Latest / Identity at the Center / #11 - Managing IAM in the Hybrid Cloud

Transcript

#11 - Managing IAM in the Hybrid Cloud · Identity at the Center

• 0:06
  Do you know who has access to what?
• 0:08
  This is the Identity at the Center podcast.
• 0:10
  If you're looking for identity and access management talk,
• 0:13
  you've come to the right place. And now on to the show.
• 0:28
  Welcome to yet another episode of the Identity at the Center
• 0:31
  podcast. Certainly been appreciating the
• 0:34
  likes and ratings we've been getting.
• 0:35
  If you like what you hear, do us a favor, share the show with
• 0:38
  other like minded individuals And you can also e-mail us at
• 0:42
  questions at identity@thecenter.com.
• 0:44
  I am Jeff and that is Jim's voice you're about to hear.
• 0:48
  Jim. Hey, Jeff, survive the
• 0:50
  hurricane. It's by the hurricane.
• 0:52
  Well, so far anyway. I'm 100 miles inland and that
• 0:55
  helped. Yeah.
• 0:57
  So then I guess I'm a Hurricane survivor as well too, being up
• 0:59
  in the Chicago area. That's right.
• 1:01
  Yeah. We're joined today by Morgan
• 1:03
  McNamara. She's one of our crack members
• 1:05
  of our engineering team here at Identity.
• 1:08
  Hello, Morgan. Hey, Jeff, How's it going?
• 1:10
  Good. Thanks for joining us today.
• 1:13
  Yeah, no problem. So Jeff, I want to clarify by
• 1:16
  being a crack member, that doesn't mean you smoke crack,
• 1:18
  right? They don't have.
• 1:20
  Well, you know, that's a personal question.
• 1:22
  I don't think that that's probably right for the podcast.
• 1:25
  I think as long as the work gets done, hey man, whatever.
• 1:30
  Not that I'm condoning that behavior.
• 1:32
  There you go. So today is Thursday.
• 1:36
  Do you know what today is, Jim Morgan?
• 1:38
  Take a guess other than you know, podcast day.
• 1:41
  Thursday there's. It's an olasp day.
• 1:45
  It's not that. It is the opening night of the
• 1:47
  NFL. Bears, Packers.
• 1:51
  My Bears actually are looking good now.
• 1:54
  So there's a chance that we might actually beat the Packers
• 1:57
  on Thursday Night Football tonight's open season.
• 1:59
  I'm very excited about this. Now those teams have probably
• 2:01
  played about 100 times. Yeah, and it's relatively even
• 2:04
  even though the Packers seem like they've been dominating the
• 2:06
  Bears for the last decade or so, the the actual overall record is
• 2:11
  relatively close, which is makes it one of the better rivalries.
• 2:14
  Yeah, cool. Morgan, do you have a team that
• 2:17
  you follow in the NFL? God, out of obligation, I have
• 2:23
  to say the Buffalo Bills. All right, on.
• 2:26
  Yeah. Go Bills.
• 2:28
  My dad is one of the Bills fans, so I get you on that one.
• 2:31
  He's from Newfane and Rochester area, so So yeah, the Bills were
• 2:35
  his team. Okay.
• 2:36
  Yeah, that's like right next to me.
• 2:38
  I'm from Buffalo, so try your hardest bills.
• 2:44
  Jim, do you follow? The team Eagles.
• 2:47
  That's right, Eagles. Of course.
• 2:50
  Did you see that the Eagles offensive line did the ESPN Body
• 2:53
  Issue? No.
• 2:55
  Yeah. So if.
• 2:56
  If that's your thing, just not. Clear it's not.
• 3:04
  This is the first time in 25 years of NFL football that I'm
• 3:09
  not doing a fantasy Football League.
• 3:12
  And I gotta tell you, I find it to be quite free.
• 3:14
  I'm actually going to be able to watch the games, enjoy them,
• 3:17
  rather than wonder, you know, how my running backs did or are,
• 3:20
  you know, having second thoughts around not starting one guy and
• 3:24
  him on the bench. So.
• 3:26
  Yeah, no, no. I stopped doing it about 10
• 3:28
  years ago, and I feel the same way.
• 3:30
  It was like it's ruining the game for me.
• 3:33
  And I did the same thing with fantasy baseball, where it's
• 3:36
  like, you know, I was just so concerned with how individual
• 3:39
  players were doing it that it was.
• 3:42
  You know, ruining the sport for me.
• 3:43
  And I'm sure there are a lot of people out there listening,
• 3:47
  period. But there are a lot of people
• 3:48
  out there listening who play fantasy sports and love it.
• 3:52
  And I used to love it. But I'm with you, man.
• 3:56
  You know it's it's freeing. Yeah, I just, I don't know what
• 3:58
  it is. It just decided not to do it
• 4:00
  this year and there's a certain, you know, freedom aspect to it.
• 4:04
  Anyway, all right, let's let's actually talk about idea access
• 4:07
  management. And get us back on track here.
• 4:11
  Today we're going to talk about a topic that was submitted to us
• 4:14
  by Neil who listens to the show. Certainly appreciate his e-mail.
• 4:17
  Let me go right into here. What he writes, 1 area that I
• 4:21
  think would be pertinent to discuss is around the managing
• 4:23
  of identity and a multi cloud environment.
• 4:25
  There is a growing movement toward vendor agnostic use of
• 4:28
  cloud services and this drives some new thinking around how we
• 4:31
  approach identity. Do we centralize or distribute
• 4:34
  identity management? And he thinks that make a good
• 4:36
  subject which I absolutely agree with.
• 4:39
  So wanna let's let's start off with you know why do companies
• 4:43
  have multi cloud environments. Morgan, do you want to take a
• 4:46
  stab at that? And then Jim, I'll chime in.
• 4:50
  My assumption would be that, you know, they have different
• 4:54
  platforms, different languages that they're using, and they're
• 4:59
  trying to sort of sequester each one of those to try and make it
• 5:03
  as secure as possible instead of integrating them all together in
• 5:08
  a single cloud instance. I think that makes sense.
• 5:12
  Yeah, no, that's a good answer. You know, Jeff, what I've found
• 5:16
  is most clients that I work with.
• 5:20
  Are either in one of two camps, they're either in a single cloud
• 5:23
  environment, so they're using something like AWS or Microsoft
• 5:27
  Azure. And those are you know
• 5:29
  definitely the two that I see the the largest uptake on at
• 5:33
  least the the client base that we've been working with or
• 5:37
  they're in a multi cloud and they have more than one.
• 5:40
  So they have AWS and Azure hosting and so the ones that I
• 5:45
  find that are in that second scenario and.
• 5:49
  And to be honest, I'm not an expert in the features of a WS,
• 5:52
  the features of Azure or any of the other cloud platforms, but
• 5:57
  from, you know, the the level that I'm at, the feature, there
• 6:01
  seems to be a lot of feature parody.
• 6:02
  I'm sure there's people out there pulling their hair out me
• 6:05
  saying that, but you know, for the most part I'm finding that
• 6:09
  most clients aren't choosing a WS or Azure based on, you know,
• 6:15
  this feature or that feature, but more.
• 6:17
  Which company they align with better now where I see the, the
• 6:22
  situation where a client has multiple clouds, maybe they even
• 6:27
  have multiple kind of instances within the same provider.
• 6:31
  It's kind of been thrust upon them in that their organization
• 6:37
  you know grew through acquisition or merger or they
• 6:44
  you know purchase some software that.
• 6:48
  That was on one of the clouds and they were already on the
• 6:51
  other cloud or that you know some decisions were made within
• 6:56
  their organization. One part of the organization
• 6:59
  went Microsoft, the other part went a WS.
• 7:01
  Now they're coming together and kind of starting to manage IT
• 7:05
  together. And so in other words, they're
• 7:08
  they're kind of thrust into that situation.
• 7:10
  They really choose multicloud. It just kind of happened.
• 7:13
  Yeah, I see as a look at like from a use case perspective,
• 7:16
  right. If you're and the the idea that
• 7:19
  there's different parts of the business that have different use
• 7:21
  cases kind of places what you just said if you're on the
• 7:24
  SharePoint side or if you're you know e-mail, you're probably
• 7:26
  familiar with Azure from a cloud perspective.
• 7:28
  But there might be someone who is more on the Google side
• 7:31
  because of the strength of the analytic side that they might be
• 7:34
  having. So they're more familiar with
• 7:35
  that. They might have gone off and
• 7:36
  built something Google's Cloud Platform, whereas you know,
• 7:39
  developers might be looking at a WS and spinning up, you know,
• 7:42
  services there. So pulling things together is
• 7:45
  certainly you know part of the challenge I think that comes
• 7:48
  along with it, but in my mind I think it's it's, it kind of goes
• 7:51
  with that use case, right. So if you're an Office 365 shop,
• 7:54
  you're on Azure, you know whether you whether you like it
• 7:57
  or not, you're already using Azure from that, from that
• 7:59
  approach and then it becomes that that question of okay, well
• 8:02
  we're already using here right land and expand, which is you
• 8:05
  know the the approach many software vendors will take.
• 8:09
  Is why don't you use you know Azure for the rest of your cloud
• 8:12
  services whereas company might have you know other pockets of a
• 8:16
  WS and that's that's I think that's pretty common.
• 8:18
  I think a lot of companies try to consolidate on one.
• 8:21
  But I like the security aspect that Morgan you mentioned before
• 8:26
  around having things in kind of a little bit of different silo
• 8:29
  where you don't have all your keys in one castle.
• 8:31
  So yeah, I think there is benefit to that as well, using
• 8:34
  the right tool for the job rather than trying to make you
• 8:37
  know, one. One service meet all your needs
• 8:41
  when it may not, may not be the best for the business.
• 8:43
  Yeah, absolutely. If I could just jump in and
• 8:46
  mention something interesting that I noticed when you guys
• 8:51
  were discussing that was that it's almost like there's this
• 8:55
  sort of resistance in a sense to complete migration to cloud
• 9:00
  infrastructure because when you think of implementation of a
• 9:03
  cloud, it's really dissolving the traditional.
• 9:06
  Perimeters that we've seen that have relied on things like a
• 9:10
  firewall and VPN, it's just those just aren't as viable
• 9:14
  anymore. You know you're looking at a
• 9:17
  cross-platform system where you're trying to simplify the IT
• 9:21
  stack. That elimination of the
• 9:23
  perimeter is gonna demand some sort of seamless implementation
• 9:27
  with a centralized user management tool and I.
• 9:30
  It almost sounds like companies are kind of afraid to do that,
• 9:34
  and they're trying to almost reestablish perimeters where
• 9:38
  they just tried to migrate to a fragmentation of it.
• 9:44
  Yeah, I think the perimeter's gone at this point.
• 9:46
  I think that's a losing effort. If you're trying to establish
• 9:50
  printer on the cloud, Jim, what are some of the problems that
• 9:53
  you see? If you're taking a multi cloud
• 9:56
  approach. Well, I think the the biggest
• 9:58
  problem is the same if you have a single cloud approach which is
• 10:02
  but you know it's it's obviously compounded.
• 10:07
  The base problem is the number of secrets or credentials that
• 10:11
  it takes to run a large cloud environment.
• 10:15
  You know you have secrets for secrets or credentials for the
• 10:20
  console to access infrastructure.
• 10:23
  Within your applications, they're embedded within
• 10:27
  configuration files or embedded service accounts.
• 10:30
  So the volume, the volume of the number of credentials that you
• 10:34
  have to manage is in in kind of a controlled fashion just
• 10:38
  becomes such a a major effort that that's really the problem.
• 10:42
  And when you go to a multicloud, now you've compounded that you
• 10:45
  have as many as twice as many secrets that you need to manage.
• 10:50
  Mm HM yeah, there's a visibility issue too, right?
• 10:52
  If it's not being if the cloud isn't being managed centrally
• 10:56
  right, some areas probably have different procedures and
• 11:00
  processes and policies for their own cloud, right?
• 11:03
  AWS might be managed different than Azure or Google and you may
• 11:07
  not have that visibility. To know who has access to what
• 11:11
  was really kind of foundational for any IM program which it
• 11:14
  would be part of the security strategy.
• 11:16
  Yeah, I mean, think of how how much companies struggle to.
• 11:21
  Comply with their own policies in terms of password rotation
• 11:25
  when it comes to service accounts, you know now you're
• 11:29
  looking at a new environment that often times you know a
• 11:34
  cloud environment that spun up without information security
• 11:39
  having a handson role. Now I'm talking in generalities,
• 11:42
  right? Not every organization spun up
• 11:45
  their cloud infrastructure that way, but now you've got
• 11:48
  thousands of. Credentials that have to be
• 11:50
  managed and passwords that need to be rotated in compliance.
• 11:55
  And you may or may not have a technology solution supporting
• 11:58
  that. So I think that's really the
• 12:00
  problem. And then when you have
• 12:01
  multicloud, they just picked up and repeated that the same kind
• 12:05
  of problem in a second place or or more.
• 12:09
  Or you could be talking about an internal private cloud.
• 12:12
  No matter how you look at it, the more places that you have to
• 12:14
  manage all these credentials, the harder the problem becomes
• 12:18
  to. Manage.
• 12:20
  So it sounds like an answer might be some sort of
• 12:23
  centralization strategy across the cloud or at least from a
• 12:26
  management standpoint. I mean that's that's the answer
• 12:29
  to you know. So I think this gets to Neil's
• 12:31
  question is using you know should we take a centralized
• 12:34
  approach or distributed approach.
• 12:36
  I'm definitely in the camp of a centralized approach.
• 12:39
  I want centralized command to control centralized visibility
• 12:43
  and do who has access to what what they've done.
• 12:46
  And I want to put together some guidelines or best practices
• 12:51
  that I can you know put into effect in in terms of managing
• 12:55
  those identities within the cloud.
• 12:57
  And you know I've got some some topics that I'd like to dive
• 13:01
  into or or kind of best practices that I think that you
• 13:05
  know and and kind of taking an approach of you've got to walk
• 13:09
  before you run. Obviously, people who are
• 13:12
  listening to this podcast could be.
• 13:15
  In different organizations that have that are a different point
• 13:19
  in their life cycle that have different types of applications
• 13:23
  are running in different clouds. So I'm going to kind of start at
• 13:26
  the most basic level in terms of here are the approaches that I
• 13:30
  think need to be tackled and then we'll get into the more
• 13:33
  advanced stuff all. Right, let's hit it.
• 13:35
  What's #1? OK, so starting on you know from
• 13:39
  the basics strong authentication practices, so.
• 13:44
  You know, starting with the assumption that you've got good
• 13:48
  practices for managing identity. So just thinking of your
• 13:52
  employees, including the population of people who do
• 13:56
  administrative developer functions in the cloud, that
• 13:59
  you've got good life cycle management or identity
• 14:02
  governance practices. For those people today, you know
• 14:05
  who works here, who gets access to what And most importantly,
• 14:09
  when they leave that, you're cutting off that access if you
• 14:12
  have that and you kind of. Centralize that, say around your
• 14:15
  Active Directory, then you can plug in your access to the cloud
• 14:22
  through your corporate single sign on solution or Pam
• 14:25
  solution. I think you know either one of
• 14:28
  those technologies is kind of trying to solve this problem,
• 14:31
  but what I see the most is organizations starting with
• 14:35
  managing the console kind of the management interface for their
• 14:40
  cloud and. Regarding that providing single
• 14:43
  sign on to that with their SSO solution, so like pop there or
• 14:46
  ping or or one login or something like that and then
• 14:50
  ideally on top of like a Pam. Solution work with with that
• 14:55
  approach as well something. Like, I mean a Pam.
• 14:57
  Cyber or Cyber? Yeah, a lot of those, a lot of
• 15:02
  those vendors have solutions developed around Azure and AWS
• 15:07
  specifically. I think AWS is probably the one
• 15:10
  that. I see addressed the most, but I
• 15:14
  think every solution that's trying to tackle this problem is
• 15:20
  really focused on providing a solution for a WS as well.
• 15:22
  It's Microsoft, so yeah, there are there are solutions out
• 15:26
  there that would allow you to use your Pam solution, which has
• 15:30
  its own set of benefits. Those benefits are kind of more
• 15:34
  down the line of. More advanced benefits and what
• 15:37
  I was planning on going through at the moment, because what I
• 15:39
  wanted to talk about next was, you know with authentication.
• 15:43
  So if we're just talking about access to the console at the
• 15:46
  moment and providing single sign on using your account that has
• 15:51
  good I GA practices around it. That's getting disabled when you
• 15:55
  leave the organization. On top of that I want to layer
• 15:58
  multifactor authentication because.
• 16:01
  You know your your web console is going to be available over
• 16:04
  the open Internet, and we want to make sure that we're
• 16:07
  providing a very strong authentication to log in.
• 16:10
  So you've got MFA, you got strong credentials.
• 16:14
  Morgan, I know you had some experience working through AWS.
• 16:19
  When you're logging into AWS, did you did you have MFA enabled
• 16:23
  when you were trying to get access to the console?
• 16:26
  So when I was setting up access to the console, I actually
• 16:30
  because I directly signed in through Aws's web browser, I did
• 16:36
  not have to do multi factor. Okay.
• 16:39
  So that might be a recommendation for a former
• 16:43
  former client, a former colleague, right?
• 16:47
  Yeah. Really.
• 16:47
  Yeah, Really. At this point, password only
• 16:49
  isn't good enough, right? I think that's kind of like
• 16:52
  preaching something that we say all the time.
• 16:54
  You got to put MFA everywhere as much as you can, especially on
• 16:58
  the cloud. You know, it's like every week
• 17:00
  there's like a new article around how you know, someone's
• 17:03
  cloud got breached. You know S3 bucket wasn't
• 17:06
  configured correctly and it was exposed.
• 17:08
  I mean there's just, there's so many things that can go wrong
• 17:12
  and I think that's what scares maybe some of the people who may
• 17:14
  be more hesitant to adopt the cloud, going back to a point
• 17:17
  where you know, Morgan, you made earlier, but it's coming.
• 17:21
  I mean, you just can't start putting, you know, racks and
• 17:24
  racks of servers in your environment where you've got to
• 17:26
  do a good job of securing access to them.
• 17:28
  And you talk about authentication and and I from my
• 17:31
  perspective, I look at it as you've got to know what you've
• 17:34
  got before you can protect it. So you got to know who has
• 17:36
  access to what. You got to know what all the
• 17:38
  different counts are. Especially if you're working off
• 17:40
  the compounded problem where you're using multicloud and you
• 17:43
  have different, you know, vendors get that inventory in
• 17:46
  place, know what the accounts are, know what the permissions
• 17:49
  are, start to figure out which ones are human and which ones
• 17:52
  are machine, right. So a lot of development takes
• 17:55
  place, so you want to make sure that you identify.
• 17:58
  You know what's actually controlled by a person will
• 18:00
  might be more programmatic and then I would look to centralized
• 18:04
  as well. So I certainly agree with that
• 18:05
  approach. Maybe putting something in front
• 18:07
  of it like the SSO solution makes sense, and then using the
• 18:11
  MFA that's part of the SSO solution to get access to the
• 18:16
  cloud environment in my mind would probably be a good, you
• 18:19
  know, first step towards that. Yeah, I mean, that's what I
• 18:22
  really. Feel strongly about is that you
• 18:24
  know from a console perspective, because I think that's where
• 18:27
  someone can inflict the most, the most damage, right?
• 18:31
  They can settings, they can allow themselves access to many
• 18:36
  of the, you know instances, the server instances or the platform
• 18:42
  services through the console. So if they can get into the
• 18:45
  console with a very, you know, very strict role or a very high
• 18:50
  level role, they could. Do a lot of damage.
• 18:53
  So it's kind of basic blocking tackling of using your SSO
• 18:57
  solution, MFA, strong password policy and then using any other
• 19:03
  policies that make business sense.
• 19:05
  I mean there, if you don't, you shouldn't have people accessing
• 19:08
  during certain times of the day or from different IP ranges than
• 19:11
  your corporate network. Then go ahead and put those
• 19:14
  policies in place. Anything you can do to restrict
• 19:18
  access to just those folks that should be accessing?
• 19:22
  That environment, all the better.
• 19:26
  And one of these vendors also have things like conditional
• 19:28
  access right, so you can do things around geolocation, you
• 19:31
  know, device fingerprinting, you know, that sort of thing.
• 19:34
  It's becoming pretty commonplace today, yeah.
• 19:36
  Yeah, I remember when that used to be like, ooh wow, we're cool
• 19:39
  because, you know, we can do this and others can't.
• 19:40
  But now it's almost a standard feature amongst most.
• 19:44
  Right, Access management providers.
• 19:46
  So now it's kind of looking for ways to differentiate between
• 19:49
  those. You know I see things that like
• 19:51
  Casha Corp, you know they specialize in you know cloud
• 19:55
  management, DevOps that's those sorts of things that might be
• 19:57
  interesting to look at. One area that I think is has a
• 20:01
  lot of potential would be more of a like a just in time
• 20:03
  provisioning of Access where. People don't have permissions
• 20:08
  all the time, right. They get them just when they
• 20:10
  need them and then those permissions are pulled back or
• 20:12
  you know what are the roles are the entitlements are they give
• 20:14
  them access. You know there's products out
• 20:16
  there like plain ID. You can even do something you
• 20:19
  know through it through an IGA tool, identity governance
• 20:22
  administration tool like you have potentially sale pointing
• 20:24
  or savians or things like Oracle or I BM you know those sorts of
• 20:28
  right. It's a lot more complicated
• 20:30
  though when you're trying to do it that way because you really
• 20:33
  have to know, you know, what are the permissions and then who's
• 20:35
  going to approve it. If it's something that's
• 20:37
  critical from like a time frame perspective, you know, is that
• 20:40
  approver available to put that in there.
• 20:43
  We see these challenges sometimes of a privileged access
• 20:45
  management side too, right? Just even inside the firewall,
• 20:48
  people getting access to servers and there's this stigma of red
• 20:51
  tape that kind of goes around privileged access management
• 20:54
  processes that could easily, you know, happen on on the cloud
• 20:58
  side too. Right.
• 20:59
  Yeah, we're, I think privilege access management really gets
• 21:03
  you the most mileage is beyond just accessing the console when
• 21:07
  you start getting into managing your server instances and
• 21:11
  managing the accounts that have access.
• 21:13
  So one of the other tips or keys that I have is, you know, making
• 21:19
  sure that each person. Who has to access servers has
• 21:25
  their own set of credentials that you're not sharing
• 21:27
  credentials over a group of people.
• 21:30
  So for example, if you're using a Linux instance on on the a WS
• 21:36
  EC2 server, those keys should be individually individually
• 21:45
  provisioned per person. So private keys should be
• 21:48
  private to the user where? Privilege access management
• 21:53
  system could be really advantageous when it comes to
• 21:56
  managing those instances is to allow temporary access.
• 22:02
  Person doesn't actually need to know the password to the account
• 22:05
  on that server. And then of course you could set
• 22:09
  the the firewall rules on the console to only allow the only
• 22:13
  allow. The IP address with the IP range
• 22:16
  that the privilege access management server exists on to
• 22:20
  actually access the server. So then you have some network
• 22:23
  access controls, you know, additional network access
• 22:26
  controls guarding access to that server.
• 22:29
  So some good and that's kind of basic blocking and tackling for
• 22:35
  the enterprise. So a lot of the best practices
• 22:38
  for managing your server environment in the enterprise
• 22:42
  move over to. Managing the servers in the
• 22:45
  cloud as well Jeff, one thing you mentioned about Hoshi Corp,
• 22:49
  I mean what I would recommend for anybody who's listening to
• 22:53
  go out to their website, watch some of the the videos that they
• 22:56
  have posted their their tech talks with their their Co CTO's.
• 23:00
  I mean those guys are both really, really bright and and
• 23:05
  they really understand the space and they can walk you through a
• 23:08
  lot of the ways to approach. Now their focus is primarily I
• 23:14
  think around managing DevOps, managing really secrets in the
• 23:20
  in the cloud. And the secrets a lot of times
• 23:24
  are go back to if you're looking at this from a developer
• 23:28
  sampling, you're publishing applications out to the cloud.
• 23:31
  But I think that's a lot of what we're talking about today,
• 23:32
  managing A multicloud environment.
• 23:34
  So I think that's a really good vendor to bring up.
• 23:38
  Relative to this discussion, you know I think that DevOps is
• 23:41
  something that you don't want to forget about.
• 23:45
  How do you deploy apps without hard coding secrets?
• 23:48
  So you look at technologies like Hash Core.
• 23:51
  It's a way to have your applications programmatically go
• 23:55
  out and fetch your secrets rather than having to hard code
• 23:58
  them into configuration files. In the same with your DevOps
• 24:02
  tools like the Kubernetes not having to hard code all those
• 24:07
  credentials. Into into something that can be
• 24:10
  seen by multiple people within the organization.
• 24:14
  Yeah, that takes a lot of work though too, because if you
• 24:16
  haven't built out applications with that in mind, right.
• 24:19
  If more of like a legacy type approach trying to go back and
• 24:24
  reconfigure applications to use the programmatic means to pull
• 24:28
  keys from vaults and those sorts of things can take some time.
• 24:31
  So it's definitely not something that happens from an overnight
• 24:33
  perspective. But I think I think Ashley Corp
• 24:35
  would be a good one to look at. You know maybe something like
• 24:37
  Plain ID as well if you're looking for more like a just in
• 24:40
  time provisioning. I think they have some
• 24:41
  interesting use cases that that might be helpful for people who
• 24:44
  are looking at managing access to cloud environments.
• 24:48
  The other thing I think you brought up a good point about,
• 24:52
  you know, it's a lot of work. I don't think that I am program
• 24:55
  manager can go in and and and you know be confrontational if
• 25:00
  you will, about trying to implement security.
• 25:03
  You really have to partner with the development team.
• 25:05
  They have to see the value and having checks and balances and
• 25:09
  see the value in. You know, the visibility that
• 25:13
  they can get and the manageability that they can get.
• 25:16
  A lot of times you run into kind of the mindset that, well,
• 25:21
  there's only 10 people in the department.
• 25:24
  They've all worked here, you know, 3, three or more years.
• 25:27
  We trust them. The thing is, some security is,
• 25:30
  you know, not about trusting people, it's about being, you
• 25:34
  know? Being able to not have to rely
• 25:37
  on trust. It's being sure that you have
• 25:39
  the security controls that everybody knows that hey, if you
• 25:42
  try to do something, we're going to know about it.
• 25:45
  And I think from an IM program manager perspective, the way I'd
• 25:50
  look at it is to try to partner with the manager of applications
• 25:55
  because I think that, you know, they're going to have to adopt
• 25:58
  this technology more or less willingly for it to be a success
• 26:03
  and. They should look at the I M team
• 26:06
  as a partner. Somebody can provide
• 26:08
  administration of that of these platforms and be a proper checks
• 26:14
  and balances that. Can allow them to focus on
• 26:18
  development and not have to focus on security as much,
• 26:21
  right. So I think hopefully that helps
• 26:23
  kind of put at least our opinions around that for Neil
• 26:26
  and maybe other folks who were having some more questions.
• 26:29
  I think to sum it up right, we're we're fans of centralizing
• 26:32
  it, but you got to have good policy procedure you know back
• 26:34
  ending that you know the right kind of technology approach and
• 26:37
  how you'd want to manage the permissions and making sure you
• 26:40
  don't forget about humans and non humans, right the
• 26:43
  programmatic side of things, DevOps etcetera, getting access
• 26:47
  to the cloud. I'd like to kind of pivot back a
• 26:50
  little bit to Morgan and kind of talk a little bit about her
• 26:55
  background, cuz I think she's got kind of an interesting story
• 26:57
  where you know how people, if you remember one of our first
• 27:01
  episodes was, you know, how people got into I M most of us
• 27:04
  kind of fell into it. And I think Morgan's another
• 27:06
  good example of that. Morgan has an amazing LinkedIn
• 27:10
  profile, by the way, which I will definitely link in the show
• 27:13
  notes. So kudos to you.
• 27:14
  Morgan definitely shows off some of the writing skills there.
• 27:20
  Maybe you can talk Morgan, about how you got, how you, how you
• 27:25
  know, how did you get into I am I guess let's start there.
• 27:27
  Yeah, sure. So as I mentioned kind of before
• 27:31
  the call, I was an English major, originally graduated and
• 27:36
  did some writing for online news journals.
• 27:39
  But there was a shift to paying writers in terms of publishing
• 27:45
  where, you know, there was no actual monetary value attached
• 27:48
  to your quote, UN quote payment. So from there I kind of pivoted
• 27:52
  and went into code. Someone who obviously has a
• 27:58
  respect for language. I figured the language of
• 28:02
  computers might be something pretty fascinating, and I was
• 28:05
  not wrong. Definitely in some regards kind
• 28:08
  of being a professional student, which I loved, I started
• 28:13
  attending the local weekly OWOSS meetings that we have in Austin.
• 28:18
  Through that, I met someone who. Is one of the board members for
• 28:23
  a hospital application called Open EMR, and that's open source
• 28:27
  and charity based. All the developer activity on
• 28:31
  that is out of people's own pockets and time through that,
• 28:39
  the person who kind of recruited me onto the project saw how.
• 28:43
  Willing I was to learn and to kind of experiment with things.
• 28:47
  So he kind of threw me towards the AWS implementation where we
• 28:51
  migrated the patient document database to Cloud Native and
• 28:56
  that's really how I fell into Identity Access Management and
• 29:00
  here you are. How long did it take to do that
• 29:02
  migration? Gosh, I'm gonna say a couple
• 29:07
  months. Maybe two months And that was
• 29:11
  what re architecting the application, moving data stores
• 29:13
  around. Yeah, my personal involvement
• 29:17
  with it was a little more spotty because I was learning and self
• 29:22
  teaching and also working on codebase infrastructure at that
• 29:28
  point as well with Open EMR. So I was kind of being thrown
• 29:31
  around there. I think that's fascinating.
• 29:34
  It's such an interesting pivot to go from English major writing
• 29:42
  into technology like that, I guess.
• 29:46
  What are some of the languages that I guess what was the first
• 29:49
  language that you learned on the IT side of things?
• 29:53
  Yeah, so when I first got interested in this.
• 29:57
  And I say this as in coding in general.
• 30:00
  I went to OWASP and I was initially just filling an A
• 30:06
  notebook as a dictionary basically with terminology and I
• 30:11
  was like OK, does anyone have any recommendations for what I
• 30:14
  should start with? And someone said Python, so
• 30:17
  that's actually where I started. I wish I would have started with
• 30:21
  like. Code Academy's command line,
• 30:24
  because my knowledge quickly became kind of Swiss cheese
• 30:28
  esque, and they had to go back a lot of times, kind of backtrack
• 30:32
  and fill in knowledge holes to understand really why things
• 30:35
  were happening and how they happened.
• 30:38
  But Python was first, and then I moved on to HTML, CSS, SQL.
• 30:45
  That was fascinating. Jim, I think you probably have a
• 30:49
  question or two. Yeah, so actually one of the
• 30:54
  things I just did want to close out one other last point that I
• 30:57
  wanted to make on the best practice.
• 31:01
  I think it's just around logging and make sure they have logging
• 31:06
  centrally set up to identify problems and and setting up
• 31:12
  alerting and it kind of triggers me into another thought so.
• 31:18
  One of the things I I started off this discussion around why
• 31:23
  organizations end up in multicloud and I said, well the
• 31:26
  clouds seem pretty comparable. So in other words, if you're
• 31:29
  down kind of the checkbox list of, you know, does it have a
• 31:34
  Nosql database, does it have logging, It's like yes, yes,
• 31:37
  yes, they all operate a little bit differently.
• 31:40
  You know, they mostly follow some open standards and they
• 31:43
  have some proprietary connectors and so.
• 31:46
  It's probably not super easy to just pick up an application and
• 31:52
  run it in both environments and expect that it.
• 31:55
  You can't only do that at a very thin level, right?
• 31:58
  You have to integrate to the logging solution.
• 32:00
  So at at many of the tiers of the application you have to make
• 32:06
  them specific to the cloud that you're running in.
• 32:08
  And that's why I think it makes it harder to consolidate clouds
• 32:13
  as well as like you can't just. Pick up all your applications in
• 32:17
  one. If you're using the platform
• 32:18
  services of the cloud, you're running everything on server
• 32:22
  instances, sure. But if you're using the logging
• 32:26
  service of the of your cloud provider, when you migrate that
• 32:30
  application from, you know, from AWS to Microsoft or vice versa,
• 32:35
  you're going to have to reengineer that application some
• 32:38
  to work with the logging service of your new cloud.
• 32:42
  So. That was just something I wanted
• 32:44
  to throw in there as well is that, you know, the idea of
• 32:47
  multicloud will probably be around with us for a long time
• 32:50
  because it's not just as easy as moving a bunch of server
• 32:55
  instances from one environment to the other.
• 32:57
  Yeah, I can't believe it. I totally skipped over the fact
• 33:00
  that you gotta be able to prove everything right, So I'm glad
• 33:03
  you brought us back to that. No, no problem.
• 33:06
  Yeah, actually with that that brings to mind, you know,
• 33:10
  identity federation in the cloud trail with AWS where you know
• 33:14
  you have a log of information about people who even requested
• 33:17
  in based on their IAM identities.
• 33:21
  So when you have decentralized logging, you have that single
• 33:24
  point of access to all salient logs that are created across
• 33:29
  accounts regions. Which is really critical for
• 33:33
  security, right? But if it's fractured with a
• 33:37
  distributed database, I would think that you really lose a lot
• 33:42
  of data integrity because of the complexity introduced there.
• 33:46
  And then I would question kind of handling failures.
• 33:50
  You know how you distinguish site failure and link failure?
• 33:55
  Yeah, and one of the things that the.
• 33:57
  Applications across. Across multiple clouds.
• 34:00
  So this is one of the things that I've been thinking about is
• 34:03
  that if you have a cloud like if one of your goals is to
• 34:08
  distribute an environment, distribute an application, I
• 34:11
  don't feel like you have to have it running at AWS time.
• 34:15
  Microsoft. So if one goes down, the others
• 34:17
  available because if you look at AWS or Microsoft, they've got
• 34:21
  data centers in around the world.
• 34:24
  So I guess you know, if you're really paranoid about your, you
• 34:27
  know. The entire company going down,
• 34:30
  that's one thing. But you know from a geographical
• 34:34
  load balancing perspective, they've got data centers in
• 34:38
  different regions of the US and throughout the world.
• 34:42
  So my thinking is that you know if you're, if you were starting
• 34:46
  out today, I'm like let's start our our migration to the cloud,
• 34:50
  you'd pick one vendor and spin up services in.
• 34:55
  More than one geographical location?
• 34:57
  You wouldn't say Hey, let's go to two different vendors in case
• 35:00
  we lose a vendor. Yeah, you don't want to
• 35:03
  overcomplicate it, especially if you're just starting out.
• 35:05
  Right. And then I mean, if you're going
• 35:07
  to go to the cloud, I mean it's kind of like level one is just
• 35:11
  spinning up server instances. The real benefit you get is if
• 35:15
  you get a level 2, Level 3, which is to leverage the
• 35:18
  platform services for your applications.
• 35:21
  So if you're using a. A common logging platform.
• 35:24
  If you're using a common no SQL database or SQL database, but
• 35:29
  it's as a as a service. Again, those services are going
• 35:34
  to look slightly different from cloud to cloud or from vendor to
• 35:37
  vendor and your applications aren't going to be able to point
• 35:41
  exactly the same way across multiple clouds.
• 35:45
  Right on. I think that's probably a good
• 35:47
  spot. We can leave it for now.
• 35:49
  I certainly appreciate the conversation.
• 35:51
  Hopefully Neil and others get some value out of what we talked
• 35:54
  about today. Morgan, appreciate you taking
• 35:56
  the time to join us. Welcome to the team.
• 35:58
  Welcome to the party. Yeah.
• 36:00
  Thank you for having me, Jim. Go Bears.
• 36:06
  Go Bills. Right Morgan.
• 36:07
  Yeah, Go Bills. Kind of, kind of.
• 36:10
  All right. All right.
• 36:12
  We're going to leave it there. Appreciate folks taking time to
• 36:14
  listen to us. Hopefully you got some value out
• 36:16
  of it. Feel free to like, subscribe,
• 36:18
  listen, tell your friends, share the show, and we'll be talking
• 36:23
  to you on the next one. You've been listening to the
• 36:30
  Identity at the Center podcast. To access all episodes, visit
• 36:34
  identity@thecenter.com.