Latest / Identity at the Center / #357 - Sponsor Spotlight - Silverfort

Transcript

#357 - Sponsor Spotlight - Silverfort · Identity at the Center

0:05
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Good.
0:17
I'm excited. Today.
0:18
We've got one of my favorite guests from one of my favorite
0:21
technology companies, so can't wait to get into it.
0:24
Yeah, today we've got a sponsor spotlight episode.
0:27
These are the ones that we create with our friends in the
0:29
industry to help us get some more detail around kind of what
0:33
they're working on. A little bit of a departure from
0:35
our normal vendor neutral, which we do every week, but this is
0:38
where we actually get to ask questions about product and and
0:40
things like that. So I want to welcome back for
0:42
the third time from Silver Fort Head Cavetts.
0:45
He's the CEO and Co founder at Silver Fort.
0:48
So welcome back to the show Head.
0:50
Hey, Jeff. Hey, Jim.
0:52
Good to be here. Yeah.
0:54
The last time we chatted was at Gartner.
0:56
And if you recall, Jim was in his like Vegas or maybe like
1:00
Western dealer outfit when we were chatting there up in your
1:04
suite. So yeah, what have you been?
1:06
Today, you know, I had. I was expecting something, you
1:10
know. Sorry, this is all I could do
1:13
for the name was a golf shirt, yeah.
1:16
You look very normal. Normal in quotation marks.
1:22
So what have you been up to for the last few months ahead since
1:24
we last chatted in December? Been very busy.
1:29
I mean, first of all, the, the identity market in general is
1:33
really moving super fast now and there's so much going on and,
1:36
and in silver for typically those you know a lot of going
1:42
very fast. You know, we, we now have more
1:45
than more than 1000 customers. Marston for us, we we've been
1:53
to, I mean we acquired a company called resume just told you
1:56
about it. You know, last time it was right
1:58
after, but you know, since then we've we've kind of integrated
2:01
the teams and the platforms together and already started the
2:05
offering it to our customers. So that has been strategic for
2:09
us. We released new products.
2:11
We we grew the team. We hired the new resident and
2:16
chief revenue to be the goal to mark not going on in in a few
2:21
months. I like it.
2:25
I like the the speed. And had we just got back from
2:29
the Denver's conference, a couple observations. 1 is that
2:34
this community is stronger than ever.
2:36
The second thing is like how much this identity security
2:41
space is evolving. You've got such a focus on NHI.
2:46
They had an NHI Pavilion, which Silver Port played a part of.
2:51
You've got the shared signals framework really taking center
2:56
stage. It's got AI agents as a major
2:58
talking point. What do you see with all this
3:02
starting to come together and evolving?
3:05
It's really changing from single sign on privileged access
3:10
management and identity governance, right, Taking on a
3:12
much bigger picture. Yeah, I or in general the the
3:18
identity market is evolving and I think that you know what we
3:22
started to see last year, I think is, is only, is only
3:28
progressing which is you know the kind of identity security
3:34
category forming and becoming it's own thing as opposed to a
3:38
lot of features and point solutions.
3:41
So I think what we're starting to see is all these things, you
3:46
know, like known human identity, security and identity threat
3:50
detection response and identity security posture management and
3:54
all these all these, you know, these buzzwords.
3:58
The different start-ups have been doing are starting to
4:00
converge and starting to to become, you know, something
4:04
border and and work together and and really kind of, you know,
4:08
collaborate and indicate between them.
4:11
And I think that's what organizations need, you know,
4:13
not a million different products, but something that
4:16
really fits the the problem holistically definitely be
4:21
happening. I mean, we we are obviously
4:22
pushing in that direction and and really kind of going for a
4:26
platform play, but we're not the only ones.
4:28
You know, a lot of a lot of people are talking about that.
4:31
And, and I think that all these, all these smaller categories
4:35
like non human identity security as an example, are actually
4:38
contributing to that because those are the things that kind
4:41
of create the momentum for a a bigger platform to be created.
4:46
That's exactly what happened in the early days of cloud security
4:48
or endpoint security, all these smaller things that eventually
4:53
created enough critical mass for that.
4:57
I get the feeling that there is like this assumption that people
5:01
at this point have solved for, you know, basic identity
5:04
governance, basic privilege access management, single sign
5:07
on MFA, right? They've kind of centralized and
5:10
maybe gotten the basics in place, which I struggle with
5:14
because I'm not always sure if that's the case.
5:16
I see a lot of companies out there that still don't have an
5:18
IGA. They still don't have really
5:20
privileged access management. I guess is, is, is that a fair,
5:23
and I don't want to call it a criticism, but you think it's a
5:25
fair observation of, OK, we're assuming you've got these basic
5:29
things in place and now we're starting to get into sort of the
5:33
next Gen. of identity security. And that might be things like,
5:37
you know, AI and NHI and share signals framework and Cape and
5:42
like a whole bunch of other acronyms, right, that assume
5:45
maybe you've got some of that stuff in place.
5:48
Is that fair? I think that you are actually,
5:53
you're actually very right about the fact that there are people
5:55
don't have those base build out. And I think that what is
5:59
happening now is not necessarily some kind of a next layer that
6:05
assumes that you already have the layer before that.
6:07
I think that in many ways what is happening now is companies
6:10
are realizing that they they haven't meant made enough
6:13
progress with the old approach. They haven't been able to solve
6:16
the problem. And part of this new approach
6:19
that we're seeing is also trying to go back to these things and,
6:23
and address them in a new, maybe simpler way.
6:28
Because I think what has been true for identity for many years
6:31
is identity is, is very complex. Anything that you do in
6:34
identity, any identity project is used and, and tons of
6:39
resources. And some of the very large
6:42
organizations have been able to do it with huge investments and,
6:45
and, and headcounts, But many companies haven't they, they got
6:49
stuck. And I think that what's
6:51
happening now with all this innovation in the market is not
6:54
only offering you the next things, but also revisiting some
6:59
of these problems and saying, hey, maybe there's a better way
7:01
to do it. Maybe there's a more automated,
7:04
scalable, easy to implement way to, to address.
7:08
So I think you're, you're completely correct about a lot
7:11
of companies don't even have those basics figured out.
7:13
So we, we can't afford to just move on.
7:15
We we have to take care of them. OK, well, I'm glad to hear that
7:19
you say the I'm going to hear you said I was right.
7:22
So that's all I took away from that answer.
7:26
So you guys have recently expanded and you know, from, I
7:29
guess like the on Prem identity to including now non human or NH
7:34
is which as Jim mentioned was sort of the buzz around the
7:37
recent identifiers conference. Why do you think that is?
7:40
I mean, it's not like NHS are new, at least from my
7:42
perspective. We've had service accounts,
7:44
another non human identities for a long time.
7:47
And I'm just curious as he why do you think this is getting so
7:50
hot right now? I think it has been a problem
7:54
for a long time. I don't think it's a new
7:55
problem. You're right.
7:58
Service accounts specifically have been a problem for decade.
8:02
Some of the newer types of energies are, are newer,
8:06
obviously, you know, maybe the the ones who are in the cloud
8:08
and SAS applications and things like that.
8:10
So they are obviously newer, but the, the fact that everybody's
8:15
talking about it right now is, you know, a combination of the
8:18
fact that it is a big problem and it is a big list that people
8:21
need to address and the fact that there are vendors of, you
8:25
know, investing money and raising money around it.
8:27
So that creates that feeds some of the hype.
8:30
I think that's actually a good thing because I think that the,
8:34
you know, the the startup ecosystem and, and, and you
8:37
know, the innovation that it brings with it is actually a, a
8:41
great way to to fuel this revolution that was seeing
8:46
across the identity industry. It's not just non human
8:48
identities. You know, last year it was all
8:50
about ITDL, right? And I'm assuming next to it will
8:54
be all about the security for Jen, TKI and all of these
8:58
things, you know, separately, they look like trends that come
9:02
and go, but all together they create this, this wave of, you
9:07
know, priority and investment in identity security in in a new
9:11
generation of identity security products.
9:13
And if you look at the early days of other security segment,
9:16
I mentioned cloud security. That's what happened, right?
9:19
It started with people, you know, kind of building companies
9:23
to do a container security or cloud security posture
9:30
management or, or, or other specific things that eventually
9:33
created enough pieces to, to combine into an overall cloud
9:38
security platform. And I think that's what we're
9:40
saying in identities is all these waves and you know, all
9:43
these trends, they seem to kind of come and go have this kind of
9:49
hype cycle, but, but all together they're creating the,
9:53
the bigger wave of, of just overall awareness to identity
9:57
security and, and, and your approach of addressing it, I
10:01
think specifically that NHI is a big problem.
10:04
It's not just a trend, it is a big problem.
10:08
People spend so many years trying to protect the human
10:10
users with multi factor authentication and, and beverage
10:13
access management and, and, and they have neglected the the non
10:17
human identities and those non human identities are now
10:20
targeted in the majority of data breaches.
10:23
So it is it is a very true, you know, risk and something that
10:27
needs to be addressed. I think it will also go now
10:30
with, with AI. So, you know, AI agents are also
10:35
increasing that problem because they're taking a bigger and
10:37
bigger hole in organizations and they probably probably will
10:41
continue to to grow. So overall, this is a very
10:44
growing problem that has no good solution.
10:46
So I I get why this is a priority.
10:50
So let's talk a little bit about that recent expansion you guys
10:52
did into that whole NHI space. I'm going to put my very well
10:56
worn on jaded, you know, see so hat there's so many products in
10:59
this space. So what makes Silver Fort
11:02
difference when it comes to how you guys are approaching, you
11:06
know that that that type of identity security is in a
11:09
specifically for these NHIS or maybe cloud identities?
11:14
So first of all, we announced an expansion in that area, but, but
11:19
we've been doing anonymous identity security for, for
11:23
several years now from before it was cool and we just started
11:30
from what was the priority. I think it still is the priority
11:34
in many cases, but it was definitely the older problem,
11:36
which is service accounts. So Active Directory service
11:39
accounts, that's when we started, you know, maybe five
11:41
years. And with AD service accounts, I
11:47
think we've built by far the best solution in the market.
11:50
I, I stayed very comfortably because I think that, you know,
11:52
we've really done some massive innovation though that no one
11:56
else has been able to do so far. So not only we are able to
12:00
discover all these service accounts, even the ones that are
12:02
not documented, the ones you don't even know about, because
12:05
we, we look at the behavior, you know, we can, we can see that
12:08
it's behaving like a machine, not like a human.
12:11
So we find even even unofficial ones, you know, ones that, you
12:14
know, maybe, maybe some person is using the personal accounts
12:19
to run some application or script.
12:21
We'll, we'll even find that. So not only the documented 1
12:26
then we also show you what they're doing.
12:28
So we show you that this service account is being used from these
12:31
sources to these destinations with these protocols.
12:34
We give you the full mapping of the, you know, the dependencies
12:37
where is it actually being used. That has been a huge problem for
12:40
years. People couldn't protect these
12:42
accounts because they were worried if they make any small
12:45
change to them, something will break.
12:47
You know who knows which other applications have been using
12:49
this account. And if I, if I even change the
12:52
password once, something will break.
12:54
We, we map all these dependencies.
12:56
You, you have full visibility to them.
12:58
And then the most powerful piece is we have a way to actually
13:02
enforce a policy. We can protect them in line.
13:07
And that is probably the biggest differentiator of silver fault
13:09
in general. And specifically for for non
13:12
even identities, not only we show you what they're doing and
13:16
offer some offline kind of, you know, risk mitigations you can
13:21
do, but also we can control what they do in line.
13:26
So if we see a service account being used outside of where it's
13:31
normally usable, it needs to be used.
13:36
We can, you know, kind of block anything else, you know, or, or,
13:42
or tell you if anything else is happening.
13:44
So if we see that this account is used to connect from A to B
13:46
every day, any attempt to use it anywhere else or to anywhere
13:50
else, we can alert on or we can even block in real time.
13:54
So make it impossible to abuse this account.
13:58
This really reduces the risk of those accounts because it means
14:00
that even if you steal the password, you can only go from A
14:03
to B. You can't cause damage.
14:08
And then that is what we've done for a few years very
14:13
successfully. Hundreds of enterprises are
14:15
using it, some of the biggest companies in the world.
14:17
I think we we'll probably have, I think we have the most
14:19
advanced ported for that. What is the the newer edition is
14:24
that we expanded that to all the cloud environments and that is
14:28
thanks to acquisition of resume. So resume it had those
14:33
connectors and and and analytics around all the different cloud
14:37
environment and we've now fully added that into our platform.
14:41
We really merged the product because a few months I think we
14:44
did it relatively fast. So we, we completely really
14:48
combined the pot. Now we can protect non human
14:53
identities anywhere, not only in AD but also in all the major
14:58
cloud identity providers like Okta and Intra and all the the
15:03
cloud infrastructure, the providers like, you know, AW and
15:08
Azure and GCP and also all the major SAS applications.
15:12
So even if you have SAS applications that you use, you
15:15
know, with local identities, we'll even we'll even see and
15:18
protect that. So now it's a really end to end
15:21
offering. And I think it it's probably the
15:23
boldest offering in this market. And and also, as opposed to some
15:27
of the younger start-ups, we have a much bigger customer
15:29
base. We have, you know, many large
15:31
organizations using it at scale. So I think, you know, overall
15:37
with the the taction and maturity that we have and with
15:40
the fact that we have this, this in line active enforcement,
15:43
modulating that we have a lot of advantages in this space.
15:48
And and then I think the the next thing that you know, was
15:53
going to to be important and we are all over it is, is how do
15:56
you protect the identities of AI agents, which are non human
16:01
identities? But I think it's a new type.
16:03
It's a completely new type of energize, not like the the
16:08
regular energize. Yeah, I know we're going to talk
16:12
about AI because we just, we can't go for an episode of the
16:14
Identity Center podcast without getting into AI at this point.
16:17
I want to ask you real quick though, about the the ITDR space
16:21
itself. When we first met, that was kind
16:23
of like, oh, OK, this is the area you're playing in.
16:27
How is ITDR fitting into this? Because you know, Jim and I just
16:32
got back to my identifiers conference and there really
16:33
wasn't a lot of mention of ITDR specifically.
16:38
And I'm curious to see if, if, if that term has evolved or are
16:41
we moving now into it? Is it just identity security?
16:46
Like where do you see ITDR fitting into this?
16:50
It's a great question. I think that what is happening
16:53
to ITDR and what I think will also happen to these other
16:56
subcategories of identity security, including an agile is
17:00
they're emerging and they're getting some maturity and then
17:04
they're being at some point kind of consolidated or, or merged
17:08
into bigger identity security offerings.
17:12
So, you know, IPDR, there were a lot of startups doing it and,
17:15
and you know, a lot of enterprises started, you know,
17:18
even looking for that and then a lot of these stars got acquired,
17:24
right. And the and and what kind of
17:27
merged into bigger identity offerings or identity security
17:30
offerings until the point where it's almost a feature now in, in
17:34
border platforms. By the way, two types of
17:37
platforms that where you see it kind of melt now.
17:40
One is into border identity security platforms like ours.
17:44
And 2nd is into XDR solutions that, that are not really
17:50
identity specific, but they do detection response in general,
17:54
right. So a lot of the the companies
17:55
that will just focus on detection response.
17:58
Now ITDL is one pillar of that. So you know, if you really think
18:02
about it as either a feature of a bigger identity security
18:05
platform or as a feature of a bigger XDR platform, but it's no
18:09
longer a stand alone thing. And that makes a lot of sense.
18:14
You know, who wants so many different products?
18:17
I think the same will eventually happen to NHI Security.
18:20
I don't think that in two years from now people will buy NHI
18:23
Security from from companies that only do that.
18:27
And so I think that the, it makes a lot of sense that these
18:31
things are, are kind of created and, and developed and, and you
18:36
know, kind of, you know, getting innovation from the startup
18:40
ecosystem. But then once they, once they
18:43
really kind of figured it out, they, they become part of bigger
18:47
platforms, very similar to what happened to UEBA in the past.
18:53
If you remember, there used to be a lot of products doing user
18:56
behavioral analytics, and today it's just a feature of every
19:00
Security Council. Yeah, good point on UEBAI
19:04
actually wanted to bring you back to that service account
19:07
discussion. This ITDR thing is so
19:10
fascinating, but I think the service account is everyone can
19:15
relate to it. You guys put out a new report,
19:18
let me get the name right. Insecurity in the shadows, new
19:22
data on hidden risks of non human identities.
19:25
There are a couple statistics in there, but one that really
19:28
jumped out at me was that 80% of organizations can't stop the
19:33
misuse of service accounts in real time.
19:37
I think 20% are out to lunch, don't even maybe don't even know
19:43
that there are service accounts. This is a really hard thing to
19:48
do. I mean, you mentioned it where
19:49
you have these service accounts and for some organizations,
19:53
they're the kind of the outlier accounts that were created in
19:56
2006 and nobody who was around there and works here anymore
20:02
kind of thing where you have these really oddball service
20:04
accounts. But even when you have good
20:09
control of your service accounts, to know that they're
20:12
being misused 1 requires that you would need to understand
20:16
what the proper use is. Then you need a mechanism to
20:20
stop that account from taking action if it's being misused.
20:27
So you kind of spoke to that, like what is the mechanism to
20:32
make all that work from a Silver Point?
20:34
Perspective, first of all, you're right, I think those
20:39
those 80% is probably really 100%.
20:42
Maybe there are the others of our customers, but other than
20:44
that, I really think it's a, it's a problem that I don't, I
20:48
don't see people solving it on their own.
20:51
And, and we have built, I think a very innovative technology for
20:59
addressing this. And also not only we have
21:02
technology, but we really talked about the full journey of doing
21:05
it. So, so I'll start just from the
21:06
technology that I'll explain what we had to figure out in the
21:09
journey to help customers really leverage this effectively.
21:13
The technology piece is, you know, we figured out that it's
21:16
not enough to just give you visibility to these accounts.
21:19
I mean that that's a good starting point and that's what a
21:21
lot of the vendors are doing now.
21:23
But I don't think that solves the problem on it's reading
21:26
information from the directories is this is just a starting
21:30
point. We had to figure out how do you
21:32
then enforce controls? How do you basically intervene
21:37
in what these accounts can do? And that really requires an
21:42
inline technology. So at the heart of the
21:46
Silverwood platform, those are technology that we call RAP,
21:50
runtime access protection that plugs into the directory, OK,
21:55
for example, Active Directory, but also others in a way that
21:58
doesn't just give us visibility, it gives us the ability to
22:02
intervene in line in the actual decisions of the directory.
22:08
So for example, if you're trying to access some system, could be
22:11
a modern system, could be a legacy system, and we see that
22:15
request coming in to the directory.
22:18
We are able to then not only see it and and and log it and
22:23
analyse it, but we are also able to potentially block it or to
22:27
potentially hold it and do something about it, like verify
22:30
it somehow and only then allow it.
22:32
So we can, we can really become a decision point in the middle
22:37
and we found a very elegant way to do it without causing, you
22:39
know, any issues to the network or to the performance that, that
22:42
that appeals a lot of the sticker sauce of Silverfold and
22:47
what gives us advantage in many areas, but also applies to to
22:51
service accounts. Because with this, we can not
22:55
just give you visibility, but we can actually prevent any abuse
22:58
of these accounts. So now moving to the, the
23:02
journey of how COC was actually adopted, they talked about
23:05
discovery, right? That that's something we do
23:07
automatically. So we, we find those accounts
23:09
based on group memberships and naming conventions and, and most
23:13
interestingly, what they do, then we map where they're being
23:17
used. That's another thing we do
23:19
automatically. But then it gets to the
23:22
enforcement base and to do the enforcement at scale.
23:26
I think about it, some of these companies have a million service
23:29
accounts, OK, that, that, that actually exists, right?
23:33
Like huge amount. Right.
23:35
You're not exaggerating there. Some, some companies have a
23:39
millions of how do you even start protecting them?
23:45
So it has to be something automated.
23:47
It has to be something that is really built into the to the
23:50
processes of the organization of the IT that that don't require
23:54
manual work. So we figured that if we learn
23:59
what each of these service accounts are doing at scale,
24:02
like even even for a million service accounts, and we
24:05
automatically figure out how predictable is it?
24:08
Can we see after a month, after two months that it really has
24:13
some baseline? You know it, it goes from these
24:15
two system to these five systems every day.
24:18
This is what it's doing. And most of these accounts, this
24:20
is kind of how they behave. We can build a mapping for each
24:25
one of these millions accounts. We can automatically build this,
24:29
this map, this, this baseline and also understand how, how
24:34
sure are we, you know, is it very predictable and repetitive.
24:40
And then we can automatically start moving them into
24:43
enforcement, into protection where we only allow that.
24:47
So if an account is very predictable, very kind of, you
24:51
know, doing the same thing every day, we'll move it very quickly
24:54
to enforcement. And we, we know that it's not
24:56
going to, to do anything wrong. If it's not, then it will take a
24:59
little longer, but all of it can happen automatically.
25:02
And we build integration to the existing IT systems that
25:06
organizations are using like service now so that we can build
25:10
it into the regular processes. So if they're working with
25:13
something like service now, we can automatically plug into that
25:18
and, and populate our policies based on, you know, the CMDB or
25:24
based on, you know, tickets of people opening.
25:25
We can, we can, you know, avoid you having to build any policy
25:30
manually. Well, that took a long time.
25:33
You know, the, the just building of the capability that that was
25:36
one piece, but getting it really to the point where it fits the
25:39
way enterprises walk at scale. That that took a long time and
25:43
lot of work. And I think that that gives us a
25:44
big advantage because we can really do that at this huge
25:47
scale because we understand what people need in order to to be
25:51
able to, to do that at this large scale.
25:54
Absolutely. Your point is really well taken
25:56
when it comes to the scale I I talked to a lot of clients who
26:01
are getting into their IM roombab and they need to take
26:07
some time in the beginning to clean up their Active Directory.
26:11
Active Directory is usually the core platform from a security
26:15
standpoint that runs most organizations.
26:18
Their emails tied to it, the ability to log on to the network
26:22
and communicate with your coworkers.
26:26
Just so many functions require are reliant on Active Directory.
26:32
So they have to do this cleanup project, which usually includes,
26:37
you know, group cleanup, group identification.
26:39
What are those groups doing and service account cleanup.
26:44
First off, I asked you to build a tool for the group cleanup.
26:48
Second off, when it comes to the Active Directory cleanup, you
26:53
are, I'm sorry, the service account cleanup, you mentioned
26:56
this mapping that needs to take place.
26:59
I mean, that's a big part of that exercise that when you're
27:03
doing it with spreadsheets and emails to, you know, try to
27:07
track down the person who knows what that account does.
27:10
It's First off is it's just not the right approach.
27:14
Second off, it takes forever, especially when you have
27:18
hundreds of thousands or a million service accounts.
27:22
So how long does that kind of that mapping exercise take with
27:27
Silver for Soul? Finding most of the service
27:31
accounts and what they're doing, within two weeks, you get almost
27:35
the full picture. And so within two weeks, it's
27:38
enough for us to figure out, you know, it's enough time to
27:41
understand if if an account is behaving like a human or not,
27:44
usually unless the person is on vacation, right?
27:46
But for most cases, it's also enough time to understand, you
27:50
know, for these accounts that are more active, what are they
27:53
doing now? That's maybe 95% of your
27:56
account. Then there's a long tail of
27:58
accounts that only run a scheduled test once every month.
28:02
And, and you know, it will take that long to to notice them and
28:05
find what they're doing. But that's like, you know, that
28:08
last 5%, you know that that can take a little while and that's
28:12
OK. You know, as long as you can
28:13
start somewhere and you can mitigate the majority of your
28:15
ways, that's OK. That that will take a little
28:18
extra time. That is a faster than more
28:23
complete approach. Then you know what you're
28:26
describing, which is how organizations try to do it until
28:28
now, trying to manually figure out what these accounts are
28:31
doing. That's not a scalable approach.
28:34
Any company was tried to do that.
28:35
Maybe they were able to do that for 100 service accounts.
28:38
I'd like like ridiculous numbers.
28:40
I'd like companies tell us. So we we managed to do this for
28:43
like 50 service because you know, we know exactly what
28:46
they're doing and but they have like 20,000 right.
28:48
So it's it's almost as symbolic and also with the manual report,
28:54
you'll never know if you really have the full picture.
28:57
So you know, you went through this, you talk to the
28:59
application owner, they think that it's being used by these 5
29:03
servers. They don't really know.
29:05
I mean, they, they think that this is better being used.
29:08
I mean, who knows if, if, if this was also, this account is
29:12
also reused for another system. Nobody knows for sure.
29:16
So at the end of the day, what happens is people end up with
29:20
these Excelsius a year to build and they're still not fully sure
29:23
that this is the the the full story.
29:26
So they don't want to act on it. They don't want to actually make
29:29
changes to the system because they're not fully certain that
29:31
it's all going to break something.
29:34
And if they try and it did break something, then the project is
29:37
completely derailed because now nobody's going to allow them to
29:40
do anything. And this happens all the time.
29:43
So with simple, not only we shorten it and simplifies it,
29:46
but also we give you the, the, the comfort that this is
29:49
everything this account is doing.
29:51
This is the full picture. It's impossible that this
29:53
account is doing anything that we don't see because we see all
29:57
the authentications that kind of the heart of our college.
30:01
So you know that if you're going to now make a change to this
30:03
system, these are the only three places where you need to do it
30:06
and you know exactly what will be affected.
30:09
And you don't even necessarily have to do that because we can
30:13
also reduce the list for you, you know, using our virtual
30:16
fencing, you know, by by just, you know, preventing this
30:19
account from being used anywhere else, that that alone is a huge
30:23
reduction of risk because it means that nobody can use this
30:26
account for lateral movement now or to spread them somewhere.
30:30
It can only log in from A to B. So it's just a very easy, very
30:35
streamlined way to reduce that that that list.
30:38
And again, this is Active Directory where I think the pain
30:41
is, by the way, the the, the biggest.
30:44
But now we can protect also all the cloud environment.
30:46
It's really, it's really that end to end approach where you
30:49
you don't need to solve these problems individually, but you
30:52
get one platform where you can do that.
30:55
And the other advantages non human identities is only one
30:59
element of your identity risk. You know, attackers don't only
31:03
target human identities, they they also target human
31:06
identities. And they might start from an any
31:07
giant then expand to an human account.
31:12
So any approach that only looks at one piece of this puzzle is
31:16
missing some context. If you only look at non human
31:19
identities, or if you only look at privileged users, or if you
31:23
only look at the cloud or only look at AD, any one of these
31:27
these siloed poachers is missed in context and is not going to
31:31
really be able to give you the full story because attackers
31:34
don't look at it like this. Attackers look at all of this is
31:37
1 big attack surface. Yeah, Attackers don't care
31:41
whether you're here or not. Human, they're going to exploit
31:43
whatever they can. That fear of breaking things is
31:47
so important to understand because that is like the number
31:50
one reason I've found that people don't do anything to, to
31:54
solve some of their, you know, servers count issues or, you
31:57
know, CICD pipeline or or whatever it may be.
32:00
How do you establish that trust to say, OK, we think we think
32:05
we've got a pretty good handle on what the mapping looks like
32:08
between if I shut down this account, whether it's AD or
32:12
cloud account or whatever it may be that I feel confident to
32:15
understand what the, you know, the, the, the ripple effect
32:18
might look like for some of the other downstream things.
32:21
How do you how do you establish that trust?
32:22
Because let's be honest, system admins and you know, other folks
32:26
are like, don't touch it. It's, it's working.
32:29
And how do you get past that fear?
32:32
That's a great question. We, we, we didn't fully
32:35
understand how big that fear is initially.
32:38
And it took us time to learn how to, to offer things that will
32:41
make people comfortable. And one of those things that was
32:43
very effective is to move these accounts before we move them
32:47
into full enforcement and prevention mode, we move them
32:50
into some kind of alerting or simulation mode.
32:53
So at that point, we basically say, hey, we are confident that
32:56
this account is only doing what we learned.
33:00
But because you know, we want to give you comfort, we're first
33:03
going to move it to a phase where it's not actually going to
33:06
block anything, but it's going to alert you, you know, if, if,
33:10
if there's any deviation that supplies that, you know, if
33:13
let's say that we think that this account is only used to
33:16
connect from these five systems to these 10 systems.
33:20
And we learned this over two months.
33:21
And we're very confident because it's very, very repetitive.
33:25
And we're going to give it another month where it's we're
33:29
not preventing anything yet, But but we're going to alert you if
33:33
there was any other use of this account that was outside of
33:37
this. And this gives you comfort
33:39
because at that period of time, you're going to see that there's
33:43
no false positive, there's no alerts, there's nothing that
33:45
actually happened that would have been prevented.
33:49
And at that point, organizations feel more comfortable.
33:52
And also, I think they realize that if, if there will be
33:54
anything that goes outside of this, it's suspicious enough at
33:59
this point to at least pause and ask, what is this?
34:02
Why is it happening? So by the way, one of the things
34:06
we do is for every one of these accounts, we, we are able to
34:08
recommend or, or kind of map, you know, two different
34:11
integrations who's the owner of that account.
34:14
That's really useful because we can say, OK, we think that this
34:18
account is only doing this, but if it's going to do anything
34:20
else, we're going to reach out to the owner of this account and
34:23
ask, is this expected? Like we'll sing this, this
34:27
account being used in this new place.
34:30
Is this something that you know about?
34:32
And, and that allows for some feedback.
34:34
So now this also builds fast because they know that those
34:38
application owners are going to, to be able to provide feedback
34:41
and say, Oh yeah, my, my account actually does need to run in
34:44
this additional place because they just, you know, did this
34:47
change? And once these and, and by the
34:51
way, at this point, we didn't prevent anything yet.
34:53
We were still in, it was still in alerting mode at that point.
34:56
When they see that this whole flow walks, they'll feel
34:59
comfortable enough moving into prevention.
35:04
But that really took a lot of investment in understanding, you
35:08
know, how organizations want to operationalize this, what other
35:11
IT system they're using that we need to integrate with to make
35:14
it, you know, more, more visible to them.
35:17
It's, it's really, I think anyone outside of the identity
35:20
market cannot fully appreciate like how complex the changes are
35:26
that I think, I think, you know, you guys, you guys know, well,
35:30
I've talked to one company, well, you know, before
35:33
implementing Silverfold, they were trying to do some of these
35:35
manually and, and finding these accounts and trying to rotate
35:38
the passwords. And they told me it would, it
35:41
would take sometimes six months to get approval to make a change
35:44
to a service account. And by the time they got the
35:46
approval, the service account maybe was already decommissioned
35:49
or was outside of the scope of the audit or the audit already
35:52
happened. Like all kinds of things that
35:54
make it make it so slow that it's almost irrelevant.
35:57
It's really a feeling of you're, you're walking and walking and
36:00
making no progress. And I think that's not only a
36:06
problem in, in non human identities, it's probably an
36:08
identity in general. But in in non human identities,
36:11
it's even more of a problem because there's no person to ask
36:15
sometimes, like, what are you doing?
36:17
Like, why are you doing this? You need to, you need to, you
36:20
know, guess if you don't have this system.
36:23
So Speaking of non persons, I think that's probably a great
36:26
segue to get into talking about some of the new things you've
36:29
announced around AI agent security because you talked
36:33
about that mapping of like, OK, who does this account belong to?
36:35
It's approaching probably sooner than we think where we have a is
36:39
talking to AIS, talking to AIS, talking to AIS.
36:42
We have like this Inception or Mostrica doll where you've got
36:46
so many different layers of, you know, bots talking to bots and
36:49
maybe there's a human in the mix somewhere.
36:52
But I want to talk about this, this new feature or this new
36:55
capability that you guys have have brought out around age AI
36:58
agent security. Tell me a little bit about that.
37:02
Yeah, it's, it's this is a very exciting space that is obviously
37:07
moving faster than anything else that we've been talking about.
37:11
I mean, other areas of identity security are moving fast, but
37:14
but nothing is even close to this.
37:17
This problem is changing and evolving, you know, every day.
37:23
And I think it's going to become a huge problem for organizations
37:26
that soon, if not already. So just an explanation for we
37:30
know anyone you know, listening to this who doesn't fully
37:33
understand what are those AI agents and, and why is it such a
37:36
new and different problem? What why is it so different than
37:39
detecting regular identities or, or NH is?
37:43
So, you know, AI agents are basically as opposed to chat
37:48
bot. AI agents are actually doing
37:50
things though, you know, logging into your systems and they can
37:53
take actions, they can write an e-mail, they can, you know,
37:57
change something in in your in your CLM.
38:01
It can, you know, build an application, it can actually do
38:05
things. And this has massive potential
38:08
for helping businesses because you can actually automate a lot
38:12
of work that was done by people, manual work.
38:16
You can use these these agents almost as virtual workforce or
38:20
virtual assistants that do things that that were just a
38:25
lot, a lot of manual effort for people.
38:29
But it also creates a huge security risk because the risk
38:34
of using our our regular good old ChatGPT are are, you know,
38:40
at the worst case you get, you get the wrong answer, right?
38:45
So it's, it's, it's there is a risk though, right, with his
38:48
utilization and things like that to, to do anything bad agents
38:55
can actually do stuff. So it can delete your data
38:59
accidentally, or it can send an e-mail that makes you look
39:03
really bad or cause an issue for your company, or it can it can
39:06
do all kinds of things that that can cause real damage.
39:11
And unlike regular non human identities, and this is where
39:17
we're starting to get into the differences, they're much less
39:21
predictable with a regular non human identity.
39:24
I mean, we just talked about, I can learn that it's connecting
39:26
from A to B every morning at 9:00 AM.
39:30
And I kind of learned that very, very simple repetitive button,
39:33
because it's just a script, an AI agent, because it's based on,
39:38
on AI, on LLMS, it's, it's not deterministic.
39:43
It can do a different thing every day.
39:45
It can suddenly decide to to do something new today that is a
39:51
little different than yesterday. So it's harder to tell is it
39:56
doing something that that it should.
40:00
At the same time it it's not a human.
40:02
So you can't use the regular stuff that the security controls
40:05
that work for human like multi factor authentication, right?
40:07
The stuff that we got used to do for humans.
40:11
So it's not a human, not classic NHI.
40:15
It's something in between. And it takes a newer post to.
40:19
How do we secure this? I think that this is a very
40:23
important problem because the adoption of AI and especially AI
40:29
agents is going to have so much benefits for the business that
40:34
companies are going to adopt it whether we the security people
40:36
are ready or not. I think that, you know, in over
40:41
the next month, you know, boards and CEOs will be coming to those
40:46
security leaders and saying, you know, we're going to adopt AI
40:49
because otherwise our competitors take us out of
40:52
business. Like we're not going to be
40:53
competitive. So we're going to implement it.
40:56
You know, you should do your best to secure it, but we're not
40:58
waiting. And I think that this is this
41:02
makes it an urgent problem, although it looks like it's so
41:05
new and and so emerging and it feels like you can wait and see
41:09
where it goes. I think that it is going to
41:11
become very urgent based and. So.
41:17
Now let me tell you our, our approach to it.
41:20
So we figured in order to make this safe, in order to make AI
41:27
agents operate in my network and know that that I, I limit them
41:31
from from causing any damage, I need to have visibility to what
41:35
they do and I need to be able to stop them from from doing things
41:39
they shouldn't do. The first part is easier.
41:44
So giving you visibility to what they do.
41:46
You know, I think that every vendor that is in the non human
41:49
identity space is going to be able to do that because at the
41:51
end of the day, these are non human identities And you know,
41:55
we can see what they're doing. The other vendors that can also
41:58
see what they're doing by looking at the logs and looking
42:00
at, you know, the configurations and things like that and show
42:02
you, you know, you have this AI agent and it's using this
42:06
identity and it's accessing this system.
42:09
I mean, it's not super easy, but but you know, vendors are
42:12
figuring it out and companies are figuring it out.
42:15
The second part is more complex. How do you actually prevent it
42:18
from doing bad things? This requires an in line
42:23
approach. What I mean by that is we need
42:24
to actually get the AI agents when they access things.
42:30
So when they connect to your e-mail server, all to all to
42:32
your customer database, we need to be in line as a gateway on
42:37
this communication in order to really be able to stop bad
42:40
things. Now, luckily, there are ways to
42:44
do that technically, For example, I don't know if you
42:47
heard about, obviously, like a lot of people are talking now
42:51
about how AI agents are accessing other systems and, and
42:54
the Basel right now is MCP, right?
42:56
MCP is kind of the, the language, the protocol in which
43:00
AI agents are connecting to other systems.
43:03
It's very cool. It, it allows you to save the
43:05
need to integrate individually with every system.
43:08
And the, the, you know, the advantage of that is that you
43:13
can actually create an MCP gateway, which means that when
43:19
an AI agent is trying to connect to different systems and
43:22
applications, it will do it to your solution to silver fault.
43:26
In this case, this means that we are actually in line on what
43:31
it's trying to do. And it means that if we're
43:33
seeing you're doing something bad, we can block it or we can
43:37
involve a human, you know, this is, by the way, in a new kind of
43:41
concept. But think about the AI agent is
43:43
doing something bad. I go to the owner of this agent
43:47
and I ask it, hey, is it OK that your AI agent is trying to do
43:51
this? And the human says, yes, that's
43:53
actually, that actually makes sense to me.
43:55
And then we can allow it. So there's a lot of things you
43:59
can do there. By the way, it's not just a new
44:03
problem. There's also new opportunities
44:05
here. You can actually use AI to be
44:09
able to do that. You, you, you, you know what you
44:11
said before, you know, you left, but that actually is true.
44:15
Like it's all kind of connected. So in order to to look at what
44:19
AI is doing and, and, and figure out if it makes sense, you can
44:22
actually leverage AI And also those new opportunities with
44:27
interacting with AI agent, for example, with regular non even
44:32
identity that is trying to do something.
44:34
I can't ask it why are you doing it?
44:37
But with an AI agent, maybe I can, maybe I can ask the AI
44:41
agent, hey, why are you accessing the customer database?
44:44
And the AI agent will actually tell me why is he trying to do
44:48
that? So there's, there's a lot of new
44:49
opportunities. There's a lot of, you know, new
44:52
challenges, new opportunities, everything is moving super fast.
44:56
But you know, the port we just released is exactly that.
44:59
It's a, a gateway that sees all these agents trying to do
45:03
things. It can show you what they're
45:04
doing. It can control what they're
45:07
allowed to do. So like granular authorization,
45:10
we can say, you know, yes, it connects to Slack, but it
45:13
shouldn't be able to write anything.
45:15
We shouldn't be able to read any, any of these groups.
45:18
And also you can really control the granular access permissions
45:20
you give it. It can block certain things.
45:23
It can, it can, you know, involve more security because if
45:26
we think it's doing something bad, it's really a very cool
45:30
answer to this concern that this is super new.
45:35
But I think without solving it, organizations will not be able
45:37
to really enjoy this revolution. So I think it's going to be.
45:41
So I, I, I think that's really clever the way you're
45:43
approaching with that gateway type of approach and, and things
45:46
like MCP or model context protocol or A to a which is
45:50
agent to agent. There's a lot of work being done
45:53
to facilitate data transferring right between models and between
45:57
agents itself. I'm curious if you have an
45:59
opinion on from an identity standpoint, how should we be
46:04
thinking about security for this?
46:05
Is it very specific fine tune agents that only have access to
46:10
the things they need to, which means more agents or something
46:15
that's a little bit broader from an agent perspective that maybe
46:18
does have more access to different things and have fewer
46:21
agents. So is it a quantity versus
46:23
quality thing? Like what are you thinking like
46:25
from an identity security standpoint?
46:28
I think that at first at least, we, we probably are going to see
46:31
many agents doing small things right and, and kind of
46:36
orchestrating each other and telling each other what to do.
46:38
But it's really, it's really an army of agents that is trying to
46:41
to do a combination of many small things in order to
46:44
accomplish one big thing. That also simplifies things a
46:48
little from a security perspective, because I can
46:50
figure out what each of these agents is exactly trying to do.
46:54
And I can understand, you know, who owns each of these pieces.
46:58
If you imagine one agent that is Superintendent can do all of it,
47:04
then it's also really hard to secure it because I don't know
47:06
what it's time. It might do this today and this
47:09
tomorrow. And you know, does it even have
47:11
an owner? Because if it's doing
47:12
everything, then who, who is the person really owns it?
47:17
So it makes things a little harder.
47:19
I think in the long term, this is where it actually might go
47:23
because, you know, AI will become smarter and, you know, we
47:27
won't need to bake it all these tiny pieces.
47:29
It will just have, you know, much better capabilities and it
47:32
will be able to take action. And we'll actually, we'll
47:35
actually want to give it more flexibility, but that will have
47:39
some paid off with, with security, you know, with our
47:42
ability to control it. I think at least for now, while
47:44
we, we still don't know how this is going to work.
47:46
We, we, we understand some of the risk, but definitely not all
47:49
the risk. I think it's important that we
47:51
that we stay pretty structured. I and I think that's what
47:55
organizations mostly are doing because that's also, you know,
47:58
the, the limitations of, of the current AI models.
48:01
They're breaking it down to small things.
48:03
And we can tell that, you know, this piece is in charge only on,
48:08
you know, writing stuff into your CRM and it's owned by this
48:13
person from sales operations and it's only connecting from here
48:17
to there and doing this. And this actually makes things,
48:20
you know, much, much more controlled from a security
48:23
perspective. So I think at least for the
48:27
short term, that that's what we mainly are going to see.
48:31
And, and by the way, I think the that that connection of every
48:35
agent to a human owner is actually very important because
48:38
it means that you have someone accountable for what it's doing.
48:41
Yeah, it seems like the agent acts in the context of the
48:46
person who is making the requests or what if I'm not sure
48:51
if the request is the right word, but depending on what the
48:53
agent does, right? So the question is, does the
48:56
agent run under a service account or does it leverage the
49:01
context and authentication of the person, Not only the
49:05
authentication, but also the authorization, the entitlements
49:09
that that person has. And via the MCP server, maybe
49:14
MCP server says, oh, here's Jim McDonald asking to access, you
49:19
know, the Custer database user example.
49:22
Yeah, that to me seems like that's the right level of
49:25
security. I think that is probably the
49:29
easiest approach because, you know, if it's on behalf of Jim,
49:32
then it's going to have Jim's permissions.
49:34
I don't think that's the safest approach because it might not
49:38
need all of Jim's permissions, you know, because it's doing
49:41
something specific. Why give it all the permissions
49:45
that the gym has? I think that that's where a lot
49:47
of people started because it was easy.
49:49
I think that what vendors like us are doing now is offering,
49:55
you know, more ground law controls.
49:57
So we the least privilege approach where we say, yes, it's
50:01
acting on behalf of gym, but it only really needs to do this one
50:04
thing. So, you know, let's only give it
50:06
this this permission that will give it all the permissions Jim
50:09
has, which is harder to do, but that's what vendors like us are
50:14
here for in order to automate this and figure it out more
50:17
automatically. I don't think that's something
50:20
that an organization can figure out on their own at scale.
50:23
But just like we've done that for service accounts and for non
50:27
humanities in the cloud, now we're doing this for NHIS
50:31
because we have already some expertise in this.
50:33
We can see all these agents, we can understand what they're
50:36
doing. We can understand who is the
50:38
owner, we can understand it. Or do they really need those
50:41
full permissions? Or based on what they're doing,
50:43
maybe they only need a much smaller set of permissions and
50:45
then we can automatically start recommending to you, you know,
50:48
where you can actually minimize that.
50:51
So all of that I think is is very important, very urgent,
50:58
because before we know it, our companies are going to be full
51:01
of agents. I mean, we're already seeing it
51:03
at Silverthorpe, even internally.
51:05
I'm sure many organizations are starting to save.
51:07
And if not, they should actually be even more concerned.
51:11
I think that, you know, they need to, and I think that this
51:14
level of control is the only thing that will allow
51:15
organizations to, to have the trust and the confidence to do
51:19
it. So in a way, it it's an enabler
51:23
for AI adoption. You know, if we don't figure out
51:25
the security aspects, then organizations are not going to
51:28
be able to adopt this fully or under competitive pressure.
51:31
They're going to adopt it without security and it's going
51:35
to be a mess. So so we do need to figure it
51:38
out. And I think that that's, you
51:41
know, starting from the the entire the permissions of the
51:45
person who's who's who's running the agent is a good start, but
51:47
it but it has to be more narrow than that.
51:51
You know that I think this kind of highlights the the urgency
51:55
and sort of the the issue with all these different agents.
51:58
I can certainly see an angle where, you know, in this, in
52:01
this example that Jim point out there I was acting in the
52:03
context of something. And you're totally right.
52:06
We, we don't want to give the thing too much information or
52:08
too much permission. So I can see one agent, you
52:11
know, saying, OK, here's what I need to do, another agent
52:14
saying, OK, well, what does that actually mean?
52:16
And then another agent that says, let me interrogate Jim's
52:20
entitlements and then some other agent that says, OK, based on
52:25
these entitlements and based on what you're trying to do, let me
52:28
down select the specific authorizations and then passing
52:31
that back through the check all the way back to the first agent
52:34
to actually do the work. Yeah, no, it's crazy.
52:36
And then it can even become more sophisticated.
52:39
I'll give you an example of something we're we're building
52:41
now. You know, we've had for years
52:45
sexually coding, right, as part of, of, of privilege access
52:49
management, right? People have been doing session
52:51
recording. They recorded what the admin is
52:53
doing inside the session and then it was sent to be buried
52:58
somewhere that nobody ever watched it, right.
53:00
But but, but we did that because we needed to have some evidence
53:05
of what the the person did. AI actually presents an amazing
53:09
opportunity to use this kind of data because you can actually
53:12
have AI watch it and figure out, you know, what is it doing?
53:15
Is it actually aligned with what it will this person was supposed
53:18
to do. Now think about this is in the
53:20
context of of AI protecting AI. You could have an AI agent
53:25
saying, I need to log into the CRM because I need to do
53:29
something. I need to update this this, you
53:32
know, record and then you can actually watch what it's doing.
53:35
I mean, another AI agent can watch what it's doing and
53:38
compare that to what the agent said is going to do.
53:41
So the agent was going though to update this record.
53:44
Did it actually upgrade the record, update the record or did
53:47
it do something else? You can apply, but of course you
53:50
can apply that to humans too. But there's so much new
53:53
opportunity to ultimate things that were impossible to do
53:56
because the manual work needed was unreasonable.
54:00
And now that those AI, we can actually do that.
54:03
We can actually watch all these hours of, you know, session
54:07
recording and compel them to what people were supposed to do
54:10
and what they said they're going to do in the ticket.
54:12
And we can automatically figure out who's doing something bad
54:16
and block it in real time. So, you know, I think security
54:20
is actually going to get way more sophisticated because we
54:23
can finally automate all these things that we're always, you
54:26
know, not feasible. And that is actually going to
54:30
help us protect the AI too. And by the way, I think that
54:34
that is critical because with AI protection has to be automated,
54:39
has to be fast because AI itself is is operating very fast.
54:44
So think about the way we secured human was always
54:48
assuming that they move at human speed.
54:50
So I could detect the bad behavioural send an alert and
54:54
somebody at the stock would look at the alert and investigate it
54:58
and then go back and, and do something about it.
55:01
And all of it was assuming that it's a human attacker moving at
55:05
human speed with AI based attacks is going to happen in
55:09
seconds because all the decisions are automated and AI
55:13
is making them. So taking over the corporate
55:15
network, you know, breaching the corporate network could take a
55:17
few seconds if all of this is automated.
55:21
This means that if we don't make those security decisions in line
55:26
in real time, and we don't block these things while they're
55:29
happening, we're too late before just sending some alerts to the
55:33
stock waiting for anyone to to look at them.
55:35
The attack already happened, so I think AI speed is actually the
55:40
only way we can protect against AI threats.
55:44
So, so had you've already given us like 12 minutes more than we
55:48
asked for and I didn't want to we neither Jeff or I wanted to
55:52
stop you along the way because we're learning so much.
55:56
It's been an absolutely great session.
55:58
So can you just give me two more minutes?
56:01
There's one more question I wanted to ask you, which was
56:03
around this ideal identity security playbook that you guys
56:07
have crafted an ideals and acronymic stands for integrated
56:11
integrate, discover and force analyze and lightweight.
56:16
So can you give us an idea of like how this gets used, why is
56:21
it useful for the practitioner? And then Jeff will take us out.
56:26
Yeah, I'll keep it very short. I think that it it kind of
56:29
summarizes a lot of what we talked about.
56:31
So I talked about syllables approach to identity security,
56:34
right. We're doing it really is a very
56:36
broad platform. We want to tackle all these
56:38
things like humans and non humans and AI and on Prem and
56:42
cloud. And, and to summarize this
56:45
approach, you know, with a playbook that I think
56:47
organizations can use to, to understand what does it take to
56:50
really deliver holistic identity security.
56:54
You can really use this, this ideal concept.
56:57
So it starts from integrate, which means in order to really
57:00
bring identity security everywhere, I need integrate
57:03
with all the pieces of my identity infrastructure all the
57:06
way from the legacy to the modern cloud ID.
57:09
PS Right, Okta, Google, AWS or all of these different pieces
57:14
including the the SAS applications or or legacy
57:17
applications that have local identities.
57:20
So integrate is the first piece because I need to see every.
57:23
The second piece is discover. Once I'm connected to all of
57:27
these pieces, I need to discover all the entities, all the
57:30
identities, all the and non human identities, all the
57:32
privileges, the group memberships, everything that
57:34
they can get. The third step is in.
57:37
Force that is also. Probably the step that is the
57:39
most unique the silver fold many vendors.
57:43
Do the first. 2 steps and they just give you that visibility
57:47
and then you know, you need to do something with that.
57:50
We need to figure out how to to address these issues.
57:53
We also believe that the critical element of this is in
57:57
force. Once we see what's going on,
57:59
when we see some bad things, we need to be able to intervene.
58:04
We need to be able to prevent certain activity.
58:06
We need to be able to authenticate certain users as
58:09
they're trying to do something. We need to be able to to to
58:12
have, you know, real time controls.
58:15
And that requires an inline architecture means that you need
58:18
to actually see the access, the quest going to, in a, in a way
58:21
that you're able to, to stop them if you need to step #4 is,
58:28
is analyzed because, you know, all of this, all of this data
58:33
and activities and, and, and, you know, people authenticating
58:38
and all these different data sources, you get, you need to,
58:41
to have intelligence around. And that's part of what we just
58:44
talked about analyzing, you know, what did it actually do
58:47
compared to what it was supposed to do?
58:49
And, you know, does this look like normal behaviour or not?
58:52
Does this look like lateral movement?
58:54
Does this, you know, you need to, to bring intelligence into,
58:58
into this. And then the last part is, is
59:02
lightweight. And the, the reason why we
59:05
believe that's so crucial is because identity project
59:08
historically have been way too complex for most organizations
59:11
to, to survive. You know, a lot of people joke
59:17
that, you know, there's no point starting an identity project
59:19
because it's going to be the, the next person after me that is
59:21
going to actually get to finish it and get a credit.
59:25
So I think we have to make identity security easier,
59:28
otherwise we'll, we'll, we'll limiting it to a very small
59:31
number of companies in the world that have the, the ability to,
59:34
to execute. And, you know, and the rest of
59:37
the companies are just, you know, listening to these type
59:40
of, of podcasts and, and, you know, wishing they had these,
59:43
these, these things, but, but they can't really implement them
59:45
effectively. So it has to be lightweight, it
59:47
has to be simple, it has to be quick.
59:51
I think that if you look at other categories of, of
59:54
security, again, the vendors that really were able to bring
59:58
innovation and conquer those markets, well, not just the ones
1:00:00
who did it in the most secure way, but the ones who made it
1:00:03
easy, made it super simple to implement and to use.
1:00:08
And I think it's time for identity to, to set this as a,
1:00:12
as a requirement of, you know, identity.
1:00:15
People deserve to have porks. They're not a nightmare to
1:00:19
implement otherwise. You know, they're just wasting
1:00:23
time and money and they're not going to get the result.
1:00:26
So that's basically the approach and.
1:00:27
It's kind of summarizes. You know, everything we said
1:00:29
before and kind of how we believe identity security should
1:00:32
be done and and yeah, whether people do it with.
1:00:37
Us or not, I think I. Think that's that's what they
1:00:39
need to aim for. I think that's.
1:00:42
AI don't know how we top. That and so I think that's
1:00:45
probably a good spot where we close it.
1:00:47
You guys are doing such, such cool work and, you know,
1:00:49
Congrats on the success. We're going to have a bunch of
1:00:51
links in our show notes, but definitely want to encourage
1:00:53
people to go to silverfork.com and check things out.
1:00:56
I was taking notes as we were kind of talking here.
1:00:58
There'll be a link to the, the insecurity in the shadows report
1:01:03
that we talked about to be a link to the identity security
1:01:05
playbook as well. And then we'll also have the
1:01:08
link in our show notes forehead for people to connect on, on
1:01:11
LinkedIn and as well as ourselves.
1:01:12
So had it's always a great pleasure talking with you and I
1:01:15
I I really appreciate you taking the time with us.
1:01:18
Any if I took one thing away from this conversation, you kept
1:01:21
mentioning that the word in line, it's like, OK, like that
1:01:26
is what we need to get people understand.
1:01:27
It's like you need to be injected into the process, into
1:01:30
the data stream, into whatever you want to call it and be,
1:01:33
well, as you said in line. Yeah, I think that's very.
1:01:37
Important otherwise. We'll just, otherwise we'll just
1:01:40
pointing out the issues without being able to actually solve
1:01:42
them or stop them. Yeah, well, there's.
1:01:46
Value in. In at least pointing the issue
1:01:48
out but we've got to start solving these problems so I I I
1:01:50
appreciate the you know the the discussion especially when we
1:01:53
say we need to make identity security easier yeah absolutely
1:01:56
right nobody wants hard tools we've got to have a way to
1:01:59
approach this and I like what you guys are doing so thank you
1:02:02
that yeah so that's is a good spot we're.
1:02:04
Going to have to leave. It for this week.
1:02:06
Thanks everyone for watching Andrew listening.
1:02:08
You can find us on the web at idacpodcast.com and we'll talk
1:02:11
with everyone in the next one. You've been listening to
1:02:16
Identity at. The Center.
1:02:18
We hope you've enjoyed the show. Make sure to like, rate and
1:02:23
review and we'll be back soon. But in the meantime, hit the
1:02:26
website at identity@thecenter.com.
1:02:30
See you next time on Identity at the Center.