular.
7:57
Topic was a specific Internet to be honest.
8:02
Well, I mean, within two days it had like 76.
8:06
So Ian brought up a topic of around 0 stemming privileges,
8:11
right, which is the, I think generationally speaking, the
8:15
next iteration of least privilege, which has been around
8:19
since we're, you know, in IT, but not in identity yet.
8:24
So Ian, I think you can do a better job with kind of like
8:28
framing up the discussion, but talk a little bit about that,
8:32
that post and what you're trying to get AT.
8:35
Yeah. So I wanted to take a tiny step
8:37
backwards because one of the things I find about myself is I
8:41
react a little to other people's ideas.
8:44
And by that I mean when someone says something like, hey, I'm
8:46
interested in acts and I've never heard of it before.
8:49
I've never really thought about it.
8:50
Like I can quickly start to, to process and, and think about it.
8:54
I was talking to my friend Eric Gusterson elaborate signal, and
8:56
he kind of threw out this concept at CSP, his zero
8:58
standing privilege. And I was like, huh.
9:02
And then I kept thinking about the, I have hit this place of
9:05
identity governance and administration nihilism where
9:07
I'm like this, this isn't working anymore.
9:10
Like we've been doing it forever and it's still not progressing
9:13
the way we ought to have progressed it.
9:15
And those things kind of came together.
9:17
So I wrote a post that said, Hey, let's for a moment, let's
9:22
be productive, right? As my old boss would say, I'm
9:24
going to be cheeky about this. I just put it out there like
9:27
least privilege is a lie, right? And the intent was to say,
9:33
everyone will say I we're doing least privilege.
9:39
But in reality, that often goes down to like, yeah, we do some
9:41
rubber stamping quarterly reviews.
9:44
And I don't mean to cite anyone because people are very, very
9:46
busy trying to cover all the bases, right?
9:48
But least privilege feels like one of those sort of the success
9:53
posters were like the cat hanging on the stick, like I'm
9:57
doing this privilege. And then I thought about this
10:01
idea of serious tag brothers. Like what if we flip this around
10:03
and just simply said, you have nothing?
10:07
You have a user account with an identifier, which is really just
10:09
used for logging and maybe essentially a credential
10:12
associated with it. Hopefully not.
10:14
That's it. And when you need to use
10:16
something, you get the things you need to use.
10:18
And having spent some time at Salesforce, Salesforce users
10:21
model, user model actually works that way.
10:22
The authorization model actually can work that way.
10:25
And so I was thinking like, oh, wait a minute, I never thought
10:28
about the application of this. So I kind of put a position out
10:30
there and. I thought I'd get a little bit
10:34
like. It's interesting.
10:36
Nope, like a variety of people were like that's horrible.
10:40
You got it wrong. That was what I wanted.
10:44
I got introduced to. I never saw least privilege
10:46
written as. Polyp.
10:48
Like PLOP. Like I was like, I've never seen
10:51
that before. I'm like, what the hell is
10:52
polyp? And then someone put it in like
10:55
off slack. I'm like.
10:56
Well, we're great at creating acronyms.
10:58
I was like, oh, that's new. But then there was like a real
11:01
meaty discussion and that sort of kick some of these things
11:04
off. I've subsequently been writing
11:05
about it and talking to more people because by no means is
11:09
this is this idea solidified, right?
11:12
I'm still like kind of, it's like molten glass.
11:14
It's starting to harden but I'm still trying to shape it a
11:16
little bit and it's just been super fun to like see where it
11:19
goes. So, Alex, have you been thinking
11:23
about this and what's your. Time yeah, I mean, I guess I'll,
11:27
I'll drop some spicy takes here to start.
11:30
I would say totally agreed with your post.
11:33
And in fact, it's something that I think, you know, we, we really
11:37
embraced when we started conductor one sort of in the
11:39
same thinking, which was that this idea of of least privilege
11:43
and constantly shaping like the, the focus on shaping roles and
11:48
permissions. There's a little bit of just
11:49
like a, it's the wrong approach. It's the wrong thing to focus
11:53
on. I think there's, I think there
11:55
is room for it, but in the right context, like in general, this
12:01
is I think the problem with all things security and identity is
12:04
like a, a concept might be good if it, but if it's misapplied or
12:07
grossly applied to broadly and it kind of doesn't end up making
12:10
sense. And I think we're we're least
12:12
privilege makes a lot of sense is when you've got, you know, a
12:15
machine or a service, something that's doing the same thing
12:19
consistently and doing it repeatedly and in a a kind of
12:24
predictable manner. Because you can, you can reshape
12:26
things and you can define what that thing needs to do its job
12:30
kind of consistently. But for humans and accounts and
12:34
you know, services always, it's like, it's kind of this concept
12:39
of the analogy is like zero based financing, budgeting, if
12:42
you're heard of this, like you start from zero and then
12:45
everything has to be justified. And I think that makes way more
12:49
sense for for humans and for service accounts and things like
12:53
that where you really everything should be built up and re
12:57
justified and then torn down if that justification is removed or
13:01
if people don't need it anymore. And it makes way more sense to
13:03
kind of constantly have the, you know, the the world reverting to
13:08
0 versus, you know, reverting the maximizing privilege.
13:11
So yeah, 100% agree with. You and I think the the, the
13:14
point I really want to point out because there's a variety of
13:16
ways of how you operationalize that we can leave that we can
13:19
get to that later. But the thing that just really
13:21
dawned on me was like, wait a minute, I use my account in an
13:26
enterprise system. How many hours a day?
13:31
Not as many as there are in the day.
13:33
And if that access I thought about, you know what I could see
13:37
it's just sitting there dormant. It's sitting there dormant that
13:40
could be used by somebody else if they were to take control of
13:43
the account. And then that sort of started
13:45
the slider started to unravel when I started to graph it.
13:47
And I'm like, oh, that's a lot of exposure time that feels
13:52
unnecessary. Certainly in some domains.
13:56
I totally agree. Like this is not something you
13:59
need to run out and do everywhere all the time.
14:01
But like there's certainly some domains production access, for
14:04
example, whoever controls DNS in your in your organization, like
14:09
crank that crap down to 0 if you can because exposure hours there
14:14
are meaningful from a risk perspective, really meaningful.
14:17
I think closing the doors right, that's you're all about reducing
14:20
risk at that point, that's why. We do it.
14:22
The operational part of it though, I think is, I think
14:25
that's the most important part really discussion because you
14:28
least privilege in my mind is a reaction to the inability to
14:31
operationalize something like 0 standing privilege.
14:35
Organizations don't have enough resources to constantly sit
14:37
there and say, Alex, how's your access doing?
14:40
Are we good? Can I take everything we need to
14:41
take everything away? Yeah, My background is in ID
14:44
administration, running teams and granting permissions,
14:47
etcetera. I mean, we're behind just trying
14:50
to keep up with an organization that's constantly hiring,
14:52
firing, removing to do 0 standing privilege.
14:55
I think you have to have a level of maturity from a operational
14:58
standpoint, which means automation.
15:01
How can we, you know, not turn this into Jeff pushing buttons
15:04
on the screen and turn it into some sort of dynamic environment
15:08
that is data-driven that says, oh, this context part of Alex or
15:14
Lance or whoever has changed and that means this other thing
15:19
changes. You can't do that in the real
15:21
world by hand. It just doesn't work, can't keep
15:24
up. And so I think the least
15:25
privilege has been, has really been the result of automation
15:29
hasn't existed. It's a fairly new construct in
15:32
the identity world and new meaning within the last 25
15:35
years, let's call it right being generous.
15:38
But that's my take on this is we.
15:41
Yeah, of course you're saying, which makes sense, but you have
15:44
it doesn't, doesn't matter if you can't operationalize.
15:46
Well, I was going to say just to to add on that a little bit.
15:49
I think the, I think everyone agrees you're saying privilege
15:53
super important and it's the right approach.
15:54
And I, I think in many ways you're saying privilege is going
15:56
to end up being similar to zero trust.
15:59
It's going to, it's going to, what people need to recognize is
16:01
it's a journey. And I think what Ian, you said
16:05
kind of about specific use cases like production access, really
16:09
privileged roles, maybe in your IDP, things like that.
16:12
And you mentioned, you know, having automation in different
16:14
places. What's important to realize is
16:17
commit to the journey, commit to the, the, the vision of where
16:20
you want to go to, which is, hey, for our organization, zero
16:23
saying privileges is a priority. This is the goal.
16:26
But there's no, there's probably realistically no world where all
16:30
your permissions go to 0 every single day the second someone
16:33
stops using it for a minute. So think about sort of how do
16:36
you apply those principles and different automation and
16:39
technology to production to secure that, You know?
16:42
So really kind of not thinking about in terms of like, I need
16:45
every single tool today to make this work to get to 0 standard
16:49
privileges, you know, immediately.
16:51
But really thinking about how do I apply it and just add a little
16:54
bit, you know, to my identity program to make things more
16:57
secure? So Jeff, you're talking about it
17:00
won't work with a human in the mix, but you can't.
17:03
I want to push back on that slightly because the interesting
17:06
thing about having a human in the mix is in most
17:11
organizations, the human is going to have a a different set
17:14
of context and a different vantage point on what needs to
17:17
happen. For example, right?
17:19
You may have a better sense of, oh, we have an active incident,
17:23
so damn right that Lance is going to get access to
17:25
protections because he's the guy to go fix it.
17:29
So the thing that's interesting to me right now is, and this is
17:32
bigger than ZSP, is that there's a whole movement around signals
17:38
and data and the ability to process these things at a higher
17:42
volume than identity teams have ever been familiar with.
17:44
Security teams have had some of this, but the ability.
17:47
To bring in a greater set of. Context into what would
17:50
notionally be policy starts to make replacing the human more
17:55
realistic. We still need the person
17:57
involved from a policy construction perspective.
18:00
We don't need them from an operational perspective.
18:03
But we're just at that. I mean, I feel like we're just
18:05
at that point to really make it happen.
18:07
Yeah, I think that definition of the orchestration that takes
18:09
place, you need someone to define what that looks like.
18:13
Professor, you've been quiet. So I agree with Alex that I love
18:21
the idea of adopting that as a principal and then kind of
18:27
pushing that car further down the track when you have
18:30
opportunities to do so. Because I've seen vendors do
18:33
this and some of them don't successfully at a limited scale
18:36
today. You know, I, I've seen vendors
18:41
who when it comes to just getting local admin rights to
18:45
your workstation, I need to install a software update.
18:48
Easy example. We have a platform at our
18:51
company that allows me to step into that role, do what I need
18:55
to do and then it expires. That part I'm there, I supported
18:59
100%. We have it in our cloud provider
19:03
today I had, I need access to a role.
19:06
I step into that role. Now we do have some operational
19:09
constraints there. Once you try and push that cart
19:14
further down the the track, there are technical limitations.
19:18
Now that shouldn't be why we don't do it.
19:21
But operationalizing it to your point, we tried to go with a
19:26
vendor who very exciting at the OS level, really cool work, but
19:32
it only worked on Windows and you know, the Internet runs on
19:36
Linux, right. And so we we need to realize
19:43
that facade of orchestration for a lot more than that or as we
19:49
were talking about pre show, do we create a protocol that allows
19:54
systems to speak that language, which we've already tried to do
19:58
a little bit in the authorization space.
19:59
I don't know how successful we've been.
20:01
It's a hot topic. I mean it feel like the
20:03
authorization space we probably get to in a minute, but.
20:05
Yeah, it's it's. The next frontier?
20:07
Feels like if we. Can have an orchestration layer
20:10
that says, hey, Lance is in an outage, you know, ticket TVD,
20:16
give him global admin in your tenant so that he can do what he
20:20
needs to do, but it's going to expire in two hours or I have to
20:24
request to renew it. I'm there.
20:26
I, I, I think that's eminently doable and in many respects it's
20:29
already kind of happening today. Getting organizations to the
20:33
maturity level that they can support that.
20:35
I think that's where we're struggling quite yet.
20:39
I agree there's a maturity curve here.
20:40
And I think, I think I just don't want anyone to, to listen
20:44
to this and, and feel like they can't get started because I
20:50
think, you know, sometimes we, I mean, we as professionals and
20:54
identity and security kind of see the future problems of how
21:00
do we share signals and better policy can do, you know, those
21:02
things. And just as a, a practitioner
21:06
who sells software that people implement, I also see a lot of
21:09
times people are struggling with like the basics, you know,
21:11
they're not, they're not thinking about anything double
21:13
black diamond signal sharing. They're thinking about how do I
21:16
just remove access that people don't need?
21:18
Yeah, I have way too many people who have access to AWS
21:22
production infrastructure. How do I get that down?
21:25
So they're, you know, they're kind of over here and I, I just
21:27
definitely think there is, we just have to appreciate there
21:30
is, you know, a little bit of a maturity curve there.
21:32
I get bobbed into that worry a lot of times too, because there
21:37
is a broad maturity curve. There are companies though, that
21:41
are in that space where so you're sending privileges and
21:45
even striving toward least privilege.
21:47
The way the reason to say striving is I look at
21:51
information security policies all the time, blah, blah, blah,
21:54
least privilege. And then you go in and you're
21:56
having the conversation about our back to me, that's like the
22:00
opposite of least privilege. Let's make it easier and more
22:04
efficient to administer access. That's it says here your
22:10
information security policy that your, your focus is on giving
22:14
people the least access that they need.
22:17
Now to me, 0 standard privilege, you know, provides another
22:22
benefit, which is it reduces your attack surface, you know,
22:26
and that is huge, right? There's we, we have to give a
22:30
nod towards that, but I think that the same knock on 0
22:34
standing privilege, which is how, how scalable is that,
22:39
right? How can we take 5000
22:42
administrators or whatever we say these, this number of roles
22:47
are the things that we have to revision on the fly as needed
22:52
only can we can we scale to that?
22:57
Well, I think lease service is the same thing and that's why
22:59
you have something like role based access control, which is
23:03
that makes provisioning access scalable.
23:05
So this is in between place, Jim.
23:07
I think one of the things, the parallel here and I draw this
23:09
and I read a follow up called a field guide is ESP
23:13
operationalization. One of the, I draw the parallel
23:15
that there's a lot of similarities to the conversation
23:17
about automated provisioning, right.
23:20
I have yet to coming back to my analyst days meet an
23:23
organization that has 100% automation for every system for
23:28
every user in use case and that that's an antique pattern.
23:31
You shouldn't burn your dollars trying to do that.
23:34
That there are high value, high volume systems that automated
23:38
permission makes sense for and then everything else is an
23:41
evaluation of use case of effort risk, etcetera.
23:45
I don't think CSP is any different than that, which is to
23:47
say there are some places where the exposure is enough to
23:52
justify the effort and then the evaluation criteria may be
23:57
different than what we used to evaluate user parish in terms of
24:00
how would I automate or not automate, but I can go through
24:02
the same thing. It is always a mistake to be
24:05
like I have new trend identity and I'm going to use it
24:08
everywhere. Like, no, don't love God, don't
24:11
do that because it only because the cultural impact to what
24:17
you're doing is so significant. And Lance, you, you and I sort
24:21
of got into this a little bit back in in any pro slack about,
24:25
Hey, where does this configuration configuration come
24:27
from? This this is a CMDB thing.
24:28
Like are we moving the risk from XYZ system, which is in the
24:32
identity domain to now a system configuration domain who may not
24:35
be as familiar with like? And there was some back and
24:37
forth and I don't think there's a good agreement on that.
24:39
Which may not even exist. Right.
24:41
No, it it doesn't. And you know, that was kind of
24:45
the point. And obviously I agree because
24:47
that's what I said. But our temptation in this
24:52
industry is to find something and pretend as though that's the
24:55
silver bullet for solving a lot of our problems.
24:58
And the answer is a blend. As you were talking about, RBAC
25:03
has a place. If I have a group of accountants
25:06
that all have the exact same 5 applications with the exact same
25:10
roles, I have no reason to implement ZSP in that context.
25:15
For that specific I want to say setting entitlements.
25:19
I actually I wanted to add on that too.
25:21
I think I do not think RBAC is an antique.
25:24
Actually, I think you can hold these two things in your hand.
25:27
I think you can do RBAC and also apply ZSP to it.
25:30
Our role based access control is just a justification for why you
25:34
get that access in the 1st place.
25:36
But there's no reason that you couldn't grant all of your
25:39
drones a bundle of access and say, oh, and by the way, the
25:41
things that you don't use in 30 days is going to go to zero.
25:44
We're going to take it away, but if you need it back, we'll give
25:47
it back to you really easily. You just have to have an
25:49
automation in place. So that that I agree with the
25:53
principle behind it that shifts the overhead to the example that
25:57
Ian's talking about, where if I can't orchestrate all of that,
26:02
then you're making my identity. So that's.
26:05
Look at the thing that's falling over, right?
26:07
The thing that this breaks in this moment is we're going to
26:11
shift a rule definition, let's say from my IGA system to maybe
26:18
my access management system. And so I'm still going to use
26:22
our Mac. I'm still going to assign some
26:24
of these entitlements. The vehicle by which I do that
26:26
is different. Do I have a way to remove that
26:29
after a certain type of crap? I don't know, right?
26:31
Like you get into these other things.
26:32
So Lance, I think I'm going to push back on is you're still
26:36
going to have the same sort of administrative requirement of
26:40
analyzing users and what they need the vehicle for expression
26:44
of that is different. But, and this is the problem is
26:49
there isn't consistent orchestration of these kinds of
26:51
things. And most, many, many, probably
26:55
most target systems, the ones you want under management, don't
26:59
have a sense of ephemerality. Maybe you can chit in, but you
27:03
don't have a good way to get out like you know.
27:05
So now you get into the real rubber meets the rain.
27:08
And I think the the point here is not lost on me too, that you
27:12
always have to assess as the person implementing these
27:16
changes and making this, getting this work done.
27:18
Is the juice worth the squeeze? Is the is.
27:22
Making an accountant's access ephemeral for certain systems
27:27
actually doing something meaningful and material?
27:30
Or is it not really? Why?
27:32
Are these accounts? We know they're not listening to
27:37
the. Podcast right now.
27:39
No risk of offending the accountants.
27:40
On this podcast somebody listens to these anyway, so I.
27:43
Think that's a great point. And and I, I think to make David
27:46
Broussard smile a little bit, you could make the argument that
27:50
that's where the appeal of key back can be because the
27:53
accountant doesn't natively have that access.
27:57
It's based in policy and maybe that's why we pivot at that from
28:01
an authorization. Model, which obviously could be
28:03
a pot into itself I. Think I'm there with you and
28:08
what I'm trying to make sure of is AI don't hate my users or
28:12
make my users hate me. Right.
28:14
And some of my users are my security admins who are going to
28:19
be directly impacted by this. Now, if I can automate that
28:22
where once they log in and they click a couple of switches, they
28:25
can step into the roles that they need to to execute their
28:28
primary day functions, I'm kind of OK with that.
28:31
Yeah, the the example that comes to my mind is the help desk
28:35
people, they're resetting credentials all day.
28:39
Do we want them to check out that access every time they need
28:42
to reset a credential? That's going to make their job
28:45
much less efficient. I think.
28:47
You know, the other thing is you could say, well, in the
28:50
beginning of the day, they check it out, they use it all day,
28:53
they leave, but then they work a different shift next week and
28:57
none of it works. And like all health purchases,
29:01
but do they pose enough of a risk that you should say zero 70
29:06
privileges? So a, a, a derivative of that is
29:12
as we get ubiquitous unfishable, strong authentication
29:16
everywhere, the attackers are going to move to other places.
29:19
It's going to be about session exfiltration, It's going to be
29:21
token exfiltration. And So what I worry about is
29:25
that we're going to need other kinds of mitigations, right?
29:29
We're going to need other kinds of identity in depth kind of
29:32
controls. And so one of those things is
29:34
ZSP is adding to that when now the new attack frontier is going
29:38
to be session exfiltration. We're going to need to put some
29:41
layer in there to. Actually.
29:42
Help that. So while I agree, like I don't
29:45
really need that access, you know, checking in and out would
29:48
be cumbersome, especially if it's manual at that it's not
29:50
happening. But it's the great I've had this
29:53
persistent thing, especially if we're talking session ID token,
29:57
how do we address that problem? Because that's that's a now
30:00
problem. And that's what you know, TDR
30:02
notionally talks. Well then it depends on what
30:05
flavor of TDR we're talking. About to like jump servers and
30:08
actually. They buy.
30:09
TDRS like the net underneath of people who are swinging back and
30:14
forth on the the swings and they're 100 feet up and if they
30:18
fall, they fall into a net. I almost I've been like
30:22
struggling with maybe ITDR should be the first thing we do
30:25
I thought. You were going to say like, I've
30:27
been arguing like no Nets like. That's the thing even with ITDR
30:33
is that it'll tell you maybe if you have a problem.
30:35
I think the, the, the trick is particularly with something like
30:39
session X filtration. And if you look at where that
30:42
would be potentially devastationals, like, you know,
30:44
infrastructure access, data access, that matters.
30:48
I don't want to hear, I don't want to find out about, I really
30:51
want to prevent it from happening in the 1st place.
30:53
So I think the, the real question is how do you achieve
30:56
that? And I think this is where you
30:59
got to. I, I'm, I'm convinced that
31:01
there's a little bit of a zoom out here because I think
31:02
identity is part of the problem, but I think you have to look at
31:05
the whole attack chain and actually go a little bit
31:08
broader. So for example, we use hopefully
31:11
my Co founder won't get mad about me saying this, but we use
31:14
Chromebooks only for production accidents because we're you
31:19
know, with strong authentication and ube keys with just in time
31:22
privilege escalation because we don't want to worry about
31:26
session exfiltration. I had a conversation on Bob Lord
31:28
at, I think it was at Seneca conference in like Seattle or
31:34
whatever. And that was one of the things
31:35
he taught me about. He was, for people who don't
31:37
know Bob Ward, he was at the time, I think he was, he'd just
31:40
come out of a role like DNC Cecil for Democratic National
31:43
Party, stuff like that. And that was the same thing he
31:45
was preaching back then. This was like maybe three years
31:47
ago was he got everybody on the Chromebooks because they were
31:50
just safer, generally speaking. So it doesn't surprise me that
31:54
that that's, you know, there, but only, I think because
31:58
they're such a small part of the population.
32:00
It's like, well, people are going after Windows because
32:02
everybody use Windows. And then, OK, well, Mac is
32:04
starting to get, you know, popular.
32:05
Some people are starting. To go after.
32:07
That Chromebooks are a very niche market.
32:11
Totally. And it's to the point though,
32:12
like is the juice worth the squeeze for production access
32:15
with, you know, very sensitive access?
32:17
Yes, for a standard of people when I make every employee at
32:21
the company do all our work on it.
32:22
No, I would have a lot of people quitting.
32:25
But actually the same thing that Lance you said about you don't
32:28
want your users to hate you, right, and make their life
32:31
difficult. Again, we're talking about Opera
32:34
authorization. Opera can talk operationalizing
32:37
this thing and we can't do 0 standing privilege if there
32:41
isn't some way to make that actually happen in a more real
32:45
time manner without it becoming really crappy for everyone
32:48
involved. I want to sit there and have to
32:50
wait for you to tell me, oh, there's an incident.
32:52
OK, let me grab you the access. Jeff, are you telling me that if
32:55
I said to you, hey, instead of quarterly access reviews, we're
32:58
going to do it every three hours, people would push back?
33:00
From them I didn't do it push back, but I think.
33:02
There's a way people would like. That I would love to do just a.
33:04
Full time job and just run it. Yes, yes.
33:09
But I think this is an area where should we be doing it?
33:14
Yes, but I was listening earlier we started to dissect 0 standing
33:17
privileges. Well, maybe this is only really
33:20
something that's realistic right now for privileged access.
33:23
Yes, of course, let's pull away domain administrator, global
33:25
admins, etcetera from roles that I think there's a little more
33:28
tolerance for that to say, OK, I need to have our structure on
33:30
that. Well, if you're talking about
33:32
the accountant scenario or doesn't matter, right, Frontline
33:35
worker, somebody's going in and and they don't McDonald's or
33:38
they're on a line, construction line and they're very ephemeral
33:41
jobs even. The only way that that happens
33:44
is if you have some sort of automation to make it much more
33:48
real time. And I wouldn't even argue it
33:50
needs to be more self-service even.
33:52
You, you have to because you have to make it easier for
33:54
people to get the access. Exactly.
33:55
If you if you take it away and it's not easy to get back, you
33:58
will have a revolt. The best experience here is the
34:01
one that the user absolutely never sees.
34:03
It's like incident happens, helpdesk tissue ticket issued.
34:08
Take it aside, that person gets blessed.
34:11
They do their job, end of discussion.
34:13
Closed ticket the stream. Baker I'm I'm walking into I'll
34:18
use a restaurant because he worked, I worked a restaurant
34:20
for like a decade and I'm wearing a ring or an ID badge or
34:23
something. And it's a what's that's Fido,
34:26
right? So we're it knows who I am by
34:29
presence. I'm in and based on data that
34:32
says I'm working this shift, as you know, a server or a
34:35
bartender or whatever, front of house, Expo, whatever, whatever
34:38
role you want to say. And those bits of data are all
34:42
correlated with what can I do in the POS system?
34:45
I can place orders. Can I adjust prices?
34:46
No, because I'm not in a management role that day or
34:49
whatever it may be. The idea of the world is.
34:52
I think all these data signals are informing what I can do like
34:58
that. That's recognition.
35:00
That's actually recognition versus authentication.
35:02
And Andre actually sort of bumped up to that topic in his
35:06
keynote, which I thought was really interesting, is like, how
35:09
does that that rich context get recognized and operationalized?
35:13
Yeah, I think, you know, obviously that's kind of where
35:16
I'm sleeping at the moment. Is, is thinking about store side
35:20
because borrow a horsemanship analogy, I had to insert at
35:25
least one in here. The principle of making the
35:29
right thing easy and the wrong thing hard applies.
35:31
And going back to your analogy of talking about the help desk,
35:37
great example. I have 0 issue with telling my
35:42
help desk employee for the 1st 10 seconds of your session in
35:47
that work today, you need to log into the portal and step into
35:50
that role. That way there's at least a
35:53
little bit of friction if that credential is compromised, that
35:57
prevents that person from stepping into that role because
35:59
maybe stepping into that role, I require a stronger method of
36:02
authentication or recognition in this context.
36:06
I love the recognition idea. I think that's really where our
36:11
next stage of authentication is. We're just going to call it
36:14
something different. Yeah, I think that help desk is
36:17
a great example because if you got into a network with a line
36:22
worker's account, who would you want to do lateral movement to
36:25
outdesk account? Because they can go and change
36:29
passwords and do a lot of things.
36:31
So the. Target for social engineering
36:33
attacks. I mean, you're calling the help.
36:35
Desk. You know, the other one that's
36:36
really beneficial there is despite what people would people
36:40
wouldn't raise their hand if I asked this question, but how
36:41
many people are still doing Model after in their
36:44
organization? A lot.
36:45
A lot. Right we.
36:46
Know that to be true. The nice thing about if you can
36:49
get to it, at least in certain domains, ZSP is even if you did
36:52
model after you did the kind of wrong thing, the exposure window
36:56
is limited. And so there's a it's that
36:59
safety net for the Acrobat kind of thing of saying like, maybe
37:02
we're never going to get away from model after because it's
37:04
actually access team efficient to do it.
37:08
But maybe we can make it slightly safer, right?
37:10
We could put a cork at the end of the fork and like, keep you
37:13
from stabbing yourself when you miss it.
37:15
So the one piece that I would like to kind of tug out this
37:18
sweater a bit, and that's actually two points.
37:22
The first one is your comments regarding governance aside, it's
37:27
a necessary evil and one of the challenges of 0 standing
37:31
privilege that honestly exists pretty easy.
37:34
SP is our data about entitlements often times is.
37:39
I'll just be candid. Careful, it's crap.
37:42
And so that's where. You know you.
37:44
You. Made the joke about the three
37:45
hour certification thing, but that has to be part and parcel
37:49
of if we achieve ZSP #1, we have to have the way of conveying
37:54
because Sarbanes-Oxley isn't going anywhere.
37:56
So if I have that level of access to those systems, I have
37:59
to be able to describe that in a way that the certifier can look
38:01
at that, recognize it and go and make an appropriate yes check on
38:06
that, not say. Again, none of those arguments
38:09
are against the idea of achieving ZSP.
38:12
It's just the the complexity surrounding.
38:14
And this is where my nihilism sprung from is entitlement
38:16
catalogs are like the most under loved and super important thing
38:20
no matter what you're doing, ZSP or proficient or what have you.
38:23
Just the what the heck does this do right?
38:26
And if I gave it to you, what would you do with it?
38:28
Like that's an under loved part of this story.
38:30
Yeah, to your. Point the the piece that could
38:33
improve out of this is if the vendors realize this in the
38:37
space, maybe these platforms become better at describing.
38:41
That. I can get into that and say I
38:44
know that Lance is stepping into a global admin role for, you
38:48
know, accessing these systems and I can use that descriptor
38:51
now in the certification phase as well.
38:53
I I was going to go exactly here, which is I think I'm not.
38:57
I actually love governance. I mean, yeah.
38:59
The truth doesn't make a company.
39:00
Governance, but it's cool the the the it's the problem where
39:05
the problem lives in the root of the problem is that systems and
39:10
ways that the governance platforms have been built
39:12
historically are not good at self describing what these
39:16
entitlements mean they are. And I think that's the piece
39:19
that's missing and there's never we talked a little bit about
39:21
protocols earlier. There's never been a protocol
39:24
that existed for systems to try to describe you were.
39:28
So spot on and I'm thinking of Darren Rawls, CTO at Wavesat
39:33
went into sale point long ago. He wanted to create a protocol.
39:39
This is when SPML was a thing. He wanted to create a sister
39:42
protocol that basically was a drive by descriptor protocol.
39:45
Basically like tell me what your roles are and what do they mean?
39:48
And that was a long ass time ago.
39:50
But like, he's not wrong, right? The How do I do discovery of the
39:54
meaning of these things? Shameless plug for we have an
39:57
open source ecosystem called Baton that we invented to solve
40:01
exactly this problem that has connectors for 100 plus major
40:06
sasses infrastructure and so forth that anybody can use, but
40:09
you don't have to buy conductor want to do that.
40:11
But I, I want to talk about this because I think that this is so
40:13
important that systems be able to describe what their
40:17
entitlements are, what their roles are, what it means in
40:19
terms of. How they're granted be able to
40:22
provision and deprovision that's always been missing in the
40:24
identity space and authorization is a mess.
40:26
And we we have to think about how we we bridge that gap of
40:30
systems describing entitlements, roles, permissions and so forth
40:33
to a government system so that those government systems can be
40:36
more effective. Yeah.
40:38
And part of what makes that such a challenge is the speed of
40:42
change of the that infrastructure has gone up
40:44
exponentially. There was a time when I would
40:47
stand up an application and the hardware was good for at least
40:50
three to five, five years. And so I can mold permissions
40:53
around that and I can certify against that.
40:54
Now it happens at the speed of light when the Kybernetes
40:58
session fails and all of a sudden we've spot up a new
41:00
container. In milliseconds.
41:03
Indeed, literally. That's why, that's why I'm so
41:05
heavily invested in the idea of to really do ZSP, it requires
41:11
automation. There's no way around it.
41:12
Yes, if now we can dissect it and say, OK, well we're only
41:15
doing ZSP for this very narrow scope of privilege or social
41:19
media accounts, right or whatever it may be that would
41:22
actually, but if. The goal in this case is.
41:23
Truly. Highly present.
41:25
Zero saying privilege. You cannot do it without a
41:28
massive amount of data. Not only just data quality data,
41:32
timely data, but automation to do things with that data to the
41:36
things that need to change to all the different systems.
41:38
So this, I think this is the new sort of battleground, if you
41:43
will, because if you buy into the identity, the idea of an
41:46
identity fabric, right? A bunch of services that have
41:49
capabilities, each of which have a different buying cycle.
41:52
Now IADP is a 10 year cycle. Maybe my, you know, this is a my
41:56
pay, my pay is a different one. All of them have to read from
42:00
the same score sheet. So data orchestration and then
42:05
policy, like that's going to be the new thing.
42:07
And the problem is that right now are market definitions.
42:11
What is admin time? What is runtime, what is IGA,
42:14
what is access management are woefully mismatched to the world
42:20
that is those three things in an identity fabric.
42:22
And there's no simple reconciliation there.
42:25
And again, we love our definitions.
42:27
So like, oh great, we're going to define yet another thing like
42:29
that's a horrible outcome. But we have this mismatch
42:32
terminologically, which is holding people back from
42:35
thinking about what they could be doing.
42:37
Oh, no, no idea. Does this.
42:39
No, no, you're thinking about it slightly skewed or in an older
42:42
definition. Yeah, I mean, there's a
42:44
combination of technologies here in play that really are needed
42:46
to make this happen. It's not just IGA, it's not just
42:49
a privileged access management tool, it's or your IDP.
42:53
It's it's it's a work day, it's your Adps, it's all your
42:56
identity, identity data sources. It's the, you know, the
43:00
contractor spreadsheet because nobody puts it in your HR
43:02
platform, right? It's stuff like that that are,
43:05
this is the real world. This is what happens.
43:08
In my real. World, how do we design around
43:11
that because what we're talking about here is a 10 year from
43:15
now, 15 year, 20 year from now solution doesn't help people
43:19
today. And you inadvertently backed
43:22
into a new acronym. DOP DOP.
43:26
Orchestration and policy Gardener can't take Rd.
43:33
You're invert for. Suppose Cheeto we've.
43:38
Had a Cheeto Cheeto as the. Jim, you should get a nickel for
43:40
every time someone says Cheeto. You voiced it.
43:43
Or a Cheeto. A literal Cheeto.
43:46
I'd like to. Get it on stage.
43:58
Be sharp. I mean, I feel like we can talk
44:00
probably about this for hours and hours.
44:01
We're already like 45 minutes. Oh wow.
44:04
Are we out of hard drive space? Just tell us.
44:05
Yeah, I am running out of hard drive space, that is for sure.
44:08
Video takes a lot of space, especially 4K video.
44:10
Maybe, you know, there's We do not.
44:12
Discover 4 Ki. Was like middle out here to do
44:15
4K, yeah. That's such a great.
44:18
There. Needs to be a better way to do
44:20
this. What I want to do is close out
44:23
with. What do you think was more
44:24
difficult to try and solve for 0 standing privileges or to try
44:29
and pick up a greased watermelon?
44:32
And then, as we were talking about earlier, the small
44:34
watermelon or big watermelon. This was before.
44:41
We get recorded. There was some somehow, we had
44:43
some conversation about the Whitewater Trading Center in
44:47
Charlotte, NC, and then somehow greased watermelons entered the
44:52
conversation. And then how much you took
44:54
except for is like, well, there's small ones or big ones.
44:56
Like what are we talking about now?
44:57
There's. We're problem solvers here.
44:59
That's forever. I'm gonna, I'm gonna ask you
45:00
that the 1st, I'll be the first one.
45:02
I'll give this and say it's actually it's easier to do ZSP
45:06
because there's no potential workman's comp issues.
45:09
We're trying to lift a greased water.
45:10
Yeah, like that could happen. So I think ZSP is a little.
45:13
Bit sick. What if I sprained my finger
45:15
clicking on a policy creation button in a piece of software?
45:18
Is that workman's comp? Putting on an access request it.
45:20
Actually. Is.
45:21
Yeah, it is. What do you spray?
45:22
You spraying your finger, clicking all the access reviews.
45:25
Yeah, thankfully my wife will never listen to this podcast
45:33
because she works in workman's comp, but that would be
45:36
considered a repetitive stress injury and would thus be covered
45:39
under your policy. Identity unsafe at every stage.
45:43
That's right with the bad boys of information security.
45:46
How about that? All right, well, this has been a
45:49
great conversation. I really do appreciate you guys
45:51
taking time. I know it's a busy time.
45:52
We have lots of people reaching out, wanting to have
45:55
conversations, but I'm really happy you guys were able to set
45:57
aside an hour for us and kind of talk through things.
46:00
I don't know if we actually solve anything, but I hope we
46:02
got people thinking about things right.
46:04
There's so much more to this this idea.
46:07
I think I think the goal should be service and privilege.
46:09
Let's get there. But let's take ZSP as the end
46:13
and let's start working our way that road.
46:14
What do we need to get to that would be a fruitful exercise.
46:17
And it's not something that's going to happen overnight,
46:20
right? There's going to be a variety of
46:21
technologies, investments, people, process technology, all
46:23
that stuff for it to make it happen.
46:24
So hopefully we don't get discouraged, right?
46:26
You know, Alex kind of point out for is like, yeah, look, there's
46:29
it is a realistic goal, but it takes quite a bit today.
46:33
To get to that. But it's a worthwhile.
46:35
Attempt. Scary, but it's job security.
46:39
Yeah, and. And the thing that I know is
46:41
COBOL. What's your point?
46:43
The thing that I try and do, and I'm experiencing this in my
46:46
current role is they, they talk frequently about what does good
46:50
look like. And that's a worthy discussion,
46:53
especially in this context. But I also like to ask the
46:55
question, what does better look like?
46:57
Yes, just pushing that one step further, reducing a risk by 1%
47:04
has a material benefit. And if, if we can take that
47:07
principle of 0 standing privilege and just say, what if
47:10
we just start playing with this around here?
47:12
Do we achieve that with some of these decisions that we make?
47:14
We're already advancing the cause.
47:16
Yeah, that's right. Yeah, any improvement is an
47:18
improvement. And taking an ROI eccentric
47:20
approach to, OK, actually we got a lot of risk over here.
47:22
Let's do that first. Yeah, all.
47:24
Right. We're going to leave it there.
47:25
I'll have links and show notes to connect with everybody on
47:30
LinkedIn and we can talk about grease watermelons or zero
47:34
standard privileges or just anything in general.
47:37
Let's see what else we are on the web. idacpodcast.com.
47:40
Yes, Jim, I will do the YouTube pull up youtube.com slash at
47:45
IDAC podcast. Go to our website, click the
47:48
link in the upper hand corner. Take it right there.
47:50
Mastodon at IDAC podcast at info site dot exchange.
47:54
I really hate the way Mastodon and like that whole thing does
47:57
their thing. Yeah, it's just not great.
47:59
Yeah, there's a problem. And then Twitter or X or
48:02
whatever it's called when you eventually hear or watch this at
48:06
IBAC podcasts, and we'll have links as well.
48:08
So hopefully people will enjoy this conversation.
48:11
I know I did. I like having these art of
48:14
possible. No clear answer.
48:17
What there's general. Agreement, consensus that yeah,
48:19
there's something here that we need to continue to work on as a
48:21
as an organization or as a group.
48:24
What is a group of Identarati called?
48:27
It's called a. Disagreement based on a dinner
48:29
in Seattle that Sarah Ciccotti had at her house.
48:33
Ian, were you there? I was not.
48:34
You're not there. I've heard of it, though.
48:36
Yes. And so there were several people
48:37
there. And that was, that was actually
48:39
my first, like, meeting of actual, real identarati.
48:43
So it's very cool. But yeah, in a disagreement of
48:46
identity professionals is what I guess what I'd call at.
48:49
Least we're not calling it a murder.
48:52
All. Right, let's see you there.
48:55
Thanks everybody for watching, listening, and yeah, we'll see
48:59
you next time. You've been listening to
49:04
Identity at the Center. We hope you've enjoyed the show.
49:08
Make sure to like, rate and review, and we'll be back soon.
49:13
But in the meantime, hit the website at
49:15
identity@thecenter.com. See you next time on Identity at
49:21
the Center.